Network security and fraud detection system and method

• US 8,776,225 B2
• Filed: 02/15/2005
• Issued: 07/08/2014
• Est. Priority Date: 06/14/2004
• Status: Active Grant

• Current Assignee: iovation Incorporated
• Original Assignee: iovation Incorporated
• Inventors: Pierson, Greg, DeHaan, Jason
• Primary Examiner(s): LEMMA, SAMSON B
• Application Number:
  US11/058,846
• Publication Number:
  US 20050278542A1
• Time in Patent Office: 3,430 Days
• Field of Search: 726/3, 726/22, 726/26, 726/23, 705/73, 705/7.29, 709/223, 709/224, 455/410, 713/182
• US Class Current: 726/23
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint

Abstract

A system and method to detect and prevent fraud in a system is provided. The system may uniquely identify physical devices connecting to a network, register unique devices, track end-user logins, associate end-user accounts with specific devices, and share information with multiple network service providers is described.

Claims

1. A computer implemented method for use with a system comprising a plurality of network service providers each configured to provide a service, and a network device configured to connect to at least one of the plurality of network service providers over a communications network and when so connected, to use the service or services provided by the at least one of the plurality of network service providers, the method comprising:

gathering, by at least one hardware processor, information about the network device used to obtain a device identifier that identifies the network device;

associating the device identifier with one or more reputation factors;

generating a reputation for the network device based on an evaluation of the one or more reputation factors associated with the device identifier; and

sharing the reputation with the plurality of network service providers for use thereby to detect fraud associated with use of the network device across the plurality of network service providers.

2. The method of claim 1, further comprising:

generating a network device identifier for the network device that uniquely identifies the network device in combination with the device identifier.

3. The method of claim 1, further comprising:

validating the network device on a periodic basis or a random basis.

4. The method of claim 1, further comprising:

validating the network device upon connection of the network device to one of the plurality of network service providers.

5. The method of claim 1, further comprising:

validating the network device when the network device logs onto one of the plurality of network service providers.

6. The method of claim 1, further comprising:

validating the network device when the network device performs a transaction with one of the plurality of network service providers.

7. The method of claim 1, further comprising:

validating the network device each time that the network device re-connects to one of the plurality of network service providers.

8. The method of claim 1, wherein the reputation factors further comprise one or more of end-user account information provided by one of the plurality of network service providers, a credit card account number of a user, a fingerprint of the user, an email address of the user, a phone number of the user, a physical address of the user, and a cellular phone number of the user.

22. The method of claim 1, wherein the evaluation of the one or more reputation factors associated with the device identifier further comprises:

cross-correlating the one or more reputation factors to generate the reputation.

23. The method of claim 1, wherein the evaluation of the one or more reputation factors associated with the device identifier further comprises:

selecting a portion of the one or more reputation factors associated with the device identifier; and

evaluation only the selected portion of the one or more reputation factors.

24. The method of claim 1, further comprising:

receiving information related to at least a portion of the one or more reputation factors from one or more of the plurality of network service providers, wherein generating the reputation for the network device based on the evaluation of the one or more reputation factors associated with the device identifier further comprises evaluating the information received.

25. The method of claim 1, further comprising:

receiving the one or more reputation factors from a first one of the plurality of network service providers; and

receiving information related to at least a portion of the one or more reputation factors from one or more of the plurality of network service providers other than the first network service provider, wherein generating the reputation for the network device based on the evaluation of the one or more reputation factors associated with the device identifier further comprises evaluating the information received.

26. The method of claim 1, further comprising:

receiving the one or more reputation factors from at least one of the plurality of network service providers.

39. The method of claim 1, wherein the evaluation comprises:

filtering the one or more reputation factors associated with the device identifier to thereby filter out a first portion of the one or more reputation factors associated with the device identifier; and

evaluating a second portion of the one or more reputation factors associated with the device identifier that were not filtered out to generate the reputation.

9. A network security and fraud detection and prevention system for use with a plurality of network service providers configured to provide services, and a network device configured to connect to the network service providers over a communications network, the system comprising:

one or more storage devices; and

one or more processors connected to the one or more storage devices, the one or more storage devices storing instructions executable by the one or more processors that when executed thereby implement a method comprising;

obtaining a device identifier that uniquely identifies the network device;

associating the device identifier with one or more reputation factors;

generating a reputation for the network device based on an evaluation of the one or more reputation factors; and

;

sharing the reputation with the plurality of network service providers for use thereby to detect fraudulent use of the network device.

10. The system of claim 9, wherein the method further comprises storing a plurality of records on the one or more storage devices, each record further comprising:

a host field containing an identifier of a particular one of the plurality of network service providers,

a user account information field containing information from the particular network service provider that identifies a particular user, and

the device identifier that uniquely identifies the network device.

11. The system of claim 9, wherein the method further comprises:

generating a network device identifier for the network device that uniquely identifies the network device in combination with the device identifier; and

transmitting the network device identifier to the network device.

12. The system of claim 11, wherein the device identifier further comprises a fingerprint.

13. The system of claim 9, wherein the method further comprises validating the network device on a periodic basis or a random basis.

14. The system of claim 9, wherein the method further comprises validating the network device upon connection of the network device to one of the plurality of network service providers.

15. The system of claim 9, wherein the method further comprises validating the network device when the network device logs onto one of the plurality of network service providers.

16. The system of claim 9, wherein the method further comprises validating the network device when the network device performs a transaction with one of the plurality of network service providers.

17. The system of claim 9, wherein the method further comprises validating the network device each time that the network device re-connects to one of the plurality of network service providers.

18. The system of claim 9, wherein the device identifier further comprises a fingerprint.

19. The system of claim 9, wherein the device identifier further comprises a serial number for a cellular phone.

20. The system of claim 9, wherein the network device further comprises one of a cellular phone, a personal digital assistant, a laptop computer, a personal computer and a telephone.

21. The system of claim 9, wherein the one or more reputation factors further comprise one or more of end-user account information provided by one of the plurality of network service providers, a credit card account number of a user, a fingerprint of the user, an email address of the user, a phone number of the user, a physical address of the user, and a cellular phone number of the user.

27. A computer implemented method comprising:

obtaining a device identifier that identifies a network device;

receiving one or more reputation factors from a first one of a plurality of network service providers, the one or more reputation factors being associated with a user or a user account;

associating the device identifier with the one or more reputation factors;

receiving information from a second one of the plurality of network service providers related to at least a portion of the one or more reputation factors;

sharing the information received and the one or more reputation factors with the plurality of network service providers; and

at one or more of the plurality of network service providers, generating a reputation for the network device based on an evaluation of the information related to the portion of the one or more reputation factors associated with the device identifier, and using the reputation to detect fraud associated with use of the network device across the plurality of network service providers.

28. The method of claim 27, wherein the reputation is generated and used by one of the plurality of network service providers other than the first network service provider.

29. A system comprising a plurality of network service providers for use with a network device configured to connect to each of the plurality of network service providers over a communications network, at least one of the plurality of network service providers comprising:

one or more storage devices; and

one or more processors connected to the one or more storage devices, the one or more storage devices storing instructions executable by the one or more processors that when executed thereby implement a method comprising;

associating a device identifier with the network device;

obtaining one or more reputation factors associated with the device identifier from others of the plurality of network service providers;

generating a reputation for the network device based on the evaluation of the one or more reputation factors; and

detecting fraud associated with use of the network device across the plurality of network service providers.

30. The system of claim 29, wherein the evaluation of the one or more reputation factors comprises:

selecting a portion of the one or more reputation factors associated with the device identifier; and

evaluating only the selected portion of the one or more reputation factors.

31. The system of claim 29, wherein the method further comprises:

downloading a client application to the network device, the client application being configured to gather information about the network device, generate the device identifier that identifies the network device based on the information gathered, and transmit the device identifier.

32. The system of claim 31, wherein the client application is embedded in another software application or a stand-alone software application.

33. The system of claim 31, wherein the at least one of the plurality of network providers automatically downloads the client application to the network device.

34. The system of claim 31, wherein the at least one of the plurality of network providers automatically downloads the client application to the network device when the network device connects to the at least one of the plurality of network providers.

35. A system for use with a network device configured to connect to the system over a communications network, the system comprising:

a fraud detection server comprising one or more storage devices, and one or more processors connected to the one or more storage devices, the one or more storage devices storing instructions executable by the one or more processors that when executed thereby implement a method comprising obtaining a device identifier associated with the network device, the device identifier being associated with one or more reputation factors; and

a plurality of network service providers connected to the fraud detection server, each of the plurality of network service providers comprising one or more storage devices, and one or more processors connected to the one or more storage devices, the one or more storage devices storing instructions executable by the one or more processors that when executed thereby implement a method comprising generating a reputation for the network device based on an evaluation of the one or more reputation factors associated with the device identifier, and sharing the reputation with others of the plurality of network service providers for use thereby to detect fraudulent use of the network device.

36. The system of claim 35, wherein the one or more reputation factors further comprise one or more of end-user account information provided by one of the plurality of network service providers, a credit card account number of a user, a fingerprint of the user, an email address of the user, a phone number of the user, a physical address of the user, and a cellular phone number of the user.

37. The system of claim 35, wherein the evaluation comprises:

cross-correlating the one or more reputation factors to generate the reputation.

38. The system of claim 35, wherein the evaluation comprises:

selecting a portion of the one or more reputation factors associated with the device identifier; and

evaluating only the selected portion of the one or more reputation factors.