Method and apparatus for maintaining high data integrity and for providing a secure audit for fraud prevention and detection

• US 8,805,925 B2
• Filed: 11/19/2010
• Issued: 08/12/2014
• Est. Priority Date: 11/20/2009
• Status: Active Grant

• Current Assignee: Nbrella, Inc.
• Original Assignee: Nbrella, Inc.
• Inventors: Degraffenreid, Scott, Dito, Joseph, Price, Taylor, Price, Michael
• Primary Examiner(s): Augustin, Evens J
• Application Number:
  US12/950,454
• Publication Number:
  US 20110125648A1
• Time in Patent Office: 1,362 Days
• Field of Search: 709/201, 709/219, 709/203, 707/999.001
• US Class Current: 709/203
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 30/0185 Product, service or business identity fraud
• CPC Class Codes: G06Q 40/12 Accounting

Abstract

Any of various comparisons of computer folders from different points in time is performed. Such comparisons provide the ability to discover missing documents or documents with modification dates that have changed when there would otherwise have been no need to change them and thus allows discovery of missing documents to discover fraud or to search for evidence after a fraud is suspected. In another embodiment, deltas in accounting system vendor invoice accounts are compared at different points in time, potentially exposing the practice of moving fraudulent vendor transactions into a large group of legitimate transactions for a legitimate vendor. Per period transaction totals for specific periods for legitimate vendors are compared over historical time for suspicious activity. A comparison of reports from the two different periods, using exact data and software from those separate periods (instead of reporting from “current’” data), may raise a red flag otherwise missed.

Claims

1. An apparatus for maintaining high data integrity and for providing a secure audit for fraud prevention and detection, comprising:

a client on-site server comprising a server processor executing instructions to perform the steps of;

copying digital data that is stored on at least one client production server;

storing said digital data in an encrypted format comprising an encryption key that is held by any of said client and a client backup/restore service provider;

archiving discrete versions of computer folders by making multiple, sequential copies of said digital data on a predetermined time interval schedule that comprises any of a set, dynamic, and randomly variable interval;

restoring from said data storage data that has been saved on at least one point in time on at least one client production server and that has been changed or deleted on said at least one client production server;

a forensics analysis system comprising a forensics analysis processor executing instructions to perform the steps of;

comparing putatively identical computer data stored on said data storage medium at different points in time to discover missing documents or documents with modification dates that have changed when there would otherwise have been no need to change them, wherein said putatively identical data comprises a plurality of discrete archival versions of said computer folders, each version containing documents as they existed at the point in time at which they were archived; and

based upon said comparing, discovering fraud or searching for evidence after a fraud is suspected by identifying any of missing documents and documents with modification dates that have changed when there would otherwise have been no need to change them.

2. The apparatus of claim 1, said forensics analysis processor further executing instructions to perform the step of comparing differences in accounting system vendor invoice accounts at different points in time to identify any moving of fraudulent vendor transactions into a large group of legitimate transactions for a legitimate vendor.

3. The apparatus of claim 1, said forensics analysis processor further executing instructions to perform the step of comparing per period transaction totals for specific periods for legitimate vendors over historical time to identify suspicious activity.

4. The apparatus of claim 1, said forensics analysis processor further executing instructions to perform the step of comparing reports from at least two different periods, using exact data and software from said separate periods to identify suspicious activity.

5. The apparatus of claim 1, wherein said server is configured to replicate one or more of said client production servers via server virtualization.

6. The apparatus of claim 5, wherein a virtual client historical environment is compared with a client environment at different points in time;

and wherein results of said comparison are reported.

7. The apparatus of claim 1, wherein said server and/or data thereon is mirrored at at least one off-site location.

8. The apparatus of claim 1, further comprising:

at least one mechanism for conspicuously publicizing said apparatus for maintaining high data integrity and for providing a secure audit for fraud prevention and detection.

9. The apparatus of claim 8, said mechanism for publicizing comprising any of:

public meetings;

written description highlighted in an employee manual;

check list item for mandatory new employee information transfer;

text messages, logos or splash screens displayed periodically on computer monitors of employees within monitored client organizations; and

mention to any of board of directors, stockholders, clients, suppliers, auditors, bankers, compliance or government oversight organizations, and insurance providers.

10. The apparatus of claim 8, said publicizing mechanism comprising any of:

color of the hardware components;

a flashing light;

a posting or tag in a language;

a periodic or random sound;

a camera;

a microphone;

a lock;

tamper proof screws;

a tampering actuated ink sprayer;

an aroma distributor; and

an anti-movement monitor.

11. The apparatus of claim 1, further comprising within a network comprising a medium of information exchange:

a plurality of data service centers;

a plurality of client environments;

a plurality of service providers;

a plurality of said hardware server appliances comprising a corresponding plurality of forensics analysis systems;

a network database; and

a fraud prevention and detection server.

12. The apparatus of claim 1, further comprising:

at least one server comprising a corresponding forensics analysis system configured to create a virtual historical environment and to perform fraud analysis in connection with fraud prevention and fraud detection.

13. The apparatus of claim 1, further comprising:

a forensics analysis system comprising;

an administration module;

a client account module;

a client environment determination module;

an automated data collection module;

a client fee calculation module;

a service deployment module;

a control module;

a custodian module; and

an auxiliary module.

14. The apparatus of claim 1, further comprising:

a client portal.

15. The apparatus of claim 14, said client portal providing for creation of and access by at least one custodian.

16. A method for maintaining high data integrity and for providing a secure audit for fraud prevention and detection, comprising the steps of:

providing a client on-site server comprising a server processor executing instructions to perform the steps of;

copying digital data that is stored on at least one client production server;

storing said digital data in an encrypted format comprising an encryption key that is held by any of said client and a client backup/restore service provider;

archiving discrete versions of computer folders by making multiple, sequential copies of said digital data on a predetermined time interval schedule that comprises any of a set, dynamic, and randomly variable interval;

restoring from said data storage data that has been saved on at least one point in time on at least one client production server and that has been changed or deleted on said at least one client production server;

providing a forensics analysis system comprising a forensics analysis processor executing instructions to perform the steps of;

comparing putatively identical computer data stored in said data storage medium at different points in time to discover missing documents or documents with modification dates that have changed when there would otherwise have been no need to change them, wherein said putatively identical data comprises a plurality of discrete archival versions of said computer folders, each version containing documents as they existed at the point in time at which they were archived; and

based upon said comparing, discovering fraud or searching for evidence after a fraud is suspected by identifying any of missing documents and documents with modification dates that have changed when there would otherwise have been no need to change them.

17. The method of claim 16, said publicizing mechanism comprising any of:

color of the hardware components;

a flashing light;

a posting or tag in a language;

a periodic or random sound;

a camera;

a microphone;

a lock;

tamper proof screws;

a tampering actuated ink sprayer;

an aroma distributor; and

an anti-movement monitor.

18. The method of claim 16, wherein said forensics analysis processor further executing instructions to perform the step of comparing differences in accounting system vendor invoice accounts at different points in time to identify any moving of fraudulent vendor transactions into a large group of legitimate transactions for a legitimate vendor.

19. The method of claim 16, wherein said forensics analysis processor further executing instructions to perform the step of comparing per period transaction totals for specific periods for legitimate vendors over historical time to identify suspicious activity.

20. The method of claim 16, wherein said forensics analysis processor further executing instructions to perform the step of comparing reports from at least two different periods, using exact data and software from said separate periods to identify suspicious activity.

21. The method of claim 16, said mechanism for publicizing comprising any of:

public meetings;

written description highlighted in an employee manual;

check list item for mandatory new employee information transfer;

text messages, logos or splash screens displayed periodically on computer monitors of employees within monitored client organizations; and

mention to any of board of directors, stockholders, clients, suppliers, auditors, bankers, compliance or government oversight organizations, and insurance providers.

22. The method of claim 16, wherein said server is configured to replicate one or more of said client production servers via server virtualization.

23. The method of claim 16, further comprising the steps of:

comparing a virtual client historical environment with a client environment of said client on-site server at different points in time; and

reporting results of said comparison.