External Content Sharing with Endpoint-Verified Access Codes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Organizations face security risks when sharing electronic files externally, as existing systems lack effective mechanisms to ensure access is revoked when recipients change roles or lose account control.
Innovation Solution
A computing system generates a sharing link that requires an access code sent to the recipient's known endpoint, ensuring only authorized users can access the content, and allows users to associate shared items with their account for seamless access without repeated code entry.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access codes are required for every external sharing link activation, then security is improved, but user convenience deteriorates
Solution Approach 1:
The system dynamically adjusts authentication requirements based on the sharing scenario. For items shared with specific external users, the system sends access codes to known endpoints. For items associated with external user accounts, the system automatically manages access without requiring repeated code entry, thus adapting the authentication process to the specific context.
Solution Approach 2:
The system performs preliminary actions by sending access codes to known endpoints (email addresses, phone numbers) before granting access. This preliminary verification step ensures that the person accessing the shared item is the intended recipient, while the codes are communicated through channels the user already controls.
2Reliability
If access codes are communicated to known endpoints for every access request, then access control is improved, but system complexity increases
Solution Approach 1:
The system leverages existing communication infrastructure (email systems, SMS gateways) that users already interact with daily. By using these self-service communication channels, the system avoids building complex custom authentication infrastructure, reducing overall system complexity while maintaining strong access control.
3Ease of operation
If external sharing is allowed without restrictions, then ease of collaboration is improved, but security risk increases
Solution Approach 1:
The system introduces an intermediary verification step through known endpoint communication. Instead of directly granting access to external users, the system uses email or SMS as an intermediary channel to verify the identity of the person attempting to access shared items, thus enabling collaboration while mitigating security risks.
Solution Approach 2:
The system applies different access control mechanisms to different sharing scenarios. Internal sharing within the organization can be more open, while external sharing triggers the access code verification process. This localized application of security measures allows easy collaboration where safe while protecting against external threats.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
A computing system is configured to provide access to electronic content stored in the data store. A user interface component is configured to receive an indication of an external user with which to share an item of electronic content. A link generation component is configured to generate a link to share the item of electronic content. An access control component is configured to receive a request to access the item of electronic content using the link, and responsively generate an access code that is communicated to a known endpoint associated with the link. The user interface component is configured to receive a user input containing a user-entered access input. The access control component is configured to selectively grant access to the item of electronic content based on whether the user-entered access input matched the access code communicated to the known endpoint associated with the link.