Patent Application
20180205737
The embodiments herein relate to data sharing and, more particularly, to data sharing with at least one other user.
Currently, sharing data by users present in a network with other users of the network, as well as with users outside the network is challenging from the perspective of users as well as an administrator of the network. The network can be an enterprise network, a network present in an organization, a personal network, a LAN (Local Area Network), a WAN (Wide Area Network), a VPN (Virtual Private Network) and so on. The users want it to be seamless and intuitive, while the administrator wants to make sure that confidential data does not fall in wrong hands and all the access is tracked. Examples of methods of sharing data with at least one other user are sending data vie email, copying, sharing a link through a message (such as email, IM (Instant Message), messaging services and so on), sharing access to data present in a server, sharing access to data present in the cloud and so on. However, current methods are unable to track who is accessing the data, when the data is being accessed, and from where (the location, the device and so on) the data is being accessed.
Current solutions use third party authentication mechanisms such as Google accounts, Facebook usernames, OpenID and so on to capture the identity of the user, who iss accessing the data. However, a user can overcome this by creating fake accounts. Another solution has the user provide a user name and password, before accessing the data. But, any user can access the data, provided he has the user name and password and there is no means to uniquely identify the user.
In the example, wherein a first user shares a link to the data with a second user (wherein the link may be a generic link or specific to the second user), the second user can share the link with a third user, wherein the third user can be an unauthorized user who does not have permission to access the data. But the third user gets access to the data, wherein the records can indicate that the second user was accessing the data, as the link can point to the second user.
The embodiments herein will be better understood from the following detailed description with reference to the drawings, in which:
The embodiments herein and the various features and advantageous details thereof are explained more fully with reference to the non-limiting embodiments that are illustrated in the accompanying drawings and detailed in the following description. Descriptions of well-known components and processing techniques are omitted so as to not unnecessarily obscure the embodiments herein. The examples used herein are intended merely to facilitate an understanding of ways in which the embodiments herein may be practiced and to further enable those of skill in the art to practice the embodiments herein. Accordingly, the examples should not be construed as limiting the scope of the embodiments herein.
The embodiments herein disclose a secure means for sharing data with at least one user using a secure means for identifying and providing access to the at least one user (if authorized). Referring now to the drawings, and more particularly to
Embodiments disclosed herein disclose obtaining of a unique identification means (such as an email address) of a user accessing data and providing access to the user by providing the user with an encoded link. Embodiments disclosed herein enable tracking the access of the data by a user using the encoded link, wherein the encoded link comprises of the unique identification means.
At least one user such as an administrator or the owner of an account (hereinafter referred to as an administrator) can control access to the data. In an embodiment herein, the administrator can enable at least one other user to access the data. The administrator can provide a list comprising of at least one authorized user. The administrator can use at least one unique identifying means for each user such as at least one of an email address, a phone number (a PSTN (Public switched Telephone Network) number, a cellular phone number, an IP based phone number and so on), a messaging ID (such as an ID belonging to Skype, Viber, Yahoo Chat, MSN Messenger and so on), a unique ID associated with a website/app (such as Facebook, Google, Linkedin and so on), an enterprise identification means (such as an employee code) or any other equivalent means. The administrator can also assign specific rights to each of the user, such as read only, write, copy, save, download and so on.
In another embodiment herein, the administrator can enable a user to gain access to the data by providing at least one unique identifying means such as at least one of an email address, a phone number (a PSTN (Public switched Telephone Network) number, a cellular phone number, an IP based phone number and so on), a messaging ID (such as an ID belonging to Skype, Viber, Yahoo Chat, MSN Messenger and so on), a unique ID associated with a website/app (such as Facebook, Google, Linkedin and so on), an enterprise identification means (such as an employee code) or any other equivalent ID means. In an embodiment herein, the administrator can specify at least one policy, such as the email ID cannot belong to a public email service provider (such as Gmail, AOL, Yahoo, Hotmail and so on), a specific pattern of acceptable and/or unacceptable email addresses (which can be specified using wildcards and so on; for example, *@xyz.com), a set of acceptable and/or unacceptable phone numbers, a set of unacceptable IDs, a set of at least acceptable IP addresses, a set of at least one unacceptable IP addresses and so on. The administrator can further specify at least one other information to be provided by the user, before providing access to the data; such as his name, his address, his organization name and so on.
The administrator can provide the data access controller 101 with details on data and can assign a policy on a per data basis.
On a user requesting for access to a data, the data access controller 101 can request the user to provide a unique identification means (such as an email address). Embodiments herein use the email address as an example to uniquely identify the user, but it may be obvious to a person of ordinary skill in the art to use any unique identification means to identify the user. The data access controller 101 can provide the user with a uniquely generated link through a suitable means such as his email address, wherein the uniquely generated link can comprise of the email address of the user (which can be present in an encoded form or a plain form).
On the user clicking the link, the data access controller 101 verifies the email address from where the user has clicked the link. If the data access controller 101 is able to verify the email address, the data access controller 101 enables the user to access the data.
In an embodiment herein, the data access controller 101 can generate a One Time Password (OTP) on verifying the email address. The data access controller 101 can sent the OTP to the embedded email address. The data access controller 101 can prompt the user to provide the OTP. The data access controller 101 can verify the OTP and provide access to the data.
The communication interface 203 can enable the data access controller 101 to communicate with at least one external entity, such as a data source and so on. The communication interface 203 can comprise of a LAN (Local Area Network) interface, a WAN (Wide Area Network) interface, IPC (Inter Process Communication), a wireless communication interface (Wi-Fi, cellular communications, Bluetooth and so on), the Internet, a private network interface and so on. The communication interface 203 can also enable the data access controller 101 to interact with other external entities such as user(s), administrator(s) and so on. The communication interface 203 can comprise of at least one of a web UI access, Application based Interface (API)-based access, FTP (File Transfer Protocol), SFTP (Secure FTP), FTPS (FTP Secure), SMTP (Simple Mail Transfer Protocol), CIFS/SMB (Common Internet File System/Server Message Block), NFS (Network File System), CIMS (Content Management Interoperability Services), ActiveSync, DAV (Distribution Authoring and Versioning), WebDAV, HTTP (Hyper Text Transfer Protocol), HTTPS (HTTP Secure) and so on.
The access controller 201 can enable the administrator to specify at least one other user to access the data. In an embodiment herein, the access controller 201 can enable the administrator to provide a list comprising of at least one authorized user by providing at least one unique identifying means for each user. The access controller 201 can enable the administrator to assign specific rights to each of the user, such as read only, write, copy, save, download and so on.
In another embodiment herein, the access controller 201 can enable the administrator to enable a user to gain access to the data by providing at least one unique identifying means. In an embodiment herein, the access controller 201 can enable the administrator to specify at least one policy. The access controller 201 can enable the administrator to further specify at least one other information to be provided by the user, before providing access to the data.
On a user requesting for access to a data, the access controller 201 can request the user to provide a unique identification means (such as an email address). In an embodiment herein, the access controller 201 can fetch the unique identification means (such as an email address) from the list of authorized user(s), as provided by the administrator (without the user requesting access to the data explicitly). The access controller 201 can encode the email address using a suitable means such as using the form of a hash or signature of the email address, a XOR of the email address and so on. The access controller 201 can then generate a link, using the encoded email address. The access controller 201 provides the user with the link using the communication interface 203, through a suitable means such as his email address.
On the user clicking the link, the access controller 201 can verify the email address from where the user has clicked the link. If the data access controller 101 is able to verify the email address, the access controller 201 can enable the user to access the data.
In an embodiment herein, the access controller 201 can generate a OTP (One Time Password), on verifying the email address. The access controller 201 can send the OTP to the embedded email address. The access controller 201 can prompt the user to provide the OTP. The access controller 201 can verify the OTP and provide access to the data.
In another embodiment herein, the access controller 201 can enable the user to enter a user editable password, wherein the user or the access controller 201 previously generated this password. On verifying the password, the access controller 201 can provide the user with access to the data.
The access controller 201 can store details of the user accessing the data, wherein the stored details can comprise of the identity of the user, the IP address from which the user is accessing the data, the time of the access, the operations performed by the user and so on.
Embodiments herein use an email address merely as an example of a unique means of identifying a user. However, it may be obvious to a person of ordinary skill in the art to use any other suitable unique identification means such as a phone number (a PSTN (Public switched Telephone Network) number, a cellular phone number, an IP based phone number and so on), a messaging ID (such as an ID belonging to Skype, Viber, Yahoo Chat, MSN Messenger and so on), a unique ID associated with a website/app (such as Facebook, Google, Linkedin and so on) or any other equivalent means to identify the user.
Embodiments herein use the email address merely as an example means of communicating the encoded link to the user. It may be obvious to a person of ordinary skill in the art to use any other equivalent means to communicate the encoded link to the user, such as a chat, an Instant Messaging (IM) session, a mobile message (Short Messaging Service (SMS) and so on) or any other equivalent means.
The foregoing description of the specific embodiments will so fully reveal the general nature of the embodiments herein that others can, by applying current knowledge, readily modify and/or adapt for various applications such specific embodiments without departing from the generic concept, and, therefore, such adaptations and modifications should and are intended to be comprehended within the meaning and range of equivalents of the disclosed embodiments. It is to be understood that the phraseology or terminology employed herein is for the purpose of description and not of limitation. Therefore, while the embodiments herein have been described in terms of preferred embodiments, those skilled in the art will recognize that the embodiments herein can be practiced with modification within the spirit and scope of the claims as described herein.
