Systems and methods for data access control and account management

Patent metadata

Field	Value
Publication number	US-10567375-B1
Application number	US-201816150202-A
Country	US
Kind code	B1
Filing date	Oct 2, 2018
Priority date	Oct 2, 2018
Publication date	Feb 18, 2020
Grant date	Feb 18, 2020

Abstract

Embodiments of systems and methods for data access control and account management are described. In an embodiment, a server can apply flags to user accounts identified as requiring the user to perform an action or, in the case of potentially compromised access credentials, to offer the user the opportunity to authenticate and create new credentials. A user account database and an access report database can store access credentials, flags, and other relevant information for use by the server to perform various administrative, authentication, and protective actions on user accounts.

First claim

What is claimed is:

1. A data access control system, comprising:
a server containing a login database storing login credentials, the database including user login credentials for a user having an account; and
a processor, wherein, upon a determination that the user login credentials are potentially compromised, the processor is configured to apply a flag to the user login credentials, wherein the flag precludes the user from accessing the account,
wherein, upon submission of user login credentials by a first client device, the server is configured to:
record one or more network identifiers of the first client device in a device identification database, and
direct the first client device to a deflection site, wherein the deflection site has no access to account data associated with the user; and

wherein, upon a submission of the user login credentials by a second client device, the server is configured to:
record one or more network identifiers of the second client device in the device identification database,
determine if the one or more network identifiers of the second client device match the one or more network identifiers of the first client device, and
upon determining that the one or more network identifiers of the second client device do not match the one or more network identifiers of the first client device, present an authentication procedure via the second client device;
upon successful completion of the authentication procedure, require the user to perform a protective action; and
remove the flag applied to the user login credentials upon completion of the authentication procedure and performance of a protective action.

2. The data access control system of claim 1 , wherein the server communicates with one or more remote servers through an application programming interface (API), and wherein the API is configured to apply the flag to the user login credentials and remove the flag from the user login credentials.

3. The data access control system of claim 1 , wherein the protective action is at least one of changing a password, changing a user name, changing an access code, changing a swipe pattern, and changing a security question.

4. The data access control system of claim 1 , wherein the protective action is establishing a form of biometric authentication.

5. The data access control system of claim 1 , wherein the protective action is establishing two-factor authentication.

6. The data access control system of claim 5 , wherein establishing two-factor authentication requires associating with the account at least one selected from the group of a telephone number, an email address, and a client device, wherein the at least one selected from the group of a telephone number, an email address, and a client device was not previously associated with the account.

7. The data access control system of claim 1 , wherein the application of the flag to the user login credentials results in the transfer of the user login credentials from the login database to an access report database.

8. The data access control system of claim 7 , wherein the one or more network identifiers of the first client device recorded in the device identification database include at least one selected from the group of an internet protocol address, a media access control address, a hardware address, an internet packet exchange address, and a netmask.

9. The data access control system of claim 7 , wherein removal of the flag from the user login credentials results in the transfer of the user login credentials from the access report database to the login database.

10. The data access control system of claim 7 , wherein the access report database contains a first table and a second table,
the first table contains fields for a category code, a category name, a category priority code, a category active status indicator, a user identifier, a time stamp, and a last update time stamp, and
the second table contains fields for a customer identifier, a category code, a user identifier, a time stamp, a last updating user identifier, and a last update time stamp.

11. The data access control system of claim 1 , wherein upon determining that the one or more network identifiers of the second client device match the one or more network identifiers of the first client device, the server is further configured to direct the next submission of user login credentials by the second client device to the deflection site.

12. A method of data access control upon determining a first client device has submitted potentially compromised login credentials for a user, the method comprising:
applying a flag to all login credentials associated with the user in a login credentials database;
recording an identifier associated with the first client device into an access report database;
directing the first client device to a deflection site having no access to account data associated with the user;
receiving a submission of login credentials from a second client device,
recording an identifier associated with the second client device into the access report database,
determining that the identifier associated with the second client device is different than the identifier associated with the first client device, and
removing the flag from all login credentials associated with the user upon completion of an authentication procedure via the second client device and performance of a protective action via the second client device.

13. The method of data access control of claim 12 , further comprising, prior to the removal of the flag and upon receipt of login credentials from a third client device associated with the user, directing the third client device to the deflection site.

14. The method of data access control of claim 12 , further comprising, prior to the removal of the flag, presenting an authentication procedure to any client device that submits login credentials associated with the user.

15. The method of data access control of claim 12 , wherein the protective action includes establishing multi-factor authentication by associating at least one of a telephone number, an email address, and a third client device with the account.

16. The method of data access control of claim 12 , further comprising storing a copy of the potentially compromised login credentials in the access report database and associating the potentially compromised login credentials with the identifier associated with the first client device.

17. The method of data access control of claim 12 , further comprising sending a notification to at least one of a telephone number and an email address associated with the account.

18. The method of data access control of claim 17 , wherein the authentication procedure requires the submission of information relating to the notification by a second client device.

19. A data access control application programming interface (API), programmed to:
receive login credentials from a first client device, wherein the login credentials are associated with a user having an account;
receive a determination that the login credentials were potentially compromised;
upon receipt of the determination that the login credentials were fraudulently submitted, the API is programmed to:
record an identifier of the first client device and write the identifier of the first client device to an access report database;
flag all login credentials associated with the user and copy the login credentials to the access report database; and
direct the first client device to a deflection site hav

Assignees

• Capital One Services Llc

Inventors

• Mossler Lara
• Dilli Baskar
• Heng Melissa
• Manivannan Aravindhan

Classifications

• H04L2463/082

  applying multi-factor authentication · CPC title

• H04L63/1491 Primary

  using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment · CPC title

• H04L63/101

  Access control lists [ACL] · CPC title

• H04L63/0876

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title

• H04L63/083 Primary

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title