System and method for preventing identity theft or misuse by restricting access

• US 8,849,716 B1
• Filed: 09/14/2007
• Issued: 09/30/2014
• Est. Priority Date: 04/20/2001
• Status: Active Grant

• Current Assignee: JP Morgan Chase Bank, N.A. (JP Morgan Chase & Co)
• Original Assignee: JP Morgan Chase Bank, N.A. (JP Morgan Chase & Co)
• Inventors: Everhart, Glenn C.
• Primary Examiner(s): Kim, Steven
• Application Number:
  US11/900,982
• Time in Patent Office: 2,573 Days
• Field of Search: 705/1, 705 50- 64, 726/26, 726/22, 707/821
• US Class Current: 705/51
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06Q 2220/10 Usage protection of distributed data files
• CPC Class Codes: G06Q 50/265 Personal security, identity or safety
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04N 7/173 with two-way working, e.g. subscriber sending a programme selection signal

Abstract

A system and method for network file filtering to prevent identity theft or misuse by restricting access to files likely to contain sensitive data is disclosed. The file filtering process includes scanning at least one data file for density of a selected pattern. Files identified as containing the selected pattern may be further analyzed to determine the likelihood of the presence of sensitive information. The process may also include restricting access to files that are identified as likely to contain sensitive information.

Claims

1. A computer implemented method of preventing identity theft and other wrongful use of information stored in a computer system of an enterprise engaged in recording financial and other confidential information, the method comprising:

(a) providing a computer system including a database comprising non-sensitive and sensitive data files, wherein the sensitive data files comprise sensitive information comprising one or more of customer names, addresses, zip codes, contact information, dates of birth, social security numbers, and financial account numbers of one or more of bank accounts, credit card accounts, and debit card accounts, wherein further multiple users are authorized by the enterprise to access the system;

(b) selecting a key word string, by at least one or more computer processors, comprising an alphanumeric string including at least a portion of numeric data identifying a financial account comprising one or more of bank accounts, credit card accounts, and debit card accounts;

(c) scanning, by the at least one or more computer processors, the database for files comprising the key word string;

(d) determining, by the at least one or more computer processors, whether a density of occurrence of the key word string in files that comprise the key word string is greater than a threshold density;

(e) calculating, by the at least one or more computer processors, a check digit from the numeric data in the determined files that correspond to the key word string;

(f) validating, by the at least one or more computer processors, the files by comparing the calculated check digit to the numeric data in the files that correspond to the key word string;

(g) based on the results of the validation, identifying special files by the at least one or more computer processors,

(h) protecting the special files by moving the identified special files to a secure location, by the at least one or more computer processors;

(i) receiving, by the at least one or more computer processors, a request to access at least one of the identified special files, and

(j) in response to receiving the access request, performing, by the at least one or more computer processors, at least one of the steps comprising;

(1) activating an alarm to indicate when unauthorized access to one or more of the special files is occurring or has occurred;

(2) password protecting one or more of the special files;

(3) controlling access based on one or more of user type, place of user access, user file authorization, and user privileges authorization;

(4) executing site specific commands wherein the site specific commands gather evidence of what actions an unauthorized user is undertaking or undertook without exposing one or more of the special files to the unauthorized user;

(5) granting at least one identifier to a file opening process for one or more of the special files and revoking the identifier when one or more of the special files are closed;

(6) preventing covert code from running in association with one or more of the special files by attaching at least one of a crypt checksum and a privilege mask to one or more of the special files; and

(7) encrypting one or more of the special files.

2. The method of claim 1, wherein the key word string comprises a credit card number and the check digit is calculated by the Luhn algorithm.

3. The method of claim 2, wherein encrypting one or more of the special files comprises public key encryption.

4. The method of claim 1, further comprising calculating the check digit for each identified file only in the event a number of identified files in the database exceeds a predetermined threshold density.

5. The method of claim 1, wherein the special files are protected only in the event a ratio of special files having a valid check digit to the identified files having no valid check digit exceeds a predetermined ratio.

6. The method of claim 1, wherein the special files are protected only in the event a percentage of special files having a valid check digit exceeds a percentage that would be found in a random collection of data.

7. A computer implemented method of preventing identity theft and other wrongful use of information stored in a computer system of an enterprise engaged in recording financial and other confidential information, the method comprising:

(a) providing a computer system including a database comprising non-sensitive and sensitive data files, wherein the sensitive data files comprise sensitive information comprising one or more of customer names, addresses, zip codes, contact information, dates of birth, social security numbers, and financial account numbers of one or more of bank accounts, credit card accounts, and debit card accounts, wherein further multiple users are authorized by the enterprise to access the system;

(b) selecting, by at least one or more computer processors a special pattern comprising;

i. a key word string comprising an alphanumeric string including at least a portion of numeric data identifying a financial account comprising one or more of bank accounts, credit card accounts, and debit card accounts; and

ii. a second string structured for identifying one or more of customer names, addresses, zip codes, contact information, dates of birth, and social security numbers;

(c) scanning, by the at least one or more computer processors, the database;

(d) determining, by the at least one or more computer processors, whether a density of occurrence of the special pattern in files having the special pattern is greater than a threshold density;

(e) calculating, by the at least one or more computer processors, a check digit from the numeric data in the determined files that correspond to the key word string;

(f) validating, by the at least one or more computer processors, the files by comparing the calculated check digit to the numeric data in the determined files that correspond to one or both of the first keyword string and the second string;

(g) based on the results of the validation, identifying special files by the at least one or more computer processors;

(h) moving, by the at least one or more computer processors, the identified special files to a secure location;

(i) receiving, by the at least one or more computer processors, a request to access at least one of the identified special files, and

(j) in response to receiving the access request, performing, by the at least one or more computer processors, at least one of the steps comprising;

(1) activating an alarm to indicate when unauthorized access to one or more of the special files is occurring or has occurred;

(2) password protecting one or more of the special files;

(3) controlling access based on one or more of user type, place of user access, user file authorization, and user privileges authorization;

(4) executing site specific commands wherein the site specific commands gather evidence of what actions an unauthorized user is undertaking or undertook without exposing one or more of the special files to the unauthorized user;

(5) granting at least one identifier to a file opening process for one or more of the special files and revoking the identifier when one or more of the special files are closed;

(6) preventing covert code from running in association with one or more of the special files by attaching at least one of a crypt checksum and a privilege mask to one or more of the special files; and

(7) encrypting one or more of the special files.

8. The method of claim 7, wherein the density of occurrence of the special pattern comprises dividing the number of occurrences of the special pattern in each data file in the database by the size of the data file.

9. The method of claim 8, wherein the selected threshold density comprises averaging the density of occurrence of the special pattern for all of the data files in the database.

10. The method of claim 7, further comprising wherein the special files are protected only in the event the ratio of special files having a valid check digit to the identified files having no valid check digit exceeds a predetermined ratio.

11. The method of claim 7, wherein the special files are protected only in the event the percentage of special files having a valid check digit exceeds the percentage that would be found in a random collection of data.

12. A computer system for recording financial and other confidential information wherein multiple users are authorized to access the system, the system comprising:

(a) a database comprising non-sensitive and sensitive data files, wherein the sensitive data files comprise one or more of customer names, addresses, zip codes, contact information, dates of birth, social security numbers, and financial account numbers of one or more of bank accounts, credit card accounts, and debit card accounts;

(b) at least one computer processor; and

(c) a memory device storing computer executable instructions, when executed by the at least one computer processor, cause the at least one computer processor to perform the method comprising;

(i) selecting a key word string comprising an alphanumeric string including at least a portion of numeric data identifying a financial account comprising one or more of bank accounts, credit card accounts, and debit card accounts;

(ii) scan scanning each data file in the database for the occurrence of the key word string;

(iii) determining whether a density of occurrence of the key word string in files in the database that comprise the key word string is greater than a threshold density;

(iv) calculating a check digit from the numeric data in the determined files that correspond to the keyword string;

(v) validating the files by comparing the calculated check digit to the numeric data in the determined files that correspond to the keyword string;

(vi) based on the results of the validation, identifying special files;

(vii) protecting the specific files by moving the identified special files to a secure location;

(viii) receiving a request to access at least one of the identified special files; and

(ix) performing at least one of the steps comprising;

(1) activating an alarm to indicate when unauthorized access to one or more of the special files is occurring or has occurred;

(2) password protecting one or more of the special files;

(3) controlling access based on one or more of user type, place of user access, user file authorization, and user privileges authorization;

(4) executing site specific commands wherein the site specific commands which gather evidence of what actions an unauthorized user is undertaking or undertook without exposing one or more of the special files to the unauthorized user;

(5) granting at least one identifier to a file opening process for one or more of the special files and revoking the identifier when one or more of the special files are closed;

(6) preventing covert code from running in association with one or more of the special files by attaching at least one of a crypt checksum and a privilege mask to one or more of the special files; and

(7) encrypting one or more of the special files.

13. The computer system of claim 12, wherein the first keyword string comprises a credit card number and the check digit is calculated by the Luhn algorithm.

14. The computer system of claim 13, wherein encrypting the special files comprises public key encryption.

15. The computer system of claim 12, wherein the steps of selecting a key word string and protecting the special files are performed by separate processors.

16. The computer system of claim 12, wherein the steps of selecting a key word string and protecting the special files are performed by the same processor.

17. The computer system of claim 12, wherein the method further comprises for determining the density of identified files in the database and calculating the check digit for each identified file only in the event the number of identified files in the database exceeds a predetermined threshold density.

18. The computer system of claim 12, wherein the special files are protected only in the event a ratio of special files having a valid check digit to the identified files having no valid check digit exceeds a predetermined ratio.

19. The computer system of claim 12, wherein the special files are protected only in the event a percentage of special files having a valid check digit exceeds a percentage that would be found in a random collection of data.