A credential storage manager for securing credentials during delegated account use

Abstract

Systems and methods for a credential storage manager are provided for securing credentials during delegated account use. A first user who controls an account can delegate account use to a second user through a credential manager that manages sensitive authentication information and delegates transactional processes for account use. The credential manager can automatically populate authentication information for use of the account by the second user. A device fingerprint of the second user's device can be used to provide risk prevention and account access. The credential manager can prevent exposure of credentials and use of the account to navigate to sensitive data or processes. Two-factor authentication can be performed by receiving a code in a message received by the first user's device, mining the code from the message, and entering the code into the second user's device.

Description

Technical Field

[0001] The present application generally relates to delegated account use across devices, and more particularly, to providing a password storage processor and delegation service that allows account access to be provided without having to share authentication credentials or other sensitive account data. Background Art

[0002] Various types of service providers can provide services to users, merchants, and other entities, including the sale of goods and services (e.g., "items" or "items"). These service providers may require payment for these items, and the payment can be performed through the merchant or service provider's account. For example, merchants and service providers can provide users with online platforms and accounts for processing transactions electronically. The online platform can further store information about financial instruments associated with the account used to process the transaction. However, this requires the user to have an online account for transaction processing and to use the account and platform to store sensitive information (e.g., personal and / or financial information). If another user gains access to this account, the user is at risk of exposing this sensitive information and may cause this information to be stolen and abused. However, users may sometimes wish to allow others to use their accounts for specific services and / or payments, but may not want to disclose their authentication credentials and sensitive information to others. BRIEF DESCRIPTION OF THE DRAWINGS

[0003] Figure 1 is a block diagram of a networked system suitable for implementing the processes described herein, according to one embodiment;

[0004] Figure 2 is a flow chart of an exemplary process for a credential store manager to secure credentials during delegate account use according to one embodiment;

[0005] Figure 3 is an exemplary system environment in which a user device and a transaction processor server may interact to establish and use a credential storage manager according to one embodiment;

[0006] Figure 4A is an exemplary application interface for delegated account usage through a credential storage manager according to one embodiment;

[0007] Figure 4B is an exemplary application interface according to one embodiment that displays a blocking notification to a delegate user when the delegate user attempts to access sensitive information; and

[0008] Figure 5 According to one embodiment, it is suitable for implementing Figure 1 A block diagram of a computer system that includes one or more components.

[0009] By referring to the detailed description below, the embodiments of the present disclosure and its advantages can be best understood. It should be understood that similar reference numerals are used to identify similar elements shown in one or more drawings, and the purpose of showing in the drawings is to illustrate the embodiments of the present disclosure, rather than to limit the embodiments of the present disclosure. DETAILED DESCRIPTION

[0010] A method for a credential storage manager is provided for protecting credentials during use of a delegated account. A system suitable for practicing the method of the present disclosure is also provided.

[0011] In some embodiments, a transaction processor providing a credential storage manager may provide accounts, account management and / or additional services, including electronic transaction processing for online transactions with merchants and service providers. In some embodiments, an account may be provided directly by a transaction processor, such as a payment account. However, in other embodiments, an account may be provided by a merchant to be used specifically for its online merchant platform, application, and branch offices. During account creation, a user may be required to provide identity information for establishing an account, such as the user's personal information, the business or merchant information of such an entity, or other types of identity information (including name, address, and / or other information). The user may also be required to provide financial information, including payment card (e.g., credit / debit card) information, bank account information, gift card information, and / or benefits / rewards, which may be used to provide funds to an account and / or transaction processing tool. The user may also be required to select an account name and / or provide authentication credentials, such as a password, a personal identification number (PIN), answers to security questions, and / or other authentication information. However, not all information is required in all embodiments. The user may then use the user's account to perform online interactions and activities. In some embodiments, this may include electronic transaction processing, messaging, social networking, content access, and the like. In various embodiments, the website may provide an online service so that the website can be accessed through a web browser application through an account. The application (or website) may be associated with a payment provider, such as Or other online payment provider services, these payment providers can provide payment and other aforementioned transaction processing services on behalf of users, merchants and other entities.In some embodiments, dedicated applications can also be used to access accounts and perform online interactions.

[0012] Thus, a first user's account may include sensitive information, including personal information, financial information, and / or authentication information. A second user may request to use the first user's account, or the first user may wish to delegate some usage rights of the first user's account to the second user, such as the second user having a certain amount of purchasing rights when using the account. For example, friends or family members may wish to delegate usage rights to each other so that others purchase items knowing that the items will be reimbursed or given as gifts to other users. Roommates may wish to use one account to purchase shared items or pay shared bills. If the first user provides account credentials directly to the second user, the second user may engage in fraudulent behavior, or the first user may be at risk of disclosing sensitive information to the second user.

[0013] Thus, the first user can utilize a credential storage manager (CSM) provided by a transaction processor or another entity (including a merchant providing an account) to establish a delegated account use for the second user and terms regarding the account use of the second user. The first user can access the interface of the CSM to delegate the account use to the second user and set terms or conditions for the account use. The terms, settings, or conditions for the account use can control the permissible account actions performed by the second user, and these terms, settings, or conditions can be set by the first user when establishing the delegated use, or automatically set by the CSM of the transaction processor. The terms can include the length of time the second user uses the account, the actions performed by the second user using the account, the maximum purchase amount or number of purchases using the account, the items that can be purchased using the account, and / or the data accessible from the account (e.g., accessible account data). The first user can also use an identifier to identify the second user and / or the second user's device. Once the information is entered, the first user can request the second user to receive the delegated use, at which point an alert about the delegated use can be issued to the second user through an application on the second user's device. The device may populate a push notification, message, banner notification, or other alert regarding the account's permitted delegated use, which may allow the second user to select an account to use using one or more online platforms. The data may be populated using an application and / or an extension added to another application associated with the CSM.

[0014] Thus, the second user can receive a delegated account use permission that enables the second user to access the first user's account and use the account within the parameters and terms set by the first user and / or CSM. The second user can access an online platform to use the first user's account. The online platform can correspond to a merchant or other type of service provider that provides goods or services that can be purchased through an account via electronic transaction processing. An online entity can provide an online platform that allows users to use an account to pay bills electronically. Other types of online platforms can also be used to use accounts to perform online activities, such as messaging, email, social networking, media playback, etc. The second user can use an application or extension on the device of the second user associated with the CSM to use the online platform to select the first user's account to log in and use, and the first user's account can be displayed in the interface through a menu option, and / or entered by the second user (e.g., by providing an account identifier, such as a login username, email address, etc.).

[0015] The CSM can automatically fill in sensitive authentication information (e.g., login identifier, password, and / or PIN). This can be accomplished through a secure background process, where the credential information is filled in through one or more processes of the CSM on the second user's device and / or using the online platform. For example, the CSM application and / or extension can retrieve security credentials from a transaction processor or other account platform, and can automatically fill these security credentials into the authentication field while preventing the credentials from being leaked (e.g., by hiding the credentials, logging in without displaying the credentials, or by replacing other elements to make them unreadable). The CSM can also directly enable the second user's device to log in to the account using the online platform by processing the second user's device's authentication of the account using the online platform and allowing the second user's device to access the online platform through the account. This can be accomplished by back-end processing by the CSM using the online platform.

[0016] In some embodiments, an application and / or extension for a CSM may be used to interact with a transaction processor and / or an account platform that provides an account to perform an automatic login for an account of a first user on a device of a second user. Thus, the second user does not need to know and enter the authentication credentials of the first user's account, and the first user may keep these authentication credentials safe during the period of entrusting the use of the first user's account for the second user. In some embodiments, two-factor authentication may be set and required for the use of the first user's account, which may be required specifically for general or for the second user's entrusted use. Two-factor authentication may work by having the account provider send a message with an unknown code (e.g., unknown authentication data versus known authentication credentials) to the device, where the unknown code needs to be entered during the authentication request. In some embodiments, a code may be sent to the second user's device, and the second user may directly enter the code during the login to the first user's account. An application or extension on the second user's device may also scrape or determine information including a code sent to the second user's device in the form of a text or push message, and the application / extension may be used to enter the code into the authentication request processed by the CSM. Additionally, the first user's device may alternatively receive a message with the two-factor authentication code, wherein a similar application or extension of the CSM may mine data from the message sent to the first user's device and enter the two-factor authentication code into an authentication request on the second user's device or utilizing an online platform.

[0017] During the use of the first user's account by the second user, the second user's login session can be tracked so that the CSM and the online platform can enforce the terms and parameters of the second user's use of the first user's account. The CSM can use the device fingerprint of the second user's device to track the second user's use of the first user's account. The device fingerprint can be determined when the second user's device logs into the first user's account through the CSM, or the device fingerprint can be determined when the first user delegates the use of the account to the second user and sends a notification to the second user's device. In this regard, determining the fingerprint when the second user is delegated account use (e.g., before login) can allow the CSM to further determine the risk rating of the second user's login account by matching the previously determined fingerprint with the device that logs into the first user's account based on the delegated use request to the second user. The timestamp of the second user's device logging into the account can also be used to track the second user's use of the first user's account on the online platform, as well as the session identifier (ID) that can be generated for a particular session. In some embodiments, the CSM can also insert a cookie or "super cookie" on the second user's device (e.g., a browser cookie that is permanently stored on the device or stored in a more redundant manner that prevents removal or makes removal more difficult). The cookie can then be used to track the second user's session, which can be done by applications and / or extensions on the device.

[0018] During the second user's session, the second user's actions and activities using the first user's account can be tracked. This can include items added by the second user for purchase and / or attempted purchases through the first user's account. If the items, amounts, and / or other transaction data meet the restrictions and terms set for the second user to use the first user's account for transaction processing, the CSM can allow account use, and the second user can use the first user's account to process transactions through the online platform. The second user's actions on the first user's account can also include access to data, navigation to web pages and / or interfaces for viewing and / or interacting with data, and messages sent using the first user's account and other data accessed or processed by the second user using the first user's account. Similarly, if such actions are allowed within the restrictions and terms set by the first user and / or CSM regarding account use, the CSM can allow the second user to perform such actions. The CSM can also display data specific to the second user to warn the second user that the second user is in the flow of delegated account use of the first user's account, such as alerts, notifications, or messages about delegated use and terms about delegated use.

[0019] However, based on the terms and restrictions set by the first user and / or the CSM, some actions taken by the second user may also be prohibited. For example, the second user may attempt to purchase prohibited items or process transactions that exceed restrictions or exceed the authorized usage time. The second user may also attempt to send prohibited messages or otherwise perform a prohibited task, such as accessing account credentials or changing settings about the account. The CSM can check the restrictions and adjudicate the transaction based on the restrictions to determine whether the account is allowed to be used. If the action is prohibited, the CSM can prevent the online platform from performing the task using the first user's account. The CSM can also redirect the second user's device to a web page, application, or notification that notifies the second user that the task is prohibited and will not be performed. This can be performed by an application or extension associated with the CSM. The application or extension can prevent the second device from performing the task and can also populate the notification on the second user's device for display.

[0020] Similarly, the second user may attempt to access prohibited information to view or change that information. For example, the second user may attempt to view personal or financial information stored using the first user's account. The second user may also attempt to access an interface or process that allows the second user to change or reset authentication credentials. If the user attempts to access the data and / or process using the first user's account, the second user's device may be rerouted to a web page or interface that prevents the second user from viewing the data and / or executing the process. This can similarly be performed by an application or extension on the second user's device. The second user may receive a warning of a violation of the terms. In some embodiments, a warning of a violation of the terms may also be issued to the first user so that the first user can revoke delegated access if necessary.

[0021] In this way, the transaction processor can provide a credential storage manager or processor that allows the delegated use of an account without leaking authentication credentials and / or exposing sensitive data. This allows other users to use the account in a way that preserves the security of the account, and allows the control of the account and the removal of the delegation for account violations. Device fingerprints can also be used to implement effective risk prevention measures by detecting the use of the account by the delegate user's device and monitoring the account use. This allows the delegate user to be prevented from navigating to sensitive data, and restrictions on account use (e.g., restrictions on payments and expenditures using the account) are implemented. The credential storage manager can also provide a process for two-factor authentication by mining messaging data on the device of the user controlling the account and inputting the mined code into the authentication process on the delegate user's device. Therefore, the credential storage manager can further provide enhanced security when implementing two-factor authentication on the account. Therefore, the delegate user does not need to go through a lengthy account setup process with multiple different service providers or merchants, thereby reducing the processing costs and account data storage requirements of different account providers. The transaction processor can provide specific applications and extensions to detect violations of the delegated use and prevent fraud or abuse by the second user.

[0022] Figure 1 1 is a block diagram of a networked system 100 suitable for implementing the processes described herein, according to one embodiment. As shown, the system 100 may include or implement a number of devices, servers, and / or software components that operate to perform various methods according to the described embodiments. Exemplary devices and servers may include operations such as It can be appreciated that, Figure 1 The devices and / or servers shown in the figure may be deployed in other ways, and for a given embodiment, the operations performed and / or services provided by these devices and / or servers may be combined or separated and may be performed by a greater or lesser number of devices and / or servers. One or more devices and / or servers may be operated and / or maintained by the same or different entities.

[0023] The system 100 includes a first user device 110, a second user device 130, a service provider server 140, and an account use platform 160 that communicate via a network 170. A user can use the first user device 110 to access various features available to the first user device 110, which may include processes and / or applications associated with the service provider server 140 to receive delegated account use for an account controlled by another user associated with the second user device 130. The service provider server 140 can manage account use and can also process transactions within account use terms during transaction use. The account use platform 160 can correspond to a platform used by an account, such as a merchant platform used to purchase items.

[0024] The first user device 110, the second user device 130, the service provider server 140, and the account use platform 160 may each include one or more processors, memories, and other appropriate components for executing instructions, such as program codes and / or data stored on one or more computer-readable media, to implement the various applications, data, and steps described herein. For example, such instructions may be stored in one or more computer-readable media, such as memory or data storage devices internal and / or external to various components of the system 100, and / or memory or data storage devices accessible via the network 170.

[0025] The first user device 110 may be implemented as a communication device that may use appropriate hardware and software configured for wired and / or wireless communication with the second user device 130, the service provider server 140, and / or the account usage platform 160. For example, in one embodiment, the first user device 110 may be implemented as a personal computer (PC), a smart phone, a laptop / tablet computer, a watch with appropriate computer hardware resources, glasses with appropriate computer hardware (e.g., GOOGLE ), other types of wearable computing devices, implantable communication devices, and / or other types of computing devices capable of sending and / or receiving data, such as of Although only one communication device is shown, multiple communication devices may operate similarly.

[0026] Figure 1The first user device 110 includes a browser application 120, a password management application 112, other applications 114, a database 116, and a network interface component 118. The browser application 120, the password management application 112, and the other applications 114 may correspond to executable processes, programs, and / or applications with associated hardware. In other embodiments, the first user device 110 may include additional or different modules with required specialized hardware and / or software.

[0027] The browser application 120 may correspond to one or more processes that execute the modules and associated devices of the first user device 110 to interact with the service provider server 140 to receive the delegated account access rights to perform one or more account actions (including performing electronic transaction processing). In this regard, the browser application 120 may correspond to dedicated hardware and / or software used by the first user device 110 to first display the delegated account usage data. The browser application 120 and / or the password management application 112 may be used to display the account information or identifiers of the accounts that the first user associated with the first user device 110 has delegated access to, and further allow the first user to select one of the accounts to perform login. One or more accounts may be controlled or owned by a second user associated with the second user device 130. The login may be performed by the password management application 112 through background operations with the browser application 120, and the browser application 120 does not display authentication information. Once logged into the account, the browser application 120 may be used to perform actions and / or interactions with the account usage platform 160 using the delegated use of the second user's account. The browser application 120 may correspond to a general browser application configured to retrieve, present, and transmit information via the Internet (e.g., utilizing resources on the World Wide Web) or a dedicated network. For example, the browser application 120 may provide a web browser that can send and receive information via the network 170, including retrieving website information, presenting website information to a user, and / or transmitting information to a website. However, in other embodiments, the browser application 120 may include a dedicated application of a service provider server 140 or other entity (e.g., a payment provider, etc.), which may be configured to provide services through the application.

[0028] The browser application 120 may provide interaction data to the service provider server 140 using the account use platform 160, which indicates the delegated use of the account, which may be monitored by the service provider server 140 to limit the interaction based on the terms, conditions and restrictions on the use of the account set by the second user or the entity managing the account (e.g., an entity associated with the service provider server 140) for the delegated use of the first user. In some embodiments, the interaction data may correspond to a purchase, transfer and / or electronic transaction processing, which may be performed using the account use platform 160. During the processing of the payment or transfer transaction, the browser application 120 may be used to select (one or more) payment instruments for providing payment for the purchase transaction, transfer or other financial process. As discussed herein, the browser application 120 may use a digital wallet or other payment source stored using the second user's account based on restrictions on the delegated use of the account that is allowed to be processed using the account. The browser application 120 may also receive transaction data elements, including recipients, transaction amounts and / or items. As discussed herein, the service provider server 140 may limit the use of the account based on restrictions. In this regard, if the account is not allowed to be used based on the restrictions, the password management application 112 can be used to redirect the user and / or display a notification. The browser application 120 can be used to view payment results, such as using transaction history, dispute resolution processes, and other post-transaction processes.

[0029] The password management application 112 may correspond to one or more processes for executing the modules and associated devices of the first user device 110 to receive delegated use information for delegated use of one or more accounts, provide a process for securely recording one or more applications (e.g., the browser application 120) into the account for delegated use, and monitor the use of the account to enforce restrictions on account use. In this regard, the browser application 120 may correspond to dedicated hardware and / or software used by the first user device 110 to first receive delegated use of one or more accounts, for example, an account of a second user associated with the second user device 130. The password management application 112 may work as a standalone application or an application extension that can be added to another application (e.g., the browser application 120) to allow the first user device 110 to log in to the delegated use account, and monitor the account use during delegation to enforce rules regarding account use. Therefore, the password management application 112 may provide one or more processes and / or interfaces to display accounts with delegated use options available for first use associated with the first user device 110. These accounts may be selectable, or designation may be made for one of the accounts to perform a login to the account through an application on the user device 110 to interact with the account usage platform 160 based on delegated use.

[0030] The password management application 112 can utilize a background process to retrieve credentials for an account securely stored by the service provider server 140, such as a username, password, etc., and enter these credentials into an authentication request having a credentials field in an application (e.g., a browser application 120 that accesses a website to perform an account login on the account usage platform 160). This can be accomplished by hiding or obscuring the authentication information so that sensitive login information is not exposed on the first user device 110. The password management application 112 can instead request that the login be performed through a process between the service provider server 140 and the account usage platform 160 so that the first user device 110 is logged into the account without requiring the first user to enter authentication credentials. The password management application 112 can also track account usage by monitoring actions taken by the first user with respect to the account via an application on the first user device 110. The password management application 112 can receive a two-factor authentication code and enter the two-factor authentication code during login, which can come from a message sent to the first user device 110 or the second user device 130. The password management application 112 may be used to provide a timestamp or session ID for an account login of a delegate use account, may provide a cookie associated with the login, or may fingerprint the first user device 110 for tracking a first user session of use of a delegate account of a second user associated with a second user device 130. In some embodiments, these actions may correspond to data access requests, electronic transaction processing requests, and / or changes to account data. If the service provider server 140 determines that the action is prohibited or violates restrictions on the use of the delegate account, the password management application 112 may prevent these actions based on the restrictions and / or instructions from the service provider server 140. In addition, the password management application 112 may present a pop-up or redirect the interface or website navigation to a message alerting the first user of the prohibited use.

[0031] In various embodiments, the first user device 110 includes other applications 114 that provide features to the first user device 110 that may be desired in a particular embodiment. For example, the other applications 114 may include a security application for implementing client security features, a programming client application for connecting to an appropriate application programming interface (API) through the network 170, or other types of applications. The other applications 114 may also include: additional communication applications, such as email, text, voice, social networking, and IM applications, allowing users to send and receive emails, calls, texts, and other notifications through the network 170. The other applications 114 may also include other media viewing applications to consume media content on the first user device 110. The other applications 114 can be used with the password management application 112 to perform logins to the entrusted use account. The other applications 114 may include device interfaces and other display modules that can receive input and / or output information. For example, the other applications 114 may include software programs that can be executed by a processor, including a graphical user interface (GUI) configured to provide an interface to a user.

[0032] The first user device 110 may also include a database 116 stored in a temporary and / or non-temporary memory of the first user device 110, which may store various applications and data and be used during the execution of various modules of the first user device 110. Thus, the database 116 may include, for example, an identifier (ID), such as an operating system registry key, a cookie associated with the browser application 120 and / or other applications 114, an ID associated with the hardware of the first user device 110, or other appropriate IDs, such as an ID for payment / user / device authentication or identification. The database 116 may include device identification data for tracking the first user device 110 during account use, and may also store information about delegated use accounts accessible to the first user device 110.

[0033] The first user device 110 includes at least one network interface component 118 adapted to communicate with the second user device 130, the service provider server 140, and / or the account usage platform 160. In various embodiments, the network interface component 118 may include a DSL (e.g., digital subscriber line) modem, a PSTN (public switched telephone network) modem, an Ethernet device, a broadband device, a satellite device, and / or various other types of wired and / or wireless network communication devices, including microwave, radio frequency, infrared, Bluetooth, and near field communication devices.

[0034] The second user device 130 may be implemented as a communication device that may use appropriate hardware and software configured for wired and / or wireless communication with the first user device 110, the service provider server 140, and / or the account usage platform 160. For example, in one embodiment, the second user device 130 may be implemented as a personal computer (PC), a smart phone, a laptop / tablet computer, a watch with appropriate computer hardware resources, glasses with appropriate computer hardware (e.g., GOOGLE ), other types of wearable computing devices, implantable communication devices, and / or other types of computing devices capable of sending and / or receiving data, such as of Although only one communication device is shown, multiple communication devices may operate similarly.

[0035] Figure 1 The second user device 130 includes an account delegation application 132, other applications 134, a database 136, and a network interface component 138. The account delegation application 132 and other applications 134 may correspond to executable processes, programs, and / or applications with associated hardware. In other embodiments, the second user device 130 may include additional or different modules with required specialized hardware and / or software.

[0036] The account delegation application 132 may correspond to one or more processes that are used to execute the modules and associated devices of the second user device 130 to provide the first user associated with the first user device 110 with the delegated use of the account of the second user associated with the second user device 130. In this regard, the account delegation application 132 may correspond to dedicated hardware and / or software used by the second user device 130 to first access one or more processes and / or interfaces to delegate the use of the account to the first user, which may be provided by the service provider server 140. The second user may select one or more accounts to delegate the use to the first user, which may be accounts that the second user owns, controls, or has access to through its authentication credentials. The account delegation application 132 may include one or more interfaces for confirming that the second user has access to the account by entering the account authentication credentials and / or other identity confirmation. The second user may identify the first user and / or the first user device 110 to receive the delegated access (e.g., by a name identifier, etc.). The second user may also provide or receive a code required for input to identify the delegated use of the second user's account. The account delegation application 132 can be used to select terms, restrictions and / or parameters for the use of the second user's account, which can be limited by the service provider application 140 to the first user's delegated use without the intervention of the second user. These can correspond to actions taken on the account, electronic transaction processing restrictions (e.g., about time, items, funds or quantities), data accessible to the account, or other tasks performed during the first user's delegated use of the account through the first user device 110. The service provider can also provide similar constraints or restrictions. Once established, the service provider server 140 can provide the delegated use to the first user device 110, as described herein. In some embodiments, the account delegation application 132 can be used to mine messages on the second user device 130 for two-factor authentication and provide a code to allow delegated access on the first user device 110.

[0037] In some embodiments, the account delegation application 132 can be used to update and / or revoke the delegated access and use of the account. For example, after the first user requests and / or the second user provides the use, the second user can request to revoke access through the account delegation application 132. The account delegation application 132 can also update the second user with the requested prohibited actions taken by the first user using the account and block based on restrictions. In response to the prohibited action, the second user can use the account delegation application 132 to revoke access to the account. The account delegation application 132 can also be used to change the parameters of the delegated use, such as by extending or shortening the time, increasing or reducing the access or electronic transaction processing rules, or otherwise changing the access. The account delegation application 132 can correspond to a general browser application configured to retrieve, present and transmit information through the Internet (e.g., using resources on the World Wide Web) or a dedicated network. For example, the account delegation application 132 can provide a web browser that can send and receive information through the network 170, including retrieving website information, presenting website information to the user, and / or transmitting information to the website. However, in other embodiments, the account delegation application 132 may include a dedicated application of a service provider server 140 or other entity (eg, a payment provider, etc.) through which the service provider server 140 or other entity may be configured to provide services.

[0038] In various embodiments, the second user device 130 includes other applications 134 that provide features to the second user device 130 that may be desired in a particular embodiment. For example, the other applications 134 may include a security application for implementing client security features, a programming client application for connecting to an appropriate application programming interface (API) via the network 170, or other types of applications. The other applications 134 may also include: additional communication applications, such as email, text, voice, and IM applications, allowing users to send and receive emails, calls, texts, and other notifications via the network 170. The other applications 134 may include device interfaces and other display modules that can receive input and / or output information. For example, the other applications 134 may include software programs that can be executed by a processor, including a graphical user interface (GUI) configured to provide an interface to a user.

[0039] The second user device 130 may also include a database 136 stored in a temporary and / or non-temporary memory of the second user device 130, which may store various applications and data and be used during the execution of various modules of the second user device 130. Thus, the database 136 may include, for example, an identifier (ID), such as an operating system registry key, a cookie associated with the account delegation application 132 and / or other applications 134, an ID associated with the hardware of the second user device 130, or other appropriate IDs, such as an ID for payment / user / device authentication or identification. The database 136 may include information about delegation use, as well as account information and account authentication credentials.

[0040] The second user device 130 includes at least one network interface component 138 adapted to communicate with the first user device 110, the service provider server 140, and / or the account usage platform 160. In various embodiments, the network interface component 138 may include a DSL (e.g., digital subscriber line) modem, a PSTN (public switched telephone network) modem, an Ethernet device, a broadband device, a satellite device, and / or various other types of wired and / or wireless network communication devices, including microwave, radio frequency, infrared, Bluetooth, and near field communication devices.

[0041] For example, the service provider server 140 may be maintained by an online service provider that may provide online transaction processing services for paying for goods and / or services (e.g., items) through an account, as well as managing the delegated use of the account. In this regard, the service provider server 140 includes one or more processing applications that may be configured to interact with the first user device 110, the second user device 130, and / or the account use platform 160 to facilitate transaction processing for purchasing items through the delegated use of the account, and to manage the delegated use of the account based on usage restrictions and terms. In one example, the service provider server 140 may be provided by a provider of a service provider in San Jose, California, USA. However, in other embodiments, the service provider server 140 may be maintained by or include another type of service provider that can provide connection services to multiple users.

[0042] Figure 1The service provider server 140 includes a credential storage manager (CSM) application 150, a transaction processing application 142, other applications 144, a database 146, and a network interface component 148. The CSM application 150 and other applications 144 may correspond to executable processes, programs, and / or applications with associated hardware. In other embodiments, the service provider server 140 may include additional or different modules with specialized hardware and / or software as required.

[0043] The CSM application 150 may correspond to one or more processes for executing modules of the service provider server 140 and associated dedicated hardware that provides credential management services to the service provider server 140 to manage credentials and account usage during delegation of account usage from one user to another (e.g., between a first user associated with the first user device 110 and a second user associated with the second user device 130). In this regard, the CSM application 150 may correspond to dedicated hardware and / or software of the service provider server 140 to provide a convenient interface to allow the second user to access the account delegation process through the second user device 130 and designate an account to provide delegated usage to the first user. The second user may confirm account ownership through an authentication mechanism and input information, and may further select terms, conditions, restrictions, and parameters for the first user's usage of the account during the delegated usage. The CSM application 150 may also determine constraints and limitations and be used to generate delegated use options for the first user, which may be transmitted to the first user device 110 based on designating the first user device 110 for delegated use or loaded to the first user device 110 based on entry of accessible information and / or an identifier or code for delegated use.

[0044] The first user device 110 may select an account on an online platform through an application (e.g., a browser application 120) on the first user device 110 to access the account. The online platform may correspond to an account usage platform 160, and the login may be a user using the account through the platform. The CSM application 150 may perform the login on behalf of the first user in an application on the first user device by securely sending the stored credentials to the first user device 110 and performing the login through a background process that hides the credentials so that they are not viewed by the first user device 110. In other embodiments, the CSM application 150 may log in to the first user device 110 without sending the credentials to the first user device 110, for example, by utilizing a process that provides access to the account on the first user device 110 using the account usage platform 160. Once the first user device 110 is provided access to the account on the platform through the application, the CSM application 150 may monitor the first user's account usage through the first user device 110 using the device fingerprint of the first user device 110, the session ID and / or timestamp provided when logging into the account, and / or cookies of the first user device 110's online activities through the account.

[0045] The CSM application 150 may be used to determine whether the first user's delegated use of the account is within the terms set by the second user or the service provider (e.g., via the CSM application 150). If the use is within the terms, the CSM application 150 may allow the use, for example, by allowing the transaction to be processed via the transaction processing application 142. However, if the action during the delegated use of the account violates the terms and is prohibited, the CSM application 150 may interact with the first user device 110 to prevent the action, for example, by ending the action and preventing the action through the password management application 112. The interface and / or navigation on the first user device 110 may be rerouted to another interface, web page, or notification that warns the first user of the prohibited use. If the action corresponds to a prohibited action, the CSM application 150 may further warn the second user via the second user device 130 and may end the first user's delegated use of the account, or allow the second user to revoke account access to the user.

[0046] The transaction processing application 142 may correspond to one or more processes that execute modules of the service provider server 140 and associated dedicated hardware to process transactions through the account based on delegating the use of the account to another user. In this regard, the transaction processing application 142 may correspond to dedicated hardware and / or software used by a second user associated with a second user device 130 that establishes a payment account that can be used to process transactions and delegate the use to a first user associated with the first user device 110. In other embodiments, the account may be generated through another online platform, such as an account use platform 160. In various embodiments, financial information may be stored in the account, such as account / card numbers and information. The account may be accessed and / or used through a browser application and / or a dedicated application on the first user device 110 and / or the second user device 130, and transaction processing may be performed through the transaction processing application 142. The first user device 110 may be provided with delegated use of the account, which may limit the use of the account for transaction processing through the CSM application 150.

[0047] In some embodiments, the first user device 110 may generate transaction data and may communicate with the transaction processing application 142 to process transactions during the delegation of use of an account associated with the second user device 130. The transaction processing application 142 may retrieve financial information and may use the financial information to process payments to a merchant account associated with the account use platform 160 if the transaction complies with the account use restrictions set for the delegation of use. The transaction processing application 142 may process the payment and may provide a transaction history to the first user device 110 and / or the second user device 130 based on the transaction authorization, approval, or rejection.

[0048] In various embodiments, the service provider server 140 includes other applications 144 that provide features to the service provider server 140 as may be desired in a particular embodiment. For example, the other applications 144 may include a security application for implementing server-side security features, a programming client application for connecting to an appropriate application programming interface (API) via the network 170, or other types of applications. The other applications 144 may include a server interface application for an online server platform for outputting data to one or more devices. For example, the other applications 144 may include a software program executable by a processor, including a graphical user interface (GUI) configured to provide interface data for display on a device.

[0049] The service provider server 140 may also include a database 146 stored in a temporary and / or non-temporary memory of the service provider server 140, which may store various applications and data and be used during the execution of various modules of the service provider server 140. The database 146 may include, for example, identifiers such as operating system registry entries, cookies associated with the CSM application 150 and / or other applications 144, identifiers associated with the hardware of the service provider server 140, or other appropriate identifiers, such as identifiers used for payment / user / device authentication or identification. In various embodiments, the database 146 may include account delegation options, rules, and information that may be used to provide account access to delegate users. In addition, the database 146 may store authentication information and other data necessary to perform account logins, monitor the use of accounts, and enforce restrictions on use during the delegated use of accounts.

[0050] The service provider server 140 includes at least one network interface component 148 adapted to communicate with the first user device 110, the second user device 130, and / or the account usage platform 160 via the network 170. In various embodiments, the network interface component 148 may include a DSL (e.g., digital subscriber line) modem, a PSTN (public switched telephone network) modem, an Ethernet device, a broadband device, a satellite device, and / or various other types of wired and / or wireless network communication devices, including microwave, radio frequency (RF), and infrared (IR) communication devices.

[0051] The account use platform 160 may correspond to an online platform where a user can use a delegated account for one or more actions or interactions. For example, the account use platform 160 may correspond to a merchant platform used by the first user device 110 to purchase one or more items when the first user device 110 accesses an account associated with the second user device 130 for delegated use. In some embodiments, the account use platform 160 may alternatively correspond to messaging, email, social networking, media playback, or other platforms where a user may wish to share the use of an account with another delegate user based on rules and restrictions on account use, and to prevent sharing of authentication credentials. As discussed herein, the use of a delegated account on the account use platform 160 by a delegated user may be managed and controlled by a service provider server 140. Although the account use platform 160 is shown as being separate from the service provider server 140, in some embodiments, the two may be combined.

[0052] Network 170 may be implemented as a single network or a combination of multiple networks. For example, in various embodiments, network 170 may include the Internet or one or more intranets, landline networks, wireless networks, and / or other suitable types of networks. Thus, network 170 may correspond to a small communication network, such as a private or local area network, or a large network, such as a wide area network or the Internet, accessible by various components of system 100.

[0053] Figure 2 200 is a flowchart of an exemplary process for a credential storage manager to secure credentials during use of a delegated account according to one embodiment. Note that one or more steps, processes, and methods described in flowchart 200 may be omitted, performed in a different order, or combined as desired or appropriate.

[0054] Flowchart 200 includes user A 102 and user B 104, and user A 102 and user B 104 can interact to provide delegated access to a user account and use the user account based on the delegated access. User A 102 can be a user using a first user device 110 (refer to Figure 1 100 discussed above) to receive a delegation of account user from user B 104 (e.g., a second user using a second user device 130 of system 100). In this regard, user A 102 may use reference Figure 1 The service provider server 140 discussed in the system 100 receives delegations of account usage. The service provider server 140 may provide a user A CSM 150a used by user A 102 to receive delegations of account usage and monitor account usage, while the service provider server 140 provides a user B CSM 150b, which is used to provide delegations of account usage to other users and manage these delegations. The user A CSM 150a and the user B CSM 150b may be referred to as Figure 1 The processes discussed are implemented and provided by the CSM application 150 in the system 100 and can be performed using a device-side application (such as the password management application 112 in the system 100) to provide and manage delegated use of an account.

[0055] In step 1 of the flowchart 200, user B 104 may perform the process of adding their account password and granting access to user A 102. This may be accomplished by the following operations: In step 2, user B 104 first saves their account username and password using user B CSM 150b. The authentication credentials may be stored using user B CSM 150b so that user B CSM 150b may perform a delegated login to the account for user A 102 without user B 104 providing authentication credentials directly to user A 102. In step 3, user B 104 then grants user A 102 limited access to the account. These restrictions may be set by user B 104 through selection of terms, usage parameters, and account usage conditions, and may limit the actions performed using the account and the account data that may be accessed from the account. The restrictions may also or alternatively be set by the service provider.

[0056] Once completed, User B CSM 150b may request the service provider server 140 to provide delegated account use to User A 102 and establish User A 102 as a delegate user for use of the account within the limits set by User B 104 and / or the service provider. This request may establish delegated use of User B 104's account for User A 102, so that User ACSM 150a may participate to allow delegated use of User B 104's account to User A 102. At step 5, User A 102 is notified of the availability of delegated use of User B 104's account by User ACSM 150a. User A CSM 150a may populate the notification and options for logging into the account based on the delegation of account use. At step 6, User A 102 may confirm, and User ACSM 150a may store the information necessary to allow User A 102 to log into the account.

[0057] At step 7, user A 102 may log in to the account of user B 104 based on the previously established account delegation. To perform the account login based on the delegated use, user A 102 may visit a website or access an application associated with the account use platform 160 at step 8. This may include navigation to an authentication screen or interface that requests authentication credentials for the account. Since the authentication credentials are unknown to user A 102, at step 9, the account use platform 160 may extract the credentials from user A CSM 150a. In some embodiments, this may include using a service provider server 140 to retrieve security credentials for the account of user B 104. For example, user A CSM 150a may have the right to use the account credentials, but may not independently have access and / or access to the security account credentials to prevent fraud. In this way, user A CSM 150a may request the service provider server 140 to provide the account credentials of the account of user B 104 to the account use platform 160. User A CSM 150a may detect navigation to account usage platform 160 and may automatically enter credentials, or may enter credentials based on a request from user A 102 and / or account usage platform 160 to perform a logon to the account for delegated use. Service provider server 140 may use the stored credentials from user B CSM 150b to automatically populate the credentials into the authentication request on account usage platform 160. Thus, user A 102 may log into the account of user B 104 with the help of service provider server 140.

[0058] After logging into the account of user B 104, at step 11, user A 102 uses the account of user B 104 to shop on the account use platform 160. At step 11, user A 102 may also perform other account actions. During the shopping action, at step 12, user A 102 may shop and select items to be purchased, for example, by adding items to a digital shopping cart. At step 13, checkout is requested using the account of user B 104. The account may be used to request checkout from the service provider server 140 to provide payment for the items selected for purchase. At step 14, the service provider server 140 checks restrictions on the use of the entrusted account using the account use platform 160 and / or transactions on the account use platform 160. This may adjudicate restrictions and determine whether transaction processing may continue. If no restrictions are violated, the transaction may be processed; however, if restrictions are violated, the service provider server 140 may prevent the transaction from being processed and may warn user A 102 and / or user B 104 of the violation. Similarly, if User A 102 attempts to make a profile change that is prohibited at step 15, such as by accessing a change password process using the account usage platform 160 at step 16, the User A CSM 150a with the service provider server 140 may detect the requested account profile change. Accordingly, at step 17, the User A CSM 150a may instead redirect the requested navigation to a block page that alerts User A 102 of the prohibited use. The User A CSM 150a and / or the service provider server 140 may alert User B 104 of the prohibited request via the User B CSM 150b.

[0059] Figure 3 is an exemplary system environment in which a user device and a transaction processor server may interact to establish and use a credential store manager according to one embodiment. Figure 3 Include reference Figure 1 The system 100 is discussed with reference to the first user device 110 and the service provider server 140 .

[0060] In environment 300, service provider server 140 performs operations generally consistent with reference Figure 1The CSM application 150 corresponds to the processes and features discussed in the system 100. In this regard, the CSM application 150 can be used to delegate account usage to the first user device 110 so that the first user associated with the first user device 110 can access the account and use the account based on the delegated usage. For example, the CSM application 150 includes delegated account usage 3100, which includes delegating account A 3020 to the first user. The delegation can be based on a request 3102 from a second user who controls, manages, or owns account A 3020. The request 3102 can also specify usage 3022 of account A 3020 and restrictions 3024 on the usage of account A 3020. The usage 3022 can specify required or recommended usage of account A 3020, while the restrictions 3024 can prevent specific usage and data access of account A 3020.

[0061] When providing the first user device 110 with delegated use of account A 3020, the CSM application can receive detected application data 3026 on the browser application 120. Further in the environment 300, the first user device 110 executes the browser application 120 and the password management application 112, which generally correspond to the reference Figure 1 The processes and features discussed in the system 100 of FIG. 100 are described in detail in detail. The password management application 112 can be implemented to provide notifications associated with delegated account use and enforce restrictions 3024 on account use. For example, the password management application 112 can receive an account authorization 3014 for delegated account use and display a message 3016 allowing a first user to be notified that they can use the second user's account. The account use authorization 3018 can include one authorization for account A 3020 and include use 3022 and restrictions 3024.

[0062] The browser application 120 may be used to generate application data 3000, such as an account authentication request 3002, which may be detected and provided to the CSM application 150. For example, the password management application 112 may access the detected application data 3026 of the application data 3000 having the account authentication request 3002, and provide the data to the CSM application 150. The security credentials 3004 may be provided to the browser application 120, such as by the password management application 112, to perform a secure login based on the account authentication request 3002 in the browser application 120. The CSM application 150 may also be used to detect the current process 3006, such as the data request 3008, the navigation 3010, and the data processing 3012 in the browser application 120, and enforce restrictions 3024 on the current process 3006.

[0063] Figure 4Ais an exemplary application interface for delegate account usage through a credential storage manager according to one embodiment. Figure 4A The environment 400a includes a user device (e.g., reference Figure 1 The browser interface 4000 is displayed on the first user device 110 discussed in the system 100 of FIG. The browser interface 4000 can be provided by the device application after accessing the account based on the delegated use of the account. Therefore, the browser interface 4000 can be used to perform one or more actions during the delegated use of the account based on the terms and restrictions on the use of the account.

[0064] In environment 400a, browser interface 4000 displays a login and shopping screen such as that seen when a user device accesses another user's account based on delegated use of the account. For example, browser interface 4000 includes a welcome message 4002 for a delegate user viewing browser interface 4000. Welcome message 4002 may display a username 4004 and a password field 4006 for account A, wherein password field 4006 displays a hidden password that is not revealed to the delegate user. Password field 4006 may be automatically populated by the service provider's CSM, and authentication credentials may be prevented from being revealed to the delegate user. Additionally, username 4004 and password fields 4006 may be displayed using account settings 4008. However, selections in account settings 4008 may be inaccessible to the delegate user, and / or selections may result in navigation to a blocked page, such as Figure 4B The block page shown.

[0065] When using account A, the delegate user may generate a shopping cart 4010, which has item A 4012 and item B, item A 4012 having a cost 4014, and item B having a cost 4018. A total 4020 may be generated based on the shopping cart 4010, and the delegate user may use account A to perform electronic transaction processing 4022 based on the delegate use. A notification 4024 may also be displayed to the delegate user based on the shopping cart 4010 and / or other information for the delegate use. For example, if item A 4012, item B 4016, and / or the total 4020 violate one of the rules set by the owner of account A regarding transaction processing, a notification 4024 may be displayed to the delegate user to update the shopping cart 4010 to ensure that the shopping cart 4010 and the electronic transaction processing 4022 are within the limits. For example, the cost 4018 may exceed the allowed amount, and the notification 4024 may notify the delegate user to remove item B 4016 from the shopping cart 4010 and / or select another item.

[0066] Figure 4B is an exemplary application interface that displays a blocking notification to a delegate user when the delegate user attempts to access sensitive information, according to one embodiment. Figure 4AThe environment 400a includes a user device (e.g., reference Figure 1 The browser interface 4000 is displayed on the first user device 110 discussed in the system 100. The browser interface 4000 can be provided by the device application after the user performs an unauthorized account action during the use of the delegated account. Therefore, the browser interface 4000 can be displayed to notify the delegate user that the user's account activity is illegal and is prohibited by one or more restrictions on account use.

[0067] In environment 400a, browser interface 4100 may display a notification or alert in response to an unauthorized account action, for example, if a delegate user attempts to access unauthorized data, change account data, and / or use an account in an unauthorized manner (e.g., exceeding transaction processing limits). Thus, in response to an unauthorized account action, a block page 4102 may be displayed to the delegate user. Block page 4102 may include a message 4104 displayed to the user. For example, message 4104 includes the following: "Warning! You have accessed unauthorized actions! If you continue unauthorized use, your account use of Bob's account will be revoked and Bob will be notified!". Content 4106 may notify the delegate user that the activity is prohibited and that the user should end the activity before the delegation of his account use is revoked. In some embodiments, block page 4102 may be displayed by a browser extension or another application associated with delegated use, and may be pushed to the device by a service provider server in response to detecting unauthorized use based on known restrictions on account use, or output by an extension / application.

[0068] Block page 4102 also includes navigation option 4108, which allows the delegate user to revoke navigation to unauthorized processes or data. This navigation option 4108 can be used to restore to the previously allowed interface, or leave and return to the welcome screen where the delegate account use is allowed. In response to block page 4102, the delegate user may also wish to receive additional permissions to allow unauthorized use, such as if the delegate user needs to purchase items that exceed the allowed threshold. In this regard, block page 4102 can also include request additional permissions option 4110 to request those permissions from the owner of the account. The delegate user can also select view restrictions option 4112, which allows the delegate user to view the restrictions that caused the block page 4102 and other restrictions on account use.

[0069] Figure 5 is suitable for implementing according to one embodiment Figure 1500. In various embodiments, the communication device may include a personal computing device capable of communicating with a network (e.g., a smart phone, a computing tablet, a personal computer, a laptop, a wearable computing device such as glasses or a watch, a Bluetooth device, a key fob, a badge, etc.). The service provider may use a network computing device capable of communicating with a network (e.g., a network server). It should be appreciated that each device used by the user and the service provider may be implemented as a computer system 500 as follows.

[0070] The computer system 500 includes a bus 502 or other communication mechanism for transmitting information data, signals and information between the various components of the computer system 500. The components include an input / output (I / O) component 504 that processes user actions, such as selecting a key from a keyboard / key, selecting one or more buttons, images or links, and / or moving one or more images, and sending corresponding signals to the bus 502. The I / O component 504 may also include an output component, such as a display 511 and a cursor control 513 (e.g., a keyboard, a key, a mouse, etc.). An optional audio input / output component 505 may also be included to allow a user to use voice input information by converting an audio signal. The audio I / O component 505 may allow the user to hear audio. A transceiver or network interface 506 sends and receives signals between the computer system 500 and other devices (e.g., another communication device, a service device, or a service provider server) via a network 170. In one embodiment, the transmission is wireless, although other transmission media and methods may also be suitable. The one or more processors 512 may be a microcontroller, digital signal processor (DSP), or other processing component that processes these various signals, such as for display on the computer system 500 or transmission to other devices via the communication link 518. The processor(s) 512 may also control the transmission of information (such as cookies or IP addresses) to other devices.

[0071] Components of the computer system 500 also include a system memory component 514 (e.g., RAM), a static storage component 516 (e.g., ROM), and / or a disk drive 517. The computer system 500 performs specific operations by (one or more) processors 512 and other components by executing one or more instruction sequences contained in the system memory component 514. Logic can be encoded in a computer-readable medium, which can refer to any medium that participates in providing instructions to (one or more) processors 512 for execution. Such media can take a variety of forms, including but not limited to non-volatile media, volatile media, and transmission media. In various embodiments, non-volatile media include optical or magnetic disks, volatile media include dynamic memory, such as the system memory component 514, and transmission media include coaxial cables, copper wires, and optical fibers (including wires with bus 502). In one embodiment, logic is encoded in a non-transitory computer-readable medium. In one example, the transmission medium can take the form of sound waves or light waves, such as those generated during radio wave, optical, and infrared data communications.

[0072] Some common forms of computer readable media include, for example, floppy disks, diskettes, hard disks, magnetic tape, any other magnetic media, CD-ROMs, any other optical media, punch cards, paper tape, any other physical media with a pattern of holes, RAM, PROM, EEPROM, FLASH-EEPROM, any other memory chip or cartridge, or any other medium suitable for reading by a computer.

[0073] In various embodiments of the present disclosure, the execution of the instruction sequence for practicing the present disclosure may be performed by the computer system 500. In various other embodiments of the present disclosure, multiple computer systems 500 coupled to a network (e.g., LAN, WLAN, PTSN, and / or various other wired or wireless networks (including telecommunications, mobile and cellular telephone networks)) via a communication link 518 may coordinately execute the instruction sequence to practice the present disclosure.

[0074] Where applicable, the various embodiments provided by the present disclosure may be implemented using hardware, software, or a combination of hardware and software. In addition, where applicable, the various hardware components and / or software components described herein may be combined into composite components including software, hardware, and / or both, without departing from the spirit of the present disclosure. Where applicable, the various hardware components and / or software components described herein may be separated into subcomponents including software, hardware, or both, without departing from the scope of the present disclosure. In addition, where applicable, it is foreseeable that software components may be implemented as hardware components, and vice versa.

[0075] Software (e.g., program code and / or data) according to the present disclosure may be stored on one or more computer-readable media. It is also contemplated that the software identified herein may be implemented using one or more general or special-purpose computers and / or computer systems, networks, and / or other means. Where applicable, the order of the various steps described herein may be changed, combined into composite steps, and / or separated into sub-steps to provide the features described herein.

[0076] The foregoing disclosure is not intended to limit the present disclosure to the precise form disclosed or to the specific field of use. Therefore, it is foreseeable that various alternative embodiments and / or modifications to the present disclosure, whether explicitly described or implied herein, are possible in light of the present disclosure. Having thus described the embodiments of the present disclosure, one of ordinary skill in the art will recognize that changes may be made in form and detail without departing from the scope of the present disclosure. Therefore, the present disclosure is limited only by the claims.

Claims

1. A system for a credential storage manager, comprising: Non-transitory memory, storing instructions; and One or more hardware processors coupled to the non-transitory memory and configured to read the instructions from the non-transitory memory to cause the system to perform the following operations, the operations comprising: detecting an authentication request from a first device of a first user, the authentication request being for accessing an account of a second user in a first application executed on the first device; processing the authentication request on behalf of the first user using authentication credentials for the second user's account, wherein the authentication request is processed while preventing the first user from viewing the authentication credentials; providing use of the account of the second user in the first application, wherein use of the account is limited based on restrictions set by the second user and / or by a service provider that manages the account for use of the account; Logging the first application out of the account in response to one of: expiration of the restriction on use of the account, or violation of the restriction on use of the account; and The authentication credentials are deleted from the first device.

2. The system according to claim 1, wherein: Before detecting the authentication request, the operation further includes: determining a device fingerprint of the first device; and The authentication request is determined to be an application usage session of the first application by the first user based on at least one of the following: a device fingerprint, a timestamp of the application usage session, a cookie on the first device, or a token on the first device.

3. The system according to claim 2, wherein: Before detecting the authentication request, the operation further includes: receiving a request from the second user to delegate use of the account to the first user, wherein the request includes a restriction on use of the account, and wherein the restriction includes one of: a time limit on use of the account, a purchase amount limit on purchases made using the account, a website use limit for logging into the account on a website, an application use limit for logging into the account in an application, or an account access limit for services provided by the account, Wherein the device fingerprint is determined in response to the request to delegate use of the account to the first user.

4. The system according to claim 1, wherein: Detecting the authentication request includes one of receiving a request to enter the authentication credentials in a field within the first application, determining a navigation to a web page within the first application, or determining that the first application is open on the first device.

5. The system according to claim 1, wherein: Before detecting the authentication request, the operation further includes: monitoring the first application for the authentication request using a second application on the first device, wherein the second application provides password management services for the system, Wherein the authentication request is detected by the second application, and wherein processing the authentication request comprises causing the second application to automatically populate the authentication credentials into the authentication request within the first application.

6. The system according to claim 5, wherein: Before detecting the authentication request, the operation further includes: The first user is notified of the availability of the first user to use the account through the second application, wherein the first user is notified of the availability and restrictions on the use of the account.

7. The system according to claim 1, wherein: Processing the authentication request includes: detecting that the authentication request requires two-factor authentication; mining a code for two-factor authentication from a message sent to a second device of the second user; and The authentication request is processed using the authentication credentials for the account and the code.

8. The system according to claim 1, wherein: Providing for use of the account includes monitoring use of the account within the first application and preventing use of the account when use violates the restrictions.

9. The system according to claim 1, wherein: The operations also include: receiving a checkout process for a transaction in the first application, wherein the checkout process uses the account to process the transaction; determining whether the transaction complies with restrictions on the use of the account; and Based on determining whether the transaction complies with the restrictions, the transaction is processed through the checkout process.

10. The system according to claim 1, wherein: Before logging out the first application from the account, the operation further includes: receiving a request to perform an action prohibited on the account based on the restriction; and The interface of the first application is redirected to a block notification, wherein the block notification notifies the first user that the prohibited action is prevented based on the restriction.

11. The system according to claim 1, wherein: The first application comprises a browser application on the first device, and wherein the detecting, the processing, and the providing are performed by an application extension provided by the system for the browser application.

12. The system according to claim 11, wherein: The operations also include: receiving, by the application extension, a webpage navigation request for accessing a webpage associated with changing at least one of personal information of the account or a password of the account; Preventing, by the application extension, navigation to the webpage based on the webpage navigation request; and A message associated with the navigation is displayed via the application extension.

13. A method for a credential storage manager, comprising: detecting an authentication request from a first device of a first user, the authentication request being for accessing an account of a second user in a first application executed on the first device; processing the authentication request on behalf of the first user using authentication credentials for the second user's account, wherein the authentication request is processed while preventing the first user from viewing the authentication credentials; providing use of the account of the second user in the first application, wherein use of the account is limited based on restrictions set by the second user and / or by a service provider that manages the account for use of the account; Logging the first application out of the account in response to one of: expiration of the restriction on use of the account, or violation of the restriction on use of the account; and The authentication credentials are deleted from the first device.

14. The method according to claim 13, wherein: Before detecting the authentication request, the operation further includes: determining a device fingerprint of the first device; and The authentication request is determined to be an application usage session of the first application by the first user based on at least one of the following: a device fingerprint, a timestamp of the application usage session, a cookie on the first device, or a token on the first device.

15. The method according to claim 14, wherein: Before detecting the authentication request, the operation further includes: receiving a request from the second user to delegate use of the account to the first user, wherein the request includes a restriction on use of the account, and wherein the restriction includes one of: a time limit on use of the account, a purchase amount limit on purchases made using the account, a website use limit for logging into the account on a website, an application use limit for logging into the account in an application, or an account access limit for services provided by the account, Wherein the device fingerprint is determined in response to the request to delegate use of the account to the first user.

16. The method according to claim 13, wherein: Detecting the authentication request includes one of receiving a request to enter the authentication credentials in a field within the first application, determining a navigation to a web page within the first application, or determining that the first application is open on the first device.

17. The method according to claim 13, wherein: Before detecting the authentication request, the operation further includes: monitoring the first application for the authentication request using a second application on the first device, wherein the second application provides password management services, Wherein the authentication request is detected by the second application, and wherein processing the authentication request comprises causing the second application to automatically populate the authentication credentials into the authentication request within the first application.

18. The method according to claim 17, wherein: Before detecting the authentication request, the operation further includes: The first user is notified of the availability of the first user to use the account through the second application, wherein the first user is notified of the availability and restrictions on the use of the account.

19. A non-transitory machine-readable medium having machine-readable instructions stored thereon, the machine-readable instructions being executable to cause a machine to perform the following operations, the operations comprising: detecting an authentication request from a first device of a first user, the authentication request being for accessing an account of a second user in a first application executed on the first device; processing the authentication request on behalf of the first user using authentication credentials for the second user's account, wherein the authentication request is processed while preventing the first user from viewing the authentication credentials; providing use of the account of the second user in the first application, wherein use of the account is limited based on restrictions set by the second user and / or by a service provider that manages the account for use of the account; Logging the first application out of the account in response to one of: expiration of the restriction on use of the account, or violation of the restriction on use of the account; and The authentication credentials are deleted from the first device.

Images