Account access recovery system, method and apparatus

• US 10,063,557 B2
• Filed: 09/30/2015
• Issued: 08/28/2018
• Est. Priority Date: 06/07/2015
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Krstic, Ivan, Wilson, James, Friedman, Eric Daniel, Subramaniam, Selvarajan, Gautier, Patrice O., Gates, John Patrick, Santhanagopal, Ramarathnam, Vaidyanathaswami, Prabhakaran, Mambakkam, Sudhakar, Pai, Raghunandan, Narayanan, Karthik
• Primary Examiner(s): Gergiso, Techane
• Application Number:
  US14/872,034
• Publication Number:
  US 20160359837A1
• Time in Patent Office: 1,063 Days
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 2212/1052 Security improvement
• CPC Class Codes: G06F 2221/2131 Lost password, e.g. recovery of lost or forgotten passwords
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

Some embodiments of the invention provide a program for recovering access to an account. The program receives an access recovery parameter (ARP) after providing a first credential to log into an account and providing a notification of a second credential necessary for accessing another resource. The program then receives a request to modify the first credential and receives the second credential. Next, after authenticating the second credential, the program uses the ARP to modify the first credential without providing the first credential.

Claims

1. A non-transitory machine readable medium storing a program, which when executed by at least one processing unit recovers access to an account, the program comprising sets of instructions for:

receiving an access recovery parameter (ARP) after providing a first credential to log into an account and providing a notification of a second credential necessary for accessing another resource;

receiving a request to modify the first credential;

receiving the second credential; and

after authenticating the second credential, using the ARP to modify the first credential without providing the first credential.

2. The non-transitory machine readable medium of claim 1, wherein the program further comprises a set of instructions for storing the ARP after receiving ARP.

3. The non-transitory machine readable medium of claim 2, wherein the program further comprises a set of instructions for encrypting the ARP before storing the ARP.

4. The non-transitory machine readable medium of claim 2, wherein the program further comprises a set of instructions for using the second credential as a key for encrypting the ARP before storing the ARP.

5. The non-transitory machine readable medium of claim 2,

wherein the non-transitory machine readable medium is a machine readable medium of a device,

wherein the set of instructions for storing the ARP comprises a set of instructions for storing the ARP on the device.

6. The non-transitory machine readable medium of claim 1, wherein the set of instructions for providing the first credential comprises a set of instructions for completing a login process, said login process comprising providing an account password and providing a second factor authentication parameter.

7. The non-transitory machine readable medium of claim 6, wherein the first credential is the account password.

8. The non-transitory machine readable medium of claim 1,

wherein the non-transitory machine readable medium is a machine readable medium of a device,

wherein the other resource is the device,

wherein the second credential is an access control parameter for accessing the device.

9. The non-transitory machine readable medium of claim 8, wherein the access control parameter is a passcode needed to unlock the device after a display screen of the device has been placed in a locked mode.

10. The non-transitory machine readable medium of claim 8, wherein the access control parameter is a gesture control needed to unlock the device after a display screen of the device has been placed in a locked mode.

11. The non-transitory machine readable medium of claim 1, wherein the set of instructions for using the ARP comprises sets of instructions for:

providing the ARP and a new value for the first credential to a set of one or more authentication servers for authenticating the ARP; and

changing the first credential from a previous value to a new value after authenticating the ARP.

12. A method for recovering access to an account on a device, the method comprising:

receiving an access recovery parameter (ARP) after providing a first credential to log into an account and providing a notification of a second credential necessary for accessing another resource;

receiving a request to modify the first credential;

receiving the second credential; and

after authenticating the second credential, using the ARP to modify the first credential without providing the first credential.

13. The method of claim 12 further comprising storing the ARP after receiving ARP.

14. The method of claim 13 further comprising encrypting the ARP before storing the ARP.

15. The method of claim 13 further comprising using the second credential as a key for encrypting the ARP before storing the ARP.

16. The method of claim 13, wherein storing the ARP comprises storing the ARP on the device.

17. The method of claim 12, wherein providing the first credential comprises completing a login process, said login process comprising providing an account password and providing a second factor authentication parameter.

18. The method of claim 12,

wherein the other resource is the device associated with the account,

wherein the second credential is a device access control parameter for accessing the device.

19. The method of claim 18, wherein the access control parameter is a passcode needed to unlock the device after a display screen of the device has been placed in a locked mode.

20. The method of claim 18, wherein the access control parameter is a gesture control needed to unlock the device after a display screen of the device has been placed in a locked mode.