Subrange synchronization

Abstract

A system and method for synchronizing data between an online data source and a client application. The method includes, in response to a change in permissions associated with a user to a protected data set included in a shared data space of an online data source, using a client application associated with the user to receive a protected data synchronization token associated with the protected data set issued by the online data source, and using the client application to download the protected data set included in the shared data space from the online data source to the client application using the protected data synchronization token without re-downloading a public data set included in the shared data space. After downloading the protected data set, the method includes synchronizing the shared data space including the protected data set and the public data set using the stored data space synchronization token.

Description

Technical Field

[0001] Embodiments described herein generally relate to synchronizing data between online data sources and client devices, and in particular synchronizing protected data associated with varying user permissions, while limiting data download requirements and associated computing resources. Summary of the invention

[0002] Many computing devices, such as personal computers, smartphones, and laptops, can access remote online data sources, including, for example, data stored in websites such as Microsoft These online data sources store data (files) that can be downloaded and modified by various computing devices that can access the online data sources. These computing devices can also install local client software applications that allow the computing devices to access the online data sources and, in some cases, download and cache local copies of data that can be accessed via the online data sources.

[0003] For example, an online data source may store a shared data space accessible by one or more users, wherein the shared data space includes public data and protected data (or lightly protected data and strongly protected data). The user must have permission to access the protected data and must provide authentication information, such as performing multi-factor authentication, to access the protected data. In particular, when a user is granted permission to access protected data in the shared data space (and the user provides verified authentication information), the online data source provides a token that allows a local client software application installed on the user's computing device to download data stored in the shared data space that the user can access based on the user's current permissions (including public information and protected information that the user has permission to access). Therefore, as the user's permissions change (for example, allowing the user to access additional protected data), the user's computing device uses the received token to download all applicable data including both protected data and public data. Therefore, the use of authentication tokens increases the computing resource burden of computing devices, communication networks, online data sources, or a combination thereof. This is especially true when the downloaded information includes more public data than protected data, because these public data will also be re-downloaded as permissions change.

[0004] Thus, the embodiments described herein provide systems and methods, among other things, for synchronizing data between an online data source and a client device to more efficiently use the computing resources of the client device, the communication network, and the online data source, and to prevent delays in user access to desired data. In particular, the embodiments described herein perform sub-scope synchronization, wherein, in response to a permission change and valid authentication, a user receives an authentication token that allows the user to download new protected data accessible to the user within a shared data space without re-downloading (or otherwise synchronizing) other portions or shared data spaces, such as public data. After the download is complete, the user uses the stored synchronization token to synchronize the downloaded data from the shared data space including the new protected data set and any public data.

[0005] For example, one embodiment provides a method for synchronizing data between an online data source and a client software application. The method includes, in response to a change in permissions associated with a user to a protected data set included in a shared data space of an online data source, using a client application associated with the user to receive a protected data synchronization token associated with the protected data set issued by the online data source, and using the client application to download the protected data set included in the shared data space from the online data source to the client application using the protected data synchronization token without re-downloading the public data set included in the shared data space. After downloading the protected data set, the method includes synchronizing the shared data space including the protected data set and the public data set between the online data source and the client application using the stored data space synchronization token.

[0006] Another embodiment provides a system for synchronizing data between an online data source and a client software application. The system includes a user device including a memory storing a client application and an electronic processor, the electronic processor being configured to execute the client application in response to a change in permissions associated with the user to a protected data set included in a shared data space of the online data source, receiving a protected data synchronization token from the online data source, and using the protected data synchronization token to download the protected data set included in the shared data space from the online data source to the client application without re-downloading a public data set included in the shared data space. After downloading the protected data set, the system is configured to synchronize the shared data space including the protected data set and the public data set between the online data source and the client application using the stored data space synchronization token and the protected data synchronization token.

[0007] Another embodiment provides a non-transitory computer-readable medium storing instructions that, when executed by an electronic processor, perform a set of functions. The set of functions includes, in response to a change in permissions associated with a user to data included in a shared data space of an online data source, the change in permissions including the withdrawal of permissions to a protected data set included in the stored data space, receiving a revocation notification from the online data source for a previously received protected data synchronization token associated with the protected data set; and in response to the revocation notification, deleting the protected data synchronization token, deleting the protected data set from a locally stored copy of the shared data space without deleting a public data set from the locally stored copy of the shared data space, and, after deleting the protected data set, synchronizing the shared data space including the public data set and excluding the protected data between the online source and a client application using the stored data space synchronization token. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] Figure 1 A system for synchronizing data between an online data source and a client software application according to one embodiment is schematically illustrated.

[0009] Figure 2 Schematically shows a method according to an embodiment of the present invention. Figure 1 Online data sources in the system.

[0010] Figure 3 Schematically shows a method according to an embodiment of the present invention. Figure 1 User equipment in the system.

[0011] Figure 4 According to one embodiment, Figure 1 A flowchart of a method for synchronizing data executed by a system. DETAILED DESCRIPTION

[0012] One or more embodiments are described and illustrated in the following description and accompanying drawings. These embodiments are not limited to the specific details provided herein and may be modified in various ways. In addition, there may be other embodiments not described herein. Moreover, the functions described herein as being performed by one component may be performed by multiple components in a distributed manner. Similarly, the functions performed by multiple components may be merged and performed by a single component. Similarly, components described as performing specific functions may also perform additional functions not described herein. For example, a device or structure "configured" in a certain way is configured at least in that way, but may also be configured in an unlisted manner. In addition, some embodiments described herein may include one or more electronic processors configured to perform the described functions by executing instructions stored in a non-transitory computer-readable medium. Similarly, the embodiments described herein may be implemented as a non-transitory computer-readable medium storing instructions, which may be executed by one or more electronic processors to perform the described functions. As used in this application, "non-transitory computer-readable media" includes all computer-readable media but does not include temporary, propagating signals. Thus, a non-transitory computer readable medium may include, for example, a hard disk, a CD-ROM, an optical storage device, a magnetic storage device, a ROM (read only memory), a RAM (random access memory), a register memory, a processor cache, or any combination thereof.

[0013] In addition, the wording and terminology used in this article are for descriptive purposes and should not be considered as limiting. For example, the use of "including", "containing", "comprising", "having" and its variants in this article is intended to cover the items listed thereafter and their equivalents and other items. The terms "connect" and "couple" are widely used, including direct and indirect connections and couplings. In addition, "connect" and "couple" are not limited to physical or mechanical connections or couplings and can include direct or indirect electrical connections or couplings. In addition, electronic communications and notifications can be performed using wired connections, wireless connections or combinations thereof, and can be sent directly or through one or more intermediate devices through various types of networks, communication channels and connections. In addition, relational terms such as first and second, top and bottom, etc. can be used in this article only to distinguish one entity or action from another entity or action, without requiring or implying any actual such relationship or order between these entities or actions.

[0014] As described above, users often need to synchronize large amounts of public data when synchronizing protected data, including when the user is authorized to access new protected data that was not previously downloaded to the user's device. This process wastes computing resources and user time. Therefore, the embodiments described herein perform sub-range synchronization, wherein new protected data is downloaded using an authentication token dedicated to the new protected data, and the authentication token is subsequently used in combination with an existing synchronization token to maintain synchronization between the online data source and the user's device, including both the new protected data and any public data. In other words, only the newly added protected data is downloaded, without re-downloading (or otherwise synchronizing) the entire data space including the new protected data, including, for example, public data.

[0015] Figure 1 A system 10 for synchronizing data between an online data source and a client software application is schematically shown. Figure 1 As shown, system 10 includes an online data source 12, a plurality of clients or user devices 14 (also individually referred to as user devices 14), and a communication network 16. It should be understood that system 10 is provided as an example, and in some embodiments, system 10 includes additional components. For example, system 10 may include fewer or additional user devices 14, more than one online data source 12, more than one communication network 16, etc.

[0016] The online data source 12 and the plurality of user devices 14 communicate via a communication network 16. Part of the communication network 16 may be implemented using a wireless network, such as a wide area network (e.g., the Internet), a local area network (e.g., Bluetooth TM Alternatively or additionally, portions of the communication network 16 may be implemented using dedicated connections (e.g., wired or wireless connections). It should also be understood that in some embodiments, the online data source 12 and the plurality of user devices 14 may be connected via a dedicated network. Figure 1 Communicates with one or more intermediate devices not shown.

[0017] The online data source 12 includes one or more computing devices, such as one or more servers. Figure 2 As shown, in some embodiments, the online data source 12 includes at least one server, which includes an electronic processor 20, a memory 22, and a communication interface 24. The electronic processor 20, the memory 22, and the communication interface 24 communicate via one or more communication lines or buses, wirelessly, or a combination thereof. In some embodiments, the online data source 12 includes Figure 2Components other than those shown in FIG. 1 and included in the online data source 12 may be arranged in various configurations. For example, as previously described, in some embodiments, the online data source 12 includes multiple servers, databases, etc. to provide an online data source.

[0018] The communication interface 24 , which may include a wireless transceiver, allows the online data source 12 to communicate with external devices, such as a plurality of user devices 14 , via the communication network 16 .

[0019] The memory 22 includes a non-transitory computer-readable storage medium. The electronic processor 20 includes a microprocessor, an application-specific integrated circuit (ASIC), or other suitable electronic device. The electronic processor 20 is configured to retrieve data from the memory 22 and execute software (instructions) related to the methods described herein, etc.

[0020] For example, Figure 2 As shown, the memory 22 stores the authentication software 25 and the token generation software 26. It should be understood that the functions performed by the software 25 and 26 described herein can be combined and distributed in various configurations. For example, in some embodiments, the functions performed by the token generation software 26 described herein are performed by the authentication software 25, and vice versa. In addition, in some embodiments, the software applications used by the online data source 12 can be stored in different memories on the same or different servers or other types of computing devices. Therefore, Figure 2 The configuration of the software shown is provided as an example configuration and should not be considered limiting.

[0021] The authentication software 25, when executed by the electronic processor 20, authenticates the user or a user device 14 associated with the user based on the authentication information for the purpose of granting access to the online data source 12, and in particular, granting access to protected data stored within the online data source 12. In some embodiments, the authentication software 25 is configured to perform multi-factor authentication to authenticate the user (e.g., sending an electronic communication with a verification code to the user via email, text message, etc.). However, other authentication techniques may be used.

[0022] The token generation software 26, when executed by the electronic processor 20, generates a protected data synchronization ("protected data sync") token that authorizes a user of the user device 14 to access protected data, as described below. In some embodiments, the token generation software 26 generates such a token after the user is authenticated via the authentication software 25. The protected data sync token generated by the token generation software 26 is, for example, an immutable (e.g., text) string that contains a unique identifier that can be parsed to identify a user, a user device 14, a client application installed on the user device 14, or a combination thereof, and grants access to data that is otherwise protected from public access. For example, a protected data sync token can identify protected data stored within an online data source 12 that the user is authorized to access and download. The authentication token can also include timing information, such as a timestamp indicating the last download or synchronization of a particular protected data set.

[0023] In some embodiments, the token generation software 26 also generates a data space synchronization ("dataspace sync") token. The data space token is used to synchronize previously downloaded data to capture changes made to the data maintained using the online data source 12. The data space sync token can identify a user, a user device 14, a client application installed on the user device 14, or a combination thereof. In some embodiments, the data space sync token also includes information identifying the data to be synchronized, including protected data sets that the user is authorized to access. In some embodiments, the data space sync token also includes timing information (timestamp), such as the time when the most recent synchronization was performed, etc.

[0024] For example, a data space synchronization token may be used to track changes within a shared data space maintained by an online data source 12. For example, when a user first accesses an online data source 12, the online data source 12 may provide an initial data space synchronization token, which may be an empty string. When the user subsequently requests synchronization (which may be performed periodically or in response to a user request or other triggering action or event), the user submits the data space synchronization token to the online data source 12 (e.g., as part of the synchronization request). The online data source 12 uses the received data space synchronization token to determine an applicable timestamp representing the time of the last download or synchronization, which the online data source 12 uses to identify (by querying one or more databases) data items included in the shared data space that have a modification date greater than (exceeding) the applicable timestamp. The online data source 12 sorts the identified data items (by modification date) and returns the identified data items (in sort) to the user along with an updated data space synchronization token including an updated timestamp. The timestamp may be set to the current time and date, or to the time immediately after the last identified modification. The user (user device 14) applies the received modifications to the locally stored copy of the shared space to keep the local copy consistent with the online data source 12. Thus, in some embodiments, the user receives one data space synchronization token applied to the shared data space, but will receive a separate protected data synchronization token for each protected data set included in the shared data space. In some embodiments, each protected data synchronization token functions similarly to a data space synchronization token as described above, but is used only to identify modifications within a protected data set (as compared to the entire shared data space).

[0025] like Figure 2As shown, the online data source 12 also includes a shared data space 27, which includes a public data set 28 and one or more protected data sets 29A, 29B and 29C (also collectively referred to as protected data sets 29). As described above, one or more users are associated with the shared data space 27, and these users can access the shared data space 27 to download data stored in the space 27 for local storage on the user device 14. In order to maintain the consistency of the locally stored data with the data stored in the shared data space 27, the user device 14 periodically (at an automatic frequency, in response to a user request or other triggering event, or a combination thereof) synchronizes the locally stored data with the data contained in the shared data space 27, such as by using a data space synchronization token as described above. As also described above, each user associated with the shared data space 27 can access and download the public data set 28 stored in the space 27. However, for the protected data set 29, the user must be granted permission to access the protected data set 29, and authentication information must be provided to access the protected data according to the user's current permissions. In some embodiments, both the public data set 28 and the protected data set 29 are protected and require access authorization. In these embodiments, protected dataset 29 is more protected than public dataset 28. For example, public dataset 28 may require a login account or access authorization, while protected dataset 29 may require both, and in addition, require multi-factor authorization each time a user wishes to access protected dataset 29.

[0026] In some embodiments, public data set 28 and protected data set 29 may include multiple layers of data that require different authorization levels. For example, protected data set 29 may include a second level of data that is protected by further authorization (e.g., a more protected data set that is only available to administrators or certain permissions that have access to protected data set 29). Much like protected data set 29 requires further access permissions than public data set 28, this second layer also requires further access permissions than protected data set 29, even if the user has access to protected data set 29. Moreover, within a single layer, there may be multiple scopes (e.g., folders), each requiring different authentication (e.g., different passwords, codes, etc.).

[0027] In some embodiments, at least a portion of the data stored in the shared dataset 27 (e.g., at least one of the protected datasets 29A-C) may be encrypted. This is particularly advantageous if the user is granted rights to the protected dataset and the user device 14 has malware or other harmful software that could damage the protected dataset 29.

[0028] It should be understood that the shared data space 27 hosted by the online data source 12 may be distributed across multiple memories, such as one or more databases, included in a single server or multiple servers or other computing devices.

[0029] Each of the plurality of user devices 14 is remote from (separated from) the online data source 12 and includes a computing device, such as a desktop computer, a laptop computer, a tablet computer, a terminal, a server, a smart TV, an electronic whiteboard, a tablet computer, a smart phone, a wearable device, etc. Figure 3 As shown, in some embodiments, the user device 14 includes an electronic processor 30, a memory 32, a human-machine interface (HMI) 34, and a communication interface 36. The electronic processor 30, the memory 32, the HMI 34, and the communication interface 36 communicate via one or more communication lines or buses, wirelessly, or a combination thereof. In some embodiments, the user device 14 includes in addition to Figure 3 Additional components other than those shown in , such as additional memory, processors, etc. In addition, Figure 3 The components shown included in user equipment 14 may be arranged in various configurations.

[0030] Communications interface 36 , which may include a wireless transceiver, allows user device 14 to communicate with external devices, such as online data sources 12 , over communications network 16 .

[0031] HMI 34 includes input devices, output devices, or combinations thereof. For example, HMI 34 may include a display device, a touch screen, a keyboard, a keypad, a button, a cursor control device, a printer, a speaker, a virtual reality headset, a microphone, etc. In some embodiments, user device 14 includes multiple HMIs. For example, user device 14 may include a touch screen and a keypad. In some embodiments, HMI 34 is included in the same housing as user device 14. However, in other embodiments, HMI 34 may be outside of user device 14, but may communicate with user device 14 via a wired or wireless connection. For example, in some embodiments, user device 14 includes a display device connected to user device 14 via a cable or other type of wired or wireless connection.

[0032] The memory 32 includes a non-transitory computer-readable storage medium. The electronic processor 30 includes a microprocessor, an application-specific integrated circuit (ASIC), or other suitable electronic device. The electronic processor 30 is configured to retrieve data from the memory 32 and execute software instructions to perform various functions, etc.

[0033] like Figure 3As shown, the memory 32 stores a client software application 37. The client software application 37 manages access, downloading, and synchronization of data stored in the online data source 12 (e.g., the shared data space 27) when executed by the electronic processor 30. For example, the client software application 37 may provide a user interface that allows a user to view and access data stored in the shared data space 27, select data to download for local storage on the user device 14 (memory 32), make changes to the downloaded data, and synchronize any changes made to the data at the user device 14 and the online data source 12. It should be understood that the client software application 37 may also perform additional functions not described herein. For example, in some embodiments, the client software application 37 also performs data processing functions, such as functions provided via a spreadsheet application, a word processing application, a presentation application, a database application, etc.

[0034] In some embodiments, the protected data synchronization token and data space synchronization token generated by the token generation software 26 are issued to and received by the client software application 37. In some embodiments, the received token is linked to a specific client software application. However, in other embodiments, such tokens can be used by different client software applications. For example, in some embodiments, the user device 14 stores multiple client software applications, where different applications can access different spaces 27, different data sets within the same space 27, or a combination thereof. In this case, a unique token can be generated to control the data that can be accessed by each client software application.

[0035] As described above, instead of re-downloading the shared data space 27 (including any public data sets 28) each time a user's permissions to the space 27 change, the token generation software 26 can be configured to generate a protected data synchronization token for the new protected data. The user device 14 (client software application 37) uses the token to download the new protected data without also downloading (or otherwise synchronizing) other parts of the shared data space 27, such as the public data sets 28. After the download is complete, the client software application 37 performs synchronization with the shared data space based on the data space synchronization token to synchronize the shared data space 27 including the new protected data.

[0036] For example, Figure 4 is a flow chart illustrating a method 40 for synchronizing data between an online data source 12 and a client software application 37 according to one embodiment. The method 40 is described as being performed by a user device 14 (a client software application 37 executed by an electronic processor 30). However, in some embodiments, the method 40 or portions thereof may be performed by other devices or hardware or software components.

[0037] like Figure 4As shown, method 40 includes, in response to a change in permissions of a user of a user device 14 with respect to a shared data space 27, receiving at the user device 14 a protected data synchronization token for protected data associated with the changed user permissions (at box 42). For example, a user of the user device 14 may join a new team, start a new project, or take on a new role in an existing project and need access to a protected data set, such as protected data set 29A. Similarly, as new protected data is added to the shared data space 27, permissions associated with the user may be updated to grant access to the protected data, which represents a change in user permissions. In some embodiments, a manager or other administrator controls permissions to protected data. As described above, the received protected data synchronization token may identify one or more protected data sets to which the user has been granted access permissions. The protected data synchronization token may also identify a user, a user device 14, a client software application 37, or a combination thereof.

[0038] In some embodiments, the protected data synchronization token is generated after the user is authenticated. For example, the authentication software 25 can perform a multi-factor authentication of the user, and the successful completion of the authentication process can trigger the generation of an appropriate protected data synchronization token.

[0039] After the user device 14 receives and stores the issued protected data synchronization token (at box 42), any ongoing synchronization action between the online data source 12 and the client software application 37 is stopped (this includes the storage of the updated data space synchronization token), and the client software application 37 uses the received protected data synchronization token to download a new protected data set (e.g., protected data set 29A) without downloading (or otherwise synchronizing) other parts of the shared data space 27, such as the public data set 28 (at box 43).

[0040] After the new protected data set 29A is downloaded (at box 43), the shared data space 27 including the protected data 29 downloaded using the protected data synchronization token is synchronized (at box 44). Synchronizing the shared data space 27 may include submitting a request including the stored data space synchronization token to the online data source 12. As described above, the online data source 12 uses the received data space synchronization token to identify modifications that need to be applied to the locally stored copy of the shared data space 27 on the user device 14. As described above, performing synchronization in this manner provides a more efficient use of computing resources (processing cycles, bandwidth, battery life, etc.) than completely re-downloading the shared data space 27 (including the public data set 28) to the user device 14 for each synchronization and each new protected data set that is accessible to the user.

[0041] In some embodiments, each protected data synchronization token is stored with a data space synchronization token to indicate which protected data sets the user can synchronize. However, in other embodiments, after the associated protected data set is downloaded and the shared data space 27 (including the newly downloaded protected data set) is synchronized, each protected data synchronization token is used to update the data space synchronization token to indicate that the user can now synchronize the protected data set. For example, the data space synchronization token can be modified to include a unique identifier of the protected data set that the user is allowed to access. After the data space synchronization token is updated, the protected data synchronization token can be discarded, which achieves efficient memory usage.

[0042] As described above, a change in user rights as described above may include granting access to a new (new to the user or new to the shared data space 27) protected data set in the shared data space 27. Similarly, in some embodiments, a change in user rights may include revoking access to an existing protected data set included in the shared data space 27. For example, when a user's rights to a particular protected data set 29 are revoked, a previously provided protected data synchronization token may be revoked, which may trigger deletion of previously downloaded protected data by the user device 14 (as part of synchronization as described above), or the data space synchronization token may be modified to remove an identifier of the protected data set 29. For example, a revocation notification may be provided to the client software application 37 to trigger deletion of a previously provided protected data synchronization token, or removal of an identifier of the protected data set 29 from the data space synchronization token. Similarly, in some embodiments, revocation of an authentication token may separately trigger deletion of any downloaded data associated with the revoked rights to perform such deletion without delay and enforce data integrity prior to performing a general synchronization of the space 27 as described above. Thus, instead of deleting all previously downloaded data and subsequently re-downloading applicable data from the shared data space 27 (which wastes computing resources and introduces delays), only the revoked protected data is deleted without deleting other portions of the shared data space previously downloaded to the user device 14, such as public data sets.

[0043] Thus, as described above, by using sub-range synchronization, new protected data is quickly downloaded and made available at the client device without re-downloading (or otherwise synchronizing) the entire shared data space, which may include public data in addition to the protected data. Thus, the disclosed synchronization process more efficiently uses computing resources and reduces delays in completing synchronization, particularly when providing new protected data sets.

[0044] Various features and advantages of some embodiments are set forth in the following claims.

Claims

1. A system for synchronizing data between an online data source and a client application, the system comprising: The online data source; A user device comprising a memory storing the client application and an electronic processor configured to execute the client application to: In response to a change in permissions associated with a user to a protected data set included in a shared data space of the online data source, wherein the change in permissions includes granting access to a new protected data set in the shared data space, receiving a protected data synchronization token associated with the protected data set from the online data source, downloading the protected data set included in the shared data space from the online data source to the client application using the protected data synchronization token without re-downloading the public data set included in the shared data space, and After downloading the protected data set, the shared data space including the protected data set and the public data set is synchronized between the online data source and the client application using the stored data space synchronization token and the protected data synchronization token associated with the protected data set.

2. The system of claim 1, wherein: The electronic processor is further configured to provide authentication information to the online data source prior to receiving the protected data synchronization token.

3. The system of claim 1, wherein: At least a portion of at least one of the protected data set and the public data set is encrypted.

4. The system of claim 1, wherein: At least one of the protected data set and the public data set includes multiple layers of data requiring different authentication levels.

5. The system of claim 1, wherein: At least one of the protected data set and the public data set includes a data layer including a plurality of scopes, wherein each scope of the plurality of scopes requires a different authentication level.

6. A computer readable medium storing instructions which, when executed by an electronic processor, perform a set of functions comprising: In response to a change in permissions associated with the user to data included in a shared data space of an online data source, the change in permissions comprising revoking permissions to a protected data set included in the stored data space, receiving, at a client application, from the online data source, a revocation notification for a previously received protected data synchronization token associated with the protected data set; as well as In response to the revocation notice, deleting the protected data synchronization token, deleting the protected data set from a locally stored copy of the shared data space without deleting the public data set from the locally stored copy of the shared data space, and After deleting the protected data set, the shared data space including the public data set and excluding the protected data set is synchronized between the online data source and the client application using the stored data space synchronization token.

7. A method for synchronizing data between an online data source and a client application, the method comprising: responding to a change in permissions associated with a user to a protected data set included in a shared data space of the online data source, wherein the change in permissions includes granting access to a new protected data set in the shared data space; receiving, using the client application associated with the user, a protected data synchronization token associated with the protected data set issued by the online data source; downloading, with the client application, the protected data set included in the shared data space from the online data source to the client application using the protected data synchronization token without re-downloading a public data set included in the shared data space; and After downloading the protected data set, the shared data space including the protected data set and the public data set is synchronized between the online data source and the client application using the stored data space synchronization token and the protected data synchronization token associated with the protected data set.

8. The method of claim 7, further comprising: Prior to receiving the protected data synchronization token, authentication information is provided from the client application to the online data source.

9. The method of claim 8, wherein: Providing authentication information includes: completing multi-factor authentication.

10. The method of claim 7, wherein: Downloading the protected data set includes: downloading a new protected data set included in the shared data space, wherein the change in permissions includes the user being granted permission to access the new protected data set, and wherein the protected data synchronization token includes an identifier of the new protected data set.

11. The method of claim 7, wherein: Synchronizing the shared data space includes identifying changes made to the shared data space since a previous synchronization and applying the changes to the locally stored copy of the shared data space.

12. The method of claim 11, wherein: Applying the changes includes applying the changes made to the protected dataset while the protected dataset is being downloaded.

13. The method of claim 7, further comprising: Prior to downloading the protected data set, the data space synchronization token is stored.

Images