Access control for a document management and collaboration system

• US 10,257,196 B2
• Filed: 06/29/2016
• Issued: 04/09/2019
• Est. Priority Date: 11/11/2013
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Dang, Wei Lien Stephen, Taylor, Cynthia Zhang, Sethuramalingam, Arun Ponniah, Harrell, Catherine Emily, Kala, Sharad, Wang, Liangliang, Gillett, Kevin, Nandiwada Santhanam, Nandhini, Cadabam, Nagesh Pradhan, Eisner, Noah Anthony, Oakley, Stephen Joseph, Khurana, Himanshu
• Primary Examiner(s): Pearson, David J
• Application Number:
  US15/197,632
• Publication Number:
  US 20160315941A1
• Time in Patent Office: 1,014 Days
• CPC Class Codes: G06F 16/13 File access structures, e.g. distributed indices arrangements of input from, or output to, record carriers G06F3/06
• CPC Class Codes: G06F 16/16 File or folder operations, e.g. details of user interfaces specifically adapted to file systems
• CPC Class Codes: G06F 16/178 Techniques for file synchronisation in file systems
• CPC Class Codes: G06F 16/182 Distributed file systems
• CPC Class Codes: G06F 16/183 Provision of network file services by network file servers, e.g. by using NFS, CIFS network file access protocols H04L67/1097
• CPC Class Codes: G06F 16/1873 Versioning file systems, temporal file systems, e.g. file system supporting different historic versions of files
• CPC Class Codes: G06F 16/192 Implementing virtual folder structures
• CPC Class Codes: G06F 16/93 Document management systems
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06Q 10/101 Collaborative creation, e.g. joint development of products or services
• CPC Class Codes: H04L 51/04 Real-time or near real-time messaging, e.g. instant messaging [IM]
• CPC Class Codes: H04L 51/42 Mailbox-related aspects, e.g. synchronisation of mailboxes
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/306 User profiles

Abstract

A method and apparatus for controlling access to documents retained by a document management and collaboration system is disclosed. The document management and collaboration system may generate one or more suggested privileges associated with one or more users. An access control policy may specify whether system-generated user privileges may be enforced. If they are enforced, access to one or more document may be made subject to the generated privileges.

Claims

1. A computer-implemented method, comprising:

obtaining a set of attributes associated with a set of users of a document management and collaboration system, the document management and collaboration system maintaining a set of documents and the set of attributes including information indicating interactions by the set of users with one or more services;

determining, at the document management and collaboration system, a set of access privileges for at least one document of the set of documents maintained by the document management and collaboration system by at least obtaining the set of attributes, wherein at least one attribute of the set of attributes indicates a measure between a first character map associated with the at least one document and a second character map associated with a first user of the set of users;

providing a notification indicating the set of access privileges available to a second user of the set of users, the second user being responsible for the at least one document;

obtaining, from the second user, an indication to enforce the set of access privileges; and

enabling the set of users to access to the at least one document in accordance with the set of access privileges.

2. The computer-implemented method of claim 1, wherein the set of attributes further comprises information of extracted content indicating suggestions to allow additional users to access the at least one document based at least in part on interactions of the first user of the set of users with the one or more services in connection with the at least one document.

3. The computer-implemented method of claim 1, wherein the second character map is based at least in part on content of one or more documents obtained by the second user.

4. The computer-implemented method of claim 1, wherein the one or more services comprises at least one of:

an email service, a calendar service, a directory service, or a location service.

5. A system, comprising:

one or more processors; and

memory that includes instructions that, as a result of execution by the one or more processors, cause the system to;

generate, at a document management and collaboration system, a recommended access privilege for one or more users based at least in part on one or more attributes associated with a user, wherein at least one of the one or more attributes is obtained from a cluster matching engine that indicates a significance measure between a weighted cluster of characters utilized by the user and a second weighted cluster of characters determined based at least in part on at least one document maintained by the document management and collaboration system;

determine to modify an access policy associated with the at least one document maintained by the document management and collaboration system based at least in part on the recommended access privilege, the recommended access privilege indicating one or more changes to the access policy to enable the one or more users to access the at least one document based at least in part on the user'"'"'s access to the at least one document maintained by the document management and collaboration system; and

cause the recommended access privilege for the one or more users to be enforced.

6. The system of claim 5, wherein the at least one attribute of the one or more attributes is obtained from a cluster matching engine in connection with the document management and collaboration system.

7. The system of claim 6, wherein the at least one attribute obtained from the cluster matching engine indicates a weighted cluster of characters obtained from a data storage service with documents utilized by the user.

8. The system of claim 5, wherein at least one other attribute of the one or more attributes further includes information based on determining content from the user'"'"'s interactions with one or more services.

9. The system of claim 5, wherein the memory further includes instructions that, as a result of being executed by the one or more processors, cause the system to:

obtain, from the user, a request to access the at least one document; and

provide the user with access to the at least on document in response to the request based at least in part on an evaluation of the recommended access privilege indicating to grant the user access to the at least one document.

10. The system of claim 9, wherein:

the evaluation of the recommended access privilege indicates that the user is to be permitted to perform at least one operation of;

view the document, annotate the document, modify the document, and provide feedback on the document; and

wherein providing the user access to the document further comprises enabling the user to perform the at least one operation.

11. The system of claim 5, wherein the memory further includes instructions that, as a result of being executed by the one or more processors, cause the system to:

obtain, from an administrator associated with the at least one document, an indication that the recommended access privilege in not to be enforced; and

provide access to the at least one document based at least in part on the access policy.

12. The system of claim 8, wherein the one or more services comprises at least one of:

a notification service,

a messaging service,

a virtual computing service, or

an on-demand storage service.

13. A non-transitory computer-readable storage medium having stored thereon executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to at least:

obtain an access control policy specifying privileges of a set of users for accessing a document maintained by a document management and collaboration system;

formulate, at the document management and collaboration system, a set of recommended access privileges for the set of users based at least in part on one or more attributes associated with the set of users, at least one attribute of the one or more attributes is a measure between a first character cluster and a second character cluster, wherein the first character cluster is based at least in part on characters included in the document and the second character cluster is obtained based at least on one or more attributes associated with a first user of the set of users;

provide the set of recommended access privileges to a second user of the set of users to accept the set of recommended access privileges; and

modify the access control policy based at least in part on the set of recommended access privileges based at least in part on an indication to enforce the set of recommended access privileges obtained from the second user.

14. The non-transitory computer-readable storage medium of claim 13, wherein the access control policy specifies that formulating additional sets of recommended access privileges of the set of users is to be performed due to an occurrence of a trigger.

15. The non-transitory computer-readable storage medium of claim 13, wherein the instructions further comprise instructions that, as a result of being executed by the one or more processors, cause the computer system to, on a condition that the second user does not provide the indication to enforce the set of recommended access privileges, set the access control policy of the set of users to a second privilege level specified by an administrator.

16. The non-transitory computer-readable storage medium of claim 13, wherein the one or more attributes associated with the set of users further comprises at least one attribute indicating a second user'"'"'s interaction with an e-mail service of one or more services.

17. The non-transitory computer-readable storage medium of claim 16, wherein the least one attribute indicating a second user'"'"'s interaction with an e-mail service of one or more services further comprises a cluster map generated based at least in part on e-mail messages obtained by the second user or e-mail messages generated by the second user.

18. The non-transitory computer-readable storage medium of claim 13, wherein the one or more attributes associated with the set of users further comprises at least one attribute indicating a second user'"'"'s interaction with a computing resource service provider.

19. The non-transitory computer-readable storage medium of claim 13, wherein the instructions that cause the computer system to formulate the set of recommended access privileges further comprise instructions that, as a result of being executed by the one or more processors, cause the computer system to

formulate the set of recommended access privileges based at least in part on one or more attributes associated with the set of users, at least one attribute of the one or more attributes obtained based at least in part on content indicating suggestions to provide additional users access the document based at least in part on user interactions with one or more services associated with the document.

20. The non-transitory computer-readable storage medium of claim 13, wherein the instructions further comprise instructions that, as a result of being executed by the one or more processors, cause the computer system to tag the document based at least in part on a subset of users of the set of users provided access to the document based at least in part on the set of recommended access privileges.