Portable access to auditing information

• US 9,756,031 B1
• Filed: 10/13/2014
• Issued: 09/05/2017
• Est. Priority Date: 12/21/2011
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Roth, Gregory B., Ilac, Cristian M., Scharf, Jr., James E., Fitch, Nathan R., Baer, Graeme D., Pratt, Brian Irl, O'Neill, Kevin Ross
• Primary Examiner(s): Korsak, Oleg
• Assistant Examiner(s): Kanaan, Simon
• Application Number:
  US14/513,147
• Time in Patent Office: 1,058 Days
• CPC Class Codes: G06F 21/123 by using dedicated hardware, e.g. dongles, smart cards, cryptographic processors, global positioning systems [GPS] devices
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

Systems and methods provide a storage media on a portable physical object associated with a set of credentials that enables access to a set of computing resources associated with a set of Web services. In some embodiments, information including a set of credentials is prepackaged onto the storage media of the portable physical object. A pre-activated subscription to the set of Web services in a distributed system is provisioned. Access to the set of Web services is enabled when the portable physical object is coupled with a computing device and the set of credentials is authenticated. In some embodiments, the portable physical object is purchased by a user on a prepaid basis without requiring the user to register an account with the set of Web services, allowing the user to remain anonymous with respect to interaction with the set of Web services.

Claims

1. A computer-implemented method of storing a secure audit log of user interaction with respect to a set of computing resources, comprising:

enabling, via usage of a computer comprising a first memory, a user to access the set of computing resources;

collecting user interaction data based at least in part on tracking the user interaction with respect to the user accessing the set of computing resources;

storing the user interaction data with respect to the set of computing resources onto a portable physical object comprising a second memory, the portable physical object comprising a signing module stored in the second memory for generating a security credential to be stored in the second memory, the security credential for accessing the set of computing resources, and the portable physical object comprising a processor for executing the signing module to generate the security credential;

enabling the user of the portable physical object to recover account information associated with the portable physical object by using the security credential; and

sending a portion of the user interaction data to a separate data store among the set of computing resources, the portion of the user interaction data comprising first user interaction recorded beyond a threshold period of time prior to a current time such that second user interaction recorded within a recent period of time is kept locally on the portable physical object,

wherein the set of computing resources is accessible across a network through an application programming interface (API) or other interface.

2. The method of claim 1, further comprising:

receiving an indication that the portable physical object is no longer communicatively coupled to the computer; and

revoking the enabled access as a result of receiving the indication that the portable physical object is no longer communicatively coupled to the computer.

3. The method of claim 1, wherein the portable physical object is sold to the user on a prepaid basis, wherein usage of the set of computing resources is limited to a usage amount associated with an amount prepaid by the user.

4. The method of claim 1, further comprising:

prepackaging a set of credentials comprising at least the security credential to be associated with the portable physical object, the set of credentials including at least one of a symmetric key, an asymmetric key, a certificate, or a public-key cryptography key, wherein access to the set of computing resources is enabled upon authentication of the portable physical object using the set of credentials.

5. The method of claim 1, wherein access to the second memory can be obtained by an administrator of the set of computing resources.

6. The method of claim 1, wherein successful and/or failed requests made using the portable physical object are tracked and stored on the portable physical object.

7. The method of claim 1, further comprising:

identifying that the signing module executed on the portable physical object generated a digital signature utilizing the security credential; and

receiving a request to access the set of computing resources, wherein the request comprises the digital signature, and wherein enabling the access to the set of computing resources is based in part on the request comprising the digital signature.

8. The method of claim 1, further comprising:

providing the user interaction data to a page, wherein the user is enabled to view the user interaction data via the page.

9. A non-transitory computer-readable storage medium including instructions for storing a secure audit log of user interaction data with respect to a set of computing resources, the instructions when executed by a processor of a computing device cause the computing device to:

enable, via usage of a computer comprising a first memory, a user to access the set of computing resources;

obtain access to the set of network-based computing resources when a portable physical object comprising a second memory is authenticated using a set of credentials that are stored in the second memory on the portable physical object, the portable physical object comprising security credential for accessing the set of network-based computing resources, portable physical object comprising a processor that executes a signing module to generate the security credential;

enable the user of the portable physical object to recover account information associated with the portable physical object by using the security credential;

perform a user interaction with respect to the set of computing resources, the portable physical object configured to track the user interaction; and

store the user interaction data recording the user interaction with respect to the set of computing resources into the second memory on the portable physical object,

wherein the set of computing resources is accessible across a network through an application programming interface (API) or other interface.

10. The non-transitory computer-readable storage medium of claim 9, wherein the set of computing resources includes at least one of storage services, email services, backup services, or virtual computing services.

11. The non-transitory computer-readable storage medium of claim 9, wherein the user interaction with respect to the set of computing resources includes successful and/or failed web service requests made using the portable physical object.

12. The non-transitory computer-readable storage medium of claim 9, wherein the set of credentials comprising at least the security credential are prepackaged onto the portable physical object, the set of credentials including at least one of a symmetric key, an asymmetric key, a certificate, or a public-key cryptography key, wherein the set of computing resources is accessible upon authentication of the portable physical object using the set of credentials.

13. The non-transitory computer-readable storage medium of claim 9, wherein the set of computing resources may be accessed in accordance with a prepaid subscription associated with the portable physical object, the prepaid subscription having one or more usage limits with respect to usage of the set of computing resources.

14. The non-transitory computer-readable storage medium of claim 13, wherein the instructions when executed further cause the computing device to:

enable access to information relating to usage of the set of computing resources, the information including current and/or past usage of the set of computing resources and an amount of value remaining on the portable physical object from an amount prepaid by the user in accordance with the prepaid subscription.

15. A portable physical device, comprising:

a processor; and

a memory device comprising a first memory that comprises instructions that, when executed by the processor, cause the portable physical device to;

provide a set of credentials from the first memory of the memory device to enable authentication of the portable physical device associated with a prepaid subscription;

upon authentication of the portable physical device, enable access to a set of computing resources in accordance with the prepaid subscription via usage of a computer comprising a second memory, the portable physical device comprising a security credential stored in the first memory for accessing the set of computing resources, and the portable physical device comprising a processor that executes a signing module to generate the security credential;

enable a user of the portable physical device to recover account information associated with the portable physical device by using the security credential, the set of computing resources accessible across a network through an application programming interface (API) or other interface and the prepaid subscription indicating one or more usage limits with respect to the set of computing resources;

collect user interaction data based at least in part on tracking a user interaction with respect to the user accessing the set of computing resources;

store the user interaction data recording the user interaction with respect to the set of computing resources into the first memory on the portable physical device; and

provide access to the user interaction data recording the user interaction in the first memory.

16. The portable physical device of claim 15, wherein the user interaction with respect to the set of computing resources tracked includes changes made to one or more computing resources in the set of computing resources and successful and/or failed web services requests.

17. The portable physical device of claim 15, wherein the instructions when executed further cause the portable physical device to:

prepackage the set of credentials comprising at least the security credential to be associated with the portable physical device, the set of credentials including at least one of a symmetric key, an asymmetric key, a certificate, or a public-key encryption key.

18. The portable physical device of claim 15, wherein the instructions when executed further cause the portable physical device to:

enable the user to create a password for accessing an account associated with the portable physical device.

19. The portable physical device of claim 15, wherein the user interaction with respect to the set of computing resources is a web service request that uses one or more of the set of computing resources.

20. The portable physical device of claim 15, wherein access to the set of computing resources is enabled without requiring the user to register an account with the set of computing resources and allowing the user to remain anonymous.