# US 7,610,491 B1 · Account recovery key > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 7,610,491 B1 - Document ID: US7610491B1 - Status: Granted - Kind: B1 - Application number: 11/095,311 - Filed: 2005-03-31 - Granted: 2009-10-27 - Earliest claimed: 2005-03-31 - Assignees: Google Inc. - Inventors: Michael Tsao - Web page: https://patentgrep.com/patent/US7610491B1 ## CPC - H04L 9/32: including means for verifying the identity or authority of a user of the system {or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials} - G06F 21/31: User authentication - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)} - G06F 2221/2131: Lost password, e.g. recovery of lost or forgotten passwords - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Systems and methods generate an account recovery key for a protected system. The account recovery key may comprise a plurality of words that may be supplied to regain access to an account on a protected system if the account has been lost due to the actions of a malicious user or if the password to the account has been forgotten by the user. ## Claims ### Claim 1 A computer-implemented method to recover an account, comprising: at a server, receiving a request from a client to restore access to an account on a protected system, wherein the account has a user identifier, a password, and an account recovery key, and the account recovery key is distinct from the user identifier and the password; providing a prompt to the client to enter an account recovery key; receiving the entered account recovery key from the client; comparing the entered account recovery key to a stored account recovery key, the stored account recovery key associated with the account and remaining invariant while associated with the account; and granting the client access to the protected system if the entered account recovery key matches the stored account recovery key. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein the stored account recovery key comprises a plurality of subkeys. ### Claim 3 (depends on 2) The computer-implemented method of claim 2, wherein each subkey comprises a word. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein the stored account recovery key comprises an encrypted stored account recovery key and wherein comparing the entered account recovery key to the stored account recovery key further comprises encrypting the entered account recovery key prior to the comparison. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein the protected system comprises an electronic mail system. ### Claim 6 A computer program product for recovering an account, comprising: a computer-readable storage medium storing one or more programs for execution by one or more processors on a server, the one or more programs comprising: instructions, which, when executed, receive a request from a client to restore access to an account on a protected system, wherein the account has a user identifier, a password, and an account recovery key, and the account recovery key is distinct from the user identifier and the password; instructions, which, when executed, provide a prompt to the client to enter an account recovery key; instructions, which, when executed, receive the entered account recovery key from the client; instructions, which, when executed, compare the entered account recovery key to a stored account recovery key, the stored account recovery key associated with the account and remaining invariant while associated with the account; and instructions, which, when executed, grant the client access to the protected system if the entered account recovery key matches the stored account recovery key. ### Claim 7 (depends on 6) The computer program product of claim 6, wherein the stored account recovery key comprises a plurality of subkeys. ### Claim 8 (depends on 7) The computer program product of claim 7, wherein each subkey comprises a word. ### Claim 9 (depends on 6) The computer program product of claim 6, wherein the stored account recovery key comprises an encrypted stored account recovery key and wherein comparing the entered account recovery key to the stored account recovery key further comprises encrypting the entered account recovery key prior to the comparison. ### Claim 10 (depends on 6) The computer program product of claim 6, wherein the protected system comprises an electronic mail system. ### Claim 11 A computer-implemented method for providing account recovery, comprising: at a server, receiving a request from a client to establish an account that provides access to a protected application; creating an account for the client, including a user identifier and a password; generating an account recovery key for the account that is invariant and is distinct from the user identifier and password; transmitting the account recovery key to the client; wherein the client will be granted access to the protected application if the client provides the user identifier and the password or if the client provides the user identifier and the account recovery key. ### Claim 12 (depends on 11) The computer-implemented method of claim 11, wherein the account recovery key comprises a plurality of subkeys. ### Claim 13 (depends on 12) The computer-implemented method of claim 12, wherein each of the plurality of subkeys comprises a word. ### Claim 14 (depends on 13) The computer-implemented method of claim 13, wherein the plurality of subkeys is determined by generating a random number for each subkey and using each random number as an index into a list of words. ### Claim 15 (depends on 11) The computer-implemented method of claim 11, wherein the protected application is an electronic mail system. ### Claim 16 A computer program product for providing account recovery, comprising: a computer readable storage medium storing one or more programs for execution by one or more processors on a server, the one or more programs comprising: instructions, which, when executed, receive a request from a client to establish an account that provides access to a protected application; instructions, which, when executed, create an account for the client, including a user identifier and a password; instructions, which, when executed, generate an account recovery key for the account that is invariant and is distinct from the user identifier and password; instructions, which, when executed, transmit the account recovery key to the client; wherein the client will be granted access to the protected application if the client provides the user identifier and the password or if the client provides the user identifier and the account recovery key. ### Claim 17 (depends on 16) The computer program product of claim 16, wherein the account recovery key comprises a plurality of subkeys. ### Claim 18 (depends on 17) The computer program product of claim 17, wherein each of the plurality of subkeys comprises a word. ### Claim 19 (depends on 18) The computer program product of claim 18, wherein the plurality of subkeys is determined by generating a random number for each subkey and using each random number as an index into a list of words. ### Claim 20 (depends on 16) The computer program product of claim 16, wherein the protected application is an electronic mail system. ### Claim 21 A server computer for providing account recovery, comprising: a main memory; one or more processors with cache memory; and one or more programs for providing access to a protected application and for providing account recovery, wherein the one or more programs are stored in the main memory and are executed by the one or more processors, the one or more programs including: instructions, which, when executed, receive a request from a client to establish an account that provides access to a protected application; instructions, which, when executed, create an account for the client, including a user identifier and a password; instructions, which, when executed, generate an account recovery key for the account that is invariant and is distinct from the user identifier and password; instructions, which, when executed, transmit the account recovery key to the client; wherein the client will be granted access to the protected application if the client provides the user identifier and the password or if the client provides the user identifier and the account recovery key. ### Claim 22 (depends on 21) The server computer of claim 21, wherein the account recovery key comprises a plurality of subkeys. ### Claim 23 (depends on 22) The server computer of claim 22, wherein each of the plurality of subkeys comprises a word. ### Claim 24 (depends on 23) The server computer of claim 23, wherein the plurality of subkeys is determined by generating a random number for each subkey and using each random number as an index into a list of words. ### Claim 25 (depends on 21) The server computer of claim 21, wherein the protected application is an electronic mail system.