Data breach detection system

Patent metadata

Field	Value
Publication number	US-10198595-B2
Application number	US-201615376038-A
Country	US
Kind code	B2
Filing date	Dec 12, 2016
Priority date	Dec 22, 2015
Publication date	Feb 5, 2019
Grant date	Feb 5, 2019

Abstract

The present disclosure deals with a system and a method to determine if an unauthorized user is attempting to access securely stored data. A user enters and stores sensitive data on a user device using a first computing system. The first computing system gathers sensitive data from the user device and stores the data on a second computing system. If the first computing system detects a potential data breach when trying to access the securely stored data, the first computing system may request the user to enter a subset of the securely stored data to confirm that the user has access to the securely stored data. The second computing system verifies the subset against the securely stored data and the securely stored data is made accessible to the user. If the second computing system is unable to verify the subset the second computing system triggers an event.

First claim

What is claimed is:

1. A distributed computing system comprising:
a first computing system including at least one server and a first database, the first computing system selectively connected to a first user device or a second user device and selectively connected to a second computing system via a communications network, the second computing system including a secured database server and a second database,
the first computing system programmed to:
establish a first connection between the first user device and the first computing system via the communications network in response to verification of a first data set received by the first computing system from the first user device;
receive a second data set from the first user device subsequent to the first connection established;
assign a unique identifier to the second data set via the at least one server of the first computing system, the unique identifier stored in the first database by the at least one server;
transmit the unique identifier and the second data set to the second computing system using a first encryption scheme, the unique identifier and the second data set stored in the second database by the secured database server according to a second encryption scheme;
terminate the first connection;
establish a second connection between the first computing system and the first user device or the second user device via the communications network in response to verification of the first data set received by the first computing system from the first user device or the second user device;
determine whether there is a potential data breach by an unauthorized user;
in response to determining there is not a potential data breach, (i) retrieve the unique identifier from the first database by the at least one server upon receiving a request for the second data set from the first user device or the second user device, (ii) transmit the unique identifier from the first computing system to the second computing system, (iii) receive the second data set from the secured database server of the second computing system based on the unique identifier;
in response to determining there is a potential data breach by an unauthorized user, (i) retrieve the unique identifier from the first database by the at least one server upon receiving a request for the second data set from the first user device or the second user device, (ii) request a first subset of the second data set from the first user device or the second user device to confirm that the first computing system is authorized to retrieve the second data set from the second computing system, (iii) receive by the at least one server, a data string from the first user device or the second user device in response to requesting confirmation, (iv) transmit the unique identifier and the data string from the first computing system to the second computing system, and (v) receive at least one of an failure message or the second set of data based whether the data string matches the subset of the second data set,
wherein the failure message is received in response to failure of the secured database server to match the data string to the first subset of the second data set, and in response to the failure message, the first computing system further programmed to:
request a second subset of the second data set from the first user device or the second user device to confirm that the first computing system is authorized to retrieve the second data set from the second computing system;
receive, by the at least one server, a second data string from the first user device or the second user device in response to requesting confirmation;
transmit the unique identifier and the second data string from the first computing system to the second computing system; and
receive at least one of a further failure message or the second set of data based on whether the data string matches the subset of the second data set.

2. The system of claim 1 , wherein in response to success of the secured database server in matching the data string to a subset of the second data set, the first computing system receives the second data set from the second computing system and determining there is no data breach.

3. The system of claim 2 , wherein in response to determining there is no data breach, the first computing system provides, a graphical user interface (GUI) to be rendered on the first user device or the second user device, a first portion of the second data set rendered in clear text in the GUI and a second portion of the second data set excluded from the GUI.

4. The system of claim 1 , wherein a maximum number requests for subsets of the second data set for confirmation by the first computing device is based on a pre-determined limit.

5. The system of claim 1 , wherein in response to failure of the secured database server to confirm that the first computing system is authorized to retrieve the second data within the maximum number of request, the first computing system retains an Internet Protocol (IP) address of the first user device or the second user device, retrains a media access control (MAC) address of the first user device or the second user device, blocks further requests from the first user device or the second user device for the second data set during the second connection or a future connection, blocks further requests for the second data set for a pre-determined amount of time, or transmits an e-mail to a verified e-mail address.

6. The system of claim 1 , wherein, the potential data breach is determined in response to at least one of, the first computing system unable to verify the first data set upon initial receipt of the first data set from the first user device or the second user device when attempting to establish the second connection, the first computing system determines a location of the first user device or the second user device is suspicious, the first computing system determines the first user device or the second user device is in a location which is not within a threshold distance of a known previous location.

7. The system of claim 1 , wherein the first computing system receives the second data set from second computing system in an encrypted format.

8. The system of claim 1 , wherein the first computing system decrypts the second data.

9. A method performed in a distributed computing system, the method comprising:
establishing a first connection between a first user device and a first computing system via a communications network, the first computing system including at least one server and a first database, the first connection established upon verification of a first data set received by the first computing system from the first user device;
receiving, by the at least one server, a second data set from the first user device subsequent to the first connection established;
assigning a unique identifier to the second data set by the at least one server, the unique identifier stored in the first database by the at least one server;
transmitting the unique identifier and the second data set from the first computing system to a second computing system using a first encryption scheme, the unique identifier and the second data set stored in the second database by the secured database server according to a second encryption scheme;
terminating the first connection;
establishing a second connection between the first computing system and one of the first user device or a second user device via the communications network, the second connection established upon verification of the first data set received by the first computing system from the first user device or the second user device;
determining whether there is a potential data breach by an unaut

Assignees

• Walmart Apollo Llc

Inventors

• Lancaster Norman Bradley

Classifications

• H04L63/10

  for controlling access to devices or network resources · CPC title

• G06F21/6245 Primary

  Protecting personal data, e.g. for financial or medical purposes · CPC title

• H04L63/0876

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title