Peer recovery procedures for access recovery and access control
The technology disclosed teaches systems, methods, and media for enabling a user to recover from a loss of one or more authentication factors that are required in order to access a service. A pre-registered helper user is able to participate in the authentication journey on behalf of the user and provide an identity validation of the user in order to successfully authenticate the user in order for an authentication journey server to grant the user access to the service. The technology disclosed further teaches systems, methods, and media obtaining secondary approval for a request to initiate a restricted action during a first active session between a user and a service. A pre-registered supervisor user is able to participate in the authentication journey on behalf of the user and provide a secondary approval for the request in order for an authentication journey server to grant the user access to the service.
1 . A computer-implemented method of enabling a user to recover from a loss of an authentication factor required by a multi-factor authentication journey to access a service, the computer-implemented method including:
an authentication journey server receiving, from a pre-registered helper on behalf of the user, a request to initiate an authentication journey for the user utilizing a recovery procedure, the request including an authentication of the pre-registered helper, wherein the request to initiate serves as a first identity validation of the user;
setting a help-me flag for the authentication journey and pushing, to the user, an authentication link for the authentication journey;
receiving from the user responsive to the pushed authentication link, a second identity validation for the user;
approving the second identity validation of the user and clearing the help-me flag; and
granting the user access to the service.
2 . The computer-implemented method of claim 1 , wherein the authentication journey server allows the pre-registered helper to initiate the authentication journey for the user.
3 . The computer-implemented method of claim 1 , wherein the pre-registered helper has been previously enrolled with the service and registered as a helper via a voluntary agreement with the user.
4 . The computer-implemented method of claim 1 , wherein the pre-registered helper has been previously enrolled due to an established relationship with the user within an organization structure, and further including the authentication journey server accessing the organization structure from an identity and access management database.
5 . The computer-implemented method of claim 1 , wherein the granting further includes pushing an access link to the user following the approval of the second identity validation, wherein the access link directs the user towards the service.
6 . The computer-implemented method of claim 5 , wherein the access link includes a request for the user to register a replacement for a lost authentication factor.
7 . A system for enabling a user to recover from a loss of an authentication factor required by a multi-factor authentication journey to access a service, the system including a processor, memory coupled to the processor and program instructions to implement the computer-implemented method of claim 1 when loaded into the memory.
8 . The system of claim 7 , wherein the authentication journey server allows the pre-registered helper to initiate the authentication journey for the user.
9 . A tangible non-transitory computer-readable storage media, including program instructions loaded into memory that, when executed on processors, cause the processors to implement the computer-implemented method of claim 1 .
10 . A computer-implemented method of enabling a user to recover from a loss of an authentication factor required by a multi-factor authentication journey to access a service, the computer-implemented method including:
an authentication journey server receiving, from the user, a request to initiate an authentication journey for the user utilizing a recovery procedure engaging a pre-registered helper, the request including at least one authentication factor of the user, wherein the request to initiate serves as a first identity validation of the user;
setting a help-me flag for a helper branch of the authentication journey and pushing, to the pre-registered helper, an authentication link for the authentication journey, while the user remains engaged with the authentication journey;
receiving, from the pre-registered helper, responsive to the pushed authentication link, a second identity validation for the user while the user still remains engaged with the authentication journey;
approving the second identity validation of the user and clearing the help-me flag; and
granting the user access to the service.
11 . The computer-implemented method of claim 10 , wherein the pre-registered helper has been previously enrolled with the service and registered as a helper via a voluntary agreement with the user.
12 . The computer-implemented method of claim 10 , wherein the pre-registered helper has been previously enrolled due to an established relationship with the user within an organization structure, and further including the authentication journey server accessing the organization structure from an identity and access management database.
13 . The computer-implemented method of claim 10 , further including pushing, to the user, an access link following the approval of the second identity validation, wherein the access link directs the user towards the service and includes a request for the user to provide at least one additional authentication factor in order to access the service.
14 . A system for enabling a user to recover from a loss of an authentication factor required by a multi-factor authentication journey to access a service, the system including a processor, memory coupled to the processor and program instructions to implement the computer-implemented method of claim 10 when loaded into the memory.
15 . The system of claim 14 , further including pushing, to the user, an access link following the approval of the second identity validation, wherein the access link directs the user towards the service and includes a request for the user to provide at least one additional authentication factor in order to access the service.
16 . A tangible non-transitory computer-readable storage media, including program instructions loaded into memory that, when executed on processors, cause the processors to implement the computer-implemented method of claim 10 .
17 . A computer-implemented method of enabling a user to recover from a loss of a first authentication factor and a second authentication factor that both are required in order to access a service, the computer-implemented method comprising:
an authentication journey server receiving, from a first pre-registered helper on behalf of the user, a request to initiate an authentication journey for the user utilizing a recovery procedure, the request including an authentication of the first pre-registered helper, wherein the request to initiate serves as a first identity validation of the user;
setting a help-me flag for the authentication journey and pushing, to a second pre-registered helper, a link for the authentication journey;
receiving, from the second pre-registered helper responsive to the pushed link, an authentication of the second pre-registered helper, wherein the authentication of the second pre-registered helper serves as a second identity validation of the user;
approving the first and second identity validations of the user and clearing the help-me flag; and
granting the user access to the service.
18 . The computer-implemented method of claim 17 , wherein the authentication journey server allows the first pre-registered helper to initiate the authentication journey for the user utilizing the recovery procedure after the user loses one authentication factor and allows the second pre-registered helper to participate in the authentication journey for the user utilizing the recovery procedure after the user loses two authentication factors.
19 . The computer-implemented method of claim 17 , wherein the first and second pre-registered helpers have each been previously enrolled with the service and registered as a helper via a voluntary agreement with the user.
20 . The computer-implemented method of claim 17 , wherein the first and second pre-registered helpers have each been previously enrolled due to an established relationship with the user within an organization structure, and further including the authentication journey server accessing the organization structure from an identity and access management database.
21 . The computer-implemented method of claim 20 , wherein the first pre-registered helper belongs to a first branch of the organization structure and the second pre-registered helper belongs to a second branch of the organization structure, and wherein the first branch has a non-overlapping team or leadership from the second branch.
22 . The computer-implemented method of claim 17 , further including pushing, to the user, an access link following the approval of the second identity validation, wherein the access link directs the user towards the service and includes a request for the user to register a replacement for both the first authentication factor and the second authentication factor.
23 . A system for enabling a user to recover from a loss of a first authentication factor and a second authentication factor that both are required in order to access a service, the system including a processor, memory coupled to the processor and program instructions to implement the computer-implemented method of claim 17 when loaded into the memory.
24 . The system of claim 23 , wherein the authentication journey server allows the first pre-registered helper to initiate the authentication journey for the user utilizing the recovery procedure after the user loses one authentication factor and allows the second pre-registered helper to participate in the authentication journey for the user utilizing the recovery procedure after the user loses two authentication factors.
25 . A tangible non-transitory computer-readable storage media, including program instructions loaded into memory that, when executed on processors, cause the processors to implement the computer-implemented method of claim 17 .