File system access for one or more sandboxed applications

A system to provide a restricted operating environment for managing access to a resource on an electronic computer system, the system comprising:

• memory to store instructions and resources;
• a storage device coupled to the memory;
• and
• one or more processors coupled to the memory and the storage device, the one or more processors to execute instructions stored in the memory to create the restricted operating environment for managing access to the resource by an application, wherein the restricted operating environment couples with a cryptographically authenticated resource manager, the cryptographically authenticated resource manager to receive a request for a location identifier to access the resource, authenticate the request by determining whether access is allowed to the resource, and send the location identifier and an identifier, wherein the identifier is a uniform resource locator (URL), which allows retrieval of the resource outside of the restricted operating environment if the resource is renamed or moved, and the location identifier is a keyed hash of the URL.

A non-transitory machine-readable storage medium, which provides instructions that, when executed by a processing system, cause the processing system to perform operations managing resource access in a restricted operating environment, the operations comprising:

• receiving a first request to provide a location identifier associated with a resource, the resource consisting of a file or folder, the file or folder representing a collection of one or more user selected files;
• verifying that the first request is entitled to access the resource;
• creating a random key and attaching the random key to the resource;
• creating a first keyed hash using the random key;
• and
• returning the location identifier associated with the resource, the location identifier including a uniform resource locator (URL) and the first keyed hash, wherein the location identifier provides persistent access to the collection of files represented by the resource.