Remote access control for stored data

• US 9,934,221 B2
• Filed: 09/29/2014
• Issued: 04/03/2018
• Est. Priority Date: 09/29/2014
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Gillett, Kevin George, Oakley, Stephen Joseph, Hutchison, Stefan Mathias, Taylor, Cynthia Zhang, Narayanamurthi, Subha, Plant, Scott Anthony, Alexander, Robert Andrew
• Primary Examiner(s): Beausoliel, Jr., Robert
• Assistant Examiner(s): Khakhar, Nirav K
• Application Number:
  US14/500,910
• Publication Number:
  US 20160092442A1
• Time in Patent Office: 1,282 Days
• CPC Class Codes: G06F 16/93 Document management systems
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 67/01 Protocols

Abstract

A method and apparatus for document collaboration and management are disclosed. User devices associated with a user of a document management and collaboration system are identified. Documents associated with the user are downloaded to the user devices from the document management and collaboration system. A targeted denial of access to the downloaded documents is performed.

Claims

1. A computer-implemented method for managing data in a document management and collaboration system, comprising:

under control of one or more computer systems configured with executable instructions,

receiving hardware or software configuration information for one or more computing devices;

uniquely identifying and tracking the one or more computing devices based on the hardware or software configuration information;

receiving a first request from one computing device of the one or more computing devices, wherein the first request is for a download of a document from the document management and collaboration system to the one computing device;

identifying a user associated with the first request;

sending the document to the one computing device;

based on the identification of the user and the tracking of the one or more computing devices, determining that the document should be deleted from a plurality of computing devices on which the user has had a user session;

performing a targeted deletion of the document from the plurality of computing devices; and

receiving, from the plurality of computing devices, indications of successful deletion of the document.

2. The computer-implemented method of claim 1, wherein said identifying comprises authenticating the user with a user session and said tracking comprises associating the user session to the one computing device.

3. The computer-implemented method of claim 1, wherein the performing the targeted deletion comprises sending a push notification commanding the one computing device to delete the document.

4. The computer-implemented method of claim 1, wherein the performing the targeted deletion comprises denying a second request to renew a time-based use of the document by the one computing device.

5. The computer-implemented method of claim 1, further comprising maintaining status for pending deletion requests.

6. The computer-implemented method of claim 1, wherein the performing the targeted deletion comprises sending a message over an idle channel commanding the one computing device to delete the document.

7. A system, comprising:

one or more processors; and

one or more memories having stored therein instructions that, upon execution by the one or more processors, cause the one or more processors to perform operations comprising;

identifying a plurality of user devices associated with a user of a document management and collaboration system on which the user has had a user session;

determining that one or more documents associated with the user that were downloaded to the plurality of user devices from the document management and collaboration system should be deleted from the plurality of user devices;

causing a targeted deletion of the one or more documents from the plurality of user devices; and

receiving, from the plurality of user devices, indications of successful deletion of the one or more documents.

8. The system of claim 7, wherein the plurality of user devices are identified based on hardware or software configuration information for the plurality of user devices.

9. The system of claim 7, wherein the operations further comprise:

receiving a request to download one of the one or more documents to one of the plurality of user devices;

sending an indication to a synchronization client of a location for document storage; and

receiving a message from the synchronization client indicating successful storage of the one of the one or more documents at the location.

10. The system of claim 9, wherein the operations further comprise:

in response to receiving the message, causing a database to indicate that the document one of the one or more documents is downloaded or present on the one of the plurality of user devices.

11. The system of claim 7, wherein the causing the targeted deletion comprises sending push notifications to the plurality of user devices indicating that the one or more documents should be deleted from the plurality of user devices.

12. The system of claim 7, wherein the causing the targeted deletion comprises denying a request to renew a time-based use of the document on the plurality of user devices.

13. The system of claim 7, wherein the causing the targeted deletion comprises:

deleting documents associated with the user that are located on the plurality of user devices and that are on persistent disk storage and a metadata store; and

terminating active user sessions.

14. The system of claim 7, wherein the causing the targeted deletion comprises deletion of a selected one of the one or more documents associated with the user.

15. The system of claim 7, wherein the causing the targeted deletion comprises overwriting memory locations where a selected one of the one or more documents are stored.

16. The system of claim 7, wherein the causing the targeted deletion comprises denial of a request to access the one or more documents.

17. A computer-implemented method comprising:

identifying a plurality of user devices associated with a user of a document management and collaboration system on which the user has had a user session;

determining that one or more documents associated with the user that were downloaded to the plurality of user devices from the document management and collaboration system should be deleted from the plurality of user devices;

causing a targeted deletion of the one or more documents from the plurality of user devices; and

receiving, from the plurality of user devices, indications of successful deletion of the one or more documents.

18. The computer-implemented method of claim 17, wherein the plurality of user devices are identified based on hardware or software configuration information for the plurality of user devices.

19. The computer-implemented method of claim 17, further comprising:

receiving a request to download one of the one or more documents to one of the plurality of user devices;

sending an indication to a synchronization client of a location for document storage; and

receiving a message from the synchronization client indicating successful storage of the one of the one or more documents at the location.

20. The computer-implemented method of claim 19, further comprising:

in response to receiving the message, causing a database to indicate that the one of the one or more documents is downloaded or present on the one of the plurality of user devices.

21. The computer-implemented method of claim 17, wherein the causing the targeted deletion comprises sending push notifications to the plurality of user devices indicating that the one or more documents should be deleted from the plurality of user devices.

22. The computer-implemented method of claim 17, wherein the causing the targeted deletion comprises overwriting memory locations where a selected one of the one or more documents are stored.