# US 11,444,936 B2 · Managing security credentials > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,444,936 B2 - Document ID: US11444936B2 - Status: Granted - Kind: B2 - Application number: 16/441,628 - Filed: 2019-06-14 - Published: 2019-09-26 - Granted: 2022-09-13 - Earliest claimed: 2011-07-29 - Assignees: Amazon Technologies, Inc. - Applicants: Amazon Technologies, Inc. - Inventors: Darren Ernest Canavor; Jesper Mikael Johannson - Web page: https://patentgrep.com/patent/US11444936B2 ## CPC - G06F 21/46: by designing passwords or checking the strength of passwords - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - G06F 21/31: User authentication - G06F 21/45: Structures or tools for the administration of authentication - H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - G06F 2221/2103: Challenge-response - G06F 2221/2131: Lost password, e.g. recovery of lost or forgotten passwords - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Disclosed are various embodiments for managing security credentials. In one embodiment, knowledge-based questions are selected in response to failing to receive a valid master security credential in a request to authenticate a user account for access to account data. In response to receiving the request, the plurality of knowledge-based questions are provided to an application. Answers to the knowledge-based questions are received and scored. Access is granted to establish a new master security credential based at least in part on the score meeting or exceeding a predetermined threshold. ## Claims ### Claim 1 A method, comprising: receiving, via at least one of one or more computing devices, a request to authenticate a user account, the request comprising a master security credential, a valid master security credential being employed to authenticate the user account for access to a plurality of security credentials; determining, via at least one of the one or more computing devices, that the master security credential is invalid; determining, via at least one of the one or more computing devices, to generate a plurality of dynamic knowledge-based questions instead of retrieving static knowledge-based questions, the determination being based at least in part on a sufficiency of user data associated with the user account; generating, via at least one of the one or more computing devices, the plurality of dynamic knowledge-based questions in an instance in which the master security credential is invalid; providing, via at least one of the one or more computing devices, the plurality of dynamic knowledge-based questions to an application executing on a client device; generating, via the at least one of the one or more computing devices, a score based at least in part on a comparison of a plurality of received answers to the plurality of dynamic knowledge-based questions with a plurality of valid answers to the plurality of dynamic knowledge-based questions, the plurality of received answers being received from the application; and in response to determining that the score meets or exceeds a predetermined threshold, granting, via the at least one of the one or more computing devices, access to reset a master security credential associated with the user account. ### Claim 2 (depends on 1) The method of claim 1, further comprising providing access to the plurality of security credentials for a predetermined number of minutes. ### Claim 3 (depends on 1) The method of claim 1, wherein providing the plurality of dynamic knowledge-based questions to the application comprises sending data to the application configured to generate a user interface to be rendered by the application, the user interface comprising the plurality of dynamic knowledge-based questions. ### Claim 4 (depends on 1) The method of claim 1, wherein the plurality of security credentials grant access for the user account to a plurality of different applications. ### Claim 5 (depends on 1) The method of claim 1, further comprising: receiving a new master security credential from the application; and storing a hashed version of the new master security credential as the master security credential. ### Claim 6 (depends on 1) The method of claim 1, further comprising sending a configuration file including a security credential specification to the client device, the security credential specification specifying at least one of: a character set, a minimum length, or a maximum length for a password. ### Claim 7 (depends on 1) The method of claim 1, wherein at least one of the plurality of dynamic knowledge-based questions is generated based at least in part on at least one of: purchase transaction data, browsing history, order history, search history, or profile information associated with the user account. ### Claim 8 (depends on 1) The method of claim 1, wherein individual received answers of the plurality of received answers are weighted with a respective different weight based at least in part on a respective knowledge-based question of the plurality of dynamic knowledge-based questions. ### Claim 9 A system, comprising: at least one computing device; and a manager executable in the at least one computing device, wherein, when executed, the manager causes the at least one computing device to at least: receive a request to authenticate a user account, the request comprising a master security credential, a valid master security credential being employed to authenticate the user account for access to account data associated with a user account; determine to generate a plurality of dynamic knowledge-based questions instead of retrieving static knowledge-based questions, the determination being based at least in part on a sufficiency of user data associated with the user account; generate the plurality of dynamic knowledge-based questions in an instance in which the master security credential is invalid; generate a user interface comprising the plurality of dynamic knowledge-based questions; receive a plurality of knowledge-based answers to the plurality of dynamic knowledge-based questions from a client device; generate a score based at least in part on the plurality of received knowledge-based answers to the plurality of dynamic knowledge-based questions; and in response to determining that the score meets or exceeds a predetermined threshold, perform an action comprising at least one of: establishing a new master security credential as the valid master security credential or providing access to the account data for a predetermined number of minutes. ### Claim 10 (depends on 9) The system of claim 9, wherein receiving the request comprises receiving a request to reset a master security credential associated with the user account. ### Claim 11 (depends on 9) The system of claim 9, wherein the account data comprises a plurality of security credentials accessible via the master security credential, and wherein, when executed, the manager causes the at least one computing device to at least provide the plurality of security credentials to the client device. ### Claim 12 (depends on 9) The system of claim 9, wherein the account data comprises a plurality of security credentials accessible via the master security credential, and wherein, when executed, the manager causes the at least one computing device to at least: automatically generate at least one of the plurality of security credentials according to a security credential specification received from a remote computing device; and send the at least one of the plurality of security credentials and the security credential specification to the client device. ### Claim 13 (depends on 9) The system of claim 9, wherein at least one of the plurality of dynamic knowledge-based questions is generated based at least in part on a recency of at least one of: purchase transaction data, browsing history, order history, search history, or profile information associated with the account data. ### Claim 14 (depends on 9) The system of claim 9, wherein the request comprises a master security credential, and receiving the request comprises determining that the master security credential is not valid based at least in part on comparing a hashed version of the master security credential with a master security credential stored in association with the user account. ### Claim 15 A non-transitory computer-readable medium embodying specific instructions that, when executed, cause at least one computing device to at least: receive a request for account data required to access a network site, the request being received from an application executing on a client device, and the request comprising a master security credential, a valid master security credential employed to authenticate a user account for access to the account data; determine to generate a plurality of dynamic knowledge based questions instead of retrieving static knowledge-based questions, the determination being based at least in part on a sufficiency of user data associated with the user account; generate the plurality of dynamic knowledge-based questions in an instance in which the master security credential is invalid; provide the plurality of dynamic knowledge-based questions to the application; generate a score based at least in part on a comparison of a plurality of received answers to the plurality of dynamic knowledge-based questions with a plurality of valid answers to the plurality of dynamic knowledge-based questions, the plurality of received answers being received from the application; and in response to determining that the score meets or exceeds a predetermined threshold, perform an action comprising at least one of resetting the master security credential or providing the application with access to the account data for a predetermined number of minutes. ### Claim 16 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein, when executed, the instructions further cause the at least one computing device to at least assign a different weight to individual answers of the plurality of received answers based at least in part on a recency of at least one of purchase transaction data or profile information associated with the account data. ### Claim 17 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the account data comprises at least one of a username, a password, a security key, or a certificate. ### Claim 18 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the instructions, when executed, further cause the at least one computing device to at least automatically generate at least one of a plurality of security credentials accessible via the master security credential according to a security credential specification received from a remote computing device. ### Claim 19 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the instructions, when executed, further cause the at least one computing device to at least deny access to the account data based at least in part on the score failing to meet a predetermined threshold. ### Claim 20 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein providing the plurality of dynamic knowledge-based questions comprises at least one of: generating a network page for rendering in a browser in the client device or sending data to the application in order for a user interface to be rendered by the application.