Managing security credentials

Patent metadata

Field	Value
Publication number	US-11444936-B2
Application number	US-201916441628-A
Country	US
Kind code	B2
Filing date	Jun 14, 2019
Priority date	Jul 29, 2011
Publication date	Sep 13, 2022
Grant date	Sep 13, 2022

Abstract

Disclosed are various embodiments for managing security credentials. In one embodiment, knowledge-based questions are selected in response to failing to receive a valid master security credential in a request to authenticate a user account for access to account data. In response to receiving the request, the plurality of knowledge-based questions are provided to an application. Answers to the knowledge-based questions are received and scored. Access is granted to establish a new master security credential based at least in part on the score meeting or exceeding a predetermined threshold.

First claim

Therefore, the following is claimed:

1. A method, comprising:
receiving, via at least one of one or more computing devices, a request to authenticate a user account, the request comprising a master security credential, a valid master security credential being employed to authenticate the user account for access to a plurality of security credentials;
determining, via at least one of the one or more computing devices, that the master security credential is invalid;
determining, via at least one of the one or more computing devices, to generate a plurality of dynamic knowledge-based questions instead of retrieving static knowledge-based questions, the determination being based at least in part on a sufficiency of user data associated with the user account;
generating, via at least one of the one or more computing devices, the plurality of dynamic knowledge-based questions in an instance in which the master security credential is invalid;
providing, via at least one of the one or more computing devices, the plurality of dynamic knowledge-based questions to an application executing on a client device;
generating, via the at least one of the one or more computing devices, a score based at least in part on a comparison of a plurality of received answers to the plurality of dynamic knowledge-based questions with a plurality of valid answers to the plurality of dynamic knowledge-based questions, the plurality of received answers being received from the application; and
in response to determining that the score meets or exceeds a predetermined threshold, granting, via the at least one of the one or more computing devices, access to reset a master security credential associated with the user account.

2. The method of claim 1 , further comprising providing access to the plurality of security credentials for a predetermined number of minutes.

3. The method of claim 1 , wherein providing the plurality of dynamic knowledge-based questions to the application comprises sending data to the application configured to generate a user interface to be rendered by the application, the user interface comprising the plurality of dynamic knowledge-based questions.

4. The method of claim 1 , wherein the plurality of security credentials grant access for the user account to a plurality of different applications.

5. The method of claim 1 , further comprising:
receiving a new master security credential from the application; and
storing a hashed version of the new master security credential as the master security credential.

6. The method of claim 1 , further comprising sending a configuration file including a security credential specification to the client device, the security credential specification specifying at least one of: a character set, a minimum length, or a maximum length for a password.

7. The method of claim 1 , wherein at least one of the plurality of dynamic knowledge-based questions is generated based at least in part on at least one of: purchase transaction data, browsing history, order history, search history, or profile information associated with the user account.

8. The method of claim 1 , wherein individual received answers of the plurality of received answers are weighted with a respective different weight based at least in part on a respective knowledge-based question of the plurality of dynamic knowledge-based questions.

9. A system, comprising:
at least one computing device; and
a manager executable in the at least one computing device, wherein, when executed, the manager causes the at least one computing device to at least:
receive a request to authenticate a user account, the request comprising a master security credential, a valid master security credential being employed to authenticate the user account for access to account data associated with a user account;
determine to generate a plurality of dynamic knowledge-based questions instead of retrieving static knowledge-based questions, the determination being based at least in part on a sufficiency of user data associated with the user account;
generate the plurality of dynamic knowledge-based questions in an instance in which the master security credential is invalid;
generate a user interface comprising the plurality of dynamic knowledge-based questions;
receive a plurality of knowledge-based answers to the plurality of dynamic knowledge-based questions from a client device;
generate a score based at least in part on the plurality of received knowledge-based answers to the plurality of dynamic knowledge-based questions; and
in response to determining that the score meets or exceeds a predetermined threshold, perform an action comprising at least one of: establishing a new master security credential as the valid master security credential or providing access to the account data for a predetermined number of minutes.

10. The system of claim 9 , wherein receiving the request comprises receiving a request to reset a master security credential associated with the user account.

11. The system of claim 9 , wherein the account data comprises a plurality of security credentials accessible via the master security credential, and wherein, when executed, the manager causes the at least one computing device to at least provide the plurality of security credentials to the client device.

12. The system of claim 9 , wherein the account data comprises a plurality of security credentials accessible via the master security credential, and wherein, when executed, the manager causes the at least one computing device to at least:
automatically generate at least one of the plurality of security credentials according to a security credential specification received from a remote computing device; and
send the at least one of the plurality of security credentials and the security credential specification to the client device.

13. The system of claim 9 , wherein at least one of the plurality of dynamic knowledge-based questions is generated based at least in part on a recency of at least one of: purchase transaction data, browsing history, order history, search history, or profile information associated with the account data.

14. The system of claim 9 , wherein the request comprises a master security credential, and receiving the request comprises determining that the master security credential is not valid based at least in part on comparing a hashed version of the master security credential with a master security credential stored in association with the user account.

15. A non-transitory computer-readable medium embodying specific instructions that, when executed, cause at least one computing device to at least:
receive a request for account data required to access a network site, the request being received from an application executing on a client device, and the request comprising a master security credential, a valid master security credential employed to authenticate a user account for access to the account data;
determine to generate a plurality of dynamic knowledge based questions instead of retrieving static knowledge-based questions, the determination being based at least in part on a sufficiency of user data associated with the user account;
generate the plurality of dynamic knowledge-based questions in an instance in which the master security credential is invalid;
provide the plurality of dynamic knowledge-based questions to the application;
generate a score based at least in part on a comparison of a plurality of received answers to the plurality of dynamic knowledge-based questions with a plurality of valid answers to the plurality of dynamic knowledge-b

Assignees

• Amazon Tech Inc

Inventors

• Canavor Darren Ernest
• Johannson Jesper Mikael

Classifications

• H04L63/083 Primary

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• G06F2221/2131

  Lost password, e.g. recovery of lost or forgotten passwords · CPC title

• G06F21/46 Primary

  by designing passwords or checking the strength of passwords · CPC title

• G06F2221/2103

  Challenge-response · CPC title