BACKGROUND

Distributed storage systems (e.g., cloud storage systems) typically use server computers and storage devices, connected to the Internet and/or another type of network, to store computer data and software applications. A device may connect to the servers via a web browser or a dedicated distributed storage application, for instance, to retrieve data, upload data, and/or run software applications. This arrangement may be beneficial for computing devices having limited storage, such as mobile computing devices, which might benefit from the large storage capacity and higher performance of the servers. This arrangement may also be beneficial to generally provide a centralized location for storage of a user's data that can be accessed by multiple devices, regardless of their location.

Distributed storage has become a readily available Internet service (e.g., OneDrive, Dropbox, Google Docs, and Amazon Cloud Drive storage services). Distributed storage enables a user to upload files to a server and disseminate those files to multiple devices based on a system of secure permissions allowing access to a centrally stored set of data. Specially, a file may be created on a user's computer, the file may be uploaded to a server, and the server has user provided instructions on where to send the file or how the file may be accessed.

The use of such cloud-based computing services has greatly increased in recent years. Additionally, the amount of data that users create and store has greatly increased. While much of this data may not include sensitive or confidential information, users often have personal information contained in at least some of their stored data. Such data may include bank statements, account information, social security numbers, and other personal information.

Ensuring that users can secure access to such personal information can be challenging given the total amount of data that a user typically stores in their data files. Furthermore, it is cumbersome to apply extraordinary security measures to all of their data, or to individually apply such measures to each and every sensitive data file. This can lead to a number of inefficiencies, as security features must be applied to data where high levels of security processes are not needed or desired, or the user must repeatedly adhere to such processes. In many applications, such as Word, Excel, OneNote, Pages, Numbers, Google Docs, and Google Sheets, each application may have their own interfaces to data files, and enforcement of security measures for sensitive documents may require that each application implement a security mechanism. However, applications may not apply security features in a consistent manner. This can lead to a number of issues, as applications may not implement the security features in an efficient manner. Furthermore, the user may be required to learn and interact with a variety of security implementations. Such limitations can cause a number of inefficiencies and a less than desirable user experience.

SUMMARY

At least some embodiments of this disclosure are directed to providing a secure area in a distributed storage system. In some embodiments, the secure area may be referred to as a vault, which may be a special folder that requires additional authorization measures such as two-step verification to access the contents or to even view the vault. This folder provides an additional layer of security to files and documents in the event that a user's device or account is compromised. In some embodiments, the additional layer of security may be provided more generally for a class of action or activity rather than to activity tied to a secure area of storage, where the vault may be one type of such activity. It should be understood that while the example implementations described herein refer to the vault, the disclosed principles may be applied to actions or activities that are tied to the additional layer of security.

When using role-based access control, roles are typically associated with a given user and not a transient authentication state for that user. In a personal cloud file system, access to files and folders is granted to security principals (users or groups) after authentication is completed, typically by providing a username and password. In one aspect of the present disclosure, permissions may be granted to a temporary strong authentication state and not the security principal. The disclosure provides a way to grant permissions based on the temporary strong authentication state to a folder or file only when using a specific type of authentication, such as strong authentication, is used. In an embodiment, a user with regular authentication is not able to see files in the vault and access such files, unless first performing strong authentication. In an embodiment, permissions may be granted based on the temporary strong authentication state to an action set that is tied to the overall file system but not necessarily to a specific folder/file. A temporary strong authentication state may be required in order to allow a user to perform specified actions, for example action that are irreversible or otherwise may have significant impact.

The techniques disclosed herein provide a number of improvements over existing systems. For instance, when the file is stored at a remote storage service, such as Google Drive, iCloud, or OneDrive, a secure area may be provided that can be used to selectively store files therein rather without having to apply additional security mechanisms to the entirety of the user's files or individually to selected files. The techniques disclosed herein further improve user interaction with a computer along with providing improvements with respect to processing resources, network resources, and memory resources. For instance, a user no longer has to manually apply security measures to individual files or open a separate secure account for storing sensitive files, causing the user to have to manage multiple storage services and accounts. A more simplified way to provide a secure area, as disclosed herein, can lead to the reduction of inadvertent inputs, and based on which other efficiencies can be improved.

This Summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key or essential features of the claimed subject matter, nor is it intended to be used as an aid in determining the scope of the claimed subject matter. The term “techniques,” for instance, may refer to system(s), method(s), computer-readable instructions, module(s), algorithms, hardware logic, and/or operation(s) as permitted by the context described above and throughout the document.

