Access to documents in a document management and collaboration system

Patent metadata

Field	Value
Publication number	US-9807073-B1
Application number	US-201414499699-A
Country	US
Kind code	B1
Filing date	Sep 29, 2014
Priority date	Sep 29, 2014
Publication date	Oct 31, 2017
Grant date	Oct 31, 2017

Abstract

A method and apparatus for securing access to a document stored by a document management and collaboration system are disclosed. In the method and apparatus, access credentials pertaining to a document are obtained, whereby the access credentials are usable for authenticating a request to access the document. A message including the access credentials is then sent out-of-band in relation to a notification indicating availability of the document for access. The document management and collaboration system then receives a request to access the document, whereby the request includes the access credentials, and authenticates the request based at least in part on the access credentials.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
receiving, by a document management and collaboration system, a request to make a document available for access by a second user, the request to make the document available for access being initiated by a first user of the document management and collaboration system;
in response to receiving the request to make the document available for access, causing a first message to be sent to a first address associated with the second user, the first message including an indication that the document is made available for access;
obtaining access credentials usable for authenticating a request to access the document by at least generating the access credentials based at least in part on information specified by the first user for use in authenticating the second user;
causing the access credentials to be sent to a second address associated with the second user, the second address being different than the first address and associated with a first computing device operated by the second user;
causing the access credentials to be provided from the first computing device to a second computing device associated with the second user and different from the first computing device;
receiving, from the second computing device, a request to access the document, the request to access the document including the access credentials; and
making the document accessible in response to authenticating the request to access the document based at least in part on the access credentials.

2. The computer-implemented method of claim 1 , wherein the document is made accessible in response to authenticating the second user based at least in part on log in credentials to the document management and collaboration system.

3. The computer-implemented method of claim 1 , wherein the first message specifies a uniform resource locator usable to access the document.

4. The computer-implemented method of claim 1 , further comprising:
causing the access credentials to become expired;
generating additional access credentials usable for authenticating the request to access the document; and
sending, to the first computing device operated by the second user, a message including the additional access credentials, the message being sent out-of-band with the first message.

5. A system, comprising:
at least one computing device implementing one or more services, wherein the one or more services:
obtain access credentials for a document stored by a document management and collaboration system, the access credentials usable for authenticating a request to access the document and generated based at least in part on information provided by a second entity associated with the document;
cause a message addressed to a first entity including the access credentials to be sent to a computing device associated with the first entity, the message being sent out-of-band in relation to a notification indicating availability of the document for access;
receive, from a second computing device associated with the first entity a request to access the document, the request including the access credentials obtained from the computer device; and
authenticate the request based at least in part on the access credentials.

6. The system of claim 5 , wherein obtaining the access credentials further comprises causing the message to be sent to the second entity in response to receiving a request to share the document.

7. The system of claim 6 , wherein the one or more services further generate the access credentials for the document corresponding to a sequence of characters provided by the second entity in response to the request to share the document.

8. The system of claim 5 , wherein the message being sent out-of-band in relation to the notification includes sending the message to a different address than the notification.

9. The system of claim 5 , wherein the request to access the document further comprises a request to download the document to a user device.

10. The system of claim 9 , wherein the one or more services further provide the document for download to the user device in response to authenticating the request to access the document.

11. The system of claim 10 , wherein the one or more services further:
in response to receiving the request to access the document, send a request for one or more attributes of the user device;
receive the one or more attributes of the user device; and
make the document available for access in response to determining that the one or more attributes meet one or more specified criteria.

12. The system of claim 5 , wherein the one or more attributes include a location of the device.

13. A non-transitory computer-readable storage medium having stored thereon executable instructions that, if executed by one or more processors of a computer system, cause the computer system to at least:
obtain access credentials for authenticating access to a document stored by a document management and collaboration system, the access credentials generated based at least in part on information provided by a user of the document management and collaboration system;
cause a first message including access credentials for the document to be sent to a first address, the first message being sent on a different communication channel than a notification indicating availability of the document for access, the first message being sent to a different device than a device the notification indicating availability of the document for access is sent to;
receive a request to access the document based at least in part on credentials information, where the credentials are provided by the different device to the device; and
authenticate the request based at least in part on the access credentials and the credentials information.

14. The non-transitory computer-readable storage medium of claim 13 , wherein the instructions that cause the computer system to obtain the access credentials further cause the computer system to obtain the access credentials due at least in part to an occurrence of a trigger.

15. The non-transitory computer-readable storage medium of claim 14 , wherein the trigger is receipt of a request to share the document from a user.

16. The non-transitory computer-readable storage medium of claim 14 , wherein the trigger is receipt of a request to upload the document for storage.

17. The non-transitory computer-readable storage medium of claim 13 , wherein the instructions that cause the computer system to obtain the access credentials further cause the computer system to receive a sequence of characters associated with the access credentials from the user.

18. The non-transitory computer-readable storage medium of claim 13 , wherein the request to access the document is a request to download the document for local storage on a device.

19. The non-transitory computer-readable storage medium of claim 13 , wherein:
the document is associated with a limited term certificate; and
the limited-term certificate enables offline access to the document for a specified period of time.

20. The non-transitory computer-readable storage medium of claim 13 , wherein the instructions further comprise instructions that, when executed by the one or more processors, cause the computer system to:
receive an additional request to access the document based at least in part on second credentials information; and
deny access to the document due at least in part to a failure to authenticate the additional reques

Assignees

• Amazon Tech Inc

Inventors

• Miller Jonathan Matthew

Classifications

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• H04L63/08 Primary

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L63/18

  using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215) · CPC title