Access control for a document management and collaboration system

Patent metadata

Field	Value
Publication number	US-9449182-B1
Application number	US-201414175884-A
Country	US
Kind code	B1
Filing date	Feb 7, 2014
Priority date	Nov 11, 2013
Publication date	Sep 20, 2016
Grant date	Sep 20, 2016

Abstract

A method and apparatus for controlling access to documents retained by a document management and collaboration system is disclosed. The document management and collaboration system may generate one or more suggested privileges associated with one or more users. An access control policy may specify whether system-generated user privileges may be enforced. If they are enforced, access to one or more document may be made subject to the generated privileges.

First claim

What is claimed is:

1. A computer-implemented method for controlling document access, comprising:
under the control of one or more computer systems configured with executable instructions,
for a document retained by a document management and collaboration system, receiving one or more attributes associated with one or more users of the document management and collaboration system, the one or more users belonging to an organization utilizing the resources of the document management and collaboration system, the one or more attributes being usable to obtain a measure of significance of the document to a user of the one or more users;
for a particular user of the one or more users, formulate a set of access privileges based at least in part on the one or more attributes, at least one attribute of the one or more attributes is a measure between a first character cluster corresponding to the document and a second character cluster corresponding to the particular user of the set of users for which the set of access privileges are to be formulated, the set of access privileges specifying a suggested permission for the particular user to access to the document;
making the set of access privileges available to a party responsible for the document;
in response to making the set of access privileges available, receiving an indication of whether the set of access privileges are to be enforced; and
enabling access to the document in accordance with the received indication.

2. The computer-implemented method of claim 1 , wherein:
the one or more attributes are received from one or more services utilized by the particular user; and
wherein the services includes at least one of: an email service, a calendar service or a location service.

3. The computer-implemented method of claim 1 , wherein:
the character cluster for the particular user being based at least in part on a content of one or more documents that are viewed by the user or received from the user.

4. The computer-implemented method of claim 1 , wherein the set of access privileges specify that the particular user is to be permitted to view the document, annotate the document, modify the document or provide feedback on the document.

5. The computer-implemented method of claim 1 , further comprising:
receiving an access control policy from an administrator of the organization; and
on a condition that the received indication specifies that the set of access privileges are not to be enforced, enabling the particular user to access the document as specified by the access control policy.

6. The computer-implemented method of claim 1 , wherein enabling access to the document in accordance with the received indication further includes:
receiving a request to access the document from the particular user; and
evaluating the set of access privileges to determine whether to grant the received request.

7. A system, comprising a set of computing devices collectively configured to implement at least a document management and collaboration system configured to:
receive an access control policy, the access control policy specifying whether an access privilege for a user is to be modified based at least in part on a recommended access privilege, the access privilege pertaining to user access to at least one document retained by the document management and collaboration system;
formulate the recommended access privilege for the user based at least in part on one or more attributes associated with the user, at least one attribute of the one or more attributes is a measure between a first character map corresponding to the at least one document and a second character map corresponding to the user; and
cause the recommended access privilege for the user to be enforced if specified by the access control policy.

8. The system of claim 7 , wherein the recommended access privilege controls user access to the at least one document retained by the document management and collaboration system.

9. The system of claim 7 , wherein the document management and collaboration system is further configured to receive the one or more attributes from at least one of: a cluster matching engine, an email service, a calendar service or a location service.

10. The system of claim 7 , wherein:
the second character map specifies a first plurality of weights based at least in part on a frequency of characters in a content of one or more documents accessed by the user; and
the first character map specifies a second plurality of weights based at least in part on a frequency of characters in a content of the document.

11. The system of claim 7 , wherein the document management and collaboration system is further configured to:
receive a request to access the document from the user; and
evaluate the recommended access privilege to determine whether to grant the received request.

12. The system of claim 7 , wherein:
the user is a member of a federated identity; and
the access control policy specifies whether the member of the federated identity is permitted minimum access privileges.

13. The system of claim 12 , wherein:
the federated identity is a domain name; and
the user is authenticated as being a member of the federated identity.

14. A non-transitory computer-readable storage medium having collectively stored thereon executable instructions that, when executed by one or more processors of a computer system, cause the computer system to at least:
receive an access control policy specifying privileges of one or more users for accessing at least one document maintained by a document management and collaboration system, the privileges of the one or more users having been expanded by a first user;
formulate a set of recommended access privileges for the one or more users based at least in part on one or more attributes associated with the one or more users, at least one attribute of the one or more attributes is a measure between a first character map corresponding to the at least one document and a second character map corresponding to a particular user of the one or more users;
request the first user to accept the set of recommended access privileges of the one or more users; and
in response to the request, set the privileges of the one or more users to a privilege level specified by the first user and based at least in part on the set of recommended access privileges.

15. The non-transitory computer-readable storage medium of claim 14 , wherein the instructions further comprise instructions that, when executed by the one or more processors, cause the computer system to, on a condition that the first user does not specify the privilege level, set the privileges of the one or more users to a second privilege level specified by the access control policy.

16. The non-transitory computer-readable storage medium of claim 14 , wherein the access control policy specifies that a baselining of the privileges of the one or more users is to be performed periodically, due to the occurrence of a trigger or according to a time schedule.

17. The non-transitory computer-readable storage medium of claim 14 , wherein the instructions further comprise instructions that, when executed by the one or more processors, cause the computer system to identify at least one user of the one or more users based at least in part on the at least one user having an expanded privilege level from a privilege level specified in the access control policy.

18. The non-transitory computer-readable storage medium of claim 14 , wherein the instructions further comp

Assignees

• Amazon Tech Inc

Inventors

• Dang Wei Lien Stephen
• Taylor Cynthia Zhang
• Sethuramalingam Arun Ponniah
• Harrell Catherine Emily
• Kala Sharad
• Wang Liangliang
• Gillett Kevin
• Nandiwada Santhanam Nandhini
• Cadabam Nagesh Pradhan
• Eisner Noah Anthony
• Oakley Stephen Joseph
• Khurana Himanshu

Classifications

• G06Q10/101

  Collaborative creation, e.g. joint development of products or services · CPC title

• G06F40/10

  Text processing (natural language analysis G06F40/20; semantic analysis G06F40/30; processing or translation of natural language G06F40/40) · CPC title

• G06Q10/10

  Office automation; Time management · CPC title

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• G06F16/16

  File or folder operations, e.g. details of user interfaces specifically adapted to file systems · CPC title