Social Authentication for Account Recovery

• US 20100293600A1
• Filed: 05/14/2009
• Published: 11/18/2010
• Est. Priority Date: 05/14/2009
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Schechter, Stuart, Reeder, Robert Wilson
• Granted Patent: US 8,856,879 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 16/00 Information retrieval; Database structures therefor; File system structures therefor
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 2221/2131 Lost password, e.g. recovery of lost or forgotten passwords
• CPC Class Codes: G06Q 10/00 Administration; Management
• CPC Class Codes: G06Q 50/265 Personal security, identity or safety
• CPC Class Codes: H04L 15/06 with a restricted number of keys, e.g. separate key for each type of code element
• CPC Class Codes: H04L 51/18 Commands or executable codes
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/40 Network security protocols
• CPC Class Codes: H04M 1/665 by checking the validity of a code
• CPC Class Codes: H04M 1/673 the user being required to key in a code
• CPC Class Codes: H04M 1/675 the user being required to insert a coded card, e.g. a smart card carrying an integrated circuit chip
• CPC Class Codes: H04M 1/727 Identification code transfer arrangements
• CPC Class Codes: H04M 2215/0156 Secure and trusted billing, e.g. trusted elements, encryption, digital signature, codes or double check mechanisms to secure billing calculation and information
• CPC Class Codes: H04M 3/382 using authorisation codes or passwords
• CPC Class Codes: H04N 5/9208 : involving the use of subcodes
• CPC Class Codes: H04W 12/06 : Authentication

Abstract

A backup account recovery authentication of last resort using social authentication is described. The account holder requests trustees who have been previously identified to obtain an account recovery code. The account recovery system sends a communication to the trustee for information to verify the trustee as one of the previously identified trustees. The account recovery system then may transmit a link and code with instructions for the trustee to return the link. The account recovery system then transmits a situational query to the trustee to provide additional security. Finally, if all the communications have been completed for the required level of security, the account recovery code is transmitted to the trustee. The trustee sends the account recovery code to the account holder for access to an account.

Claims

1. A method, comprising:

receiving a request from a trustee for an account recovery code, wherein the account recovery code is used by an account holder to obtain access to an account;

transmitting a verification form to the trustee for authentication;

receiving the verification form from the trustee after the verification form is completed by the trustee;

transmitting a code to authenticate the trustee to a pre-identified contact destination;

receiving the code from the trustee to authenticate the trustee;

transmitting a query to the trustee;

receiving a response to the query from the trustee;

determining a probability that the trustee is operating on behalf of the account holder; and

determining whether to send the account recovery code to the trustee based at least in part on the determining of the probability.

2. The method of claim 1, wherein the receiving of the request comprises receiving a request from at least two trustees, and wherein the account recovery code is sent to each of the at least two trustees and further wherein, the account holder must receive the account recovery codes from each of the at least two trustees before the account holder is able to access the account.

3. The method of claim 2, further comprising, if the account holder discovers an unauthorized attempt to obtain a first account recovery code before all of the account recovery codes have been received, the account holder aborts the acquisition of the remaining account recovery codes.

4. The method of claim 2, further comprising aborting the account recovery code process for the first trustee if the code is not received from the first trustee of the at least two trustees.

5. The method of claim 1, wherein the pre-identified contact destination includes one of the following:

telephone;

e-mail;

or

text message.

6. The method of claim 1, wherein the receiving the response to the query further comprises sending the trustee a warning message to enhance security based at least in part on responses provided on the verification form and dynamically updating the warning message to respond to ongoing security threats.

7. The method of claim 1, wherein receiving a code to authenticate the trustee further comprises checking the code against a database record created to track the trustee.

8. The method of claim 1, wherein the code is embedded in a link.

13. The method of claim 1, wherein the receiving the response to the query further comprises sending the trustee a warning message to enhance security based at least in part on responses provided on the verification form and dynamically updating the warning message to respond to ongoing security threats.

9. A method, comprising:

receiving a request from a trustee for an account recovery code;

transmitting a verification form to the trustee for authentication;

receiving the verification form from the trustee after the verification form is completed by the trustee;

identifying the trustee by comparing the verification form as completed by the trustee with information stored in a database;

transmitting a code to authenticate the trustee to a pre-identified contact destination;

receiving the code from the trustee to authenticate the trustee;

transmitting a query to the trustee;

receiving a response to the query from the trustee; and

transmitting the account recovery code to the trustee for delivery to the account holder.

10. The method of claim 9, wherein at least two trustees are identified and account recovery codes from each of the at least two trustees are sent to the account holder before the account holder is able to access the account.

11. The method of claim 10, further comprising, if the account holder discovers an unauthorized attempt to obtain a first account recovery code before all of the account recovery codes have been received, the account holder aborts the acquisition of the remaining account recovery codes.

12. The method of claim 11, wherein the account recovery code sent to each of the at least two trustees comprises six characters.

14. One or more computer-readable media comprising computer-executable instructions that, when executed, perform the method, comprising:

receiving a request from a trustee for an account recovery code, wherein the account recovery code is used by an account holder to obtain access to an account;

transmitting a verification form to the trustee for authentication;

receiving the verification form from the trustee after the verification form is completed by the trustee;

transmitting a code to authenticate the trustee to a pre-identified contact destination;

receiving the code from the trustee to authenticate the trustee;

transmitting a query to the trustee;

receiving a response to the query from the trustee;

sending a warning message to the trustee to enhance security based at least in part on responses provided on the verification form, wherein the warning message is dynamically updated to respond to ongoing security threats;

wherein the warning message is configured to provide the trustee with information to assist at least in part in determining whether or not to proceed with the acquisition of the account recovery code, and further wherein the trustee contacts the account holder to confirm the request with the account holder to further assist in determining whether or not to proceed with the acquisition of the account recovery code.

15. The method of claim 14, wherein at least two trustees are identified and account recovery codes from each of the at least two trustees are sent to the account holder before the account holder is able to recover access the account.

16. The method of claim 15, wherein if the account holder discovers an unauthorized attempt to obtain a first account recovery code before all of the account recovery codes have been received, the account holder aborts the acquisition of the remaining account recovery codes.

17. The method of claim 14, wherein if the trustee decides to proceed with the acquisition of the account recovery codes after receiving the warning message, the trustee electronically signs the warning message and transmits the signed warning message providing authorization to proceed.

18. The method of claim 14, wherein if the trustee decides not to proceed with the acquisition of the account recovery code after receiving the warning message, the trustee aborts the acquisition of the account recovery code.

19. The method of claim 14, wherein receiving a code to authenticate the trustee further comprises checking the code against a database record created to track the trustee.

20. The method of claim 14, wherein the pre-identified contact destination includes one of the following:

telephone;

e-mail;

or

text message.