Managing security credentials

Patent metadata

Field	Value
Publication number	US-9767262-B1
Application number	US-201113194287-A
Country	US
Kind code	B1
Filing date	Jul 29, 2011
Priority date	Jul 29, 2011
Publication date	Sep 19, 2017
Grant date	Sep 19, 2017

Abstract

Disclosed are various embodiments for managing security credentials. In one embodiment, a request for a security credential is obtained from a client and is stored in association with a user account. Knowledge-based questions are provided to the client in response to the request. At least one of the knowledge-based questions is dynamically generated based at least in part on data associated with the user account. Answers to the knowledge-based questions are obtained from the client. The security credential is provided to the client based at least in part on the answers.

First claim

Therefore, the following is claimed:

1. A non-transitory computer-readable medium embodying specific instructions that, when executed, cause a remote computing device to at least:
automatically generate a security credential for a user account with a network site according to a security credential specification requested from the network site at a standardized location, the security credential having a maximum security strength as defined by the security credential specification;
automatically establish the security credential with the network site as a valid security credential;
select a plurality of knowledge-based questions to be presented to a user at a client computing device in response to receiving a request for the security credential from the client computing device;
provide the plurality of knowledge-based questions to the client computing device in response to the request;
generate a score based at least in part on a comparison of a plurality of received answers to the plurality of knowledge-based questions with a plurality of valid answers to the plurality of knowledge-based questions, the plurality of received answers being received from the client computing device, and individual received answers of the plurality of received answers being weighted with a respective different weight based at least in part on a respective knowledge-based question of the plurality of knowledge-based questions;
provide the security credential to the client computing device when the score meets a predetermined threshold; and
establish a master security credential received from the client computing device as a valid master security credential when the score meets the predetermined threshold.

2. The non-transitory computer-readable medium of claim 1 , wherein at least one of the plurality of knowledge-based questions is dynamically generated based at least in part on purchase transaction data associated with the user.

3. The non-transitory computer-readable medium of claim 1 , wherein the respective different weight for a first answer of the plurality of received answers to a first knowledge-based question of the plurality of knowledge-based questions is greater than the respective different weight for a second answer of the plurality of received answers to a second knowledge-based question of the plurality of knowledge-based questions when a first event associated with the first knowledge-based question is more recent than a second event associated with the second knowledge-based question.

4. A system for providing a security credential, comprising:
at least one remote computing device; and
a security credential manager executable in the at least one remote computing device, wherein, when executed, the security credential manager causes the at least one remote computing device to at least:
automatically generate at least one security credential according to a security credential specification received from a network site at a standardized location;
store the at least one security credential in association with a user account for the network site;
provide a plurality of dynamically generated knowledge-based questions to a user at a client computing device and a request for a master security credential in response to a request for the at least one security credential received from the client computing device;
generate a score based at least in part on a plurality of answers to the plurality of dynamically generated knowledge-based questions, the plurality of answers being received from the user via the client computing device, and individual answers of the plurality of answers being weighted with a respective different weight based at least in part on a respective knowledge-based question of the plurality of dynamically generated knowledge-based questions; and
provide the at least one security credential to the client computing device in response to the score meeting or exceeding a predefined threshold and a determination that the master security credential received from the client computing device is valid.

5. The system of claim 4 , wherein the at least one security credential corresponds to a plurality of security credentials associated with a plurality of different network sites.

6. The system of claim 4 , wherein, when executed, the security credential manager further causes the at least one remote computing device to at least determine that the master security credential received from the client computing device is valid by comparing a hashed version of the master security credential to a valid master security credential that is stored in association with the user account.

7. The system of claim 4 , wherein, when executed, the security credential manager further causes the at least one remote computing device to at least determine that the master security credential received from the client computing device is valid using a public-key cryptographic system.

8. The system of claim 4 , wherein, when executed, the security credential manager further causes the at least one remote computing device to at least automatically establish the at least one security credential with the network site.

9. The system of claim 4 , wherein, when executed, the security credential manager further causes the at least one remote computing device to at least:
automatically regenerate the at least one security credential according to another security credential specification received from the network site, wherein the at least one security credential that has been regenerated replaces the at least one security credential that was previously generated.

10. The system of claim 4 , wherein the client computing device includes a local security credential generation application that causes the client computing device to at least automatically generate another security credential, and, when executed, the security credential manager further causes the at least one remote computer device to at least receive the other security credential from the client computing device.

11. The system of claim 4 , wherein the client computing device corresponds to a kiosk, and the kiosk is configured to remove the at least one security credential from a memory of the kiosk upon expiration of a user session.

12. The system of claim 4 , wherein the security credential specification defines at least a character set and a length for a password.

13. The system of claim 4 , wherein, when executed, the security credential manager further causes the at least one remote computing device to at least, in response to receiving the master security credential from the client computing device, establish the master security credential in the at least one remote computing device as a valid master security credential based at least in part on the plurality of answers to the plurality of dynamically generated knowledge-based questions.

14. The system of claim 4 , wherein the score is generated based at least in part on a recency of an event associated with at least one of the plurality of dynamically generated knowledge-based questions.

15. The system of claim 4 , wherein the score is generated based at least in part on at least one supplemental security credential received from the client computing device.

16. The system of claim 4 , wherein, when executed, the security credential manager further causes the at least one remote computing device to at least dynamically generate the plurality of dynamically generated knowledge-based questions based at least in part on data associated with the user account.

17. The system of claim 16 , wherein the

Assignees

• Canavor Darren E
• Johansson Jesper M
• Amazon Tech Inc

Inventors

• Canavor Darren E
• Johansson Jesper M

Classifications

• G06F21/31 Primary

  User authentication · CPC title

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• H04L9/3226 Primary

  using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083) · CPC title