Automated account recovery using trusted devices
Embodiments of the invention are directed to an automated account restoration system. In some embodiments, the system determines a state of an account based on a likelihood that the account has been compromised. If the account is determined to be in a low-risk state, then upon an successful login to that account, a verification cookie may be generated which is unique to a user device used to access the account. If the account is determined to be in a high-risk state, then system may prevent access to the account except by user devices that include a valid verification cookie.
1. A method comprising:
receiving, at a service provider computer from a user device, a request to access an account, the request including a device identifier and login credentials;
determining, by the service provider computer, whether the account is in a high-risk state or a low-risk state;
upon determining that the account is in a low-risk state, and upon determining that the login credentials are valid:
generating a verification cookie from the device identifier;
providing the verification cookie to the user device for storage in a memory of the user device; and
providing access to the account via the user device; and
upon determining that the account is in a high-risk state, and upon determining that the login credentials are valid:
retrieving the verification cookie from the memory of the user device;
determining whether the verification cookie is valid, the determining comprises:
determining whether a creation date of the verification cookie is before or after a date attributed to a breach detected with respect to the account; and
providing access to the account via the user device only if the verification cookie is valid.
2. The method of claim 1 , wherein the account is determined to be in a high-risk state if a breach is detected with respect to the account.
3. The method of claim 1 , wherein upon determining that the account is in a high-risk state, and upon determining that the login credentials are valid, the method further comprises completing a password reset process via the user device.
4. The method of claim 3 , wherein the account is placed in a low-risk state upon completing the password reset process.
5. The method of claim 1 , wherein providing the verification cookie to the user device for storage in the memory of the user device comprises replacing an existing verification cookie stored in the memory of the user device.
6. The method of claim 1 , wherein the verification cookie is encrypted using a cryptographic key known to the service provider computer.
7. The method of claim 1 , wherein determining whether the verification cookie is valid comprises determining whether an obscured device identifier in the verification cookie matches the device identifier.
8. The method of claim 7 , wherein the obscured device identifier is an encrypted version of a device identifier, and wherein determining whether the obscured device identifier matches the device identifier comprises decrypting the obscured device identifier and comparing the decrypted result to the device identifier.
9. The method of claim 7 , wherein the obscured device identifier is a hashed version of a device identifier, and wherein determining whether the obscured device identifier matches the device identifier comprises hashing the device identifier and comparing the hashed result to the obscured device identifier.
10. A service provider computer comprising:
a processor; and
a memory including instructions that, when executed with the processor, cause the service provider computer to, at least:
receive, from a user device, a request to access an account, the request including a device identifier and login credentials;
determine a current state of the account;
upon determining that the current state of the account is a high-risk state, and upon determining that the login credentials are valid:
retrieve a verification cookie from the memory of the user device;
determine whether the verification cookie is valid, wherein determining comprises:
determining whether a creation date of the verification cookie is before or after a date attributed to a breach detected with respect to the account; and
provide access to the account via the user device only if the verification cookie is valid.
11. The service provider computer of claim 10 , wherein the verification cookie has been generated by the service provider computer and provided to the user device in response to a previous request to access the account via the user device.
12. The service provider computer of claim 11 , wherein the verification cookie has been generated in response to determining that the previous request to access the account via the user device was made while the account was in a low-risk state.
13. The service provider computer of claim 10 , wherein the instructions further cause the service provider computer to generate a second verification cookie upon determining that the verification cookie is not valid, the second verification cookie indicating that the user device is not authorized to access the account.
14. The service provider computer of claim 13 , wherein the instructions further cause the service provider computer to, upon receiving the second verification cookie in a subsequent request to access the account, deny access to the account.
15. The service provider computer of claim 10 , wherein the instructions further cause the service provider computer to, upon determining that the verification cookie is not valid, provide a notification that the login credentials are not valid.
16. The service provider computer of claim 10 , wherein the instructions further cause the service provider computer to initiate a password reset upon providing access to the account via the user device.
17. The service provider computer of claim 10 , wherein determining whether the verification cookie is valid comprises determining whether an obscured device identifier included in the verification cookie corresponds to the device identifier.
18. A service provider computer comprising:
a processor; and
a memory including instructions that, when executed with the processor, cause the service provider computer to, at least:
receive, from a user device, a request to access an account, the request including a device identifier and login credentials;
determine a current state of the account;
upon determining that the current state of the account is a high-risk state, and upon determining that the login credentials are valid:
retrieve a verification cookie from the memory of the user device;
determine that the verification cookie is not valid;
generate a second verification cookie upon determining that the verification cookie is not valid, the second verification cookie indicating that the user device is not authorized to access the account; and
upon receiving the second verification cookie in a subsequent request to access the account, deny access to the account.