REMOTE ACCESS CONTROL FOR STORED DATA

• US 20160092442A1
• Filed: 09/29/2014
• Published: 03/31/2016
• Est. Priority Date: 09/29/2014
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Oakley, Stephen Joseph, Plant, Scott Anthony, Gillett, Kevin George, Hutchison, Stefan Mathias, Taylor, Cynthia Zhang, Narayanamurthi, Subha, Alexander, Robert Andrew
• Granted Patent: US 9,934,221 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/93 Document management systems
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 67/01 Protocols

Abstract

A method and apparatus for document collaboration and management are disclosed. User devices associated with a user of a document management and collaboration system are identified. Documents associated with the user are downloaded to the user devices from the document management and collaboration system. A targeted denial of access to the downloaded documents is performed.

Claims

1. A computer-implemented method for managing data in a document management and collaboration system, comprising:

under control of one or more computer systems configured with executable instructions,

receiving hardware or software configuration information for one or more computing devices;

uniquely identifying and tracking the one or more computing devices based on the hardware or software configuration information;

receiving a request from one computing device of the one or more computing devices, wherein the request is for a download of a document from the document management and collaboration system to the one computing device;

identifying a user associated with the download request;

sending the requested document to the one computing device;

based on the identification of the user and the tracking of the one or more computing devices, determining that the downloaded document should be deleted from the one computing device;

performing a targeted deletion of the downloaded document from the one computing device; and

receiving, from the one computing device, an indication of successful deletion of the downloaded document.

2. The computer-implemented method of claim 1, wherein said identifying comprises authenticating the user with a user session and said tracking comprises associating the user session to the one computing device.

3. The computer-implemented method of claim 1, wherein the performing the targeted deletion comprises sending a push notification commanding the one computing device to delete the downloaded document.

4. The computer-implemented method of claim 1, wherein the performing the targeted deletion comprises denying a request to renew a time-based use of the downloaded document by the one computing device.

5. The computer-implemented method of claim 1, further comprising maintaining status for pending deletion requests.

6. The computer-implemented method of claim 1, wherein the performing the targeted deletion comprises sending a message over an idle channel commanding the one computing device to delete the downloaded document.

7. A system, comprising one or more computing devices collectively configured to implement at least an application service configured to:

identify one or more user devices associated with a user of a document management and collaboration system;

determine that one or more documents associated with the user that were downloaded to the one or more user devices from the document management and collaboration system should be made inaccessible from the one or more user devices; and

cause a targeted denial of access to the downloaded one or more documents from the one or more user devices.

8. The system of claim 7, wherein the one or more user devices are identified based on hardware or software configuration information for the one or more user devices.

9. The system of claim 7, wherein the application service is further configured to:

receive a request to download one of the one or more documents to the one or more user devices;

send an indication to a synchronization client of a location for document storage; and

receive a message from the synchronization client indicating successful storage of the document at the location.

10. The system of claim 9, wherein:

the application service is further configured to, in response to receiving the message, cause a database to indicate that the document is downloaded or present on the one or more user devices.

11. The system of claim 7, wherein the one or more computing devices are collectively configured to receive an indication of successful deletion of the one or more downloaded documents.

12. The system of claim 7, wherein the causing the targeted denial of access comprises sending push notifications to the one or more user devices indicating that the downloaded documents should be deleted from the one or more user devices.

13. The system of claim 7, wherein the causing the targeted denial of access comprises denying a request to renew a time-based use of the document on the one or more user devices.

14. The system of claim 7, wherein the causing the targeted denial of access comprises:

deleting documents associated with the user that are located on the one or more user devices and that are on persistent disk storage and a metadata store; and

terminating active user sessions.

15. The system of claim 7, wherein the causing the targeted denial of access comprises deletion of a selected one of the one or more documents associated with the user.

16. The system of claim 7, wherein the causing the targeted denial of access comprises overwriting memory locations where a selected one of the one or more documents are stored.

17. The system of claim 7, wherein the causing the targeted denial of access comprises denial of a request to access the one or more documents.

18. A non-transitory computer-readable storage medium having collectively stored thereon executable instructions that, when executed by one or more processors of a computing device, cause the computing device to at least:

send data to a document management and collaboration system, the data being for tracking which computing devices are associated with a user of the document management and collaboration system;

receive documents from the document management and collaboration system and store the received documents, wherein the received and stored documents are associated with the user and the received and stored documents are tracked by the document management and collaboration system; and

in response to a command from the document management and collaboration system, deny access to selected ones of the downloaded documents associated with the user.

19. The non-transitory computer-readable storage medium of claim 18, further comprising instructions that cause the computing device to send, to the document management and collaboration system, an indication of successful deletion of the selected ones of the downloaded documents.

20. The non-transitory computer-readable storage medium of claim 18, wherein the documents associated with the user are only downloaded upon verification that the computing device is configured to perform a targeted deletion of the selected ones of the downloaded documents.

21. The non-transitory computer-readable storage medium of claim 18, wherein the instructions further comprise instructions that, when executed by the one or more processors, cause the computing device to terminate an active session associated with the user.

22. The non-transitory computer-readable storage medium of claim 18, wherein the denying access comprises overwriting memory locations where the selected one of the downloaded documents is stored.