Patent Description:
A computer network provides connectivity among a set of nodes. A node may execute a client process and/or a server process. A client process makes a request for a computing service (such as, execution of a particular application, and/or storage of a particular amount of data) through the computer network. A server process responds by executing the requested service and/or returning corresponding data through the computer network.

In a cloud environment, network resources that execute server processes are shared amongst multiple clients. Clients may request computing services from the computer network independently of each other. Network resources may be dynamically assigned to the requests and/or clients on an on-demand basis.

In a personal cloud, one or more personal cloud devices are used to execute server processes. The personal cloud devices are provisioned for exclusive use by a particular group of one or more entities (such as, corporations, organizations, persons). Generally, an entity that is using the personal cloud is responsible for managing the personal cloud, including maintaining a network connection, maintaining user accounts, and maintaining security. A personal cloud device may be protected behind a firewall that is maintained by an entity using the personal cloud. A personal cloud device may be located on the premises of an entity using the personal cloud.

In a public cloud, a set of public cloud devices implement a cloud service for multiple entities that are independent of each other (also referred to as "tenants" or "customers" of the cloud service). Clients of different tenants may access the same network resource to request a cloud service. Generally, a cloud service provider manages a public cloud. A tenant need not be responsible for managing a public cloud. A tenant uses an application programming interface (API) provided by the cloud service provider to make requests for a cloud service. Through the API, the tenant may request execution of a particular application on the public cloud. Additionally or alternatively, the tenant may request storage and/or retrieval of a particular data set on the public cloud. Tenant isolation techniques may be used to ensure the security of tenant data processed by a same public cloud device.

A hybrid cloud includes both a personal cloud and public cloud. An interface between the personal cloud and the public cloud allows for data and application portability. Data stored at the private cloud and data stored at the public cloud may be exchanged through the interface. Applications implemented at the private cloud and applications implemented at the public cloud may have dependencies on each other. A call from an application at the private cloud to an application at the public cloud (and vice versa) may be executed through the interface.

A user desiring to use a hybrid cloud needs to be authenticated to both the personal cloud and the public cloud. Such an authentication process may be overly cumbersome for a user. Moreover, while a user may typically connect to a public cloud service via the Internet, the user may need to execute a complex process to establish a connection with a personal cloud device. As an example, a user may need to ensure that firewall settings associated with the personal cloud device allow the user to communicate with the personal cloud device.

<CIT> discloses a data backup linear capacity expanding method and system based on a public cloud storage account. The method includes that a personal private cloud storage system account is bound to a public cloud storage account and a WiFi-enabled storage device; the directory and file names of the public cloud storage account are subjected to traversal; the personal private cloud storage system generates a plurality of task groups and waits for the WiFi-enabled storage device; after the storage device is connected to internet, the storage device obtains tasks and automatically starts to download task data from the public cloud storage account and feeds the residual storage space back; if the residual memory of the storage device is lower than a preset value, the storage device is set in an inactive mode, and stops the synchronous operation until the storage device converts into the active state by deleting data or a new storage device is added.

<CIT> discloses a method and an apparatus for effective data sharing between users in a cloud computing system. The cloud computing system includes a first cloud hub and a User Equipment (UE). The first cloud hub provides a cloud service to a UE connected by a public cloud access and provides a cloud service to a UE connected to a public personal cloud system installed by a service provider, and is installed by a user. The UE subscribes to the first cloud hub as a main cloud and inquires as to data stored in the first cloud hub.

<CIT> discloses a private cloud equipment managing method, a private cloud equipment, a public cloud equipment and a storage device. The method comprises receiving a prompting message that a user account is bound to the private cloud equipment from public cloud equipment; determining whether the user account has an administrator authority; if YES, managing first range data of the private cloud equipment according to a control instruction sent by user equipment; and if NO, managing second range data associated with the user account in the private cloud equipment and narrower than the first range according to the control instruction sent by the user equipment. The user equipment binds the private cloud equipment via the user account.

One or more embodiments involve a hybrid cloud environment. A hybrid cloud environment includes a public cloud service, a personal cloud device, and a client device that accesses both the public cloud service and the personal cloud device. A personal cloud account for using the personal cloud device and a public cloud account for using the public cloud service may be bound together to facilitate communications with both the personal cloud device and the public cloud service, thereby creating a more integrated hybrid cloud environment.

One or more embodiments include binding a public cloud user account and a personal cloud user account for a hybrid cloud environment. An administrator of the personal cloud device creates a pre-approval list, indicating which public cloud user accounts are pre-approved to be bound with which personal cloud user accounts. A copy of the pre-approval list is stored on the personal cloud device, and another copy of the pre-approval list is stored on the public cloud service.

A user logs into the user's public cloud account through a client device. The public cloud service accesses a pre-approval list stored in a data repository associated with the public cloud service. Based on the pre-approval list, the public cloud service determines that the user's public cloud user account is pre-approved to be bound with a particular personal cloud user account on a particular personal user device. The particular personal cloud user account is associated with the same user. The public cloud service generates a credential. The public cloud service transmits, to the client device, (a) information indicating that the user's public cloud user account is pre-approved to be bound with the user's personal cloud user account and (b) the credential.

Optionally, the client device presents, using a user interface, a request for a new key corresponding to the user's personal cloud user account. The client device receives, using the user interface, the key as user input. The client device establishes a connection with the particular personal cloud device (which may be performed with the assistance of the public cloud service). The client device transmits, to the particular personal cloud device, a request to bind the user's public cloud user account and the user's personal cloud user account. The request includes (a) the key entered through the user interface and (b) the credential received from the public cloud service.

The personal cloud device stores the key in association with the personal cloud account, such that the user may subsequently use the key to log into the personal cloud account.

Further, the personal cloud device accesses a pre-approval list stored in a data repository associated with the personal cloud device. Based on the pre-approval list, the personal cloud device verifies that the user's public cloud user account is pre-approved to be bound to the user's personal cloud user account. The personal cloud device transmits, to the public cloud service, (a) a verification indicating that the user's public cloud user account and the user's personal cloud user account are approved to be bound and (b) the credential received from the client device.

The public cloud service verifies that the credential received from the personal cloud device is the same as the credential earlier generated by the public cloud service. Upon verification, the public cloud service stores a binding between the user's public cloud user account and the user's personal cloud user account. The binding is stored at a data repository associated with the public cloud service. The public cloud service transmits a confirmation of the binding to the personal cloud device.

Upon receiving the confirmation, the personal cloud device stores a binding between the user's public cloud user account and the user's personal cloud user account. The binding is stored at a data repository associated with the personal cloud device. Hence, the public cloud account and the personal cloud account are bound together.

One or more embodiments include exporting a content item associated with a personal cloud user account to a public cloud user account based on a binding between the two accounts. Exportation includes making a user's personal cloud content item accessible to the user's public cloud user account. A personal cloud device receives a request to export a content item that is associated with a user's personal cloud user account. The personal cloud device accesses a binding list. Based on the binding list, the personal cloud device verifies that a binding exists between the user's personal cloud user account and a particular public cloud user account. The particular public cloud user account is associated with the same user. The personal cloud device transmits, to the public cloud service, information indicating that the content item is approved for exporting to the user's public cloud user account. Once the content item is exported, the user may view and/or access the content item from the user's public cloud user account.

One or more embodiments include sharing a content item associated with a personal cloud user account using a public cloud user account based on a binding between the two accounts. Sharing includes making a user's personal cloud content item accessible to a public cloud user account of another user. A personal cloud device receives a request to share a content item that is associated with a personal cloud user account of an originating user. The request indicates that the content item should be shared with a public cloud user account of a recipient user. The personal cloud device accesses a binding list. Based on the binding list, the personal cloud device determines that a binding exists between the originating user's personal cloud user account and a particular public cloud user account. The particular public cloud user account is associated with the same originating user. The personal cloud device transmits, to the public cloud service, a request to use the originating user's public cloud user account to share the content item with the recipient user's public cloud user account. The public cloud device confirms that the content item has been exported to the originating user's public cloud account. The public cloud device makes the content item accessible to the recipient user's public cloud account. The recipient user may then receive a notification that the content item has been shared from the originating user's public cloud user account. The recipient user may view and/or access the content item from the recipient user's public cloud user account.

<FIG> illustrates a hybrid cloud system, in accordance with one or more embodiments. As illustrated in <FIG>, a system <NUM> includes a public cloud service <NUM>, one or more client devices 108a-c, and one or more personal cloud devices 110a-c. In one or more embodiments, the system <NUM> may include more or fewer components than the components illustrated in <FIG>. The components illustrated in <FIG> may be local to or remote from each other. The components illustrated in <FIG> may be implemented in software and/or hardware. Each component may be distributed over multiple applications and/or machines. Multiple components may be combined into one application and/or machine. Operations described with respect to one component may instead be performed by another component.

In one or more embodiments, a public cloud service <NUM> is a cloud environment used by one or more entities (also referred to herein as "tenants"). A tenant may be, for example, a corporation, organization, enterprise, person, or other entity. Tenants are independent of each other. Businesses or operations of tenants are separate from each other.

Tenants of a public cloud service <NUM> may be but are not necessarily involved in managing the hardware, software, and other supporting infrastructure of the public cloud service <NUM>. Rather, a public cloud service provider manages the hardware, software, and other supporting infrastructure of the public cloud service <NUM>. The public cloud service provider may implement tenant isolation techniques. Tenant isolation may involve: ensuring that a tenant can access only the tenant's own data (and not the data of other tenants), ensuring that data of different tenants do not interact with each other, and/or minimizing the effect of one tenant's resource requests on another tenant's quality of service. (Where the public cloud service <NUM> is used in conjunction with one or more person cloud devices to provide a hybrid cloud environment, the public cloud service provider may be referred to as a "hybrid cloud service provider.

A public cloud service <NUM> includes a public cloud manager <NUM> and a data repository <NUM>. Further details regarding a public cloud service <NUM> are described below with reference to <FIG>.

In one or more embodiments, a personal cloud device (such as any of personal cloud devices 110a-c) provides a personal cloud to a single entity (or a single group of related entities). The entity itself manages the hardware, software, and other supporting infrastructure of the personal cloud device. Further details regarding a personal cloud device are described below with reference to <FIG>.

In one or more embodiments, a public cloud service <NUM> and one or more personal cloud devices (such as any of personal cloud devices 110a-c) together provide a hybrid cloud environment. An entity is both (a) a tenant of the public cloud service <NUM> and (b) an owner, manager, and/or user of a personal cloud device. Data associated with the entity may be stored at the public cloud service <NUM> and/or the personal cloud device.

Additional embodiments and/or examples relating to computer networks are described below in Section <NUM>, titled "Computer Networks and Cloud Networks.

In one or more embodiments, a client device (such as any of client devices 108a-c) requests services from a public cloud service <NUM> and/or a personal cloud device (such as any of personal cloud devices 110a-c).

A client device that is associated with a tenant of a public cloud service <NUM> may access the public cloud service <NUM>. The client device may include hardware and/or software managed by the tenant. Additionally or alternatively, the client device may be used by a person associated with the tenant (such as an employee of the tenant, or a registered user of a product or service of the tenant).

A client device that is associated with an entity managing a personal cloud device may access the personal cloud device. The client device may include hardware and/or software managed by the entity. Additionally or alternatively, the client device may be used by a person associated with the entity (such as an employee of the entity, or a family member of the entity).

As an example, client device 108a may execute an application associated with a tenant of public cloud service <NUM>. Client device 108b may execute an application associated with another tenant of public cloud service <NUM>. Client device 108c may execute an application associated with another tenant of public cloud service <NUM>. Hence, as illustrated, each of client devices 108a-c may access public cloud service <NUM>.

Continuing the example, Daddy Joe may manage personal cloud device 110a. Daddy Joe may grant Little Johnny (who is Daddy Joe's son) access to personal cloud device 110a. Meanwhile Little Johnny may manage personal cloud device 110b. Justin may manage personal cloud device 110c.

Since Daddy Joe is the administrator of personal cloud device 110a, client device 108a of Daddy Joe may access personal cloud device 110a. Further, since Daddy Joe has granted access to Little Johnny, client device 108b of Little Johnny may access personal cloud device 110a. Client device 108c of Justin cannot access personal cloud device 110a.

Since Little Johnny is the administrator of personal cloud device 110b, client device 108b of Little Johnny may access personal cloud device 110b. Client devices 108a and 108c cannot access personal cloud device 110b.

Since Justin is the administrator of personal cloud device 110c, client device 108c of Justin may access personal cloud device 110c. Client devices 108a-b cannot access personal cloud device 110c.

Hence, as illustrated, client devices 108a-b may access personal cloud device 110a. Client device 108b may access personal cloud device 110b. Client device 108c may access personal cloud device 110c.

In one or more embodiments, a client device executes an interface for interacting with both the public cloud service <NUM> and/or the personal cloud device. The client device may request storage of a content item at the public cloud service <NUM> and/or the personal cloud device. The client device may request retrieval of a content item from the public cloud service <NUM> and/or the personal cloud device. A content item stored on a data repository associated with a public cloud service <NUM> may be referred to herein as a "public cloud content item. " A content item stored on a data repository associated with a personal cloud device may be referred to herein as a "personal cloud content item.

<FIG> illustrates a public cloud manager and a data repository of a public cloud service, in accordance with one or more embodiments. Labels of the same number across <FIG> refer to similar components.

In one or more embodiments, a data repository <NUM> is any type of storage unit and/or device (e.g., a file system, database, collection of tables, or any other storage mechanism) for storing data. Further, a data repository <NUM> may include multiple different storage units and/or devices. The multiple different storage units and/or devices may or may not be of the same type or located at the same physical site. Further, a data repository <NUM> may be implemented or executed on the same computing system as a public cloud manager <NUM>. Alternatively or additionally, a data repository <NUM> may be implemented or executed on a computing system separate from a public cloud manager <NUM>. The data repository <NUM> may be communicatively coupled to the public cloud manager <NUM> via a direct connection or via a network.

In one or more embodiments, a data repository <NUM>, associated with a public cloud service <NUM>, stores one or more public cloud content items <NUM>. A public cloud content item <NUM> is a content item associated with a tenant of the public cloud service <NUM>.

In one or more embodiments, a public cloud manager <NUM> refers to hardware and/or software configured to manage a public cloud service <NUM>. The public cloud manager <NUM> manages one or more public cloud user accounts 112a-b, a pre-approval list <NUM>, and a binding list <NUM>.

In one or more embodiments, a public cloud user account (such as any of public cloud user accounts 112a-b) is a user account that a user logs into in order to request services of a public cloud service <NUM>. Each public cloud user account (also referred to herein as a "public cloud account") is associated with a unique identifier (such as a username). A user may enter a username and a key to login to the user's public cloud user account.

Each public cloud user account may be associated with one or more public cloud content item identifiers (IDs), one or more exported personal cloud content item IDs, and one or more shared content item IDs. As illustrated, public cloud account 112a is associated with public cloud content item IDs 114a, exported personal cloud content item IDs 116a, and shared content item IDs 118a. Public cloud account 112b is associated with public cloud content item IDs 114b, exported personal cloud content item IDs 116b, and shared content item IDs 118b.

Content item IDs associated with a particular public cloud user account identify content items that are accessible to the particular public cloud user account. As an example, a user logged into public cloud account 112a may access any content item(s) identified by public cloud content item IDs 114a, exported personal cloud content item IDs 116a, and/or shared content item IDs 118a.

A public cloud content item ID, associated with a particular public cloud user account, identifies a public cloud content item <NUM> that (a) is stored on a data repository <NUM> associated with a public cloud service <NUM> and (b) is owned and/or managed by the particular public cloud user account. As an example, Mary may upload a photo to a public cloud service. The photo, stored on the public cloud service, may be associated with a public cloud content item ID, ID #PUB123. Mary's public cloud user account may be updated to indicate an association with ID #PUB123.

An exported cloud content item ID, associated with a particular public cloud user account, identifies a personal cloud content item that (a) is stored on a data repository associated with a personal cloud device (such as any of personal cloud devices 110a-c) and (b) has been exported to the particular public cloud user account. As an example, Mary may store a photo on a personal cloud device. The photo, stored on the personal cloud device, may be associated with a personal cloud content item ID, ID #PER456. Mary may export the photo to Mary's own public cloud user account. Mary's public cloud user account is stored in association with ID #PER456. Further details regarding exportation are described below with reference to <FIG>.

A shared content item ID, associated with a particular public cloud user account, identifies a content item that has been shared from another public cloud user account. As an example, shared content item ID 118a, associated with public cloud account 112a, may be associated with a content item that has been shared from public cloud account 112b. The shared content item may be a public cloud content item <NUM> stored on a data repository <NUM> associated with a public cloud service <NUM>. Alternatively, the shared content item may be a personal cloud content item stored on a data repository associated with a personal cloud device (such as any of personal cloud devices 110a-c). Further details regarding sharing are described below with reference to <FIG>.

In one or more embodiments, a pre-approval list <NUM> identifies which public cloud user accounts 112a-b and which personal cloud user accounts 126a-b are approved for binding with each other. A pre-approval list <NUM> may identify a personal cloud user account by using (a) an identifier of the personal cloud user account and (b) an identifier of the personal cloud device associated with the personal cloud user account. A pre-approval list <NUM> may be stored in any data structure, which may be but is not necessarily a list.

As an example, John's personal cloud device may be associated with a unique identifier, ID #<NUM>. John's personal cloud device may be associated with two personal cloud user accounts. One account may have the username "JohnMe" for John himself. Another account may have the username "Daddy" for John's father.

Continuing the example, Mary's personal cloud device may be associated with a unique identifier, ID #<NUM>. Mary's personal cloud device may be associated with two personal cloud user accounts. One account may have the username "IAmMary" for Mary himself. Another account may have the username "Daddy" for Mary's father.

Continuing the example, John, John's father, Mary, and Mary's father may each utilize a public cloud service. John's public cloud user account may have the username "John. " John's father's public cloud user account may have the username "David. " Mary's public cloud user account may have the username "Mary123. " Mary's father's public cloud user account may have the username "Frank.

Continuing the example, a pre-approval list, associated with a public cloud service, may indicate the following:.

In the above example, the pre-approval list indicates that the public cloud account "David. Smith" and the personal cloud account "Daddy" on personal cloud device ID #<NUM> are approved to be bound together. The pre-approval list further indicates that the public cloud account "Frank. Ho" and the personal cloud account "Daddy" on personal cloud device ID #<NUM> are approved to be bound together.

In one or more embodiments, a binding list <NUM> identifies which public cloud user accounts 112a-b and which personal cloud user accounts 126a-b are bound together. A binding list <NUM> may identify a personal cloud user account by using (a) an identifier of the personal cloud user account and (b) an identifier of the personal cloud device associated with the personal cloud user account. A binding list <NUM> may be stored in any data structure, which may be but is not necessarily a list.

In one or more embodiments, a pre-approval list <NUM> is generated and/or updated based on an approval for binding provided by an administrator of a personal cloud device. In contrast, a binding list <NUM> is generated and/or updated based on a request for binding submitted from a user who would like to bind the user's personal cloud account and the user's public cloud account. The binding between the two accounts is generated and stored in the binding list <NUM>, if the binding has been approved as indicated in the pre-approval list <NUM>.

In one or more embodiments, a public cloud manager <NUM> is configured to perform operations described herein for binding a public cloud user account and a personal cloud user account, exporting a content item, and/or sharing a content item. Examples of operations for binding a public cloud user account and a personal cloud user account, exporting a content item, and/or sharing a content item are described below with reference to <FIG>.

<FIG> illustrates a personal cloud device, in accordance with one or more embodiments. Labels of the same number across <FIG> refer to similar components.

In one or more embodiments, a personal cloud device <NUM> is associated with a data repository that stores one or more personal cloud content items <NUM>. A personal cloud device <NUM> and an associated data repository may be implemented or executed on the same computing system. Alternatively or additionally, a personal cloud device <NUM> and an associated data repository may be implemented or executed on separate computing systems.

In one or more embodiments, a personal cloud device <NUM> manages one or more personal cloud user accounts 126a-b, a pre-approval list <NUM>, and a binding list <NUM>.

In one or more embodiments, a personal cloud user account (such as any of personal cloud user accounts 126a-b) is a user account that a user logs into in order to request services of a personal cloud device <NUM>. Each personal cloud user account (also referred to herein as a "personal cloud account") of a personal cloud device <NUM> is associated with an identifier (such as a username) that is unique for the personal cloud device <NUM>. However, personal cloud user accounts of different personal cloud device may have the same identifiers. A user may enter a username and a key to login to the user's personal cloud user account.

In one or more embodiments, personal cloud user accounts 126a-b of a personal cloud device <NUM> are maintained by one or more administrators (users of the personal device <NUM> with special privileges). In an embodiment, an administrator sets up each personal cloud user account, including for example providing a username and/or key for each personal cloud user account. In another embodiment, a user may request a personal cloud user account. The administrator may determine whether to approve the request. Upon approval, the user may be permitted to set up a username and/or key for the user's personal cloud user account. Information associated with personal cloud user accounts 126a-b of a personal cloud device <NUM> (such as, usernames, identifiers, keys, profiles) is stored on a data repository associated with the personal cloud device <NUM>.

Each personal cloud user account is associated with one or more personal cloud content item IDs. As illustrated, personal cloud account 126a is associated with personal cloud content item IDs 128a. Personal cloud account 126b is associated with personal cloud content item IDs 128b.

A personal cloud content item ID, associated with a particular personal cloud user account, identifies a personal cloud content item <NUM> that (a) is stored on a data repository associated with a personal cloud device <NUM> and (b) is owned by, managed by, and/or otherwise accessible to the particular personal cloud user account. As an example, Mary may store a photo on a personal cloud device. The photo, stored on the personal cloud device, may be associated with a personal cloud content item ID, ID #PER456. Mary's personal cloud user account may be updated to indicate an association with ID #PER456.

In one or more embodiments, a pre-approval list <NUM> is similar to the pre-approval list <NUM> described above with reference to <FIG>. The pre-approval list <NUM> is stored on a data repository associated with a personal cloud device <NUM>, whereas the pre-approval list <NUM> is stored on a data repository associated with a public cloud service <NUM>. The personal cloud device <NUM> may access the pre-approval list <NUM> (rather than the pre-approval list <NUM>) to perform verifications. The public cloud service <NUM> may access the pre-approval list <NUM> (rather than the pre-approval list <NUM>) to perform verifications. A binding is generated only if approval for the binding is verified by both sides (the personal cloud device <NUM> and the public cloud service <NUM>).

In one or more embodiments, a binding list <NUM> is similar to the binding list <NUM> described above with reference to <FIG>. The binding list <NUM> is stored on a data repository associated with a personal cloud device <NUM>, whereas the binding list <NUM> is stored on a data repository associated with a public cloud service <NUM>. The personal cloud device <NUM> may access the binding list <NUM> (rather than the binding list <NUM>) to perform verifications. The public cloud service <NUM> may access the binding list <NUM> (rather than the binding list <NUM>) to perform verifications. Certain actions (such as exportation, or sharing) associated with a public cloud account and a personal cloud account are taken only if binding of the two accounts is verified by both sides (the personal cloud device <NUM> and the public cloud service <NUM>).

In an embodiment, a public cloud manager <NUM>, a personal cloud device <NUM>, and/or a client device is implemented on one or more digital devices. The term "digital device" generally refers to any hardware device that includes a processor. A digital device may refer to a physical device executing an application or a virtual machine. Examples of digital devices include a computer, a tablet, a laptop, a desktop, a netbook, a server, a web server, a network policy server, a proxy server, a generic machine, a function-specific hardware device, a mainframe, a television, a content receiver, a set-top box, a printer, a mobile handset, a smartphone, and/or a personal digital assistant (PDA).

<FIG> illustrates an example set of operations for manually binding a public cloud user account and a personal cloud user account, in accordance with one or more embodiments. One or more operations illustrated in <FIG> may be modified, rearranged, or omitted all together. Accordingly, the particular sequence of operations illustrated in <FIG> should not be construed as limiting the scope of one or more embodiments.

Client device <NUM> is similar to any of client devices 108a-c of <FIG>. Public cloud service <NUM> is similar public cloud service <NUM> of <FIG>. Personal cloud device <NUM> is similar to any of personal cloud devices 110a-c of <FIG>.

In one or more embodiments, a client device <NUM> creates a secure connection with a personal cloud device <NUM> (Operation <NUM>). Depending on the personal cloud device <NUM>, creating a secure connection may involve a process that is complex and/or tedious for a user of the client device <NUM> and/or an administrator of the personal cloud device <NUM>. As an example, an administrator of a personal cloud device <NUM> may need to modify firewall settings to allow a user's client device <NUM> to access the personal cloud device <NUM>. Further, the user may need to provide certain configurations for the client device <NUM> in order to overcome the firewall associated with the personal cloud device <NUM>. As another example, an administrator of a personal cloud device <NUM> may need to specify a particular port for a user's client device <NUM> to access the personal cloud device <NUM>. Further, the user may need to configure the client device <NUM> to communicate with the particular port of the personal cloud device <NUM>.

In one or more embodiments, a client device <NUM> logs into a personal cloud account associated with the personal cloud device <NUM> (Operation <NUM>). The client device <NUM> presents a prompt on a user interface, requesting a username (or other identifier) of a personal cloud account. The client device <NUM> may also request a key for logging into the personal cloud account. The client device <NUM> receives the username and key through the user interface. The client device <NUM> transmits the information to the personal cloud device <NUM>. The personal cloud device <NUM> verifies the received information against the personal cloud user account information stored on a data repository associated with the personal cloud device <NUM>. If the personal cloud device <NUM> determines that the key provided for the personal cloud account is correct, the personal cloud device <NUM> allows the user to log into the personal cloud account. The client device <NUM> may receive a confirmation that the personal cloud account has been logged in.

In one or more embodiments, the client device <NUM> transmits a request to bind to a particular public cloud account (Operation <NUM>). The client device receives user input indicating a username (or other identifier) of a public cloud account, associated with a public cloud service <NUM>, to be bound to the personal cloud account. In response to the user input, the client device <NUM> transmits a request to bind the personal cloud account to the public cloud account. The request is transmitted to the personal cloud device <NUM>.

In one or more embodiments, the client device <NUM> transmits a key for the public cloud account (Operation <NUM>). The client device <NUM> also receives user input indicating a key for logging into the public cloud account. The client device <NUM> transmits the key for the public cloud account to the personal cloud device <NUM>.

In one or more embodiments, the personal cloud device <NUM> transmits a request to bind the personal cloud account and the public cloud account (Operation <NUM>). The request includes the key for the public cloud account.

In one or more embodiments, the public cloud service <NUM> verifies the key for the public cloud account (Operation <NUM>). Responsive to verifying that the key is correct, the public cloud service <NUM> stores a binding between the personal cloud account and the public cloud account (Operation <NUM>). Information indicating the binding between the personal cloud account and the public cloud account is stored on a data repository associated with the public cloud service <NUM>. The information indicating the binding may be stored in a binding list, such as binding list <NUM> of <FIG>. The information stored may include (a) the username of the personal cloud account, (b) an identifier of the personal cloud device <NUM>, and (c) the username of the public cloud account.

In one or more embodiments, the public cloud service <NUM> transmits a confirmation of the binding to the personal cloud device <NUM> (Operation <NUM>). Responsive to receiving the confirmation, the personal cloud device <NUM> stores a binding between the personal cloud account and the public cloud account (Operation <NUM>). The binding is stored on a data repository associated with the personal cloud device <NUM>. Information indicating the binding between the personal cloud account and the public cloud account may be stored in a binding list, such as binding list <NUM> of <FIG>. The information stored may include (a) the username of the personal cloud account, and (b) the username of the public cloud account. Once information indicating the binding is stored on both the personal cloud device <NUM> and the public cloud service <NUM>, the binding between the public cloud account and the personal cloud account is generated.

Based on the operations of <FIG>, a binding between a public cloud account and a personal cloud account is generated without the use of a pre-approval list. A user of a client device <NUM> needs to (a) configure the client device <NUM> to connect with the personal cloud device <NUM>, (b) input the personal cloud account username and key, and (c) input the public cloud account username and key.

<FIG> illustrates an example set of operations for binding a public cloud user account and a personal cloud user account based on a pre-approval, in accordance with one or more embodiments. One or more operations illustrated in <FIG> may be modified, rearranged, or omitted all together. Accordingly, the particular sequence of operations illustrated in <FIG> should not be construed as limiting the scope of one or more embodiments.

Prior to the performance of the operations of <FIG>, a pre-approval list is generated. An administrator of a personal cloud device <NUM> may enter a pre-approval list using an interface associated with the personal cloud device <NUM>. The administrator logs into the personal cloud device <NUM>. The administrator enters information allowing a personal cloud account to be created for a particular user. Additionally, the administrator enters information allowing a binding to be generated between the personal cloud account and a particular public cloud account. The administrator may identify the public cloud account by the username (or other identifier) associated with the public cloud account. The personal cloud device <NUM> stores a copy of the pre-approval list on a data repository associated with the personal cloud device <NUM>. Additionally, the personal cloud device <NUM> transmits the pre-approval list to a public cloud service <NUM>. The public cloud service <NUM> stores a separate copy of the pre-approval list on a data repository associated with the public cloud service <NUM>. Optionally, the public cloud service <NUM> may merge information indicated in pre-approval lists of multiple different personal cloud devices into one pre-approval list that is maintained by the public cloud service <NUM>. Optionally, the personal cloud device <NUM> may transmit a notification (such as an email) to the particular user to inform him that his personal cloud account and public cloud account have been pre-approved for binding.

In one or more embodiments, a client device <NUM> logs into a public cloud account of a public cloud service <NUM> (Operation <NUM>). The client device <NUM> presents a prompt on a user interface, requesting a username (or other identifier) of a public cloud account. The client device <NUM> may also request a key for logging into the public cloud account. The user interface may be, for example, a web interface for accessing the public cloud service <NUM>. The client device <NUM> receives the username and key through the user interface. The client device <NUM> transmits the information to the public cloud service <NUM>. The public cloud service <NUM> verifies the information and allows the user to log into the public cloud account. The client device <NUM> may receive a confirmation that the public cloud account has been logged into.

In one or more embodiments, the public cloud service <NUM> determines that the public cloud account is pre-approved to bind to a particular personal cloud account (Operation <NUM>). The public cloud service <NUM> obtains a pre-approval list from a data repository associated with the public cloud service <NUM>. The pre-approval list may be, for example, the pre-approval list <NUM> of <FIG>. The public cloud service <NUM> performs a lookup on the pre-approval list using the username of the public cloud account. The public cloud service <NUM> finds an entry in the pre-approval list associated with the username of the public cloud account. The entry in the pre-approval list includes (a) the username of the public cloud account, (b) a username (or other identifier) of a personal cloud account, and (c) an identifier of a personal cloud device <NUM>. Based on the above information, the public cloud service <NUM> determines that the public cloud account is pre-approved to bind to the personal cloud account associated with the personal cloud device <NUM>.

In one or more embodiments, the public cloud service <NUM> generates a temporary credential (Operation <NUM>). The public cloud service <NUM> may generate the temporary credential by any means, for example, by using a random number generator and/or a pseudo-random number generator. The public cloud service <NUM> stores the temporary credential on a data repository associated with the public cloud service <NUM>.

In one or more embodiments, the public cloud service <NUM> transmits the personal cloud account identifier and the temporary credential to the client device <NUM> (Operation <NUM>). The personal cloud account identifier includes (a) the username of the personal cloud account and (b) an identifier of the personal cloud device <NUM>.

In one or more embodiments, the client device <NUM> presents, on a user interface, a request for a key for logging into the personal cloud account (Operation <NUM>). This is an optional operation performed in the process of binding the personal cloud account and the public cloud account. The client device <NUM> may present the username of the personal cloud account on the user interface. The client device <NUM> may present a textbox configured to receive a key for logging into the personal cloud account. The client device <NUM> receives the key as user input through the user interface.

In an embodiment, the user interface of the client device <NUM> requests a new key, selected and/or chosen by the user himself, for logging into the personal cloud account. Since the user is already authenticated by means of being logged into the public cloud account, the client device <NUM> provides the user the ability to create the key to the user's personal cloud account. The user may subsequently use the same key for logging into the user's personal cloud account. Hence, the user may perform two actions, (a) the creation of a password for the personal cloud account and (b) the binding of the personal cloud account to the public cloud account, in a single interaction process with the client device <NUM>.

In an embodiment, the user interface of the client device <NUM> requests an existing key for logging into the personal cloud account. As an example, the existing key may be previously set by the administrator of the personal cloud device. The existing key may be communicated from the administrator to the user using any means, such as, email, text messaging, or orally by telephone. As another example, the existing key may be previously set by the user himself. The user may set the key to the user's personal cloud account through a direct interface to the personal cloud device. The existing key may be used as an additional piece of information (in addition to the temporary credential) for the personal cloud device <NUM> to authenticate the user.

In one or more embodiments, the client device <NUM> creates a secure connection with the personal cloud device <NUM> via the public cloud service <NUM> (Operation <NUM>). The connection between the client device <NUM> and the personal cloud device <NUM> may be a "direct connection" or a "tunnel connection.

In an embodiment, the public cloud service <NUM> facilitates the establishment of a direct connection between the client device <NUM> and the personal cloud device <NUM>. The client device <NUM> transmits a request to the public cloud service <NUM> to establish a direct connection with the personal cloud device <NUM>. The public cloud service <NUM> transmits information to the client device <NUM> and the personal cloud device <NUM> to be used for establishing the connection.

The information transmitted from the public cloud service <NUM> may include, for example, configuration information to configure the client device <NUM> to connect with the personal cloud device <NUM>. Configuration information may include, for example, an address of the personal cloud device <NUM>, a port of the personal cloud device <NUM> used for communicating with the client device <NUM>, and/or a protocol used by the personal cloud device <NUM>.

Further, the information transmitted from the public cloud service <NUM> may include, for example, an authentication token. The personal cloud device <NUM> may authenticate the client device <NUM> by verifying that the client device <NUM> possesses an authentication token matching the authentication token that the personal cloud device <NUM> received from the public cloud service <NUM>. Hence, an authenticated direct connection is established between the client device <NUM> and the personal cloud device <NUM>.

In an embodiment, the public cloud service <NUM> serves to tunnel communications between the client device <NUM> and the personal cloud device <NUM>. The public cloud service <NUM> maintains a persistent connection with the personal cloud device <NUM>. Communications may be delivered from the client device <NUM> to the personal cloud device <NUM> using (a) a direct connection between the client device <NUM> and the public cloud service <NUM> and (b) the persistent connection between the public cloud service <NUM> and the personal cloud device <NUM>.

In one or more embodiments, the client device <NUM> transmits a request to bind the public cloud account and the personal cloud account (Operation <NUM>). Based on the identifier of the personal cloud device <NUM> received at Operation <NUM>, the client device <NUM> identifies the personal cloud device <NUM> as the recipient of the request to bind. The request to bind is transmitted using the direct connection or the tunnel connection between the client device <NUM> and the personal cloud device <NUM>, as described above with reference to Operation <NUM>. The request to bind includes the temporary credential received from the public cloud service <NUM> at Operation <NUM>. Optionally, the request to bind further includes the key for logging into the personal cloud account received through the user interface at Operation <NUM>.

In one or more embodiments, the personal cloud device <NUM> verifies pre-approval for binding the public cloud account to the personal cloud account (Operation <NUM>).

The personal cloud device <NUM> obtains a pre-approval list stored on a data repository associated with the personal cloud device <NUM>. The pre-approval list may be, for example, the pre-approval list <NUM> of <FIG>. The personal cloud device <NUM> performs a lookup on the pre-approval list to find an entry associated with the username of the public cloud account and the username of the personal cloud account. Upon finding the entry, the personal cloud device <NUM> verifies that the public cloud account is pre-approved to bind to the personal cloud account associated with the personal cloud device <NUM>.

In an embodiment, the client device <NUM> received an existing key for the user's personal cloud account at Operation <NUM>. The personal cloud device <NUM> obtains personal cloud user account information stored on a data repository associated with the personal cloud device <NUM>. The stored personal cloud user account information includes pairs of usernames and keys. Based on the stored personal cloud account information, the personal cloud device <NUM> determines a key for the personal cloud account. The personal cloud device <NUM> verifies whether the key for the personal cloud account matches the key received from the client device <NUM> (which was received as user input). Based on a match between the two keys, the personal cloud device <NUM> verifies that the key received from the client device <NUM> is correct.

In an embodiment, the client device <NUM> received a new key for the user's personal cloud account at Operation <NUM>. The personal cloud device <NUM> stores the key in association with the user's personal cloud account, such that the user may subsequently use the key for logging into the personal cloud account. Further description regarding storing the new key is included below with respect to Operation <NUM>.

In one or more embodiments, the personal cloud device <NUM> transmits, to the public cloud service <NUM>, (a) a verification of the pre-approval and (b) the temporary credential received from the client device <NUM> (Operation <NUM>). The verification of the pre-approval indicates that the pre-approval list associated with the personal cloud device <NUM> indicates that the personal cloud account and the public cloud account are approved for binding with each other. The temporary credential is used to determine whether the personal cloud device <NUM> received the request to bind from the client device <NUM>.

In one or more embodiments, the public cloud service <NUM> verifies whether the temporary credential received from the personal cloud device <NUM> at Operation <NUM> matches the temporary credential generated by the public cloud service <NUM> at Operation <NUM> (Operation <NUM>). Responsive to determining a match between the temporary credentials, the public cloud service <NUM> stores a binding between the public cloud account and the personal cloud account (Operation <NUM>). Example steps for storing a binding between a public cloud account and a personal cloud account on a data repository associated with a public cloud service are described above with reference to Operation <NUM>.

In one or more embodiments, the public cloud service <NUM> transmits a confirmation of the binding to the personal cloud device <NUM> (Operation <NUM>). Responsive to receiving the confirmation, the personal cloud device <NUM> stores a binding between the personal cloud account and the public cloud account (Operation <NUM>). Example steps for storing a binding between a public cloud account and a personal cloud account on a data repository associated with a personal cloud device are described above with reference to Operation <NUM>.

In an embodiment, the client device <NUM> received a new key for the user's personal cloud account at Operation <NUM>. The personal cloud device <NUM> stores the key in association with the user's personal cloud account, such that the user may subsequently use the key for logging into the personal cloud account. As an example, a data repository associated with a personal cloud device <NUM> may store pairs of usernames and keys. As part of the binding process, the personal cloud device <NUM> may receive a new key for a personal cloud account. The personal cloud device <NUM> may store the new key in association with the username of the user's personal cloud account.

Based on operations of <FIG>, a binding between a public cloud account and a personal cloud account is generated based on a pre-approval list. Criteria for generating the binding include (a) the public cloud service determining that the public cloud user account and the personal cloud user account are approved to be bound based on a pre-approval list stored on the public cloud service, and (b) the personal cloud device determining that the public cloud user account and the personal cloud user account are approved to be bound based on a pre-approval list stored on the personal cloud device.

A user of a client device <NUM> need not configure the client device <NUM> to connect with the personal cloud device <NUM>. Rather, the public cloud service <NUM> facilitates the establishment of a direct connection or a tunnel connection between the client device <NUM> and the personal cloud device <NUM>. Further, the user of the client device <NUM> need not input the personal cloud account username. After logging into the public cloud account, the public cloud service <NUM> performs a lookup on a pre-approval list to determine that the public cloud account is pre-approved to bind to the personal cloud account. The public cloud service <NUM> thereby identifies the personal cloud account to be bound to the public cloud account, without the user specifying the personal cloud account.

<FIG> illustrates an example set of operations for exporting a content item associated with a personal cloud user account to a public cloud user account based on a binding between the two accounts, in accordance with one or more embodiments. One or more operations illustrated in <FIG> may be modified, rearranged, or omitted all together. Accordingly, the particular sequence of operations illustrated in <FIG> should not be construed as limiting the scope of one or more embodiments. <FIG> illustrates an example for exporting a content item. Additional and/or alternative ways of exporting a content item based on a binding between a public cloud user account and a personal cloud user account may be used.

In one or more embodiments, a user logs into a personal cloud account associated with a personal cloud device <NUM> (Operation <NUM>). An interface for the personal cloud device <NUM> presents a prompt requesting a username (or other identifier) of a personal cloud account. The interface for the personal cloud device also requests a key for logging into the personal cloud account. The interface receives the username and key. The personal cloud device <NUM> verifies the information and allows the user to log into the personal cloud account.

In alternative embodiments, a user may log into the personal cloud account using alternative means. As an example, a user may use a client device <NUM> to log into the personal cloud account.

In one or more embodiments, the personal cloud device <NUM> receives a request to export a personal cloud content item (such as Folder X) to a public cloud account (Operation <NUM>). The interface for the personal cloud device <NUM> receives user input indicating a request to export Folder X.

In alternative embodiments, a user may submit a request to export the content item using alternative means. As an example, a user may use a client device <NUM> to enter and submit a request to export a personal cloud content item.

In one or more embodiments, the personal cloud device <NUM> determines whether there is a binding between the personal cloud account and any public cloud account (Operation <NUM>). The personal cloud device <NUM> obtains a binding list from a data repository associated with the personal cloud device <NUM>. The binding list may be, for example, the binding list <NUM> of <FIG>. The personal cloud device <NUM> performs a lookup on the binding list using the username of the personal cloud account. The personal cloud device <NUM> finds an entry in the binding list associated with the username of the personal cloud account. The entry in the binding list includes (a) the username of the personal cloud account and (b) a username of a public cloud account. Based on the above information, the personal cloud device <NUM> determines that the personal cloud account is bound to the public cloud account.

In one or more embodiments, the personal cloud device <NUM> transmits a request to export Folder X to the public cloud account (Operation <NUM>). The request is transmitted to the public cloud service <NUM>. The request includes the username of the personal cloud account and the username of the public cloud account.

In one or more embodiments, the public cloud service <NUM> verifies the binding between the personal cloud account and the public cloud account (Operation <NUM>). The public cloud service <NUM> obtains a binding list from a data repository associated with the public cloud service <NUM>. The binding list may be, for example, binding list <NUM> of <FIG>. The public cloud service <NUM> performs a lookup on the binding list. The public cloud service <NUM> finds an entry in the binding list including (a) the username of the personal cloud account and (b) the username of the public cloud account. The public cloud service <NUM> verifies that the personal cloud account is bound to the public cloud account.

In one or more embodiments, the public cloud service <NUM> classifies Folder X as an exported content item (Operation <NUM>). The public cloud service <NUM> stores an association between the public cloud account and the content item ID of Folder X. The content item ID of Folder X may be stored as an "exported content item ID" associated with the public cloud account. The public cloud service <NUM> may store a pointer (or other reference) to the storage location of Folder X, the storage location being within a data repository associated with the personal cloud device <NUM>. Hence, if a user requests to access Folder X using the public cloud account, the public cloud service <NUM> may access Folder X based on the storage location indicated by the pointer. The public cloud service <NUM> may but need not make a duplicate copy of Folder X (and the contents thereof) on a data repository associated with the public cloud service <NUM>.

In one or more embodiments, a client device <NUM> transmits a request for exported content items of the public cloud account (Operation <NUM>). A user logs into the public cloud account using the client device <NUM>. The user further submits a request for exported content items of the public cloud account. Responsive to receiving the request for exported content items from the user, the client device <NUM> transmits the request for exported content items to the public cloud service <NUM>.

In one or more embodiments, the public cloud service <NUM> transmits information identifying the exported content items, including Folder X, to the client device <NUM> (Operation <NUM>). The public cloud service <NUM> may transmit the names of the exported content items, the types of the exported content items (such as, folder or file, extension types), the sizes of the exported content items, the security levels of the exported content items (such as, read only, write permissions, sharing permissions), and/or other information.

In one or more embodiments, the client device <NUM> displays the exported content items, including Folder X, on a user interface (Operation <NUM>). The client device <NUM> may display the information received from the public cloud service <NUM>, such as the names of the exported content items, the types of the exported content items, the size of the exported content items, and/or the security levels of the exported content items.

Each icon associated with an exported content item may be hyperlinked to the exported content item. When a user of the client device <NUM> clicks on the icon, the client device <NUM> transmits a request to open and/or download the exported content item to the public cloud service <NUM>. The public cloud service <NUM> obtains the pointer to the exported content item. The public cloud service <NUM> obtains the exported content item from the storage location indicated by the pointer, the storage location being within a data repository associated with the personal cloud device <NUM>.

Based on the operations of <FIG>, a personal cloud content item associated with a personal cloud account is exported to a public cloud account only after verification of a binding by both the personal cloud device <NUM> and the public cloud service <NUM>. The personal cloud device <NUM> verifies the binding between the personal cloud account and the public cloud account based on a binding list stored on a data repository associated with the personal cloud device <NUM>. The public cloud service <NUM> verifies the binding between the personal cloud account and the public cloud account based on a binding list stored on a data repository associated with the public cloud service <NUM>. Hence, a binding between a public cloud account and a personal cloud account is a criterion for exporting a content item, that is stored in association with the personal cloud user account to the public cloud user account. After a personal cloud content item is exported to a public cloud account, a user may access the personal cloud content item using the public cloud account, without logging into the personal cloud account.

<FIG> illustrates an example set of operations for sharing a content item associated with a personal cloud user account using a public cloud user account based on a binding between the two accounts, in accordance with one or more embodiments. One or more operations illustrated in <FIG> may be modified, rearranged, or omitted all together. Accordingly, the particular sequence of operations illustrated in <FIG> should not be construed as limiting the scope of one or more embodiments.

In one or more embodiments, a client device <NUM> logs into a personal cloud account associated with a personal cloud device <NUM> (Operation <NUM>). Example steps for logging into a personal cloud account from a client device are described above with reference to Operation <NUM> of <FIG>.

In one or more embodiments, the client device <NUM> transmits a request to share a personal cloud content item (such as File Y) to a recipient public cloud account associated with a public cloud service <NUM> (Operation <NUM>). The client device <NUM> receives user input indicating a request to share File Y. The user input requests sharing File Y with a particular public cloud account (referred to herein as a "recipient public cloud account"). Responsive to receiving the user input, the client device <NUM> transmits the request to share File Y to the personal cloud device <NUM>.

In alternative embodiments, a user may submit a request to share the content item using alternative means. As an example, a user may use an interface of the personal cloud device (rather than the client device <NUM>) to enter and submit a request to share a personal cloud content item.

In one or more embodiments, the personal cloud device <NUM> determines whether there is a binding between the personal cloud account and any public cloud account (Operation <NUM>). Example steps for determining whether there is a binding are described above with reference to Operation <NUM> of <FIG>. Based on a binding list stored on a data repository associated with the personal cloud device, the personal cloud device <NUM> determines that the personal cloud account is bound to a particular public cloud account.

In one or more embodiments, the personal cloud device <NUM> transmits a request to share File Y (Operation <NUM>). The request to share specifies sharing File Y with the recipient public cloud account using the particular public cloud account. The request is transmitted to the public cloud service <NUM>.

In one or more embodiments, the public cloud service <NUM> determines whether File Y has been exported to the particular public cloud account (Operation <NUM>). The public cloud service <NUM> receives the request to share File Y using the particular public cloud account. The public cloud service <NUM> obtains exported content item IDs that have been stored in association with the particular public cloud account. The public cloud service <NUM> determines that the content item ID of File Y is one of the exported content item IDs associated with the particular public cloud account. Additionally or alternatively, the public cloud service <NUM> determines that File Y is within another content item (such as Folder X), and that the content item ID of Folder X is one of the exported content item IDs associated with the particular public cloud account. Therefore, the public cloud service <NUM> determines that File Y has been exported to the particular public cloud account.

In one or more embodiments, the public cloud service <NUM> makes File Y accessible to the recipient public cloud account (Operation <NUM>). The public cloud service <NUM> stores an association between the recipient public cloud account and the content item ID of File Y. The content item ID of File Y may be stored as a "shared content item ID" associated with the recipient public cloud account. The public cloud service <NUM> may store a pointer (or other reference) to the storage location of File Y, the storage location being within a data repository associated with the personal cloud device <NUM>. Hence, if a user requests to access File Y using the recipient public cloud account, the public cloud service <NUM> may access File Y based on the storage location indicated by the pointer. The public cloud service <NUM> may but need not make a duplicate copy of File Y on a data repository associated with the public cloud service <NUM>.

The public cloud service <NUM> may provide a notification to a user of the recipient public cloud account, indicating that File Y has been shared from the particular public cloud account. The public cloud service <NUM> need not provide a username of the personal cloud account associated with File Y to the recipient public cloud account.

A user of the recipient public cloud account may use a client device to log into the recipient public cloud account. The client device may present information indicating the content items that have been shared with the recipient public cloud account. The information presented may include information indicating that File Y has been shared from the particular public cloud account. The information presented need not include a username of the personal cloud account associated with File Y.

Based on the operations of <FIG>, a personal cloud content item associated with a personal cloud account of a particular user is shared from a public cloud user account of the particular user (also referred to as an "originating user"). The personal cloud content item is shared with a public cloud account of another user (also referred to as a "recipient user"). The sharing is performed only after (a) verifying that the personal cloud account and the public cloud account of the originating user are bound together and (b) verifying that the personal cloud content item has been exported to the public cloud account of the originating user. Hence, (a) a binding between an originating user's personal cloud account and public cloud account, and (b) exportation of a content item from the personal cloud account to the public cloud account, are criteria for sharing the content item using the originating user's public cloud user account. After a personal cloud content item is shared with a public cloud account of a recipient user, the recipient user may access the personal cloud content item using the recipient user's public cloud account. The recipient user need not be aware of the personal cloud account of the originating user.

Detailed examples are described below for purposes of clarity. Components and/or operations described below should be understood as specific examples which may not be applicable to certain embodiments. Accordingly, components and/or operations described below should not be construed as limiting the scope of any of the claims.

In an example, a hybrid cloud service includes (a) a public cloud service run by a hybrid cloud service provider, and (b) personal cloud devices owned by various users. The hybrid cloud service is accessed by various client devices.

An administrator and/or owner of a personal cloud device P desires to enable an additional user, John Smith, on the personal cloud device. The administrator proceeds to establish a new account, associated with the identifier bestie, for John. The administrator logs into the personal cloud device P. The administrator enters user input to pre-approve the following: (a) a user of a cloud user account, associated with the identifier john. smith@exampleemail. com, to be able to create a local user account, bestie, and (b) the user of the local user account, bestie, to be able to bind to the cloud user account, john. smith@exampleemail. com, for global access and sharing purposes.

The above requests result in: (a) creation of a record of a pre-approval for binding the cloud user account john. smith@exampleemail. com and the local user account bestie, and storage of the record on the personal cloud device P, and (b) creation of a record of a pre-approval for binding the cloud user account john. smith@exampleemail. com and the local user account bestie associated with the personal cloud device P, and storage of the record on the public cloud.

Optionally, the public cloud (or the personal cloud device) causes a notification (such as an email) to be sent to John (using, for example, the email address john. smith@exampleemail. com associated with the cloud user account).

Upon receipt of the notification, John uses a client application on John's client device (such as a smartphone or a laptop) to login to John's cloud user account, john. smith@exampleemail. (Alternatively, if John's cloud user account has not been created yet, John creates the cloud user account and then logs in.

The client application queries the public cloud service to determine whether there is a pre-approved binding between John's cloud user account, john. smith@exampleemail. com, and any local user account.

The client application receives information the public cloud service indicating that the local account account bestie, associated with the personal cloud device P, is awaiting completion of local user account setup, which includes binding to the cloud user account john. smith@exampleemail.

The client application connects to the personal cloud device P. The public cloud service facilitates the connection (either through a relay channel or a peer-to-peer connection).

The client application requests a temporary credential from the public cloud service for the purpose of validating that the holder of the temporary credential has the identity of the cloud user account john. smith@exampleemail.

The client application makes a request to the personal cloud device P (through the established connection, described above) to complete the setup of local user account bestie. The client application identifies itself as using the cloud user account, john. smith@exampleemail. com, and sending the temporary credential to the personal cloud device as proof of the client application's identity.

The personal cloud device confirms against the personal cloud device's own record that the local user account bestie is to be setup and bound to cloud user account john. smith@exampleemail. The personal cloud device further checks the temporary credential received from the client application against the record of the public cloud service to validate that the temporary credential is owned by the cloud user account john. smith@exampleemail.

Upon validating the temporary credential as owned by cloud user account john. smith@exampleemail. com, the personal cloud device performs the following: (a) accepts a new password information for local user account bestie, entered by John Smith through the client application, and (b) sends a final request to the public cloud service to confirm the binding of cloud user account john. smith@exampleemail. com to the local user account bestie of Personal Cloud Device P.

Then, each of the public cloud and the personal cloud device P record the information indicating the binding between the cloud user account john. smith@exampleemail. com and the local user account bestie of Personal Cloud Device P.

Optionally, additional operations for completing setup may be performed. For example, default folders of the local user account bestie may be exported to the cloud user account john. smith@exampleemail. A final notification may be sent to the administrator of the personal cloud device P, indicating that cloud user account john. smith@exampleemail. com has completed the setup and binding process for the local user account bestie.

<FIG> illustrate example user interfaces associated with a client device <NUM>, in accordance with one or more embodiments.

Referring to <FIG>, user interface <NUM> of client device <NUM> may be presented to a user who is logged into a public cloud user account, skyride35.

A user logs into a public cloud account, skyride35, for using a public cloud service. The public cloud service determines that the public cloud account, skyride35, is pre-approved to bind with a particular personal cloud account, daddy, for using a particular personal cloud device. The public cloud service transmits, to client device <NUM>, (a) an identifier of the personal cloud account, and (b) a temporary credential generated by the public cloud service. Based on the user's login to the public cloud account, the binding of the public cloud account and the personal cloud account may be completed without further user involvement.

Optionally, the client device <NUM> presents user interface <NUM> to request a new key for the personal cloud account. User interface <NUM> includes the public cloud account name <NUM>, skyride35. User interface <NUM> also includes the personal cloud account name <NUM>, daddy. User interface <NUM> also includes a textbox <NUM> configured to receive the new key for the personal cloud account, daddy. Optionally, the client device <NUM> transmits the new key to the personal cloud device (along with the request to bind, which is described below). The personal cloud device stores the new key in association with the personal cloud account, daddy, such that the user may subsequently use the same key for logging into the personal cloud account, daddy. Hence, the user may create a password for the personal cloud account, daddy, at the same time as conducting a binding process for the personal cloud account daddy and the public cloud account skyride35.

After receiving (a) the identifier of the personal cloud account and (b) the temporary credential, the client device <NUM> transmits a request to bind to the personal cloud device. The request to bind includes the temporary credential received from the public cloud service. The personal cloud device verifies that the public cloud account skyride35 and the personal cloud account daddy are pre-approved for binding. The personal cloud device transmits, to the public cloud service, (a) a verification of the pre-approval, and (b) the temporary credential received from the client device <NUM>.

The public cloud service verifies that the temporary credential received from the personal cloud device is correct. Upon verification, the public cloud service stores a binding between the public cloud account skyride35 and the personal cloud account daddy. The public cloud service transmits a confirmation to the personal cloud device. The personal cloud device stores a binding between the public cloud account skyride35 and the personal cloud account daddy. Hence, each of the public cloud service and the personal cloud device stores information indicating a binding between the public cloud account skyride35 and the personal cloud account daddy.

Referring to <FIG>, user interface <NUM> of client device <NUM> is presented to indicate the exported files associated with a public cloud user account, skyride35.

User interface <NUM> includes the public cloud account name <NUM>, skyride35. User interface <NUM> also shows content items arranged in a file directory. One directory is labeled "Exported but Not Shared. " Another directory is labeled "Exported and Shared.

Under "Exported but Not Shared" are files that have been exported from a personal cloud account to the public cloud account skyride35. The exported files include Tax Return File, Medical Report File, and Hotel Confirmation File. The exported files are stored on one or more personal cloud devices. The exported files are accessible using the public cloud account skyride35.

Under "Exported and Shared" are two sub-directories: "joejoe3" and "marysmith. " Under "joejoe3" are files that have been shared with the public cloud user a\ccount joejoe3. The shared files include Family Photo File. Under "marysmith" are files that have been shared with the public cloud user account marysmith. The shared files include Trip Itinerary File. The files are shared using the public cloud account skyride35.

A user of the public cloud account skyride35 is planning a trip with a user of the public cloud account marysmith. The user of the public cloud account skyride35 has already shared Trip Itinerary File with marysmith. The user of the public cloud account skyride35 now requests to share Hotel Confirmation File with marysmith.

The user logs into the user's personal cloud account, honey, for using a personal cloud device. The user submits, to the personal cloud device, a request to share Hotel Confirmation File with marysmith. The personal cloud device determines that Hotel Confirmation File is stored in association with honey on the personal cloud device. The personal cloud device determines that the personal cloud account honey is bound to the public cloud account skyride35. The personal cloud device transmits a request to share Hotel Confirmation File with marysmith using skyride35. The request is transmitted to the public cloud service.

The public cloud service determines that Hotel Confirmation File is an exported file of skyride35. The public cloud service makes Hotel Confirmation File accessible to marysmith. The user of marysmith sees that Hotel Confirmation File has been shared from skyride35, rather than honey.

Referring to <FIG>, user interface <NUM> of client device <NUM> is presented to indicate the exported files associated with a public cloud user account, skyride35. User interface <NUM> includes the public cloud account name <NUM>, skyride35. After the user of skyride35 has requested sharing of Hotel Confirmation File, Hotel Confirmation File now appears under "marysmith" under "Exported and Shared. " Based on the public cloud account name <NUM> and other information presented by user interface <NUM>, user interface <NUM> indicates that Hotel Confirmation File has been shared with marysmith using the public cloud account skyride35.

In one or more embodiments, a computer network provides connectivity among a set of nodes. The nodes may be local to and/or remote from each other. The nodes are connected by a set of links. Examples of links include a coaxial cable, an unshielded twisted cable, a copper cable, an optical fiber, and a virtual link.

A subset of nodes implements the computer network. Examples of such nodes include a switch, a router, a firewall, and a network address translator (NAT). Another subset of nodes uses the computer network. Such nodes (also referred to as "hosts") may execute a client process and/or a server process. A client process makes a request for a computing service (such as, execution of a particular application, and/or storage of a particular amount of data). A server process responds by executing the requested service and/or returning corresponding data.

A computer network may be a physical network, including physical nodes connected by physical links. A physical node is any digital device. A physical node may be a function-specific hardware device, such as a hardware switch, a hardware router, a hardware firewall, and a hardware NAT. Additionally or alternatively, a physical node may be a generic machine that is configured to execute various virtual machines and/or applications performing respective functions. A physical link is a physical medium connecting two or more physical nodes. Examples of links include a coaxial cable, an unshielded twisted cable, a copper cable, and an optical fiber.

A computer network may be an overlay network. An overlay network is a logical network implemented on top of another network (such as, a physical network). Each node in an overlay network corresponds to a respective node in the underlying network. Hence, each node in an overlay network is associated with both an overlay address (to address to the overlay node) and an underlay address (to address the underlay node that implements the overlay node). An overlay node may be a digital device and/or a software process (such as, a virtual machine, an application instance, or a thread) A link that connects overlay nodes is implemented as a tunnel through the underlying network. The overlay nodes at either end of the tunnel treat the underlying multi-hop path between them as a single logical link. Tunneling is performed through encapsulation and decapsulation.

In an embodiment, a client may be local to and/or remote from a computer network. The client may access the computer network over other computer networks, such as a private network or the Internet. The client may communicate requests to the computer network using a communications protocol, such as Hypertext Transfer Protocol (HTTP). The requests are communicated through an interface, such as a client interface (such as a web browser), a program interface, or an application programming interface (API).

In an embodiment, a computer network provides connectivity between clients and network resources. Network resources include hardware and/or software configured to execute server processes. Examples of network resources include a processor, a data storage, a virtual machine, a container, and/or a software application. Network resources are shared amongst multiple clients. Clients request computing services from a computer network independently of each other. Network resources are dynamically assigned to the requests and/or clients on an on-demand basis. Network resources assigned to each request and/or client may be scaled up or down based on, for example, (a) the computing services requested by a particular client, (b) the aggregated computing services requested by a particular tenant, and/or (c) the aggregated computing services requested of the computer network. Such a computer network may be referred to as a "cloud network.

In an embodiment, a service provider provides a cloud network to one or more end users. Various service models may be implemented by the cloud network, including but not limited to Software-as-a-Service (SaaS), Platform-as-a-Service (PaaS), and Infrastructure-as-a-Service (IaaS). In SaaS, a service provider provides end users the capability to use the service provider's applications, which are executing on the network resources. In PaaS, the service provider provides end users the capability to deploy custom applications onto the network resources. The custom applications may be created using programming languages, libraries, services, and tools supported by the service provider. In IaaS, the service provider provides end users the capability to provision processing, storage, networks, and other fundamental computing resources provided by the network resources. Any arbitrary applications, including an operating system, may be deployed on the network resources.

In an embodiment, various deployment models may be implemented by a computer network, including but not limited to a private cloud, a public cloud, and a hybrid cloud. In a private cloud, network resources are provisioned for exclusive use by a particular group of one or more entities (the term "entity" as used herein refers to a corporation, organization, person, or other entity). The network resources may be local to and/or remote from the premises of the particular group of entities. In a public cloud, cloud resources are provisioned for multiple entities that are independent from each other (also referred to as "tenants" or "customers"). The computer network and the network resources thereof are accessed by clients corresponding to different tenants. Such a computer network may be referred to as a "multi-tenant computer network. " Several tenants may use a same particular network resource at different times and/or at the same time. The network resources may be local to and/or remote from the premises of the tenants. In a hybrid cloud, a computer network comprises a private cloud and a public cloud. An interface between the private cloud and the public cloud allows for data and application portability. Data stored at the private cloud and data stored at the public cloud may be exchanged through the interface. Applications implemented at the private cloud and applications implemented at the public cloud may have dependencies on each other. A call from an application at the private cloud to an application at the public cloud (and vice versa) may be executed through the interface.

In an embodiment, tenants of a multi-tenant computer network are independent of each other. For example, a business or operation of one tenant may be separate from a business or operation of another tenant. Different tenants may demand different network requirements for the computer network. Examples of network requirements include processing speed, amount of data storage, security requirements, performance requirements, throughput requirements, latency requirements, resiliency requirements, Quality of Service (QoS) requirements, tenant isolation, and/or consistency. The same computer network may need to implement different network requirements demanded by different tenants.

In one or more embodiments, in a multi-tenant computer network, tenant isolation is implemented to ensure that the applications and/or data of different tenants are not shared with each other. Various tenant isolation approaches may be used.

In an embodiment, each tenant is associated with a tenant ID. Each network resource of the multi-tenant computer network is tagged with a tenant ID. A tenant is permitted access to a particular network resource only if the tenant and the particular network resources are associated with a same tenant ID.

In an embodiment, each tenant is associated with a tenant ID. Each application, implemented by the computer network, is tagged with a tenant ID. Additionally or alternatively, each data structure and/or dataset, stored by the computer network, is tagged with a tenant ID. A tenant is permitted access to a particular application, data structure, and/or dataset only if the tenant and the particular application, data structure, and/or dataset are associated with a same tenant ID.

As an example, each database implemented by a multi-tenant computer network may be tagged with a tenant ID. Only a tenant associated with the corresponding tenant ID may access data of a particular database. As another example, each entry in a database implemented by a multi-tenant computer network may be tagged with a tenant ID. Only a tenant associated with the corresponding tenant ID may access data of a particular entry. However, the database may be shared by multiple tenants.

In an embodiment, a subscription list indicates which tenants have authorization to access which applications. For each application, a list of tenant IDs of tenants authorized to access the application is stored. A tenant is permitted access to a particular application only if the tenant ID of the tenant is included in the subscription list corresponding to the particular application.

In an embodiment, network resources (such as digital devices, virtual machines, application instances, and threads) corresponding to different tenants are isolated to tenantspecific overlay networks maintained by the multi-tenant computer network. As an example, packets from any source device in a tenant overlay network may only be transmitted to other devices within the same tenant overlay network. Encapsulation tunnels are used to prohibit any transmissions from a source device on a tenant overlay network to devices in other tenant overlay networks. Specifically, the packets, received from the source device, are encapsulated within an outer packet. The outer packet is transmitted from a first encapsulation tunnel endpoint (in communication with the source device in the tenant overlay network) to a second encapsulation tunnel endpoint (in communication with the destination device in the tenant overlay network). The second encapsulation tunnel endpoint decapsulates the outer packet to obtain the original packet transmitted by the source device. The original packet is transmitted from the second encapsulation tunnel endpoint to the destination device in the same particular overlay network.

The special-purpose computing devices may be hard-wired to perform the techniques, or may include digital electronic devices such as one or more application-specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), or network processing units (NPUs) that are persistently programmed to perform the techniques, or may include one or more general purpose hardware processors programmed to perform the techniques pursuant to program instructions in firmware, memory, other storage, or a combination. Such special-purpose computing devices may also combine custom hard-wired logic, ASICs, FPGAs, or NPUs with custom programming to accomplish the techniques.

Common forms of storage media include, for example, a floppy disk, a flexible disk, hard disk, solid state drive, magnetic tape, or any other magnetic data storage medium, a CD-ROM, any other optical data storage medium, any physical medium with patterns of holes, a RAM, a PROM, and EPROM, a FLASH-EPROM, NVRAM, any other memory chip or cartridge, content-addressable memory (CAM), and ternary content-addressable memory (TCAM).

Embodiments are directed to a system with one or more devices that include a hardware processor and that are configured to perform any of the operations described herein and/or recited in any of the claims below.

In an embodiment, a non-transitory computer readable storage medium comprises instructions which, when executed by one or more hardware processors, causes performance of any of the operations described herein and/or recited in any of the claims.

Claim 1:
One or more non-transitory machine-readable media storing instructions which, when executed by one or more processors, cause:
identifying, by an application, a public cloud user account of a user for using a public cloud service (<NUM>, <NUM>);
characterised in that the instructions when executed further cause:
obtaining information, by the application from the public cloud service (<NUM>, <NUM>), indicating a pre-approval for binding (a) the public cloud user account and (b) a personal cloud user account of the user for using a personal cloud device (<NUM>, 110a-c, <NUM>);
transmitting, by the application to the personal cloud device (<NUM>, 110a-c, <NUM>), a request to bind the public cloud user account and the personal cloud user account, the request to bind comprising an identifier associated with the public cloud user account;
obtaining, by the application, a confirmation indicating that a binding between the public cloud user account and the personal cloud user account has been generated in response to the request to bind.