Securing shipment information accessed based on data encoded in machine-readable data blocks
Example embodiments provide a Shipment Preparation System (“SPS”), which facilitates the preparation of shipments, such as by producing shipping labels. In one embodiment, the SPS is configured to receive shipment preparation information from a bar code or other machine-readable data block in a packing list. The shipment preparation information identifies a uniform resource identifier (“URI”) that identifies a code module that is remote from the SPS. The shipment preparation information and/or the URI further includes an access token. The SPS then uses the URI to communicate with the code module in order to access shipment information (e.g., to read a read a shipping address, to store an indication that a shipment is ready for pick up). The code module restricts access to the shipment information based on the access token, such as by only allowing a limited number or duration of access via the token.
1. A method for securing access to shipment information, the method comprising:
restricting and redirecting access to shipment information, the access based on data encoded in a bar code in a packing list, the data including a first access token, by:
receiving a request from a shipment preparation computing system and based on a network resource identifier determined by the shipment preparation computing system based on the data encoded in the bar code in the packing list, wherein the request based on the network resource identifier includes a second access token that is based on the first access token;
in response to the received request based on the network resource identifier, transmitting to the shipment preparation computing system a uniform resource identifier;
receiving from the shipment preparation computing system a request to access the shipment information, wherein the request to access the shipment information uses the uniform resource identifier and includes the access token from the data encoded in the bar code in the packing list;
determining access information, based at least in part on the request to access the shipment information;
determining, by a computer system, based on the access information, whether to allow access to the shipment information;
allowing access to the shipment information only when it is determined to allow access to the shipment information; and
performing, based on the second access token, a limited number of translations of the network resource identifier into the uniform resource identifier.
2. The method of claim 1 , wherein the shipment information is information related to preparation of a shipment of an order and wherein receiving a request to access the shipment information includes: receiving a request to provide the shipment information and/or a request to record the shipment information.
3. The method of claim 1 , wherein receiving a request to access the shipment information includes receiving a request to provide the shipment information, and further comprising: in response to the received request to provide the shipment information, transmitting the requested information only when it is determined to allow access to the shipment information.
4. The method of claim 1 , wherein receiving a request to access the shipment information includes receiving a request to record the shipment information, and further comprising: in response to the request to record the shipment information, persistently storing the information only when it is determined to allow access to the shipment information.
5. The method of claim 1 , wherein the determining access information includes: determining the first access token based on the request.
6. The method of claim 5 , wherein the determining, based on the access information, whether to allow access includes: determining whether the first access token has been used more than a threshold number of times.
7. The method of claim 5 , wherein the determining, based on the access information, whether to allow access includes: determining whether the first access token has expired.
8. The method of claim 7 , wherein the determining whether the first access token has expired includes: determining whether the first access token is being used within an allowable time period.
9. The method of claim 8 , wherein the allowable time period begins at an initial use of the first access token and runs for an amount of time that is specified by the first access token.
10. The method of claim 5 , wherein the determining, based on the access information, whether to allow access includes: determining whether the first access token has been used less than a threshold number of times and whether the first access token is being used within an allowable time period.
11. The method of claim 5 , wherein the determining, based on the access information, whether to allow access includes: determining whether the request to access the shipment information is received from an authorized device.
12. The method of claim 11 , wherein the determining whether the request to access the shipment information is received from an authorized device includes: determining whether the device has a network address that matches a network address used during a previously received request to access the shipment information.
13. The method of claim 11 , wherein the determining whether the request to access the shipment information is received from an authorized device includes: determining whether the device has a network address that is within a range of authorized network addresses.
14. The method of claim 13 , wherein the range of authorized network addresses is based at least in part on the first access token.
15. The method of claim 5 , further comprising:
transmitting a second access token for use in subsequent requests to access the shipment information;
receiving a further request to access the shipment information; and
ensuring that the further request includes the second access token.
16. The method of claim 15 , wherein the first and second access tokens are each single-use tokens.
17. The method of claim 1 , further comprising: recording information about the access to the shipment information, the recorded information including indications of: a network address of the shipment preparation computing system, a time associated with the access, an access type, and whether or not the access is authorized.
18. A system for securing access to shipment information, the system comprising:
a processor;
a memory;
a module that is stored in the memory and that is configured, when executed by the processor, to perform a method comprising:
restricting and redirecting access to shipment information, the access based on data encoded in a machine-readable data block in a packing list, the data including a first access token, by:
receiving a request from a client computing system and based on a network resource identifier determined by the client computing system based on the data encoded in the machine-readable data block in the packing list, wherein the request based on the network resource identifier includes a second access token that is based on the first access token;
in response to the received request based on the network resource identifier, transmitting to the client computing system a uniform resource identifier;
receiving from the client computing system a request to access the shipment information, wherein the request to access the shipment information uses the uniform resource identifier and includes the access token from the data encoded in the bar code in the packing list;
determining, based on the first access token, whether to allow access to the shipment information; and
allowing access to the shipment information only when it is determined to allow access to the shipment information; and
performing, based on the second access token, a limited number of translations of the network resource identifier into the uniform resource identifier.
19. The system of claim 18 , further comprising:
an indirection service that is configured to:
receive from the client computing system the request based on the network resource identifier; and
in response to the received request based on the network resource identifier, transmit to the client computing system the uniform resource identifier for making the request to access the shipment information,
wherein the client computing system is configured to include in the request to access the shipment information the first access token from the data encoded in the bar code in the packing list.
20. The system of claim 19 , wherein the method further comprises: transmitting multiple access tokens to the indirection service for inclusion in uniform resource identifiers provided by the indirection service.
21. The system of claim 19 , wherein the indirection service is a URI shortening service that is configured to translate the network resource identifier into the uniform resource identifier, wherein the uniform resource identifier is longer than the network resource identifier, thereby reducing the payload size of the machine-readable data block in the packing list.
22. A non-transitory computer-readable medium including contents that are configured, when executed, to cause a computing system to perform a method for securing access to shipment information, the method comprising:
restricting and redirecting access to shipment information, the access based on data encoded in a bar code in a packing list, the data including a first access token, by:
receiving a request from a shipment preparation computing system and based on a network resource identifier determined by the shipment preparation computing system based on the data encoded in the bar code in the packing list, wherein the request based on the network resource identifier includes a second access token;
in response to the received request based on the network resource identifier, transmitting to the shipment preparation computing system a uniform resource identifier;
receiving from the shipment preparation computing system a request to access the shipment information, wherein the request to access the shipment information uses the uniform resource identifier and includes the access token from the data encoded in the bar code in the packing list;
determining access information, based at least in part on the request to access the shipment information;
determining, based on the access information, whether to allow access to the shipment information;
allowing access to the shipment information only when it is determined to allow access to the shipment information; and
performing, based on the second access token, a limited number of translations of the network resource identifier into the uniform resource identifier.
23. The computer-readable medium of claim 22 , wherein the computer-readable medium is a memory in the computing system and wherein the contents are instructions that, when executed, cause the computing system to perform the method.