Persistent Key Access To Album

• US 20120331529A1
• Filed: 06/25/2012
• Published: 12/27/2012
• Est. Priority Date: 06/27/2011
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Steiner, Matthew S., Ibel, Maximilian
• Granted Patent: US 9,087,208 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key

Abstract

A method includes receiving a first request from a first user device to access a first resource that includes data for a second user account for which access to the data is restricted to authorized users, the first request including an authorization token and associated with a first user identifier that identifies a first user; determining that the first user identifier does not identify an authorized user and in response: determining that the first user identifier identifies an authorized user based on the authorization token, and provide the first resource to the first user device; receiving a second request for access to data to the second user account, the second request associated with the first user identifier; and based on the first user identifier being determined to identify authorized user, providing access to the data to the second user account in response to the second request.

Claims

1. A system, comprising:

a data processing apparatus including one or more computers;

a computer-readable medium coupled to the data processing apparatus and storing instructions executable by the data processing apparatus and that when executed by the data processing apparatus cause the data processing apparatus to perform operations comprising;

receive, by the data processing apparatus, a first request from a first user device to access one photo album in a collection of photo albums for a second user account for which access to the photo album for the second user account is restricted to authorized users, the first request including an authorization token and associated with a first user identifier that identifies a first user;

determine that the first user identifier does not identify an authorized user and in response;

determine that the first user identifier identifies an authorized user for the one photo album of the second user account based on the authorization token; and

provide data from only the one photo album to the first user device;

receive, by the data processing apparatus, a second request for access to the collection of photo albums of the second user account, the second request associated with the first user identifier; and

based on the first user identifier being determined to identify authorized user for only the one photo album, provide access to only the one photo album of the second user account in response to the second request.

2. A system, comprising:

a data processing apparatus including one or more computers;

a computer-readable medium coupled to the data processing apparatus and storing instructions executable by the data processing apparatus and that when executed by the data processing apparatus cause the data processing apparatus to perform operations comprising;

receive, by the data processing apparatus, a first request from a first user device to access a first resource that includes data for a second user account for which access to the data for the second user account is restricted to authorized users, the first request including an authorization token and associated with a first user identifier that identifies a first user;

determine that the first user identifier does not identify an authorized user and in response;

determine that the first user identifier identifies an authorized user based on the authorization token; and

provide the first resource to the first user device;

receive, by the data processing apparatus, a second request for access to data to the second user account, the second request associated with the first user identifier; and

based on the first user identifier being determined to identify authorized user, provide access to the data to the second user account in response to the second request.

3. The system of claim 2, wherein the instructions cause the data processing apparatus to:

associate the authorization token with the first user identifier and store the association in an access control data store;

receive, from a second user identified by a second user identifier associated with the second user account, a revocation of the authorization token; and

in response to receiving the revocation of the authorization token, determine that the first user identifier does not identify an authorized user to preclude access to the data by the first user.

4. The system of claim 2, wherein the instructions cause the data processing apparatus to:

generate an access link to the first resource, the access link including a resource locator of the first resource and the authorization token; and

provide the access link as a communication to an electronic account associated with the first user identifier.

5. The system of claim 4, wherein:

generating an access link to the first resource comprises;

receiving, from a second user identified by a second user identifier associated with the second user account, the first user identifier and data indicating the that the first user is to be granted access to the first resource;

generating a hash of the user identifier for use in the authorization token; and

determining that the first user identifier identifies an authorized user based on the authorization token comprises;

generating a hash of the first user identifier associated with the request;

comparing the hash of the first user identifier associated with the request to the authorization token; and

determining that the first user identifier identifies an authorized user only when the hash of the user identifier for use in the authorization token matches the hash of the first user identifier associated with the request.

6. The system of claim 2, wherein the instructions cause the data processing apparatus to:

receive, by the data processing apparatus, respective third requests from respective second user devices to access the first resource that includes data for the second user account for which access to the data for the second user account is restricted to authorized users, each of the second requests including the authorization token and associated with respective third user identifiers that identify respective third users, and for each respective third request;

determine that the respective third user identified by the respective third user identifier is not an authorized user and in response;

determine that the respective third user identifier identifies an authorized user based on the authorization token; and

provide the first resource to the respective second user device;

receive, by the data processing apparatus, a respective fourth request for access to data to the second user account, the respective fourth request associated with the respective third user identifier; and

based on the respective third user identifier being determined to identify an authorized user, provide access to the data to the respective second user account in response to the respective fourth request.

7. The system of claim 6, wherein the instructions cause the data processing apparatus to:

associate the authorization token with each of the respective third user identifiers and store the association in an access control data store;

receive, from an administrator of the section user account, a revocation of the authorization token; and

in response to receiving the revocation of the authorization token, determining that each of the first user identifier and the respective third user identifiers do not identify an authorized user to preclude access to the data by the first user and the respective third users.

8. The system of claim 2, wherein determining that the first user identifier identifies an authorized user based on the authorization token comprises determining that the first user identifier identifies an authorized user only in response to determining that the authorization token has not been previously used to identify an authorized user.

9. The system of claim 2, wherein determining that the first user identifier identifies an authorized user based on the authorization token comprises determining that the first user identifier identifies an authorized user only in response to determining that the authorization token has not been used to identify more than a maximum number of other users as authorized users.

10. The system of claim 2, wherein the authorization token is further associated with a set of other user identifiers, and wherein determine that the first user identifier identifies an authorized user based on the authorization token is further based on determining that the first user identifier is included in the set of user identifiers.

11. The system of claim 2, wherein the authorization token is associated with an expiration value that indicates a time period for which the authorization token is valid for use in the first request, and after which the authorization token cannot be used to determine that the first user identifier identifies an authorized user based on the authorization token.

12. A method performed by a data processing apparatus, the method comprising:

receiving, by a data processing apparatus, a first request from a first user device to access a first resource that includes data for a second user account for which access to the data for the second user account is restricted to authorized users, the first request including an authorization token and associated with a first user identifier that identifies a first user;

determining that the first user identifier does not identify an authorized user and in response;

determining that the first user identifier identifies an authorized user based on the authorization token; and

providing the first resource to the first user device;

receiving, by the data processing apparatus, a second request for access to data to the second user account, the second request associated with the first user identifier; and

based on the first user identifier being determined to identify authorized user, providing access to the data to the second user account in response to the second request.

13. The method of claim 12, further comprising:

associating the authorization token with the first user identifier and store the association in an access control data store;

receiving, from a second user identified by a second user identifier associated with the second user account, a revocation of the authorization token; and

in response to receiving the revocation of the authorization token, determining that the first user identifier does not identify an authorized user to preclude access to the data by the first user.

14. The method of claim 12, further comprising:

generating an access link to the first resource, the access link including a resource locator of the first resource and the authorization token; and

providing the access link as a communication to an electronic account associated with the first user identifier.

15. The method of claim 14, wherein:

generating an access link to the first resource comprises;

receiving, from a second user identified by a second user identifier associated with the second user account, the first user identifier and data indicating the that the first user is to be granted access to the first resource;

generating a hash of the user identifier for use in the authorization token; and

determining that the first user identifier identifies an authorized user based on the authorization token comprises;

generating a hash of the first user identifier associated with the request;

comparing the hash of the first user identifier associated with the request to the authorization token; and

determining that the first user identifier identifies an authorized user only when the hash of the user identifier for use in the authorization token matches the hash of the first user identifier associated with the request.

16. The method of claim 12, further comprising:

receiving, by the data processing apparatus, respective third requests from respective second user devices to access the first resource that includes data for the second user account for which access to the data for the second user account is restricted to authorized users, each of the second requests including the authorization token and associated with respective third user identifiers that identify respective third users, and for each respective third request;

determining that the respective third user identified by the respective third user identifier is not an authorized user and in response;

determining that the respective third user identifier identifies an authorized user based on the authorization token; and

providing the first resource to the respective second user device;

receiving, by the data processing apparatus, a respective fourth request for access to data to the second user account, the respective fourth request associated with the respective third user identifier; and

based on the respective third user identifier being determined to identify an authorized user, providing access to the data to the respective second user account in response to the respective fourth request.

17. The method of claim 16, further comprising:

associating the authorization token with each of the respective third user identifiers and store the association in an access control data store;

receiving, from an administrator of the section user account, a revocation of the authorization token; and

in response to receiving the revocation of the authorization token, determining that each of the first user identifier and the respective third user identifiers do not identify an authorized user to preclude access to the data by the first user and the respective third users.

18. The method of claim 12, wherein determining that the first user identifier identifies an authorized user based on the authorization token comprises determining that the first user identifier identifies an authorized user only in response to determining that the authorization token has not been previously used to identify an authorized user.

19. The method of claim 12, wherein determining that the first user identifier identifies an authorized user based on the authorization token comprises determining that the first user identifier identifies an authorized user only in response to determining that the authorization token has not been used to identify more than a maximum number of other users as authorized users.

20. The method of claim 12, wherein the authorization token is further associated with a set of other user identifiers, and wherein determine that the first user identifier identifies an authorized user based on the authorization token is further based on determining that the first user identifier is included in the set of user identifiers.

21. The method of claim 12, wherein the authorization token is associated with an expiration value that indicates a time period for which the authorization token is valid for use in the first request, and after which the authorization token cannot be used to determine that the first user identifier identifies an authorized user based on the authorization token.