Portable access to auditing information

• US 8,881,256 B1
• Filed: 12/21/2011
• Issued: 11/04/2014
• Est. Priority Date: 12/21/2011
• Status: Expired due to Fees

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Roth, Gregory B., Ilac, Cristian M., Scharf, James E. Jr., Fitch, Nathan R., Baer, Graeme D., Pratt, Brian Irl, O'Neill, Kevin Ross
• Primary Examiner(s): Barron, Jr., Gilberto
• Assistant Examiner(s): KANAAN, SIMON P
• Application Number:
  US13/333,933
• Time in Patent Office: 1,049 Days
• Field of Search: None
• US Class Current: 726/9
• CPC Class Codes: G06F 21/123 by using dedicated hardware, e.g. dongles, smart cards, cryptographic processors, global positioning systems [GPS] devices
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

Systems and methods provide a storage media on a portable physical object associated with a set of credentials that enables access to a set of computing resources associated with a set of Web services. In some embodiments, information including a set of credentials is prepackaged onto the storage media of the portable physical object. A pre-activated subscription to the set of Web services in a distributed system is provisioned. Access to the set of Web services is enabled when the portable physical object is coupled with a computing device and the set of credentials is authenticated. In some embodiments, the portable physical object is purchased by a user on a prepaid basis without requiring the user to register an account with the set of Web services, allowing the user to remain anonymous with respect to interaction with the set of Web services.

Claims

1. A computer-implemented method of providing a secure audit log for usage of a set of network-based computing resources accessible through an application programming interface (API) or other interface, comprising:

under control of one or more computer systems configured with executable instructions,

receiving, over a network, a first indication that a computing device has interacted with a portable physical object that includes a storage medium having stored thereon a set of credentials;

receiving the set of credentials as a result of interaction between the computing device and the portable physical object;

authenticating the portable physical object using the set of credentials;

upon authenticating the portable physical object, enabling usage of the set of network-based computing resources of a service provider when the portable physical object is communicatively coupled with the computing device, wherein the portable physical object is communicatively coupled with the computing device when a signal is received upon the portable physical object being within a threshold distance with the user computer device;

tracking user interaction with respect to the usage of the set of network-based computing resources;

storing data recording the user interaction with respect to the set of network-based computing resources into a data store on the portable physical object in the secure audit log, the data stored in a tamper-evident data store, and the data being stored locally with the portable physical object such that the data may not be altered by an administrator of the set of network-based computing resources when the portable physical object is communicatively coupled with the computing device; and

enabling access to the data recording the user interaction in the data store.

2. The method of claim 1, wherein the portable physical object is sold to a customer on a prepaid basis, wherein the usage of the set of network-based computing resources is limited to an amount prepaid by the customer.

3. The method of claim 1, wherein the portable physical object includes at least one of a universal serial bus (USB) flash drive, a smartcard, or a secure digital (SD) card.

4. The method of claim 1, wherein access to the data store can be obtained by an administrator of the set of network-based computing resources.

5. The method of claim 1, further comprising:

enabling a user to create a pin for accessing an account associated with the portable physical object, wherein the access to the set of network-based computing resources is enabled upon verification of the pin.

6. The method of claim 1, wherein successful and/or failed requests made using the portable physical object are tracked and stored on the portable physical object.

7. The method of claim 1, wherein access to the set of network-based computing resources is enabled without requiring a user to register an account with the set of network-based computing resources and allowing the user to remain anonymous.

8. A computer-implemented method of storing a secure audit log of user interaction with respect to a set of network-based computing resources, comprising:

under control of one or more computer systems configured with executable instructions,

enabling usage of the set of network-based computing resources of a service provider when a portable physical object is communicatively coupled with a computing device;

tracking user interaction with respect to the usage of the set of network-based computing resources;

storing the data recording the user interaction with respect to the set of network-based computing resources into a data store on the portable physical object in the secure audit log, the secure audit log stored in a tamper-evident data store; and

sending a portion of the data to a separate data store among the set of network-based computing resources, the portion of the data including user interaction recorded beyond a threshold period of time prior to a current time such that user interaction recorded within a recent period of time is kept locally on the portable physical object,

wherein the set of network-based computing resources is accessible across a network through an application programming interface (API) or other interface.

9. The method of claim 8, further comprising:

receiving an indication that the portable physical object is no longer communicatively coupled to the computing device; and

revoking the enabled access as a result of receiving the indication that the portable physical object is no longer communicatively coupled to the computing device.

10. The method of claim 8, wherein the portable physical object is sold to a user on a prepaid basis, wherein usage of the set of network-based computing resources is limited to a usage amount associated with an amount prepaid by the user.

11. The method of claim 8, further comprising:

enabling a user to register an account to obtain a security credential such that the user can recover account information associated with the portable physical object by using the security credential.

12. The method of claim 8, further comprising:

prepackaging a set of credentials to be associated with the portable physical object, the set of credentials including at least one of a symmetric key, an asymmetric key, a certificate, or a public-key cryptography key, wherein access to the set of network-based computing resources is enabled upon authentication of the portable physical object using the set of credentials.

13. A non-transitory computer-readable storage medium including instructions for storing a secure audit log of user interaction with respect to usage of a set of network-based computing resources, the instructions when executed by a processor of a computing device causing the computing device to:

provide a first indication that a computing device is communicatively coupled with a portable physical object that includes a storage medium having stored thereon a set of credentials;

obtain access to use the set of network-based computing resources of a service provider when the portable physical object is authenticated using the set of credentials;

perform user interaction with respect to the usage of the set of network-based computing resources, the portable physical object configured to track the usage;

store data recording the user interaction with respect to the usage of the set of network-based computing resources into a data store on the portable physical object in the secure audit log, the data being stored locally with the portable physical object such that the data may not be altered by an administrator of the set of network-based computing resources when the portable physical object is communicatively coupled with the computing device,

wherein the set of network-based computing resources is accessible across a network through an application programming interface (API) or other interface; and

send a portion of the data to a separate data store among the set of network-based computing resources, the portion of the data including the user interaction recorded beyond a threshold period of time prior to a current time such that user interaction recorded within a recent period of time is kept locally on the portable physical object.

14. The non-transitory computer-readable storage medium of claim 13, wherein the set of network-based computing resources includes at least one of storage services, email services, backup services, or virtual computing services.

15. The non-transitory computer-readable storage medium of claim 13, wherein the user interaction with respect to the set of network-based computing resources includes successful and/or failed web service requests made using the portable physical object.

16. The non-transitory computer-readable storage medium of claim 13, wherein a set of credentials are prepackaged onto the portable physical object, the set of credentials including at least one of a symmetric key, an asymmetric key, a certificate, or a public-key cryptography key, wherein the set of network-based computing resources is accessible upon authentication of the portable physical object using the set of credentials.

17. The non-transitory computer-readable storage medium of claim 13, wherein the set of network-based computing resources may be accessed in accordance with a prepaid subscription associated with the portable physical object, the prepaid subscription having one or more usage limits with respect to usage of the set of network-based computing resources.

18. The non-transitory computer-readable storage medium of claim 17, wherein the instructions when executed further cause the computing device to:

enable access to information relating to usage of the set of network-based computing resources, the information including current and/or past usage of the set of network-based computing resources and an amount of value remaining on the portable physical object from an amount prepaid by a user in accordance with the prepaid subscription.

19. A portable physical device, comprising:

a processor;

a memory device including instructions that, when executed by the processor, cause the portable physical device to;

provide a set of credentials from the memory device to enable authentication of the portable physical device associated with a prepaid subscription;

upon authentication of the portable physical device, enable usage of a set of network-based computing resources of a service provider in accordance with the prepaid subscription when the portable physical device is communicatively coupled with the set of network-based computing resources, the set of network-based computing resources accessible across a network through an application programming interface (API) or other interface and the prepaid subscription indicating one or more usage limits with respect to the usage of the set of network-based computing resources;

track user interaction with respect to the usage of the set of network-based computing resources;

store the data recording the user interaction with respect to the usage of the set of network-based computing resources into a data store on the portable physical object, the data being stored locally with the portable physical object such that the data may not be altered by an administrator of the set of network-based computing resources;

provide access to the data recording the user interaction in the data store; and

cease access with the portable physical object such that the portable physical object is no longer communicatively coupled to the set of network-based computing resources.

20. The portable physical device of claim 19, wherein the user interaction with respect to the set of network-based computing resources tracked includes changes made to one or more computing resources in the set of network-based computing resources and successful and/or failed web services requests.

21. The portable physical device of claim 19, wherein the instructions when executed further cause the portable physical device to:

prepackage the set of credentials to be associated with the portable physical device, the set of credentials including at least one of a symmetric key, an asymmetric key, a certificate, or a public-key encryption key.

22. The portable physical device of claim 19, wherein the instructions when executed further cause the portable physical device to:

enable a user to create a password for accessing an account associated with the portable physical object.

23. The portable physical device of claim 19, wherein the instructions when executed further cause the portable physical device to:

enable a user to register an account associated with the portable physical object to obtain a security credential such that the user can recover account information associated with the portable physical object.

24. The portable physical device of claim 19, wherein the user interaction with respect to the set of network-based computing resources is a web service request that uses one or more of the set of network-based computing resources.

25. The portable physical device of claim 19, wherein access to the set of network-based computing resources is enabled without requiring a user to register an account with the set of network-based computing resources and allowing the user to remain anonymous.