Selectively specifying account access recovery process based on account activity

• US 10,110,583 B1
• Filed: 08/07/2016
• Issued: 10/23/2018
• Est. Priority Date: 06/07/2015
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Krstic, Ivan, Wilson, James, Friedman, Eric Daniel, Subramaniam, Selvarajan, Gautier, Patrice O., Gates, John Patrick, Santhanagopal, Ramarathnam, Vaidyanathaswami, Prabhakaran, Mambakkam, Sudhakar, Pai, Raghunandan, Narayanan, Karthik
• Primary Examiner(s): Chen, Eric
• Application Number:
  US15/230,446
• Time in Patent Office: 807 Days
• Field of Search: None
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 2221/2131 Lost password, e.g. recovery of lost or forgotten passwords
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32

Abstract

Some embodiments provide an account-access recovery method that receives a request to recover access to an account. The method also assesses recent usage of a device that is associated with the account. The method also, based on the assessment, selects a recovery process from a group of different recovery processes for regaining access to the account. The method also provides the selected recovery process to a party that is requesting the access recovery.

Claims

1. An account-access recovery method comprising:

receiving a request to recover access to an account;

assessing obtained data regarding recent usage of a device associated with the account to compute an activity metric value to quantify the recent usage of the device;

selecting, based at least in part on the activity metric value, a recovery process identifier that identifies a recovery process of a group of different recovery processes for regaining access to the account; and

providing the selected recovery process to a party that is requesting the access recovery.

2. The method of claim 1, wherein assessing the obtained data regarding the recent usage further comprises:

obtaining unlock event data for the device, wherein an access control parameter must be provided on the device in order to unlock the device; and

assessing the unlock event data to determine whether the device has been unlocked a requisite number of times during a time period.

3. The method of claim 2,

wherein the obtained unlock event data comprises a flag that indicates whether the device has been unlocked with a time period before receiving the request to recover access.

4. The method of claim 3, wherein the device provides unlock event data periodically about whether the device has been unlocked a requisite number of times during a previous monitoring time period, and the device provided unlock event data is stored in a storage from which the unlock event data is subsequently obtained.

5. The method of claim 3,

wherein the device stores an account recovery parameter that allows the device to request the account access recovery through the access control parameter of the device,

wherein the device unlock event data is assessed in order to ensure that the device is not readily available to use in the account access recovery.

6. The method of claim 1,

wherein each recovery process requires a set of recovery operations to be performed,

wherein two different recovery processes have at least one recovery operation not in common.

7. The method of claim 6, wherein recovery operations of different recovery processes includes one or more of:

answering a set of one or more questions regarding a user of the device, wherein a set of answers to the questions was previously collected;

retrieving a secondary authentication parameter from an email account;

retrieving a secondary authentication parameter from a text message sent to a trusted phone number associated with the user;

providing a security code from a credit card; and

showing a personal identification document to identify the user.

8. The method of claim 6,

wherein a first set of recovery operations of a first recovery process comprises answering a first set of questions regarding a user of the device,

wherein a second set of recovery operations of a second more onerous recovery process comprises answering a second set of questions regarding the user of the device,

wherein the second set of questions are more difficult questions than the first set of questions as the second set of questions have less commonly known answers.

9. The method of claim 1, wherein the received request is one of (1) a request to reset a credential for accessing the account and (2) a request to unlock an account that has been locked and cannot be used.

10. A non-transitory machine readable medium storing a program which when executed by at least one processor processes account-access recovery requests, the program comprising sets of instructions for:

receiving a request to recover access to an account;

assessing recent usage of a device associated with the account, wherein the assessing comprises obtaining unlock event data for the device and assessing the unlock event data to determine whether the device has been unlocked a predetermined number of times during a time period, further wherein an access control parameter must be provided on the device in order to unlock the device and the unlock event data comprises a flag that indicates whether the device has been unlocked within a time period before receiving the request to recover access;

based on the assessment, selecting a recovery process from a group of different recovery processes for regaining access to the account; and

providing the selected recovery process to a party that is requesting the access recovery.

11. The non-transitory machine readable medium of claim 10, wherein the set of instructions for selecting a recovery process comprises sets of instructions for:

selecting a first recovery process comprising a first recovery operation for a first assessed usage level of the device; and

selecting a second recovery process comprising a second recovery operation for a second assessed usage level of the device,

wherein the first assessed usage level is less than the second assessed usage level,

wherein the second recovery operation is more onerous than the first recovery operation.

12. The non-transitory machine readable medium of claim 10,

wherein the device has an access control parameter for unlocking and using the device,

wherein the device stores an account recovery parameter that allows the device to request the account access recovery,

wherein in response to an account access recovery request, the device (1) provides a prompt to receive the access control parameter, and (2) after receiving the access control parameter in response to the prompt, sends the account recovery parameter to request the account access recovery,

wherein the set of instructions for providing the selected recovery process comprises a set of instructions for directing the use of the device'"'"'s access control parameter to request the account access recovery.

13. The non-transitory machine readable medium of claim 10, wherein the set of instructions for assessing recent usage of the device comprises a set of instructions for assessing the device'"'"'s use of the account.

14. The non-transitory machine readable medium of claim 13, wherein the set of instructions for assessing the device'"'"'s use of the account comprises a set of instructions for assessing the device'"'"'s active use of at least one service associated with the account.

15. The non-transitory machine readable medium of claim 14,

wherein the set of instructions for assessing the device'"'"'s use of the account further comprises a set of instructions for discounting the device'"'"'s passive use of at least one service associated with the account,

wherein an active use requires participation by a user, while a passive use does not require participation by the user.

16. A device comprising:

a memory; and

at least one processor configured to;

receive a request to recover access to an account;

assess obtained data regarding recent usage of the account to compute an activity metric value to quantify the recent usage of the account;

select, based at least in part on the activity metric value, a recovery process identifier that identifies one recovery process of a group of different recovery processes for regaining access to the account; and

provide the selected recovery process to a party that is requesting the access recovery.

17. The device of claim 16, wherein obtained data regarding recent usage of the account comprises data regarding usage of the account a time period before receiving the request to recover access.

18. The device of claim 16, wherein the at least one processor is configured to select, based at least in part on the activity metric value, the recovery process identifier by using a recovery graph to correlate different recovery process identifiers to different activity metric values.

19. The device of claim 16, wherein the at least one processor is configured to select, based at least in part on the activity metric value, the recovery process identifier by using a look up table to correlate different recovery process identifiers to different activity metric values.

20. The device of claim 16, wherein the received request is one of (1) a request to reset a credential for accessing the account and (2) a request to unlock an account that has been locked and cannot be used.