Identity security architecture systems and methods

• US 10,699,028 B1
• Filed: 06/19/2018
• Issued: 06/30/2020
• Est. Priority Date: 09/28/2017
• Status: Active Grant

• Current Assignee: Csidentity Corporation (Experian plc)
• Original Assignee: Csidentity Corporation (Experian plc)
• Inventors: Kennedy, Adam, Hjelm, Bryan, Jarvinen, Jay, Stambaugh, Tom, Carleton, Joel, Connealy-Seri, Iris
• Primary Examiner(s): Shaw, Peter C
• Application Number:
  US16/012,681
• Time in Patent Office: 742 Days
• Field of Search: 726 26
• CPC Class Codes: G06F 16/2462 Approximate or statistical queries
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes

Abstract

Embodiments of various systems and methods described herein provide an identity security database analytics system which is configured to provide security alerts to a user. The security alerts can include for personalized metrics related to potential identity theft incidents. The personalized metrics can include user specific information on security breaches of the user'"'"'s personal information as well as depersonalized statistics generated based on information of other users having one or more similar characteristics of the user.

Claims

1. A identity security system, the identity security system comprising:

a non-transitory data storage configured to store computer executable instructions for an identity data analysis system;

a dark web data store configured to store compromised data related to users'"'"' personal identifying information (PII) and aggregated statistics calculated based on the compromised data;

a plurality of identity alerts data stores configured to store alerts sent to the users and metadata associated with the alerts;

an identity metrics data store configured to store depersonalized summary statistics; and

a hardware processor programmed to execute the computer executable instructions in the non-transitory data storage to cause the identity security system to;

receive an instruction to generate an alert comprising personalized metrics of a user, wherein the instruction comprises PII of the user;

query a dark web data store with the PII of the user to acquire information on security compromises related to the PII of the user;

query an identity alerts data store with geographic location information of the user to obtain report statistics associated with a geographic region of the user;

query an identity metrics database to obtain the depersonalized summary statistics, wherein the depersonalized summary statistics are generated based on a group of individuals whose PIIs overlaps at least with a portion of the user'"'"'s PII;

generate an alert which comprises information on security compromises related to the PII of the user, report statistics associated with a geographic region of the user, and the depersonalized summary statistics; and

deliver the alert to a client computing device via a network, wherein compromised PIIs are acquired from dark web sites using one or more automated data collection processes.

2. The identity security system of claim 1, wherein the identity metrics data store is further configured to store counterpart tables corresponding to the aggregated statistics in the a dark web data store and the metadata in the plurality of identity alerts data stores, and the hardware processor is further programmed to periodically synchronize the counterpart tables with data in the dark web data store and the identity alerts data store.

3. The identity security system of claim 2, wherein the counterpart tables comprise a first counterpart table and a second counterpart table each of which corresponds to an aspect of a data table in the dark web data store.

4. The identity security system of claim 2, wherein the counterpart tables comprise a third counterpart table which corresponds to metadata of the plurality of identity alerts data store.

5. The identity security system of claim 2, wherein the hardware processor is programmed to update the summary statistics in the identity metrics data store based at least partly on updates to the counterpart tables in the periodic synchronization.

6. The identity security system of claim 1, wherein the alert comprises a report in an extensible markup language format.

7. A method for protecting identity security, the method comprising:

receiving an instruction to generate an alert comprising personalized metrics of a user, wherein the instruction comprises PII of the user;

querying a dark web data store with the PII of the user to acquire information on security compromises related to the PII of the user;

querying an identity alerts data store with geographic location information of the user to obtain report statistics associated with a geographic region of the user;

querying an identity metrics database to obtain depersonalized summary statistics, wherein the depersonalized summary statistics are generated based on a group of individuals whose PIIs overlaps at least with a portion of the user'"'"'s PII;

generating an alert which comprises information on security compromises related to the PII of the user, report statistics associated with a geographic region of the user, and the depersonalized summary statistics; and

delivering the alert to a client computing device via a network, wherein compromised PIIs are acquired from dark web sites using one or more automated data collection processes.

8. The method of claim 7, wherein the method further comprises periodically synchronizing counterpart tables in the identity metrics data store with data in the dark web data store and the identity alerts data store.

9. The method of claim 8, wherein the counterpart tables comprise a first counterpart table and a second counterpart table each of which corresponds to an aspect of a data table in the dark web data store.

10. The method of claim 8, wherein the counterpart tables comprise a third counterpart table which corresponds to metadata of a plurality of identity alerts data store.

11. The method of claim 8, wherein the method further comprises updating the summary statistics in the identity metrics data store based at least partly on updates to the counterpart tables in the periodic synchronization.

12. The method of claim 7, wherein the alert comprises a report in an extensible markup language format.

13. Non-transitory computer readable medium storing computer executable instructions thereon, the computer executable instructions when executed cause an identity security system to:

receive an instruction to generate an alert comprising personalized metrics of a user, wherein the instruction comprises PII of the user;

query a dark web data store with the PII of the user to acquire information on security compromises related to the PII of the user;

query an identity alerts data store with geographic location information of the user to obtain report statistics associated with a geographic region of the user;

query an identity metrics database to obtain depersonalized summary statistics, wherein the depersonalized summary statistics are generated based on a group of individuals whose PIIs overlaps at least with a portion of the user'"'"'s PII;

generate an alert which comprises information on security compromises related to the PII of the user, report statistics associated with a geographic region of the user, and the depersonalized summary statistics; and

deliver the alert to a client computing device via a network, wherein compromised PIIs are acquired from dark web sites using one or more automated data collection processes.

14. The non-transitory computer readable medium of claim 13, wherein the computer executable instructions further causes the identity security system to periodically synchronize counterpart tables in the identity metrics data store with data in the dark web data store and the identity alerts data store.

15. The non-transitory computer readable medium of claim 14, wherein the counterpart tables comprise a first counterpart table and a second counterpart table each of which corresponds to an aspect of a data table in the dark web data store.

16. The non-transitory computer readable medium of claim 14, wherein the counterpart tables comprise a third counterpart table which corresponds to metadata of a plurality of identity alerts data store.

17. The non-transitory computer readable medium of claim 14, wherein the computer executable instructions further causes the identity security system to update the summary statistics in the identity metrics data store based at least partly on updates to the counterpart tables in the periodic synchronization.

18. The non-transitory computer readable medium of claim 13, wherein the alert comprises a report in an extensible markup language.