SYSTEMS AND METHODS OF SHARING INFORMATION THROUGH A TAG-BASED CONSORTIUM

• US 20180262478A1
• Filed: 03/06/2018
• Published: 09/13/2018
• Est. Priority Date: 03/25/2009
• Status: Active Grant

• Current Assignee: The 41st Parameter, Inc. (Experian plc)
• Original Assignee: The 41st Parameter, Inc. (Experian plc)
• Inventors: Eisen, Ori
• Granted Patent: US 10,616,201 B2
• Time in Patent Office: Days
• CPC Class Codes: G06Q 2220/00 Business processing using cryptography postage metering system using cryptography G06Q2250/05
• CPC Class Codes: G06Q 40/02 Banking, e.g. interest calculation or account maintenance credit or loans G06Q40/03
• CPC Class Codes: G06Q 50/265 Personal security, identity or safety
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

The invention provides one or more consortia of networks that identify and share information about users and/or user devices interacting with the consortia. User devices may be identified, at least in part, by tag-based computer information. Computers and other devices accessing the Web carry device tags with date and time information describing when they were issued by a security tag server. A server time stamp may be inserted into time based computer tags such as a cookies indicating when they were created. Such time stamp information can be encrypted and analyzed during future attempts to access a secure network such as a customer attempting to log into an online banking account. When the time stamp information from the tag is compared to other selected information about the user, device and/or account, including but not limited to last account log-in date/time or account creation date, the invention may be used to detect suspicious activity. The invention may be use for identity-based applications such as network security, the detection of fraudulent transactions, identity theft, reputation-based communities, and law enforcement.

Claims

1-20. -20. (canceled)

21. A system comprising:

a network interface configured to communicate with a plurality of network service devices comprising a first network service device associated with a first institution;

a data store configured to store computer-executable instructions; and

a processor in communication with the data store, the processor, when executing the computer-executable instructions, configured to, during an online transaction;

access a first plurality of transaction tags associated with a plurality of customer computing devices and a first server computing device;

determine, for each of the first plurality of transaction tags, a corresponding timestamp and a corresponding server computing device identification information associated with the first server computing device which generated the corresponding timestamp, wherein the corresponding timestamp is indicative of a time of creation of the each of the first plurality of transaction tags;

automatically analyze the corresponding timestamps of each of the first plurality of transaction tags using a fraud detection protocol to determine a number of transaction tags within the first plurality of transaction tags which have corresponding timestamps that fall within a predetermined time interval, wherein the fraud detection protocol provides an indication of an increased risk of fraud associated with a threshold predetermined number of transaction tags with corresponding timestamps that fall within the predetermined time interval;

associate an increased risk of fraud with the first plurality of transaction tags, based at least in part on the determination that the number of transaction tags within the first plurality of transaction tags is greater than the predetermined number of transaction tags;

generate a risk data packet configured for transmission to at least the first network service, the risk data packet comprising encrypted identifying information associated with a subset of the first plurality of transaction tags with corresponding timestamps that fall within the predetermined time interval and an electronic indication of the increased risk of fraud associated with the first server computing device; and

share the risk data packet with other network service devices.

22. The system of claim 21, wherein the risk data packet further comprises the predetermined time interval.

23. The system of claim 21, wherein the corresponding timestamp of the each of the first plurality of transaction tags is in a first format and each associated with a clock of the corresponding server computing devices.

24. The system of claim 21, wherein the determining that there is an increased risk of fraud associated with the first plurality of transaction tags is further based at least on a second timestamp of each of the plurality of transaction tags associated with the plurality of customer computing devices.

25. The system of claim 21, wherein the determining the number of transaction tags within the first plurality of transaction tags is further based at least on duration of account inactivity associated with each of the plurality of customer computing devices.

26. The system of claim 25, wherein the each of the first plurality of transaction tags further comprise a third transaction timestamp indicative of a time of an electronic transaction associated with the first network service device.

27. The system of claim 26, wherein the each of the first plurality of transaction tags further comprise a previous transaction timestamp indicative of a time of a previous electronic transaction.

28. The system of claim 27, wherein the processor is further configured to determine, based at least in part of the transaction timestamp and the previous transaction timestamp, a duration of account inactivity.

29. The system of claim 28, wherein the fraud detection protocol further provides an indication of an increased risk of fraud associated with duration of account inactivity exceeding a predetermined threshold.

30. The system of claim 29, wherein the processor is further configured to determine that the duration of account inactivity exceeds the predetermined threshold, and wherein the determination that there is an increased risk of fraud associated with the first plurality of transaction tags is further based at least in part on the determination that the duration exceeds the predetermined threshold.

31. A computer-implemented method comprising:

accessing computer-executable instructions from at least one computer-readable storage medium; and

executing the computer-executable instructions, thereby causing computer hardware comprising at least one computer processor to perform operations comprising;

receiving, from a first server computing device, a first plurality of transaction tags associated with a first plurality of electronic transactions involving a first network service device and a first plurality of customer computing devices, each of the first plurality of transaction tags associated with at least a first of the first plurality of customer computing devices and a first account associated with the first network service device, and the each of the first plurality of transaction tags comprising a corresponding timestamp and a corresponding server computing device identification information associated with the first server computing device;

automatically analyzing the corresponding timestamps of each of the first plurality of transaction tags using a fraud detection protocol to determine a number of transaction tags within the first plurality of transaction tags which have corresponding timestamps that fall within a predetermined time interval, wherein the fraud detection protocol indicates of an increased risk of fraud associated with a threshold predetermined number of transaction tags with corresponding timestamps that fall within the predetermined time interval;

determining, based at least in part on the fraud detection protocol, that the first plurality of transaction tags indicate an increased risk of fraud; and

generating an encrypted data packet, the encrypted data packet comprising identifying information associated with a subset of the first plurality of transaction tags with corresponding timestamps that fall within the predetermined time interval and an electronic indication of the increased risk of fraud associated with the first server computing device.

32. The computer-implemented method of claim 31, wherein the first server computing device and the first network service device are associated with a first institution of a consortium.

33. The computer-implemented method of claim 32 further comprising causing transmission of the encrypted data packet to at least the first institution.

34. The computer-implemented method of claim 32 further comprising causing transmission of the encrypted data pack to at least a second institution of the consortium.

35. The computer-implemented method of claim 31, wherein the corresponding timestamp is indicative of a time of creation of the each of the first plurality of transaction tags.

36. The computer-implemented method of claim 31, wherein the encrypted data packet further comprises the predetermined time interval.

37. The computer-implemented method of claim 31, wherein determining that the first plurality of transaction tags indicates an increased risk of fraud further comprises:

identifying a previous electronic transaction between the first network service device and a first of the plurality of consumer computing devices;

identifying a previous timestamp associated with the previous electronic transaction;

determining, based at least in part of the corresponding timestamp and the previous timestamp of the first of the plurality of consumer computing devices, a first time interval of inactivity; and

determining that the first time interval of inactivity exceeds a predetermined inactivity threshold.

38. The computer-implemented method of claim 31, wherein the corresponding timestamp of the each of the first plurality of transaction tags is in a first format and each associated with a clock of the corresponding server computing devices.

39. The computer-implemented method of claim 31, wherein the determining the increased risk of fraud associated with the first plurality of consumer computing devices is further based on a second timestamp of each of the plurality of transaction tags associated with the plurality of customer computing devices.

40. A non-transitory computer storage medium storing computer-executable instructions that, when executed by a processor, cause the processor to perform the following method:

receiving, from a first server computing device, a first plurality of transaction tags associated with a first plurality of electronic transactions involving a first network service device and a first plurality of customer computing devices, each of the first plurality of transaction tags associated with at least a first of the first plurality of customer computing devices and a first account associated with the first network service device, and the each of the first plurality of transaction tags comprising a corresponding timestamp and a corresponding server computing device identification information associated with the first server computing device;

automatically analyzing the corresponding timestamps of each of the first plurality of transaction tags using a fraud detection protocol to determine a number of transaction tags within the first plurality of transaction tags which have corresponding timestamps that fall within a predetermined time interval, wherein the fraud detection protocol indicates of an increased risk of fraud associated with a threshold predetermined number of transaction tags with corresponding timestamps that fall within the predetermined time interval;

determining, based at least in part on the fraud detection protocol, that the first plurality of transaction tags indicate an increased risk of fraud; and

generating an encrypted data packet, the encrypted data packet comprising identifying information associated with a subset of the first plurality of transaction tags with corresponding timestamps that fall within the predetermined time interval and an electronic indication of the increased risk of fraud associated with the first server computing device.