# US 2021/0240732 A1 · Synchronized organization directory with team member folders

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2021/0240732 A1
- Document ID: US20210240732A1
- Status: Published application
- Kind: A1
- Application number: 17/237,267
- Filed: 2021-04-22
- Published: 2021-08-05
- Earliest claimed: 2017-12-28
- Assignees: Dropbox, Inc.
- Applicants: Dropbox, Inc.
- Inventors: Thomas Kleinpeter; Tony Xu; Akos Albert; Nils Bunger; Sam Jau; Conor Woods; Aaron Staley
- Web page: https://patentgrep.com/patent/US20210240732A1

## CPC

- G06F 16/11: File system administration, e.g. details of archiving or snapshots (error detection or correction of the data by redundancy in operations G06F11/14)
- G06F 1/04: Generating or distributing clock signals or signals derived directly therefrom
- G06F 3/0619: {in relation to data integrity, e.g. data losses, bit errors}
- G06F 3/0623: {in relation to content}
- G06F 3/0629: {Configuration or reconfiguration of storage systems}
- G06F 3/065: {Replication mechanisms}
- G06F 3/0652: {Erasing, e.g. deleting, data cleaning, moving of data to a wastebasket}
- G06F 3/067: {Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]}
- G06F 9/547: {Remote procedure calls [RPC]; Web services}
- G06F 11/1469: {Backup restoration techniques}
- G06F 12/1466: {Key-lock mechanism}
- G06F 16/113: {Details of archiving (lifecycle management in storage systems G06F3/0649; point-in-time backing up or restoration of persistent data G06F11/1446)}
- G06F 16/116: {Details of conversion of file system types or formats}
- G06F 16/119: {Details of migration of file systems (migration mechanisms in storage systems G06F3/0647)}
- G06F 16/122: {using management policies (point-in-time backing up or restoration of persistent data G06F11/1446; file migration policies for HSM systems G06F16/185)}
- G06F 16/125: {characterised by the use of retention policies (retention policies for HSM systems G06F16/185)}
- G06F 16/128: {Details of file system snapshots on the file-level, e.g. snapshot creation, administration, deletion (error detection or correction of the data by redundancy in operations or in hardware G06F11/14, G06F11/16)}
- G06F 16/13: File access structures, e.g. distributed indices (arrangements of input from, or output to, record carriers G06F3/06)
- G06F 16/137: {Hash-based (content-based indexing of textual data G06F16/31)}
- G06F 16/148: {File search processing}
- G06F 16/152: {using file content signatures, e.g. hash values}
- G06F 16/156: {Query results presentation}
- G06F 16/16: File or folder operations, e.g. details of user interfaces specifically adapted to file systems
- G06F 16/162: {Delete operations (erasing in storage systems G06F3/0652)}
- G06F 16/168: {Details of user interfaces specifically adapted to file systems, e.g. browsing and visualisation, 2d or 3d GUIs (query results presentation G06F16/156)}
- G06F 16/172: Caching, prefetching or hoarding of files
- G06F 16/1734: {Details of monitoring file system events, e.g. by the use of hooks, filter drivers, logs}
- G06F 16/1744: {using compression, e.g. sparse files}
- G06F 16/176: Support for shared access to files; File sharing support
- G06F 16/1767: {Concurrency control, e.g. optimistic or pessimistic approaches}
- G06F 16/178: Techniques for file synchronisation in file systems
- G06F 16/1787: {Details of non-transparently synchronising file systems}
- G06F 16/18: File system types
- G06F 16/182: Distributed file systems
- G06F 16/1827: {Management specifically adapted to NAS (management of storage area networks [SAN] G06F3/067)}
- G06F 16/183: {Provision of network file services by network file servers, e.g. by using NFS, CIFS (network file access protocols H04L67/1097)}
- G06F 16/184: {implemented as replicated file system}
- G06F 16/1844: {Management specifically adapted to replicated file systems}
- G06F 16/185: Hierarchical storage management [HSM] systems, e.g. file migration or policies thereof (details of archiving G06F16/11)
- G06F 16/2246: {Trees, e.g. B+trees}
- G06F 16/2255: {Hash tables}
- G06F 16/2322: {using timestamps}
- G06F 16/2358: {Change logging, detection, and notification (replication G06F16/27)}
- G06F 16/2365: {Ensuring data consistency and integrity}
- G06F 16/2379: {Updates performed during online database operations; commit processing}
- G06F 16/24552: {Database cache management}
- G06F 16/27: Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
- G06F 16/275: {Synchronous replication}
- G06F 16/9027: {Trees}
- G06F 16/907: Retrieval characterised by using metadata, e.g. metadata not derived from the content or metadata generated manually
- G06F 16/951: Indexing; Web crawling techniques
- G06F 16/955: using information identifiers, e.g. uniform resource locators [URL]
- G06F 16/958: Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
- G06F 21/10: Protecting distributed programs or content, e.g. vending or licensing of copyrighted material (protection in video systems or pay television H04N7/16) {; Digital rights management [DRM]}
- G06F 21/604: {Tools and structures for managing or administering access control systems}
- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)}
- H04L 9/3247: {involving digital signatures}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)}
- H04L 63/10: {for controlling access to devices or network resources}
- H04L 63/101: {Access control lists [ACL]}
- H04L 63/102: {Entity profiles}
- H04L 67/06: specially adapted for file transfer, e.g. file transfer protocol [FTP]
- H04L 67/1095: Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
- H04L 67/1097: for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
- G06F 2201/84: Using snapshots, i.e. a logical point-in-time copy of the data
- G06F 2212/1052: Security improvement
- G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices
- H04L 67/306: User profiles
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

The present technology pertains to a organization directory hosted by a synchronized content management system. The corporate directory can provide access to user accounts for all members of the organization to all content items in the organization directory on the respective file systems of the members' client devices. Members can reach any content item at the same path as other members relative to the organization directory root on their respective client device. In some embodiments novel access permissions are granted to maintain path consistency.

## Claims

### Claim 1

A method for controlling access to managed content items, the method comprising:
in response to a request from a user account to access a content item, determining whether the user account can access the content item based on a first access control associated with a namespace;
when the user account can access the content item based on the first access control, determining whether the user account is denied access to the content item based on a second access control;
when the user account is denied access based on the second access control, determining whether the request can access any child content item of the content item; and
when the request can access any child content item of the content item, accessing the child content item.

### Claim 2 (depends on 1)

The method of claim 1, wherein the accessing the child content item includes traversing the content item.

### Claim 3 (depends on 2)

The method of claim 2, comprising:
storing the content item in a traversal dictionary, wherein content items corresponding to folders stored in the traversal dictionary are accessible for navigation to the child content item, and content items corresponding to files are not accessible.

### Claim 4 (depends on 1)

The method of claim 1, wherein the first access control provides default access to the content item and the child content item.

### Claim 5 (depends on 4)

The method of claim 4, wherein the second access control comprises a restrictive access control list that grants access to user accounts identified in the restrictive access control list.

### Claim 6 (depends on 5)

The method of claim 5, wherein the second access control restricts access to user accounts not identified in the restrictive access control list.

### Claim 7 (depends on 5)

The method of claim 5, further comprising:
in response to receiving a modification to the child content item,
synchronizing the modified item with devices associated with user accounts listed in the restrictive access control list.

### Claim 8 (depends on 1)

The method of claim 1, further comprising:
after receiving a response to the request to access the content item, identifying a context of the request based on the request; and
based on the context of the request, determining whether to mount a namespace to list content items in a path to the child content item.

### Claim 9

A non-transitory computer readable medium comprising instructions, the instructions, when executed by a computing system, cause the computing system to:
in response to a request from a user account to access a content item, determine whether the user account can access the content item based on a first access control associated with a namespace;
when the user account can access the content item based on the first access control, determine whether the user account is denied access to the content item based on a second access control;
when the user account is denied access based on the second access control, determine whether the request can access any child content item of the content item;
when the request can access any child content item of the content item, access the child content item.

### Claim 10 (depends on 9)

The computer readable medium of claim 9, the accessing the child content item includes traversing the content item.

### Claim 11 (depends on 10)

The computer readable medium of claim 10, wherein the computer readable medium further comprises instructions that, when executed by the computing system, cause the computing system to:
store the content item in a traversal dictionary, wherein content items corresponding to folders stored in the traversal dictionary are accessible for navigation to the child content item, and content items corresponding to files are not accessible.

### Claim 12 (depends on 9)

The computer readable medium of claim 9, the first access control provides default access to the content item and the child content item.

### Claim 13 (depends on 12)

The computer readable medium of claim 12, the second access control comprises a restrictive access control list that grants access to user accounts identified in the restrictive access control list.

### Claim 14 (depends on 13)

The computer readable medium of claim 13, the second access control restricts access to user accounts not identified in the restrictive access control list.

### Claim 15 (depends on 13)

The computer readable medium of claim 13, wherein the computer readable medium further comprises instructions that, when executed by the computing system, cause the computing system to:
in response to receiving a modification to the child content item; and
synchronize the modified item with devices associated with user accounts listed in the restrictive access control list.

### Claim 16 (depends on 9)

The computer readable medium of claim 9, wherein the computer readable medium further comprises instructions that, when executed by the computing system, cause the computing system to:
after receiving a response to the request to access the content item, identify a context of the request based on the request; and
based on the context of the request, determine whether to mount a namespace to list content items in a path to the child content item.

### Claim 17

A system comprising:
a storage configured to store instructions;
a processor configured to execute the instructions and cause the processor to:
in response to a request from a user account to access a content item, determine whether the user account can access the content item based on a first access control associated with a namespace;
when the user account can access the content item based on the first access control, determine whether the user account is denied access to the content item based on a second access control;
when the user account is denied access based on the second access control, determine whether the request can access any child content item of the content item; and
when the request can access any child content item of the content item, access the child content item.

### Claim 18 (depends on 17)

The system of claim 17, wherein the accessing the child content item includes traversing the content item.

### Claim 19 (depends on 18)

The system of claim 18, wherein the processor is configured to execute the instructions and cause the processor to:
store the content item in a traversal dictionary, wherein content items corresponding to folders stored in the traversal dictionary are accessible for navigation to the child content item, and content items corresponding to files are not accessible.

### Claim 20 (depends on 17)

The system of claim 17, wherein the first access control provides default access to the content item and the child content item.