IP Library › Granted Patent US 10,198,595
Granted Patent B2
US 10,198,595 · App. 15/376,038 · Granted Feb 5, 2019

Data breach detection system

Inventor: Norman Bradley Lancaster (Bentonville, AR)
Assignee: Walmart Apollo, LLC
G06F21/6245H04L63/0876H04L63/10
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 10,198,595
App. No.
15/376,038
Granted
Feb 5, 2019
Kind
B2
Abstract

The present disclosure deals with a system and a method to determine if an unauthorized user is attempting to access securely stored data. A user enters and stores sensitive data on a user device using a first computing system. The first computing system gathers sensitive data from the user device and stores the data on a second computing system. If the first computing system detects a potential data breach when trying to access the securely stored data, the first computing system may request the user to enter a subset of the securely stored data to confirm that the user has access to the securely stored data. The second computing system verifies the subset against the securely stored data and the securely stored data is made accessible to the user. If the second computing system is unable to verify the subset the second computing system triggers an event.

Claims (48)

1. A distributed computing system comprising:

a first computing system including at least one server and a first database, the first computing system selectively connected to a first user device or a second user device and selectively connected to a second computing system via a communications network, the second computing system including a secured database server and a second database,

the first computing system programmed to:

establish a first connection between the first user device and the first computing system via the communications network in response to verification of a first data set received by the first computing system from the first user device;

receive a second data set from the first user device subsequent to the first connection established;

assign a unique identifier to the second data set via the at least one server of the first computing system, the unique identifier stored in the first database by the at least one server;

transmit the unique identifier and the second data set to the second computing system using a first encryption scheme, the unique identifier and the second data set stored in the second database by the secured database server according to a second encryption scheme;

terminate the first connection;

establish a second connection between the first computing system and the first user device or the second user device via the communications network in response to verification of the first data set received by the first computing system from the first user device or the second user device;

determine whether there is a potential data breach by an unauthorized user;

in response to determining there is not a potential data breach, (i) retrieve the unique identifier from the first database by the at least one server upon receiving a request for the second data set from the first user device or the second user device, (ii) transmit the unique identifier from the first computing system to the second computing system, (iii) receive the second data set from the secured database server of the second computing system based on the unique identifier;

in response to determining there is a potential data breach by an unauthorized user, (i) retrieve the unique identifier from the first database by the at least one server upon receiving a request for the second data set from the first user device or the second user device, (ii) request a first subset of the second data set from the first user device or the second user device to confirm that the first computing system is authorized to retrieve the second data set from the second computing system, (iii) receive by the at least one server, a data string from the first user device or the second user device in response to requesting confirmation, (iv) transmit the unique identifier and the data string from the first computing system to the second computing system, and (v) receive at least one of an failure message or the second set of data based whether the data string matches the subset of the second data set,

wherein the failure message is received in response to failure of the secured database server to match the data string to the first subset of the second data set, and in response to the failure message, the first computing system further programmed to:

request a second subset of the second data set from the first user device or the second user device to confirm that the first computing system is authorized to retrieve the second data set from the second computing system;

receive, by the at least one server, a second data string from the first user device or the second user device in response to requesting confirmation;

transmit the unique identifier and the second data string from the first computing system to the second computing system; and

receive at least one of a further failure message or the second set of data based on whether the data string matches the subset of the second data set.

2. The system of claim 1 , wherein in response to success of the secured database server in matching the data string to a subset of the second data set, the first computing system receives the second data set from the second computing system and determining there is no data breach.

3. The system of claim 2 , wherein in response to determining there is no data breach, the first computing system provides, a graphical user interface (GUI) to be rendered on the first user device or the second user device, a first portion of the second data set rendered in clear text in the GUI and a second portion of the second data set excluded from the GUI.

4. The system of claim 1 , wherein a maximum number requests for subsets of the second data set for confirmation by the first computing device is based on a pre-determined limit.

5. The system of claim 1 , wherein in response to failure of the secured database server to confirm that the first computing system is authorized to retrieve the second data within the maximum number of request, the first computing system retains an Internet Protocol (IP) address of the first user device or the second user device, retrains a media access control (MAC) address of the first user device or the second user device, blocks further requests from the first user device or the second user device for the second data set during the second connection or a future connection, blocks further requests for the second data set for a pre-determined amount of time, or transmits an e-mail to a verified e-mail address.

6. The system of claim 1 , wherein, the potential data breach is determined in response to at least one of, the first computing system unable to verify the first data set upon initial receipt of the first data set from the first user device or the second user device when attempting to establish the second connection, the first computing system determines a location of the first user device or the second user device is suspicious, the first computing system determines the first user device or the second user device is in a location which is not within a threshold distance of a known previous location.

7. The system of claim 1 , wherein the first computing system receives the second data set from second computing system in an encrypted format.

8. The system of claim 1 , wherein the first computing system decrypts the second data.

9. A method performed in a distributed computing system, the method comprising:

establishing a first connection between a first user device and a first computing system via a communications network, the first computing system including at least one server and a first database, the first connection established upon verification of a first data set received by the first computing system from the first user device;

receiving, by the at least one server, a second data set from the first user device subsequent to the first connection established;

assigning a unique identifier to the second data set by the at least one server, the unique identifier stored in the first database by the at least one server;

transmitting the unique identifier and the second data set from the first computing system to a second computing system using a first encryption scheme, the unique identifier and the second data set stored in the second database by the secured database server according to a second encryption scheme;

terminating the first connection;

establishing a second connection between the first computing system and one of the first user device or a second user device via the communications network, the second connection established upon verification of the first data set received by the first computing system from the first user device or the second user device;

determining whether there is a potential data breach by an unauthorized user;

in response to determining there is not a potential data breach, (i) retrieving the unique identifier from the first database by the at least one server upon receiving a request for the second data set from the first user device or the second user device, (ii) transmitting the unique identifier from the first computing system to the second computing system, (iii) receiving the second data set from the secured database server of the second computing system based on the unique identifier;

in response to determining there is a potential data breach by an unauthorized user, (i) retrieving the unique identifier from the first database by the at least one server upon receiving a request for the second data set from the first user device or the second user device, (ii) requesting a first subset of the second data set from the first user device or the second user device to confirm that the first computing system is authorized to retrieve the second data set from the second computing system, (iii) receiving, by the at least one server, a data string from the first user device or the second user device in response to requesting confirmation, (iv) transmitting the unique identifier and the data string from the first computing system to the second computing system, and (v) receiving at least one of a failure message or the second set of data based on whether the data string matches the subset of the second data set,

wherein the failure message is received in response to failure of the secured database server to match the data string to the first subset of the second data set, and in response to the failure message, the method further comprises:

requesting a second subset of the second data set from the first user device or the second user device to confirm that the first computing system is authorized to retrieve the second data set from the second computing system;

receiving, by the at least one server, a second data string from the first user device or the second user device in response to requesting confirmation;

transmitting the unique identifier and the second data string from the first computing system to the second computing system; and

receiving at least one of a further failure message or the second set of data based on whether the data string matches the subset of the second data set.

10. The method of claim 9 , further comprising:

in response to success of the secured database server in matching the data string to a subset of the second data set, receiving, by the first computing system, the second data set from the second computing system and determining there is no data breach.

11. The method of claim 10 , further comprising:

in response to determining there is no data breach, providing, by the first computing system, a graphical user interface (GUI) to be rendered on the first user device or the second user device, a first portion of the second data set rendered in clear text in the GUI and a second portion of the second data set excluded from the GUI.

12. The method of claim 9 , wherein a maximum number requests for subsets of the second data set for confirmation by the first computing device is based on a pre-determined limit.

13. The method of claim 12 , wherein in response to failure of the secured database server to confirm that the first computing system is authorized to retrieve the second data within the maximum number of request, the first computing system retains an Internet Protocol (IP) address of the first user device or the second user device, retrains a media access control (MAC) address of the first user device or the second user device, blocks further requests from the first user device or the second user device for the second data set during the second connection or a future connection, blocks further requests for the second data set for a pre-determined amount of time, or transmits an e-mail to a verified e-mail address.

14. The method of claim 9 , wherein, the potential data breach is determined in response to at least one of, the first computing system unable to verify the first data set upon initial receipt of the first data set from the first user device or the second user device when attempting to establish the second connection, the first computing system determines a location of the first user device or the second user device is suspicious, the first computing system determines the first user device or the second user device is in a location which is not within a threshold distance of a known previous location.

15. The method of claim 9 , wherein the first computing system receives the second data set from second computing system in an encrypted format.

16. The method of claim 15 , further comprising: decrypting, by the first computing system, the second data set.

Assignments (2)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Apr 12, 2018
From: WAL-MART STORES, INC.
To: WALMART APOLLO, LLC
Reel/Frame 045917/0756 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Dec 12, 2016
From: LANCASTER, NORMAN BRADLEY
To: WAL-MART STORES, INC.
Reel/Frame 040715/0919 →
Continuity (2)
Provisional Application 62270963 · Dec 22, 2015
Related Publication 20170177901A1 · Jun 22, 2017
Cited By (1)
US 12,694,144