Verification of credential reset

Patent metadata

Field	Value
Publication number	US-9954867-B1
Application number	US-201514969424-A
Country	US
Kind code	B1
Filing date	Dec 15, 2015
Priority date	Dec 15, 2015
Publication date	Apr 24, 2018
Grant date	Apr 24, 2018

Abstract

Methods and systems are provided for verifying reset of credentials for user accounts. The methods and systems receive a request to change a credential associated with a user account. The user account has account privileges associated with a network service. The methods and systems set the user account to a cool-down status and send a reset notification to one or more trusted access points associated with the user account to inform a valid owner or user of the account that a credential has been reset. The methods and systems manage availability of at least a restricted subset of the account privileges for a cool-down time period or until a reset verification is received from a valid owner or user.

First claim

What is claimed is:

1. A non-transitory computer-readable storage medium having stored thereon executable instructions that, as a result of execution by one or more processors of a computer system, cause the computer system to at least:
receive a request to change a credential associated with a user account, the user account having account privileges associated with a network service;
grant the request to change the credential associated with the user account;
convey a reset notification to one or more trusted access points associated with the user account, the reset notification indicating that the credential has been changed in connection with the user account;
set a status of the user account to a cool-down status;
deny access to restricted account privileges while the user account is in the cool-down status; and
maintain the cool-down status for a period of time based on at least one of a cool-down time period or a reset verification from the one or more trusted access points.

2. The non-transitory computer-readable storage medium of claim 1 , wherein the credential represents a password and the computer system denies access to at least one of i) the user account or ii) a restricted subset of the account privileges, after the password is reset, for the cool-down time period.

3. The non-transitory computer-readable storage medium of claim 1 , wherein the computer system further identifies a first client computing device that generated the request to change the credential, wherein the convey operation includes transmitting the reset notification to a second client computing device that represents one of the trusted access points.

4. A computer implemented method, comprising:
receiving a request to change a credential associated with a user account, the user account having account privileges associated with a network service;
granting the request to change the credential associated with the user account;
setting the user account to a cool-down status; and
managing availability of at least a restricted subset of the account privileges based on at least one of a cool-down time period or a reset verification.

5. The method of claim 4 , further comprising determining whether the reset verification is received from a client computing device that differs from a client computing device that sent the request to change the credential, the availability of the account privileges managed based on the determining operation.

6. The method of claim 4 , wherein the restricted subset includes all of the account privileges and the managing operation denies access to the user account until either i) the cool-down time period expires or ii) the reset verification is received from a trusted access point.

7. The method of claim 4 , wherein the request to change the credential is received from a mobile phone, and the reset notification is transmitted to a trusted access point corresponding to a network application operating on a different client computing device.

8. The method of claim 4 , wherein the cool-down period continues indefinitely until receiving the reset verification.

9. The method of claim 4 , further comprising conveying a reset notification to one or more trusted access points associated with the user account, the reset notification indicating that the credential has been changed in connection with the user account.

10. The method of claim 9 , wherein the reset notification indicates that the credential has been reset and directs a user to log back into the user account from a trusted access point to terminate the cool-down time period.

11. The method of claim 9 , further comprising identifying a change in an account status; and varying a content of a notification regarding the change based on whether the user account is in the cool-down status.

12. The method of claim 9 , further comprising locking the user account in connection with receiving a reset deny instruction.

13. The method of claim 4 , further comprising receiving a network communication from at least one of a single purpose purchase device and a networked environment control device, the network communication representing the reset verification.

14. The method of claim 4 , wherein the managing operation includes:
granting access, during the cool-down time period, to un-restricted account privileges that include at least one of viewing pre-existing digital content stored in connection with the user account or performing one-click transactions; and
denying access, during the cool-down time period, to restricted account privileges that include at least one of i) accessing cloud drive content, ii) viewing transaction history, iii) viewing device session history, iv) changing an address associated with the user account; or v) changing a financial instrument associated with the user account.

15. A system, comprising:
at least one processor; and
a memory coupled to the at least one processor, wherein the memory stores program instructions, wherein the program instructions are executable by the at least one processor to:
receive a request to change a credential associated with a user account, the user account having account privileges associated with a network service;
grant the request to change the credential associated with the user account;
set a status of the user account to correspond to a cool-down status;
maintain the user account in the cool-down status until receiving a reset verification or expiration of a cool-down time period; and
manage availability of the account privileges based on whether the user account is in the cool-down state.

16. The system of claim 15 , wherein the manage operation denies access to at least a restricted subset of the account privileges during the cool-down period.

17. The system of claim 15 , wherein the network session relates to an e-commerce transaction, and the program instructions are executable by the at least one processor to:
identify a change in an account status in connection with the transaction; and
designate a notice, relating to the change in the account status, based on whether the user account is in the cool-down status.

18. The system of claim 17 , wherein the memory stores a trusted access point, the one or more processors sending a reset notification to the trusted access point.

19. The system of claim 15 , wherein the memory stores, in connection with the user account, a prioritized list of account privileges, the prioritized list based on transactions that have high, medium and low risk.

20. The system of claim 15 , wherein the memory stores, in connection with the user account, sign-in credentials, account privileges, access points and trusted access points, the access points representing at least one of client computing devices, browsers or applications that have been used previously during a network session with a valid owner of user of the user account.

Assignees

• Amazon Tech Inc

Inventors

• Johansson Jesper Mikael
• Funderburk Max Harwell
• Khurrum Mian Zainulabadin
• Karukurichi Subramanian Kripa Shankar

Classifications

• G06F21/31

  User authentication · CPC title

• H04L63/102 Primary

  Entity profiles · CPC title

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• H04L67/22

  Electricity · mapped topic

• H04L67/535

  Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34) · CPC title