Migrating user accounts from assisted to self-managed

Patent metadata

Field	Value
Publication number	US-10713655-B1
Application number	US-201615353568-A
Country	US
Kind code	B1
Filing date	Nov 16, 2016
Priority date	Nov 16, 2016
Publication date	Jul 14, 2020
Grant date	Jul 14, 2020

Abstract

Disclosed are various embodiments for transitioning user accounts from an assisted status to a self-managed status. In one embodiment, a service receives an authentication request from a client device, where the authentication request specifies a unique user identifier corresponding to a communication channel. The service then determines that the unique user identifier corresponds to an assisted user account but the client device is not logged in under an assisting user account. The service generates an ephemeral security credential and sends the ephemeral security credential to the communication channel. The service then creates a self-managed user account having the unique user identifier in response to receiving the ephemeral security credential from the client device.

First claim

Therefore, the following is claimed:

1. A non-transitory computer-readable medium embodying a program executable in at least one computing device, wherein when executed the program causes the at least one computing device to at least:
authenticate a first client device for access to an assisting user account, wherein the first client device corresponds to a kiosk in a physical store, and the kiosk is operated by an agent of the physical store having access to the assisting user account;
create an assisted user account having a unique user identifier and a first security credential in response to an assisted account creation request received from the first client device, the assisted account creation request specifying the unique user identifier and the first security credential, the unique user identifier corresponding to a communication channel;
record transaction data corresponding to at least one transaction initiated by the first client device authenticated for access to the assisting user account on behalf of the assisted user account;
receive an authentication request from a second client device that is not authenticated for access to the assisting user account, the authentication request specifying the unique user identifier corresponding to the assisted user account;
generate an ephemeral security credential;
send the ephemeral security credential to the communication channel corresponding to the unique user identifier;
create a self-managed user account having the unique user identifier in response to receiving the ephemeral security credential from the communication channel, the self-managed user account being inaccessible to the assisting user account;
receive a second security credential from the second client device;
associate the self-managed user account with the second security credential; and
facilitate access to the transaction data by the second client device via the self-managed user account.

2. The non-transitory computer-readable medium of claim 1 , wherein when executed the program further causes the at least one computing device to at least:
authenticate a third client device for access to another assisting user account;
receive another authentication request from the third client device, the other authentication request specifying the unique user identifier and the first security credential;
record additional transaction data corresponding to another at least one transaction initiated by the third client device on behalf of the assisted user account; and
facilitate access to the additional transaction data but not the transaction data by the third client device.

3. The non-transitory computer-readable medium of claim 1 , wherein when executed the program further causes the at least one computing device to at least receive a user confirmation to associate the transaction data of the assisted user account with the self-managed user account.

4. A system, comprising:
at least one computing device; and
at least one service executable in the at least one computing device, wherein when executed the at least one service causes the at least one computing device to at least:
receive a first authentication request from a first client device that is authenticated for access to an assisting user account, the first authentication request specifying a unique user identifier corresponding to a communication channel and a security credential, wherein the first client device corresponds to a kiosk in a physical store, and the kiosk is operated by an agent of the physical store having access to the assisting user account;
authenticate the first client device for access to an assisted user account, wherein the assisted user account is in an assisted status such that one or more previous transactions with the assisted user account have been assisted by the assisting user account;
receive a second authentication request from a second client device, the second authentication request specifying the unique user identifier;
determine that the unique user identifier corresponds to the assisted user account but the second client device is not logged in under the assisting user account;
generate an ephemeral security credential;
send the ephemeral security credential to the communication channel; and
create a self-managed user account having the unique user identifier in response to receiving the ephemeral security credential from the second client device, the self-managed user account being inaccessible to the assisting user account, and the self-managed user account providing access to the one or more previous transactions.

5. The system of claim 4 , wherein the first client device has access to transaction data associated with the assisted user account where the assisting user account assisted in completing a transaction, and first client device does not have access to other transaction data associated with the assisted user account where the assisting user account did not assist in completing the transaction.

6. The system of claim 4 , wherein the ephemeral security credential is at least one of: time limited or use limited.

7. The system of claim 4 , wherein when executed the at least one service causes the at least one computing device to at least receive a user confirmation whether to associate transaction data of the assisted user account with the self-managed user account.

8. The system of claim 4 , wherein the self-managed user account has access to transaction data associated with the assisted user account and transaction data associated with the self-managed user account.

9. The system of claim 4 , wherein the assisting user account has access to transaction data associated with the assisted user account but not transaction data associated with the self-managed user account.

10. The system of claim 4 , wherein the authentication request includes a first security credential associated with the assisted user account, and when executed the at least one service causes the at least one computing device to at least:
request from the second client device a second security credential that differs from the first security credential;
receive the second security credential from the second client device; and
associate the self-managed user account with the second security credential.

11. The system of claim 10 , wherein when executed the at least one service causes the at least one computing device to at least evaluate the second security credential for compliance with first credential strength criteria that are greater than second credential strength criteria under which the first security credential is evaluated.

12. A method, comprising:
receiving, via at least one of one or more computing devices, a first authentication request from a first client device that is authenticated for access to a first assisting user account, the first authentication request specifying a unique user identifier corresponding to a communication channel and a security credential, wherein the first client device corresponds to a kiosk in a physical store, and the kiosk is operated by an agent of the physical store having access to the assisting user account;
authenticating, via at least one of the one or more computing devices, the first client device for access to an assisted user account, wherein the assisted user account is in an assisted status such that transactions associated with the assisted user account are assisted by at least one authenticated assisting user on behalf of an end user;
completing, via at least one of the one or more computing devices, an electronic commerce transaction for the assisted user account through at least one user interaction with the firs

Assignees

• Amazon Tech Inc

Inventors

• Mcclintock Jon Arron
• Sharma Mayur

Classifications

• G06Q20/18

  involving self-service terminals [SST], vending machines, kiosks or multimedia terminals · CPC title

• H04L63/102

  Entity profiles · CPC title

• H04L63/08 Primary

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• G06Q20/4014 Primary

  Identity check for transactions · CPC title

• G06Q20/3223

  Realising banking transactions through M-devices · CPC title