Method and system for enabling automatic access to an online account

Some embodiments provide a system that enables access to an online account. During operation, the system receives a login attempt containing a login for the online account through a login interface associated with the online account. Next, the system receives, from the user, user-initiated communications outside of the login interface requesting automatic access to the online account. The system then identifies the online account using the user-initiated communications. Finally, the system temporarily enables the automatic access to the online account using the login from the login attempt without requiring additional authentication information from the login attempt.

BACKGROUND

Related Art

The present embodiments relate to techniques for enabling access to online accounts.

Online accounts are typically accessed through a computing device with network connectivity, such as a laptop computer. Furthermore, access to an online account is typically only granted after valid authentication credentials, such as a login and password, are provided by a user of the computing device. Such authentication credentials may be used both to identify the online account and prevent unauthorized access to the online account. Consequently, knowledge of the authentication credentials should be restricted to authorized users of the online account.

However, in practice, authorized users may occasionally permit access to the online account by other users. For example, an authorized user of the online account may wish to access the online account but may not have network connectivity and/or a suitable computing device. As a result, the authorized user may permit a trusted user, such as a friend or family member, to access the online account on the authorized user's behalf using the authorized user's authentication credentials. While such access may be approved by the authorized user, sharing of authentication credentials may violate the security policy of the online account and/or create potential security risks for the online account. For example, the trusted user may accidentally reveal the authentication credentials to a malicious user allowing the malicious user to more easily gain access to the online account and/or other online accounts containing the same password. Furthermore, to maintain security for the online account, the authorized user may be required to change his/her password after sharing the password with the trusted user. Such password changes may be burdensome for the authorized user and may increase the likelihood that the authorized user forgets the new password and is thus unable to access the online account.

Hence, what is needed is a mechanism for enabling access to online accounts by trusted users without revealing authentication credentials for the online accounts to the trusted users.

SUMMARY

Some embodiments provide a system that enables access to an online account. During operation, the system receives a login attempt containing a login for the online account through a login interface associated with the online account. Next, the system receives, from the user, user-initiated communications outside of the login interface requesting automatic access to the online account. The system then identifies the online account using the user-initiated communications. Finally, the system temporarily enables the automatic access to the online account using the login from the login attempt without requiring additional authentication information from the login attempt.

In some embodiments, the system also disables the automatic access to the online account upon establishing a user session for accessing the online account through the login attempt.

In some embodiments, the system also disables the automatic access to the online account if the login attempt is not received within an enabled period corresponding to the temporarily enabled automatic access.

In some embodiments, the system also terminates a user session for accessing the online account through the login attempt upon an expiration of the enabled period if the login attempt is received within the enabled period.

In some embodiments, the user-initiated communications are received after the login attempt and is used to verify a request for the automatic access to the online account from the login attempt.

In some embodiments, the user-initiated communications are received before the login attempt and is used to temporarily enable the automatic access to the online account prior to receiving the login attempt.

In some embodiments, a source of the user-initiated communications is used to identify the online account.

In some embodiments, the user-initiated communications are provided using at least one of a text message, a phone call, and an interactive voice response (IVR) command.

DETAILED DESCRIPTION

Embodiments provide a method and system for enabling access to an online account. The online account may be accessed through a web-based user interface from a computing device with network connectivity, such as a personal computer or laptop computer. In addition, access to the online account may only be granted if valid authentication credentials for the online account, such as a login and password, are received from the computing device.

More specifically, embodiments may provide a method and system for bypassing traditional authentication mechanisms associated with the online account. In particular, automatic access to the online account using only the login may temporarily be enabled by receiving user-initiated communications requesting the automatic access to the online account. The user-initiated communications may be used to identify the online account and enable the automatic access to the online account. A login attempt containing only the login for the online account may be permitted to access the online account while the automatic access is enabled. The automatic access may then be disabled after the login attempt is made and/or upon expiration of an enabled period corresponding to the temporarily enabled automatic access.

FIG. 1shows a schematic of a system in accordance with an embodiment. The system may be used to enable automatic access to an online account, as described above. As shown inFIG. 1, the system includes a communications device102, a communications server104, an authentication server106, a login interface108, and a computing device110.

Authentication server106may correspond to a software and/or hardware component that is used to authenticate a user of the online account. To authenticate the user, authentication server106may obtain authentication credentials, such as a login, a password, an answer to a security question, and/or a software token, from the user. If the authentication credentials match the authentication credentials for the online account, the user is granted access to the online account. If the authentication credentials do not match the authentication credentials for the online account, the user is denied access to the online account.

To obtain the authentication credentials, authentication server106may provide a login interface108through which the user may enter the authentication credentials. In one or more embodiments, login interface108corresponds to a web-based user interface. For example, login interface108may include one or more webpages that obtain the authentication credentials from the user and notify the user of the validity of the authentication credentials. Moreover, because login interface108and the online account may be web-based, user access to both login interface108and the online account may be restricted to computing devices (e.g., computing device110) with network connections and web browsers, such as personal computers.

However, the user may not always have access to a computing device that enables interaction with login interface108. For example, the user may lose network connectivity on his personal computer, or the user may not be near a computing device with a web browser. Consequently, lack of access to a suitable computing device and/or network connection may preclude the user from accessing the online account and performing tasks using the online account. Instead, the user may permit a trusted user, such as a friend or family member, to access the online account and perform tasks using the online account on the user's behalf.

In one or more embodiments, the system ofFIG. 1allows the trusted user to temporarily bypass normal authentication mechanisms enforced by authentication server106in accessing the online account. In other words, the trusted user may be allowed to access the online account for the user without acquiring knowledge of the authentication credentials for the online account. The system ofFIG. 1may thus allow greater flexibility in accessing the online account without compromising the security of the online account or violating a security policy for the online account.

To enable access to the online account by the trusted user, the user may send user-initiated communications112requesting automatic access to the online account from communications device102(e.g., a mobile phone, telephone, etc). User-initiated communications112may be provided using a text message, a phone call, and/or an interactive voice response (IVR) command. For example, user-initiated communications112may be sent as a text message from a mobile phone, a telephone call between the user and a call center operator, and/or an IVR command sent from a telephone or mobile phone by the user. Furthermore, user-initiated communications112may be transmitted over secured and/or trusted communications mechanisms. For example, user-initiated communications112may be sent to a phone number provided by communications server104to enable access to online accounts with authentication server106by trusted users.

User-initiated communications112may then be received by communications server104and processed to obtain information associated with the request. For example, communications server104may determine a source (e.g., phone number) of user-initiated communications112and/or parse the contents of user-initiated communications112to obtain additional information such as a login and/or password for the online account.

Authentication server106may then identify the online account using the source and/or contents of user-initiated communications112. In particular, authentication server106may obtain the source of user-initiated communications112and/or the contents of user-initiated communications112from communications server104. Authentication server106may use the source and/or the contents to identify the online account, as well as verify the validity of the request in user-initiated communications112. For example, authentication server106may confirm a valid request for automatic access to the online account by matching the phone number from which user-initiated communications112is sent and the phone number listed under the online account. The phone number may be obtained from the user during registration for the online account and stored under a database entry for the online account.

Authentication server106may also examine the contents of user-initiated communications112for valid authentication credentials associated with the online account, such as the login and password for the online account. For example, authentication server106may parse the contents of a text message and/or IVR command to obtain the login, password, security token, and/or other authentication credentials required to enable access to the online account by the trusted user.

Next, authentication server106may temporary enable automatic access to the online account through login interface108. In one or more embodiments, authentication server106enables automatic access to the online account by allowing access to the online account using only the login for the online account. In other words, authentication server106may not require additional authentication information (e.g., password, security token, etc.) outside of the login to grant access to the online account while automatic access to the online account is enabled.

After automatic access to the online account is enabled, the trusted user may access the online account on a network-connected computing device (e.g., computing device110) by providing a login attempt containing the login for the online account through login interface108. If the login attempt is made while automatic access to the online account is enabled, a user session for accessing the online account is established with the trusted user. In other words, the user session may allow the trusted user to perform tasks associated with the online account on the user's behalf.

In one or more embodiments, the login attempt is made before user-initiated communications112are received by communications server104. User-initiated communications112may thus be used to verify a request for automatic access to the online account from the previously received login attempt, as described below with respect toFIG. 3. Alternatively, the login attempt may be made after user-initiated communications112are received by communications server104. Consequently, user-initiated communications112may be used to temporarily enable automatic access to the online account prior to receiving the login attempt, as discussed below with respect toFIG. 2.

In one or more embodiments, the temporary enabling of automatic access to the online account corresponds to an enabled period during which automatic access to the online account is enabled. For example, automatic access to the online account may be enabled for an enabled period of five minutes after user-initiated communications112is received. The enabled period may also limit the duration of the user session created from the automatic access.

The enabled period may be set by authentication server106(e.g., for security reasons) and/or specified by the user in user-initiated communications112(e.g., to allocate time for performing tasks on the online account by the trusted user). If the login attempt is not received within the enabled period, the automatic access is disabled and authentication server106may resume the use of normal authentication mechanisms in granting access to the online account. Alternatively, the user may manually disable automatic access to the online account prior to the expiration of the enabled period by sending additional user-initiated communications from communications device102to communications server104. For example, the user may transmit a text message containing a request to disable automatic access to the online account prior to the expiration of a five-minute enabled period for automatic access to the online account. Authentication server106may disable automatic access to the online account upon receiving the request instead of waiting until the enabled period has expired.

The automatic access may also be disabled upon establishing the user session for accessing the online account through the login attempt. In other words, automatic access to the online account may be disabled after the first successful attempt to access the online account using automatic access. Finally, the user session may be terminated upon expiration of the enabled period if the trusted user has not logged out of the online account by then.

FIG. 2shows a flowchart illustrating the process of enabling access to an online account in accordance with an embodiment. In one or more embodiments, one or more of the steps may be omitted, repeated, and/or performed in a different order. Accordingly, the specific arrangement of steps shown inFIG. 2should not be construed as limiting the scope of the technique.

Initially, user-initiated communications requesting automatic access to the online account are received (operation202). The user-initiated communications may be sent by a user of the online account as a text message, phone call, and/or IVR command. As a result, the user-initiated communications may originate from a phone number linked to the online account. The user-initiated communications may also include other information associated with the request, such as authentication credentials for the online account and/or an enabled period during which the automatic access is allowed. The phone number and/or contents of the user-initiated communications may then be used to identify the online account (operation204).

Next, automatic access to the online account is temporarily enabled (operation206). The automatic access may correspond to granting access to the online account using only the login for the online account and without requiring additional authentication information from the login attempt. In addition, the automatic access may only be enabled during the enabled period. The automatic access may also be terminated prior to the expiration of the enabled period if additional user-initiated communications (e.g., text message, phone call, IVR command, etc.) requesting such termination are received from the user. If a login attempt containing the login for the account is received during the enabled period (operation208), a user session for accessing the online account through the login attempt is established (operation210) and the online account may be accessed using the user session.

As described above, the user session may be terminated upon expiration of the enabled period. Furthermore, automatic access to the online account is disabled after the user session is established (operation212). If a login attempt containing the login for the account is not received during the enabled period, automatic access to the online account is disabled (operation212) and normal authentication mechanisms for granting access to the online account are resumed.

FIG. 3shows a flowchart illustrating the process of verifying automatic access to an online account in accordance with an embodiment. In one or more embodiments, one or more of the steps may be omitted, repeated, and/or performed in a different order. Accordingly, the specific arrangement of steps shown inFIG. 3should not be construed as limiting the scope of the technique.

First, a login attempt for the online account is received (operation302). The login attempt may contain incomplete authentication credentials for the online account, such as only a login for the online account. In other words, the login attempt may include a request for automatic access to the online account using only the login. Such a request may be implicit in providing only the login to the online account, or the request may be made by entering the login through a special area (e.g., webpage) of a login interface for the online account, such as an “automatic access” webpage of the login interface. Because the authentication credentials are incomplete, automatic access to the online account through the login attempt may require confirmation from a user of the online account.

In particular, the confirmation may be received from the user as user-initiated communications also requesting automatic access to the online account (operation304). The user-initiated communications may be used to verify the request for automatic access to the online account from the login attempt (operation306). As mentioned previously, verification of the request for automatic access from the login attempt and/or identification of the online account from the user-initiated communications may involve examining the source and/or contents of the user-initiated communications.

Next, a user session for accessing the online account through the login attempt is established (operation308). The user session may allow a trusted user providing the login attempt to access the online account on the user's behalf. In addition, the user session may only be valid during an enabled period (operation310) that limits the duration of automatic access to the online account. If the user session remains within the enabled period, the user session is allowed to continue (operation312). However, once the user session is no longer within the enabled period, the user session is terminated (operation314) and normal authentication mechanisms for granting access to the online account are resumed.