Secure hybrid file-sharing system
A method includes (1) receiving a request to share a file stored on a secure network with a target, the request identifying the file and the target, (2) performing a location operation to determine whether the target belongs to the secure network, (3) when a result of the location evaluation operation indicates that the target does not belong to the secure network, performing a sensitivity evaluation operation to determine whether the file identified by the request includes sensitive information, and (4) performing an access control operation, the access control operation (i) rejecting the request when both (a) the result of the location evaluation operation indicates that the target does not belong to the secure network, and (b) a result of the sensitivity evaluation operation indicates that the file includes sensitive information, and (ii) otherwise causing a link to access the file to be provided to the target.
1. A method of controlling access to data, the method comprising:
receiving, by processing circuitry, a request to share a file stored on a secure network with a target user, the request identifying the file and the target user;
performing, by the processing circuitry, a location evaluation operation to determine whether the target user belongs to the secure network;
when a result of the location evaluation operation indicates that the target user does not belong to the secure network, performing, by the processing circuitry, a sensitivity evaluation operation to determine whether the file identified by the request includes sensitive information; and
performing, by the processing circuitry, an access control operation, the access control operation (i) rejecting the request when both (a) the result of the location evaluation operation indicates that the target user does not belong to the secure network, and (b) a result of the sensitivity evaluation operation indicates that the file includes sensitive information, and (ii) otherwise causing a link to access the file to be provided to the target user;
wherein:
performing the access control operation includes:
causing a message including the link to be sent to the target user through a public network when the result of the sensitivity evaluation operation indicates that the file does not includes sensitive information and the result of the location evaluation operation indicates that the target user does not belong to the secure network;
creating a share identifier (shareID), the shareID identifying the file; and
when the result of the sensitivity evaluation operation indicates that the file does not includes sensitive information and the result of the location evaluation operation indicates that the target user does not belong to the secure network, sending the shareID and an indication that the target user does not belong to the secure network to a web server within the secure network, the web server being configured to:
generate a signature of the shareID; and
cause the link to be sent to the target user;
the method further comprises:
receiving an access request to access the file from a file-seeking user, the access request including an access link, the access link encoding the shareID;
rejecting the access request when the access request does not include the signature of the shareID; and
otherwise, causing the file to be sent to the file-seeking user;
receiving the access request and rejecting the access request are performed by the web server in response to the file-seeking user being redirected to the web server after accessing the link at a cloud server on the public network; and
causing the file to be sent to the file-seeking user includes the web server performing the following operations:
retrieving the file from the secure network; and
sending the retrieved file to the file-seeking user.
2. The method of claim 1 wherein the cloud server is configured to:
in response to the file-seeking user accessing the link at the cloud server:
authenticate the file-seeking user; and
upon successfully authenticating the file-seeking user, generate the access link from the link, the access link pointing to the web server rather than the cloud server.
3. The method of claim 2 wherein generating the access link from the cloud link includes cryptographically combining the link with an address of the file-seeking user.
4. The method of claim 2 wherein generating the access link from the cloud link includes cryptographically combining the link with a current time, the access link remaining valid for a limited period of time.
5. The method of claim 1 wherein the method further comprises:
extracting the shareID from the access link; and
extracting the signature of the shareID from within HTTP POST data of the access request, the HTTP POST data having been placed within the access request by the cloud server.
6. A method of controlling access to data, the method comprising:
receiving, by processing circuitry, a request to share a file stored on a secure network with a target user, the request identifying the file and the target user;
performing, by the processing circuitry, a location evaluation operation to determine whether the target user belongs to the secure network;
when a result of the location evaluation operation indicates that the target user does not belong to the secure network, performing, by the processing circuitry, a sensitivity evaluation operation to determine whether the file identified by the request includes sensitive information; and
performing, by the processing circuitry, an access control operation, the access control operation (i) rejecting the request when both (a) the result of the location evaluation operation indicates that the target user does not belong to the secure network, and (b) a result of the sensitivity evaluation operation indicates that the file includes sensitive information, and (ii) otherwise causing a link to access the file to be provided to the target user;
wherein:
performing the access control operation includes:
causing a message including the link to be sent to the target user through a public network when the result of the sensitivity evaluation operation indicates that the file does not includes sensitive information and the result of the location evaluation operation indicates that the target user does not belong to the secure network;
creating a share identifier (shareID), the shareID identifying the file; and
when the result of the sensitivity evaluation operation indicates that the file does not includes sensitive information and the result of the location evaluation operation indicates that the target user does not belong to the secure network, sending the shareID and an indication that the target user does not belong to the secure network to a web server within the secure network, the web server being configured to:
generate a signature of the shareID; and
cause the link to be sent to the target user; and
the method further comprises:
receiving an access request to access the file from a file-seeking user, the access request including an access link, the access link encoding the shareID;
extracting the shareID from the access link;
extracting the signature of the shareID from the access link;
rejecting the access request when the access request does not include the signature of the shareID; and
otherwise, causing the file to be sent to the file-seeking user.
7. A method of controlling access to data, the method comprising:
receiving, by processing circuitry, a request to share a file stored on a secure network with a target user, the request identifying the file and the target user;
performing, by the processing circuitry, a location evaluation operation to determine whether the target user belongs to the secure network;
when a result of the location evaluation operation indicates that the target user does not belong to the secure network, performing, by the processing circuitry, a sensitivity evaluation operation to determine whether the file identified by the request includes sensitive information; and
performing, by the processing circuitry, an access control operation, the access control operation (i) rejecting the request when both (a) the result of the location evaluation operation indicates that the target user does not belong to the secure network, and (b) a result of the sensitivity evaluation operation indicates that the file includes sensitive information, and (ii) otherwise causing a link to access the file to be provided to the target user;
wherein:
performing the access control operation includes:
causing a message including the link to be sent to the target user via the secure network when the result of the location evaluation operation indicates that the target user belongs to the secure network;
creating a share identifier (shareID), the shareID identifying the file; and
when the result of the location evaluation operation indicates that the target user belongs to the secure network, sending the shareID and an indication that the target user belongs to the secure network to a web server within the secure network, the web server being configured to cause the link to be sent to the target user; and
the method further comprises:
receiving an access request to access the file from a file-seeking user, the access request including the shareID;
authenticating the identity of the file-seeking user;
rejecting the access request when the identity of the file-seeking user indicates that the file-seeking user does not belong to the secure network; and
otherwise:
rejecting the access request when the file-seeking user is not authorized to access the file; and
otherwise, causing the file to be sent to the file-seeking user.
8. The method of claim 7 wherein receiving the access request and authenticating the identity of the file-seeking user are performed by the web server in response to the fileseeking user being redirected to the web server after accessing the link at a cloud server on the public network.
9. The method of claim 8 wherein causing the file to be sent to the file-seeking user includes performing the following operations:
retrieving the file from the secure network; and
sending the retrieved file to the file-seeking user via the secure network.
10. The method of claim 8 wherein causing the file to be sent to the file-seeking user includes redirecting the user to a file server storing the file.
11. The method of claim 8 wherein the cloud server is configured to, in response to the file-seeking user accessing the link at the cloud server, generating the access link from the link, the access link pointing to the web server rather than the cloud server, by cryptographically combining the link with an address of the file-seeking user.
12. The method of claim 8 wherein the cloud server is configured to, in response to the file-seeking user accessing the link at the cloud server, generating the access link from the link, the access link pointing to the web server rather than the cloud server, by cryptographically combining the link with a current time, the access link remaining valid for a limited period of time.