# US 11,443,052 B2 · Secure area in a file storage system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,443,052 B2 - Document ID: US11443052B2 - Status: Granted - Kind: B2 - Application number: 16/428,824 - Filed: 2019-05-31 - Published: 2020-09-24 - Granted: 2022-09-13 - Earliest claimed: 2019-03-21 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Filip C. Lazar; Steven J. Bailey; John D. Rodrigues; Andrew Keith Glover; Jyotsana Rathore; Jose A. Barreto; Kevin Andrew Chan; Gregory P. Young; Jacob C. Schieber; Jackson Cowan; Meir E. Abergel - Web page: https://patentgrep.com/patent/US11443052B2 ## CPC - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F 16/134: {Distributed indices} - G06F 16/1774: {Locking methods, e.g. locking methods for file systems allowing shared and concurrent access to files} - G06F 16/183: {Provision of network file services by network file servers, e.g. by using NFS, CIFS (network file access protocols H04L67/1097)} - G06F 21/31: User authentication - G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)} - H04L 63/101: {Access control lists [ACL]} - H04L 63/105: {Multiple levels of security} - H04L 63/108: {when the policy decisions are valid for a limited amount of time} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 67/06: specially adapted for file transfer, e.g. file transfer protocol [FTP] - H04L 67/1095: Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes - H04L 67/1097: for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] - H04L 67/306: User profiles - H04L 67/535: {Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34)} - G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L 2463/082: applying multi-factor authentication - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system is provided for controlling access to data stored in a cloud-based storage service. Data associated with a user account is stored at the cloud-based storage service. A first request to cause a portion of the data to be associated with a heightened authentication protocol is received. In response, the portion of the data is caused to require the heightened authentication protocol for access. A second request for a file that is stored in the area that is associated with the heightened authentication protocol is received. The second request is authenticated based on the heightened authentication protocol. In response to authenticating the second request, permission is granted to access the file. In response to a failure to authenticate the second request, access to the file is denied, while access to files stored in other areas associated with the user account is allowed. ## Claims ### Claim 1 A method for controlling access to data stored in a cloud-based storage service, the method comprising: storing, at the cloud-based storage service, files and folders associated with a user account, the files and folders requiring an authentication protocol for access to the files and folders, the files and folders uploaded to the cloud-based storage service and accessible by users having access to the uploaded files and folders via the user account; receiving, at the cloud-based storage service, a first request from the user account, to cause a selected folder of the files and folders to be associated with a heightened authentication protocol; in response to the first request, causing the selected folder to require the heightened authentication protocol for access, wherein files in the selected folder are restricted from file sharing capability while the selected folder is associated with the heightened authentication protocol, and wherein files moved into the selected folder require the heightened authentication protocol for access without applying the heightened authentication protocol to an entirety of the files and folders associated with the user account or individually applying the heightened authentication protocol to individual files; receiving, at the cloud-based storage service, a second request from the user account for a file that is stored in the selected folder that is associated with the heightened authentication protocol; authenticating the second request based on the heightened authentication protocol; in response to authenticating the second request, granting permission to access the selected folder and files that are stored in the selected folder associated with the heightened authentication protocol, wherein visibility to the selected folders and files is provided in response to requests from applications that include an indication that the applications are configured to interact with files and folders that are associated with the heightened authentication protocol; and in response to a failure to authenticate the second request, denying access to the selected folder that is associated with the heightened authentication protocol, while allowing access to other folders associated with the user account based on a simple or basic authentication mechanism associated with the user account, wherein visibility to the selected folders and files is hidden in response to requests from applications that do not include the indication that the applications are configured to interact with files and folders that are associated with the heightened authentication protocol. ### Claim 2 (depends on 1) The method of claim 1, wherein the permission is temporary. ### Claim 3 (depends on 1) The method of claim 1, wherein the permission is associated with a timeout period. ### Claim 4 (depends on 1) The method of claim 1, wherein the files and folders are accessed via a file system. ### Claim 5 (depends on 4) The method of claim 4, wherein the files and folders are accessible via a user interface for accessing the file system. ### Claim 6 (depends on 1) The method of claim 1, wherein the files and folders are accessible based on a temporary session. ### Claim 7 (depends on 6) The method of claim 6, wherein temporary session is associated with a specific user device. ### Claim 8 (depends on 3) The method of claim 3, wherein the permission is withdrawn when the timeout period expires. ### Claim 9 (depends on 1) The method of claim 1, wherein the heightened authentication protocol comprises one of two-factor authentication, multifactor authentication, multiple step verification, two-step authentication, or strong authentication. ### Claim 10 A system for controlling access to data, the system comprising: one or more hardware data processing units; and a non-transitory computer-readable medium having encoded thereon computer-executable instructions to cause the one or more hardware data processing units to perform operations comprising: storing files and folders associated with a user account, the files and folders requiring an authentication protocol for access to the files and folders, the files and folders uploaded to a cloud-based storage service and accessible by users having access to the uploaded files and folders via the user account; receiving a first request from the user account, to cause a selected folder of the files and folders to be associated with a heightened authentication protocol; in response to the first request, causing the selected folder to require the heightened authentication protocol for access, wherein files in the selected folder are restricted from file sharing capability while the selected folder is associated with the heightened authentication protocol, and wherein files moved into the selected folder require the heightened authentication protocol for access without applying the heightened authentication protocol to an entirety of the files and folders associated with the user account or individually applying the heightened authentication protocol to individual files; receiving a second request from the user account for access to the selected folder that is associated with the heightened authentication protocol; authenticating the second request based on the heightened authentication protocol; in response to authenticating the second request, granting a session to access the selected folder and files that are stored in the selected folder that is associated with the heightened authentication protocol, wherein visibility to the selected folder and files is provided in response to requests from applications that include an indication that the applications are configured to interact with files and folders that are associated with the heightened authentication protocol; and in response to a failure to authenticate the second request, denying access to the selected folder and files that are stored in the selected folder that is associated with the heightened authentication protocol, while allowing access to other folders associated with the user account based on other authentication mechanisms associated with the user account, wherein visibility to the selected folder and files is hidden in response to requests from applications that do not include the indication that the applications are configured to interact with files and folders that are associated with the heightened authentication protocol. ### Claim 11 (depends on 10) The system of claim 10, wherein the session is temporary. ### Claim 12 (depends on 10) The system of claim 10, wherein the session is associated with a timeout period. ### Claim 13 (depends on 10) The system of claim 10, wherein the selected folder is accessed via a file system. ### Claim 14 (depends on 13) The system of claim 13, wherein the selected folder is accessible via a user interface for accessing the file system. ### Claim 15 (depends on 10) The system of claim 10, wherein the selected folder is accessible based on a temporary session. ### Claim 16 (depends on 15) The system of claim 15, wherein the temporary session is associated with a specific user device. ### Claim 17 (depends on 12) The system of claim 12, wherein the session is terminated when the timeout period expires. ### Claim 18 (depends on 10) The system of claim 10, wherein the session is associated with a role using an access control list. ### Claim 19 A computing device comprising: one or more hardware data processing units; and a non-transitory computer-readable medium having encoded thereon computer-executable instructions to cause the one or more hardware data processing units to perform operations comprising: receiving a first request to cause a selected folder of files and folders of a storage area to be associated with a heightened authentication protocol, the selected folder of the storage area associated with a user account, the files and folders requiring an authentication protocol for access to the files and folders, the files and folders uploaded to a cloud-based storage service and accessible by users having access to the uploaded files and folders via the user account; in response to the first request, causing the selected folder of the storage area to require the heightened authentication protocol for access, wherein files in the selected folder are restricted from file sharing capability while the selected folder is associated with the heightened authentication protocol, and wherein files moved into the selected folder require the heightened authentication protocol for access without applying the heightened authentication protocol to an entirety of the files and folders associated with the user account or individually applying the heightened authentication protocol to individual files; receiving a second request from the user account to access a file that is stored in the selected folder that is associated with the heightened authentication protocol; authenticating the second request based on the heightened authentication protocol; in response to authenticating the second request, granting a session to access the file that is stored in the selected folder associated with the heightened authentication protocol, wherein visibility to the file is provided in response to requests from applications that include an indication that the applications are configured to interact with files and folders that are associated with the heightened authentication protocol; and in response to a failure to authenticate the second request, denying access to the file that is stored in the selected folder associated with the heightened authentication protocol, while allowing access to other areas associated with the user account based on a different authentication mechanism associated with the user account, wherein visibility to the selected folders and files is hidden in response to requests from applications that do not include the indication that the applications are configured to interact with files and folders that are associated with the heightened authentication protocol. ### Claim 20 (depends on 19) The computing device of claim 19, further comprising when the second request is authenticated, allowing data to be moved from the storage area associated with the heightened authentication protocol to the other areas associated with the user account based on a different authentication mechanism.