Remediating unauthorized sharing of account access to online resources
View Patent ↗A number of effective alternatives for discouraging unauthorized online-resource sharing are discussed. An anti-sharing strategy can be built by applying one or more of the alternatives in response to possible, strongly-suspected or virtually certain unauthorized sharing.
1. A method comprising:
processing an authentication request in connection with an account for access to an online resource;
determining, by a processor, whether the account is suspected of unauthorized sharing between a legitimate user and at least one non-legitimate user;
when the account is not suspected of unauthorized sharing, granting access to the online resource; and
when the account is suspected of unauthorized sharing, automatically selecting a sharing remediation technique from a plurality of sharing remediation techniques; and
applying the sharing remediation technique, wherein the automatically selecting operation comprises:
determining whether the suspicion of unauthorized sharing is an initial suspicion of unauthorized sharing or a recurring suspicion of unauthorized sharing; and
when the suspicion of unauthorized sharing is an initial suspicion of unauthorized sharing, selecting a mild sharing remediation technique; and
when the suspicion of unauthorized sharing is a recurring suspicion of unauthorized sharing, selecting a severe sharing remediation technique.
2. The method of claim 1 wherein a suspicion of unauthorized sharing occurring more than a configurable period of time after a prior suspicion of unauthorized sharing is an initial suspicion of unauthorized sharing.
3. The method of claim 1 wherein the plurality of sharing remediation techniques comprises:
displaying an anti-sharing message.
4. The method of claim 3 wherein displaying the anti-sharing message is displaying the anti-sharing message with a first post-authentication page.
5. The method of claim 3 wherein displaying the anti-sharing message is displaying the anti-sharing message in an interstitial page before a first post-authentication page.
6. The method of claim 3 wherein displaying the anti-sharing message is displaying the anti-sharing message in a pop-up dialog window.
7. The method of claim 1 wherein the plurality of sharing remediation techniques comprises:
sending an anti-sharing message via an alternate communication channel.
8. The method of claim 7 wherein the alternate communication channel is an electronic-mail message.
9. The method of claim 7 wherein the alternate communication channel is a Small Message Service (“SMS”) text message.
10. The method of claim 1 wherein the plurality of sharing remediation techniques comprises:
performing a supplemental authentication operation before granting access to the account.
11. The method of claim 10 wherein the supplemental authentication operation is one of:
obtaining an answer to a previously-answered question of personal knowledge; or
requiring selection of a true semi-public information item from among a plurality of decoy information items; or
performing a keystroke-dynamics typing test.
12. The method of claim 1 wherein the plurality of sharing remediation techniques comprises:
forcing a password change for the account.
13. The method of claim 1 wherein the plurality of sharing remediation techniques comprises:
transmitting a new password for the account to an authorized user of the account via an alternate communication channel.
14. The method of claim 13 wherein transmitting the new password for the account comprises:
sending an electronic mail message; or
sending a Small Message Service (“SMS”) text message; or
sending an automatic voice message to a telephone associated with the authorized user.
15. The method of claim 1 wherein the plurality of sharing remediation techniques comprises:
scheduling a workflow item to cause a human contact on a party responsible for the account that is suspected of unauthorized sharing.
16. The method of claim 1 wherein the plurality of sharing remediation techniques comprises:
restricting access to the account that is suspected of unauthorized sharing.
17. The method of claim 1 wherein the plurality of sharing remediation techniques comprises:
alerting an operator of the online resource about the authentication request.