Identity security architecture systems and methods

Information

  • Patent Grant
  • 10699028
  • Patent Number
    10,699,028
  • Date Filed
    Tuesday, June 19, 2018
    6 years ago
  • Date Issued
    Tuesday, June 30, 2020
    4 years ago
  • CPC
  • Field of Search
    • US
    • 726 026000
    • CPC
    • G06F21/6245
  • International Classifications
    • G06F21/62
    • G06F16/2458
    • G06F16/9535
    • Term Extension
      185
Abstract
Embodiments of various systems and methods described herein provide an identity security database analytics system which is configured to provide security alerts to a user. The security alerts can include for personalized metrics related to potential identity theft incidents. The personalized metrics can include user specific information on security breaches of the user's personal information as well as depersonalized statistics generated based on information of other users having one or more similar characteristics of the user.
Description
LIMITED COPYRIGHT AUTHORIZATION

A portion of the disclosure of this patent document includes material which is subject to copyright protection. The copyright owner has no objection to the facsimile reproduction by anyone of the patent document or the patent disclosure as it appears in the Patent and Trademark Office patent file or records, but otherwise reserves all copyrights whatsoever.


FIELD OF THE DISCLOSURE

The present disclosure generally relates to information security such as detecting and alerting an identity theft in a computer environment.


BACKGROUND OF THE DISCLOSURE

Identity theft is one of the largest and expanding forms of crime in the world. Identity theft is a crime in which an imposter obtains key pieces of information, such as social security numbers, driver's license numbers, email addresses, and so forth, and uses it for his or her improper personal gain. The imposters can obtain new accounts; re-direct the mail and telephone calls from existing accounts; sign up for unwanted and often expensive services; order subscriptions; order and take delivery of products; and otherwise “become” the individual whose identity has been stolen, minus the conscience and fiscal responsibility.


SUMMARY OF EXAMPLE EMBODIMENTS

Various systems and methods described herein provide a database analytics system which is configured to provide alerts to a user for personalized metrics related to potential identity theft incidents. The alerts can include user specific information on security breaches of the user's personal information as well as depersonalized statistics generated based on information of other users having one or more similar characteristics of the user.


In one embodiment, an identity security system comprises a non-transitory data storage configured to store computer executable instructions for an identity data analysis system; a dark web data store configured to store compromised data related to users' personal identifying information (PIT) and aggregated statistics calculated based on the compromised data; a plurality of identity alerts data stores configured to store alerts sent to the users and metadata associated with the alerts; an identity metrics data store configured to store depersonalized summary statistics. The hardware processor can be programmed to execute the computer executable instructions in the non-transitory data storage to cause the identity security system to: receive an instruction to generate an alert comprising personalized metrics of a user, wherein the instruction comprises PII of the user; query a dark web data store with the PII of the user to acquire information on security compromises related to the PII of the user; query an identity alerts data store with geographic location information of the user to obtain report statistics associated with a geographic region of the user; query an identity metrics database to obtain the depersonalized summary statistics, wherein the depersonalized summary statistics are generated based on a group of individuals whose PIIs overlaps at least with a portion of the user's PII; generate an alert which comprises information on security compromises related to the PII of the user, report statistics associated with a geographic region of the user, and depersonalized summary statistics; and deliver the alert to a client computing device via a network.


In another embodiment, a method for protecting identity security can comprise: receiving an instruction to generate an alert comprising personalized metrics of a user, wherein the instruction comprises PII of the user; querying a dark web data store with the PII of the user to acquire information on security compromises related to the PII of the user; querying an identity alerts data store with geographic location information of the user to obtain report statistics associated with a geographic region of the user; querying an identity metrics database to obtain depersonalized summary statistics, wherein the depersonalized summary statistics are generated based on a group of individuals whose PIIs overlaps at least with a portion of the user's PII; generating an alert which comprises information on security compromises related to the PII of the user, report statistics associated with a geographic region of the user, and the depersonalized summary statistics; and delivering the alert to a client computing device via a network.


In yet another embodiment, non-transitory computer readable medium storing computer executable instructions thereon, the computer executable instructions when executed can cause an identity security system to: receive an instruction to generate an alert comprising personalized metrics of a user, wherein the instruction comprises PII of the user; query a dark web data store with the PII of the user to acquire information on security compromises related to the PII of the user; query an identity alerts data store with geographic location information of the user to obtain report statistics associated with a geographic region of the user; query an identity metrics database to obtain depersonalized summary statistics, wherein the depersonalized summary statistics are generated based on a group of individuals whose PIIs overlaps at least with a portion of the user's PII; generate an alert which comprises information on security compromises related to the PII of the user, report statistics associated with a geographic region of the user, and the depersonalized summary statistics; and deliver the alert to a client computing device via a network.


Although certain embodiments and examples are disclosed herein, the subject matter extends beyond the examples in the specifically disclosed embodiments to other alternative embodiments and/or uses, and to modifications and equivalents thereof. The systems, methods, and devices of the disclosure each have several innovative aspects, no single one of which is solely responsible for the desirable attributes disclosed herein.





BRIEF DESCRIPTION OF THE DRAWINGS

Throughout the drawings, reference numbers are re-used to indicate correspondence between referenced elements. The drawings are provided to illustrate embodiments of the subject matter described herein and not to limit the scope thereof.



FIG. 1 illustrates an embodiment of a computing environment for an identity management system.



FIG. 2A illustrates an example embodiment of an identity management system for collecting data used to generate personalized metrics.



FIG. 2B illustrates example embodiments of data collection processes.



FIG. 3A illustrates an example embodiment of a metrics calculation system for generating personalized metrics of a user.



FIG. 3B illustrates an example embodiment of data synchronization between an identity metrics data store and a dark web data store.



FIG. 3C illustrates an example embodiment of calculating identity statistics based on data from a dark web data store.



FIG. 3D illustrates an example embodiment of synchronizing the identity metrics database with a plurality of report and alert metadata databases.



FIG. 3E illustrates example embodiments of statistical computation processes.



FIG. 4A illustrates an example embodiment of a data flow diagram for report generation.



FIG. 4B illustrates example embodiments of reports delivered to a client computing device.



FIG. 5A illustrates an example embodiment of an identity metrics analysis process.



FIG. 5B illustrates an example embodiment of an identity monitoring process.



FIG. 6 illustrates an embodiment of a computing system which may implement example embodiments of an identity management system.





DETAILED DESCRIPTION OF VARIOUS EMBODIMENTS
Overview

With the spread of computer and Internet usage, there is a growing concern about the increased risk of identity theft. Individuals often reveal their personally identifiable information (PIT) on the Internet when conducting transaction or interacting with various websites. The PII can include information that can be used to uniquely identify, contact, or locate an individual person or can be used with other sources to uniquely identify, contact, or locate an individual person. PII may include, but is not limited to, social security numbers (SSN), bank or credit card account numbers, passwords, birth dates, and addresses. Imposters can acquire the PII from various sources, such as the Internet, and take advantage of sensitive personal information, such as, for example, by committing fraud with the stolen identity. As an example, it is commonplace for PII to be compromised and utilized for identity theft in a remote commercial transaction which involves little or no direct personal contact between a consumer and a goods or services provider.


Identity theft resulting from compromised PII (such as the PII obtained without proper authorization) is costly to victims and companies alike. The Identity Fraud Survey Report created by Javelin Strategy & Research reported that in 2009 victims averaged a personal cost of $373 and 21 hours of time to resolve identity-theft issues. The annual cost of identity theft currently exceeds $200 billion worldwide. In addition, as a result of new legislation and litigation resulting from compromised PII, companies stand to suffer from lower profit margins, damaged credibility due to negative customer experiences, and eroded brand value. Identity theft also looms as a threat to the advancement of promising consumer-driven, self-service, and cost-savings technologies.


Identity theft can be discovered using monitoring platforms which conduct automated inquiries and searches of a variety of third party sources to locate matches to a person's information and providing an automated alert if an anomaly is detected. For example, an identity management system can alert a user where suspicious use of its PII is discovered, and can allow them to remediate the damage of the stolen information if an identity theft occurs. However, the rate on how often a person receives the identity alert is typically low. For example, a person can subscribe to an identity monitoring service but only get one to two alerts during the entire subscription. As a result of the low alert frequency, the person may not know if there are no alerts or if their account has been compromised.


Thus, it is important that an identity monitoring service increases the frequency of the alerts but yet continues to provide relevant and valuable information in the alert without disclosing the PII of other persons. Advantageously, in some embodiments, the identity management system described herein can generate relevant alerts for a user more frequently. For example, the identity management system can utilize a web-based Application Programming Interface (API) to receive a user's personal and demographic information from a client computing device. The API can generate personalized metrics for the user and return an alert including the personalized metrics. The personalized metrics can include identity metrics specific to the user's PII, such as the number of hits found for user's PII in a security breach (for example, the number of hits of the user's email address in a search of dark websites). Advantageously, in some embodiments, the personalized metrics can also include depersonalized identity metrics such that the statistics of the identity metrics are based on a group of users whose identities are not revealed to the user. Some example of depersonalized identity metrics can include the number of alerts that have been generated for other monitored consumers with in the same geographical region of the user, the total number of compromised email addresses where the number of compromised email addresses matches the user's email address domain, the total number of compromised credit cards where the credit cards are from the same issuer as the user's credit card, the total number of comprised phone numbers having the same area code as the user's phone number, and so forth. The personalized metrics can be calculated over different time horizons. For example, the personalized metrics can be calculated based on historical total, last 5 days, last 60 days, last 3 months, or other time durations.


The personalized metrics can be calculated based on statistics generated using dark web data (which may include compromised personal information) and historical identity monitoring alerts associated with other individuals (and/or the user). The statistics can further be refined or filtered to generate personalized metrics based on the person's personal and demographic information. For example, the depersonalized statistics may be filtered to identify the number of notifications sent to users within the same geographic areas as the user whose identity metrics are calculated. Accordingly, a user can learn the likelihood that his personal information is stolen based on compromised data from similar individuals.


As will be appreciated by one skilled in the art, there are numerous ways of carrying out the examples, improvements, and arrangements of the identity management system in accordance with the embodiments disclosed herein. Although reference will be made to the illustrative embodiments depicted in the drawings and the following description, these embodiments are not meant to be exhaustive of the various alternative designs and embodiments that are encompassed by the disclosed embodiments. Those skilled in the art will readily appreciate that various modifications may be made, and various combinations can be made, without departing from the disclosure.


For purposes of this disclosure, certain aspects, advantages, and novel features of various embodiments are described herein. It is to be understood that not necessarily all such advantages may be achieved in accordance with any particular embodiment. Thus, for example, those skilled in the art will recognize that one embodiment may be carried out in a manner that achieves one advantage or group of advantages as taught herein without necessarily achieving other advantages as may be taught or suggested herein.


Computing Environment of Identity Management System



FIG. 1 illustrates an embodiment of a computing environment for an identity management system. The identity management system 130 can be in communication with a client computing device 110 via a network 108. For example, client computing device 110 can generate and send request messages to obtain a user's identity metrics or a request to monitor a user's identity metric to the identity management system 130. The identity management system 130 can calculate identity metrics for the user based on data associated with individuals similar to the user (such as, for example, data obtained from dark web sites) as well as data particular to the user's PII. The identity management system 130 can generate and return an encrypted report package which includes the identity metrics to the client computing device. To simplify discussion and not to limit the present disclosure, FIG. 1 illustrates only one client computing device 110 and one identity management system 130, though multiple systems may be used.


Client Computing Device


The illustrated client computing device 110 can implement a web portal or application to communicate with the identity management system 130. For example, the client computing system 110 can host a software application which includes an API for requesting and receiving a user's identity metrics. As another example, the client computing device 110 can communicate with the identity management system 130 via a browser application. The client computing device 110 can request and receive reports including identity metrics via HTTP protocols.


The client computing device 110 can be associated with an identity monitoring entity 112 or a user 114. The identity monitoring entity 112 may be a company or a software suite which offers identity monitoring or reporting to an individual. The identity monitoring entity 112 may also be an entity interested in obtaining another individual's information (such as for example, where a company runs a background check of an employee candidate). A user may be an individual whose identity metrics are calculated and reported.


In some embodiments, a user (for example, the user A 114) can send an electronic request for a report of his identity metrics. A user can communicate directly with the identity management system 130 to request a report. For example, as illustrated in FIG. 1, the user A 114 can request his identity metrics from the identity management system 130 via the network 108 or enroll in an identity monitoring service without going through the identity monitoring entity 112.


The identity monitoring entity 112 can act on behalf of a user to obtain the user's information. For example, the identity monitoring entity 112 can provide an online portal which allows the user B 116 to input his PII. The identity monitoring entity 112 can use the user B's PII to request personalized metrics for user B. Based on the PII provided by the identity monitoring entity 112, the identity management system 130 can return a report comprising the personalized metrics for user B 116. As further described with reference to FIGS. 4A and 4B, the personalized metrics may be generated based on data specific to the user's PII or data from individuals similar to the user B 116.


As another example, the identity monitoring entity 112 can subscribe on behalf of the user B 116 for monitoring the user B's 116 identity. Once the identity management system 130 receives the user B's PII, the identity management system 130 can register the user B's information and periodically sending personalized metrics to the identity monitoring entity 112 or directly to the user B. The personalized metrics may be delivered as an electronic alert (which is also referred to as a report), for example, via an email, a mobile application, a text message, and so on.


The client computing device 110 can implement one or more components of the computing system 600 as described with reference to FIG. 6. The modules 609 of FIG. 6 can include software executable code for receiving PII from a user (for example, user B 116 or user A 114), and for communicating to the identity management system 130 a request for a report or a request to enroll a user into periodic monitoring of the user's identity metrics. The software executable code can also include routines for delivering or displaying a report to a user (for example, user B 116).


Network


The network 108 can comprise one or more of local area network (LAN), wide area network (WAN), and/or the Internet, for example, via a wired, wireless, or combination of wired and wireless communication links. The network 108 may communicate with various computing devices and/or other electronic devices via wired or wireless communication links. The network 108 may be used to share resources and may be used for the analog and/or digital transfer of data and information. In some embodiments, the network 108 can be used to enable multiple devices access to a single system, enable file sharing across the network 108, share software programs on remote systems, or make information easier to access and maintain among network users.


A remote system or device may include data, objects, devices, components, and/or modules not stored locally, that are not accessible via the local bus. Thus, remote devices may include a device which is physically stored in the same room and connected to the user's device via a network. In other situations, a remote device may be located in a separate geographic area, such as, for example, in a different location, country, and so forth.


Although not specifically illustrated in FIG. 1, the user B 116 can also communicate with the identity monitoring entity 112 via the network 108 and the identity management system 130 can also acquire comprised data from the dark web sites 120 via the network 108.


Identity Management System


The identity management system 130 illustrated in FIG. 1 includes a client gateway 162, an identity monitoring system 164, a user identity registration system 166, an identity alerts data store 144, a dark web data store 142, a data acquisition system 130, and an identity data analysis system 150. In various embodiments, one or more of these systems may be combined into a single system or one or more systems may be part of another system. For example, the identity monitoring system 164 and the client gateway 162 may be combined as one system. As another example, the user identity registration system 166 may be part of the identity monitoring system 164. The identity management system 130 can also include other components not illustrated in FIG. 1. As an example, the identity management system 130 may include a report and alert data acquisition system 230 configured to calculate report statistics associated with reports sent to the users of the identity management system 130.


Client Gateway, Identity Monitoring System, and User Identity Registration System


The client gateway 162 can be configured to receive a request for personalized metrics from the client computing device 110. The request may include PII of a user. The client gateway 162 can parse the request to extract PII and feed the PII into the identity data analysis system 150 to obtain a report comprising the personalized metrics for the user. The client gateway 162 can pass the report back to the client computing device 110 for delivery or display to a user. In some embodiments, the identity data analysis system 150 can pass the report directly back to the client computing device 110 via the network 108.


In some embodiments, the request from the client computing device 110 may be a subscription request which includes a request to subscribe a user to receiving periodic reports of the user's personalized metrics. The client gateway 162 can determine that the request includes a subscription request, such as by parsing the electronic request data package, and forward the request to the identity monitoring system 164 for further processing (such as storing the user's PII in a data store or registering the user to the period monitoring).


In some embodiments, if the client computing device 110 can send the subscription request directly to the identity monitoring system 164 without first routing through the client gateway 162. The identity monitoring system 164 can be configured to receive a subscription request for subscribing a user to a monitoring service where the identity management system 130 periodically calculates the personalized metrics for the user and delivers the personalized metrics to the user. For example, the identity monitoring system 164 can receive a request to subscribe a user from the client computing device 110. The request can include the user's PII. The identity monitoring system 164 can extract the PII from the request and pass the PII to the user identity registration system 166.


The user identity registration system 166 can initiate storage of the user's PII into the identity alerts data store or another data store configured to store subscribers' information. The user identity registration system 166 can further associate the user's PII with periodic monitoring and calculation of personalized metrics. The identity monitoring system 164 can periodically cause the identity data analysis system 150 to calculate personalized metrics and pass the periodic calculation to the client computing device as a report. For example, the identity monitoring system 164 can periodically send a request for a user's personalized metrics to the identity data analysis system 150. As another example, the identity monitoring system 164 can periodically send the request to the client gateway 162 which can pass the request to the identity data analysis system 150 for calculating the user's personalized metrics.


Although the identity monitoring system 164 and the user identity registration system 166 are illustrated as two separate blocks, the user identity registration system 166 may be part of the identity monitoring system 154. Thus, the identity monitoring system 164 can be configured to provide periodic monitoring service to the identity monitoring entity 112 and a user A 114, where the identity monitoring system 164 can subscribe a user to a periodic monitoring of his personalized metrics, periodically calculate the user's personalized metrics, and deliver the personalized metrics to the client computing device 110.


In some embodiments, the client gateway 162 and the identity monitoring system 164 may be combined to become one system which can be configured to handle requests from the client computing device 110 and provide reports to the client computing device 110. For example, the combined system may receive a request for personalized metrics or a request to subscribe a user to periodic alerts related to the personalize metrics. The combined system can pass the PII associated with the request to the identity data analysis system 150 to retrieve the personalized metrics. The combined system can also register a user for periodic monitoring related to his identity information and periodically communicate with the identity data analysis system 150 to retrieve the personalized metrics.


Dark Web Data Acquisition System


The illustrated dark web data acquisition system 140 can be configured to identify, acquire, and analyze data associated with PII that may be compromised. PII can be compromised in a myriad of ways. Record keeping for entities such as, for example, healthcare, governmental, financial, and educational institutions, is increasingly and sometimes exclusively electronic. Electronic record keeping introduces new risks for which the entities are frequently ill-equipped to handle. For example, PII is often compromised via stolen hardware, inadequate security procedures, security breaches, or employee carelessness or misconduct.


Another way that PII is frequently compromised is via phishing. Phishing is the process of attempting to acquire PII by masquerading as a trustworthy entity in an electronic communication. A common example of phishing is a fraudulent email that is made to appear as though it originates from a valid source such as, for example, a national bank. The fraudulent email may incorporate a uniform resource locator (URL) that re-directs its target to a false website that appears to be a legitimate website for the valid source. In actuality, the false website may be a front for stealing PII as part of a spurious transaction. For example, the false website may request a confirmation of PII such as, for example, a credit card number or a username and password. The PII may then be stored for later improper use such as, for example, identity theft in a remote commercial transaction.


The dark web data acquisition system 140 can acquire data associated with PII and determine whether the PII is compromised by scanning dark web sites. The data associated with compromised PII can also be referred to compromised data. The dark web data acquisition system 140 can utilize search engines, web spiders, keyword-matching features, data filters, and so forth to uncover information associated with PII. For example, the search engines and the web spiders may be utilized to collect identity-theft information, such as, for example, potential sources of compromised PII. The potential sources of compromised PII may include, for example, websites and forums that facilitate exchange of compromised PII (for example, by identity thieves). Further, keyword-matching features may be leveraged to analyze the potential sources of identity-theft information using, for example, identity-theft nomenclature.


Oftentimes, compromised PII is exchanged via chat rooms (for example, between identity thieves on Internet Relay Chat (IRC) channels). The dark web data acquisition system 140 can utilize an IRC bot to crawl the Internet in search of chat rooms (for example, IRC channels) that are frequented by identity thieves. The IRC bot can be operable to monitor such chat rooms for identity-theft nomenclature. Furthermore, the IRC bot 101 can be operable to identify and collect compromised PII, uniform resource locators (URLs), references to other IRC chat rooms, and other identity-theft information from such chat rooms.


In addition to or in alternative to scanning the dark websites, the dark web data acquisition system 140 can also acquire compromised PII from other sources. For example, individuals' PIIs may be compromised due to a security breach of an electronic commerce websites. The dark web data acquisition system 140 can acquire the compromised PIIs from the electronic commerce websites. As another example, a user may report an account as stolen to an account issuer. The account issuer can report the stolen account to the dark web data acquisition system 140 and the stolen account (as well as information associated with the stolen account) can thus be flagged as compromised PII.


The compromised PII may be parsed, analyzed, and stored into the dark web data store 142. For example, the identity-theft information collected from the dark websites 120 or other sources may be processed for compromised PII by one or more parsers that recognize common formats for PII (such as for example recognizing a list of text strings as email address or credit card numbers). Advantageously, in some embodiments, the dark web data acquisition system 140 can de-personalize the compromised data. For example, the data web data acquisition system 140 can calculate statistics based on the compromised data and store the statistics in the dark web data store 142 or another persistent storage location. In some embodiments, the statistics may be stored in dedicated lookup tables (as illustrated by aggregated statistics database 224). As an example, one of the statistics can be associated with email domains. The dark web data acquisitions system 130 can calculate the number of hits during a time period for a certain domain name (such as, for example, “email.exampledomain.com”) as found in the data from the dark web sites 120. Advantageously, in some embodiments, such statistics are depersonalized such that they are not specific to a person's PII but nevertheless provide valuable information for the user based on the statistics of other individuals whose email addresses have the same domain name. As further described with reference to data aggregation and synchronizations system 156, in some embodiments, the process of calculating aggregated statistic and/or de-personalizing the compromised data may be performed by the data aggregation and synchronization system 156.


Identity Data Analysis System


The identity data analysis system 150 can include a data aggregation and synchronization system 156, a metrics calculation system 154, report generation system 152, and an identity metrics data store 158. The data aggregation and synchronization system 156 can be configured to acquire compromised PII or statistics (shown in FIG. 3A) stored in the dark web data store 142. The data aggregation and synchronization system 156 can also be configured to acquire report and alert data associated with users of the identity management system 130 by communicating with the identity alerts data store 144.


The data aggregation and synchronization system 156 can synchronize the data acquired from the dark web data store 142 and the identity alerts data store(s) 144 with the data in the identity metrics data store 158. The identity metrics data store 158 can be configured to store master statistics tables (such as, for example, the tables 342 and 344 shown in FIG. 3A) which can include statistics associated with various identity metrics. The identity metrics data store 158 can also be configured to store counterpart tables which correspond to tables in the dark web data store 142 and the identity alerts data store(s) 144. The data aggregation and synchronization system 156 can synchronize the counterpart tables may be synchronized with the corresponding tables in the dark web data store 142 and the identity alerts data store(s) 144. Data in the counterpart tables may be used to calculate statistics associated with various identity metrics and update the master statistics tables stored in the identity metrics data store 158.


Although not shown in FIG. 1, the data aggregation and synchronization system 156 can also be configured to aggregate and synchronize data from other data sources such as, a data store associated with one or more credit bureaus which can store a user's credit data.


The master statistics tables stored in the identity metrics data store 158 can be used by the metrics calculation system 154 to generate personalized metrics for a user. For example, the metrics calculation system can use PII of the user to determine a user's zip code. The metrics calculation system 154 can access the identity metrics data store 158 to determine the number of compromises of PIIs within the user's zip code. The metrics calculation system 154 can return the number of PIIs to the client computing device 110 (for example, via the report generation system 152), which may indicate a likelihood on whether the user is living in a region with a high risk of identity theft. In some embodiments, the metrics calculation system 150 can update the statistics in the identity metrics data store periodically based on the data synchronization with the dark web data store 142 and the identity alerts data store(s) 144. For example, the metrics calculation system 150 can re-calculate the number of compromised incidents for a given email domain after the metrics calculation system 150 receives an update from the data aggregation and synchronization system 158 for the latest data received from the dark web data store 142.


As further described with reference to FIG. 4A, the report generation system 152 can be configured to acquire a report based on data from the dark web data store 142, the identity alerts data store(s) 144, and the identity metrics data store 158. For example, the report may include information on an email domain name and the site where the breach occurs, as well as the number of breaches identified for the same email domain name. The report generation system 152 can obtain the email domain name and the site of breach from the dark web data store 142 and obtain the number of breaches identified for the same email domain name from the identity metrics data store. The report can also include the number of notifications sent to people within the same zip code as the user. The report generations system 152 can obtain information on the number of notifications from the identity alerts data store(s) 144.


As further described with reference to FIGS. 4A and 4B, the report may be communicated to the client computing device 110 in various ways. For example, the report may be in an extensible markup language (XML) format and can be communicated to the client computing device 110 via an API. The report can also be a hypertext markup language (HTML) webpage which can be rendered by a browser of the client computing device 110. In some embodiments, the client computing device 110, the client gateway 162, or the identity monitoring system 164, can automatically populate an HTML template for rendering of the XML report.


Although the report generation system is illustrated as a separate system from the metrics calculation system 154, the report generation system can also be part of the metrics calculation system 154. Further, as described with reference to FIG. 4A, the report generation system 152 can also be part of the client gateway 162.


The identity data analysis system 150 may also be used to perform analytics on the dark web data store 142 or data received from the dark web. For example, the identity data analysis system 150 may determine that there has been a spike in the number of compromised credentials related to a particular domain (for example, Company A), which could be used by the system to send an alert for a potential breach with Company A's data.


Dark Web Data Store and Identity Alerts Data Store(s)


The dark web data store 142 can be configured to store data acquired from the dark web sites 120. The data from dark websites 120 may include information related to security breaches of one or more user's PII. For example, the dark web data store 142 can store chat logs from one or more chat rooms on the dark web. The dark web data store 142 can also be configured to store the results based on the analysis of data acquired from the dark websites 120. For example, with reference to FIG. 2A, the dark web data store 142 can store parsed content 222 (such as, for example, email address or breach site identified from the data acquired from dark web sites). As another example, the dark web data store 142 can include aggregated statistics database 224 configured to store various statistics calculated from dark web data, such as for example, the number of compromises associated with an email domain name, the number of compromises associated with a phone area code, the number of compromises associated with an issuer identification number (also referred to as BIN), or the number of hits associated with a postal code, so on, alone or in combination. Each type of the statistics may be stored in a dedicated look up table. For example, as shown in FIG. 3A, statistics related to emails are stored in the table 322, statistics related to address are stored in the table 324, statistics related to financial cards are stored in the table 326, and statistics related to phone numbers are stored in the table 328.


In addition to or in alternative to storing dark web data, the dark web data store 142 can also be configured to store data from other sources. For example, the dark web data store 142 can store the data relating incidents of security breaches of a user's PII acquired from an electronic commerce website.


The identity alerts data store(s) 144 can be configured to store users' information, such as for example, the user's PII, although in some embodiments, the user's PII may be stored in the dark web data store 142 in addition to or in alternative to the identity alerts data store(s) 144. The identity alerts data store(s) 144 can also be configured to store information associated with reports of the users, such as the content of the reports, the reports themselves, or the metadata of the reports. The metadata of the report can include report statistics. As shown in the report and alert metadata table 332 (in FIG. 3A), the report statistics can include a postal code, record counts for the postal code, the user identifier which the report was sent to, date, and so forth. As shown in FIG. 2A, the content of the reports and/or the reports themselves can be part of the report and alert items 242, while the metadata of the reports can be stored as part of the repot and alert metadata database 224.


Although the disclosures uses the words “data table” or “table”, data stored in various data stores or databases are not limited to a tabular data structure and can include non-relational data stores as well. Other types of data structures, such as, for example, trees, hashes, graphs, blockchain structures, and so on, can also be used to store various data described herein.


Examples of Data Collection



FIG. 2A illustrates an example embodiment of an identity management system 130 for collecting data used to generate personalized metrics. FIG. 2A illustrates three main components: dark web data acquisition system 140, report and alert data acquisition system 230, and identity data analysis system 150 that are involved in the data collection process. These three components can be part of the identity management system 130, even though one or more of these components may be implemented by different computing devices. For example, the report and alert data acquisition system 230 may be implemented on a cloud platform while the dark web data acquisition system 140 and/or the identity data analysis system 150 may can be implemented on a separate platform with dedicated servers.


As described with reference to FIG. 1, the dark web data acquisition system 140 can be configured to scan and retrieve compromised data such as identity-theft information from dark web sites 120, parse the compromised data to generate the parsed content 222, compile aggregated statistics 222 based the compromised data, and insert the parsed content 222 and the aggregated statistics 224 into the dark web data store 142. The dark web data acquisition system 140 can implement the process 280 shown in FIG. 2B to obtain and analyze compromised data.


The report and alert data acquisition system 230 can be configured to access reports and store the reports into the identity alerts data store(s) 144. The reports can be received from client gateway 162 or the identity monitoring system 164. The reports can also be received from the report generation system 152. In some embodiments, the report generation system 152 may be part of the report and alert data acquisition system 230.


The report and alert data acquisitions system 230 can maintain the report and alert metadata database 244 which can be configured to store metadata 332 associated with reports (shown in FIG. 3A). The metadata can include report statistics such as the number of reports, the types of reports sent to the users in a geographic region. The report and alert data acquisition system 230 can implement the process 290 shown in FIG. 2B for gathering reports, storing the reports and metadata associated with the reports.


Although only one report and alert data acquisition system 230 is illustrated in FIG. 2A, the identity management system 130 may utilize multiple instances of the report and alert data acquisition system 230. Each report and alert data acquisition system 230 may be associated with a specific group of individuals who share certain demographic information or may be assigned to a certain geographic region. For example, each report and alert data acquisition system 230 may be associated with individuals having the same zip code. Each report and alert data acquisition system 230 can maintain its own a report and alert metadata database 244 specific to its group of individuals. For example, the report and alert metadata for a report and alert acquisition system 230 may include report statistics specific to the report and alert acquisition system 230. As an example, the report and alert metadata may include the number of reports delivered for a zip code assigned to a certain report and alert acquisition system 230.


In some situations, the report and alert metadata database 244 or the report and alert items 242 for respective report and alert data acquisition system 230 can be maintained without truncations, regardless of whether an individual is actively enrolled in monitoring its identity metrics. In some embodiments, each report and alert data acquisition system 230 can maintain its own identity alerts data store 144 which can include report and alert items 242 and report and alert metadata database 244 specific to the population group assigned to the report and alert data acquisition system 230. In other implementations, an identity alerts data store 144 can include a plurality of report and alert metadata databases 244 and/or report and alert items 242 (which are associated with their respective report and alert data acquisitions systems 230).


The identity data analysis system 150 can be configured to generate personalized metrics for a user based on data from the dark web data store 142 and the identity alerts data store(s) 144. As further described with reference to FIG. 3A, the data aggregation and synchronization system 156 can access data from the dark web data store 142, such as aggregated statistics database 224, and data from the identity alerts data store(s) 144, such as report and alert metadata 332. Such data access can occur on a periodic basis, such as for example, every day, every 12 hours, every week, every month, every two months, every year, and so on, and use either a push or pull technique. The data acquired by the data aggregation and synchronization system 156 can be stored in the identity metrics data store 158 and/or communicated to a metrics calculation system 154 which can statistics related to identity metrics. The statistics related to identity metrics can be calculated based on data in the identity metrics data store 158, the data recently acquired by the data aggregation and synchronization system 156, alone or in combination. The results from the calculation may be stored in the identity metrics data store 158 as part of one or more master statistics tables. The metrics calculation system 154 can retrieve the relevant statistics from the master statistics tables based on the PII of the user and communicate the relevant statistics to the report generation system 152 for inclusion in a report.


In addition to or in alternative to the dark web data store 142 and the identity alerts data store(s) 144, the identity data analysis system 150 can also generate reports based on data received from other sources. For example, the identity data analysis system 150 may receive credit reports from one or more credit bureaus' databases, calculate metrics based on the content of the credit reports, and include metrics calculated from such credit reports (or the content of the credit reports) to be part of the personalized metrics of a user.


Data Collection Processes



FIG. 2B illustrates example embodiments of data collection processes, which include a dark web data acquisition process 280 and a report and alert data acquisition process 290. The process 280 can be implemented by the dark web data acquisition system 140 and the process 290 can be implemented by the report and alert data acquisition system 230, but it is also recognized that the processes can be implemented by other systems.


Dark Web Data Acquisition Process


At block 282, the dark web data acquisition system can scan for and retrieve compromised data from dark webs sites. For example, the dark web data acquisition system can use search engines, web spiders, IRC bots, and key-word matching features to identify and collect identity-theft information, such as, for example, potential sources of compromised PII, the personal information in the compromised PII, etc.


At block 284, the dark web data acquisition system 140 can scan and parse content of the compromised data. For example, the collected identity-theft information may be processed for determining compromised PII by one or more parsers that recognize common formats for PII. A parser may identify token-separated data (for example, tab-delimited data). Similarly, a parser may determine a column type for columns lacking a column header, for example, by analyzing data that is present in particular columns (for example, recognizing a list of text strings as email addresses). Furthermore, a parser may identify multi-line labeled data such as, for example, “first name: John,” and various other labels that may be associated with compromised PII (for example, recognizing “ccn,” “cc” or “credit card” as possible labels for credit-card information). Additionally, by way of a further example, a parser may identify identity-theft information taken from encodings that may be present on cards such as, for example, credit cards, driver's licenses, and the like. The encodings may include, for example, track 1 and track 2 magnetic-stripe data.


Additionally, as part of the parsing process, rules may be enforced that require groups of fields to be present in particular compromised PII before allowing the particular compromised PII to be recorded in block 286. The requirement that groups of fields be present has the benefit of reducing “false positives” within compromised PII. False positives may be considered elements of compromised PII that are not deemed to be sufficiently private or sufficiently important to merit recordation. False positives may be removed from the collected identity-theft information. For example, an email address that is not accompanied by a password may be considered a false positive and not recorded. A rule may be established that requires, for example, a username or email address to be accompanied by a password in order to be recorded.


In some embodiments, a validation process may be implemented to analyze a source of the collected identity-theft information such as, for example, compromised PII, and to facilitate a determination on whether any elements of the compromised PII are false positives. For example, genealogy websites, phone/address lookup websites, and website log files are common sources of false positives. Compromised PII that is mined from such websites may be considered false positives and removed from the collected identity-theft information. Conversely, compromised PII mined, for example, from known hacker websites and websites replete with identity-theft nomenclature, in a typical embodiment, may be protected from identification as false positives.


The compromised data collected form the data websites can be normalized to ensures that the collected identity-theft information such as, for example, compromised PII, is stored (at block 286) according to a standardized format. For example, standardized data structures and attributes may be established for names, credit card numbers, and the like. The normalization process facilitates matching, for example, elements of compromised PII to particular individuals to whom the elements correspond. In that way, reports and alerts based on the compromised PII may be more efficiently and more accurately generated.


At block 286, the dark web data acquisition system 140 can insert parsed content into the dark web data store 142. In some embodiments, the parsed content can be added to the dark web data store after the validation process and the normalization process described above. As described with reference to FIG. 2A, the dark web data acquisition system 140 can also store the compromised data retrieved from the dark web site before the compromised data is parsed, validated, or normalized.


At block 288, the dark web data acquisition system 140 can generate aggregated statistics and store the aggregated statistics in the dark web data store 142. The aggregated statistics can include one or more statistics related to the identity metrics. The aggregated statistics may be specific to a user's PII, such as, for example, the number of hits found for a user's email address in a dark web search. The aggregated statistics may also be depersonalized, such as, for example, the number of hits found for a user's email domain name in a dark web search. The aggregated statistics may be stored in dedicated look up tables, such as, for example, tables storing email data 322, address data 324, card data 325, or phone data 328. In some embodiments, the aggregated statistics are stored in the identity metrics data store 158. Further, in various embodiments, the dark we data acquisition system or the metrics calculation system 154 may calculate the aggregated statistics from the compromised data.


Report and Alert Data Acquisition Process


With reference to the process 290, report and alert data associated with a group of users can also be used to determine personalized statistics. The process 290 can be implemented by the report and alert data acquisition system 230 or another system to compile reports associated with a group of users (which may or may not including the user whose personalized metrics are requested).


At block 292, the report and alert data acquisition system 230 receives a report from a client gateway or an identity monitoring system. In some embodiments, the report can also be received from the report generation system 152. For example, the report generation system 152 can forward a copy of the report to the report and alert data acquisition system 230 before, during, or after sending the report to the computing device 110. The report may include personalized metrics generated for users who subscribed to the periodic monitoring service of their identity metrics. The report may also be created in response to a one time request for personalized metrics. In some embodiments, where multiple instances of report and alert data acquisition system 230 are initiated, the reports obtained by a report and alert data acquisition system may share similar characteristics. For example, the reports may be associated with users having the same geographic characteristics (for example, the same zip code, state, or city).


At block 294, the report and alert data acquisition system 230 can insert the report into an identity alerts data store(s) 144. For example, the report and alert data acquisition system 230 can store the reports sent to a group of individuals or at least a portion of the reports' content into the identity alerts data store(s) 144. As described with reference to FIG. 2A, identity alerts data store(s) 144 may retain its data for a long term (such as, for example, for permanent storage), even though some of the individuals in the group are no longer subscribed to the periodic monitoring of their identity metrics.


At block 296, the report and alert data acquisition system 230 can determine metadata associated with the report. The metadata can include report statistics based on the types of reports and the numbers of reports sent to the users of the identity management system 130. The report statistics may be depersonalized such that individual user's PII will not be revealed in the report sent to the user. Rather, the report statistics may include numbers pertaining to the group of individuals sharing similar characteristics as the user. For example the report statistics may include the number of notifications sent to the individuals in the same geographic area as the user. Some example fields of the metadata are also illustrated in FIG. 3A.


At block 298, the report and alert data acquisition system 230 can store the metadata into a report and alert metadata database. In some embodiments, the metadata may also be retained without truncation even though the individual (or the group of individuals) associated with the metadata is no longer actively subscribed to the identity management system 130.


The blocks in the processes 280 and 290 are for illustrative purposes. The processes 280 and 290 do not have to flow exactly in the order indicated by the arrows shown in FIG. 2B. For example, the process blocks 298 and 294 may be executed in parallel. As another example, the process block 288 may be executed before the process block 286. In various implementations, more or fewer blocks may also be implemented in the processes 280 and 290.


Examples of Statistical Computation for Personalized Metrics


As described herein, the identity data analysis system 150 can use data obtained from dark web data store 142, identity alerts data store(s) 144, and the identity metrics data store 158 to generate a report for personalized metrics of a user. FIG. 3A illustrates an example embodiment of a metrics calculation system for generating personalized metrics of a user. The metrics calculation system 154 shown in FIG. 3A can be part of the identity data analysis system 150.


Dark Web Data Analysis Subsystem


In FIG. 3A, the metrics calculation system 154 includes a dark web data analysis subsystem 352 and a report and alert data analysis subsystem 354. The dark web data analysis subsystem 352 can implement the dark web data analysis process 380 and the report and alert data analysis subsystem 354 can implement the report and alert data analysis process 390 shown in FIG. 3E. Although the dark web data analysis subsystem 352 and the report and alert data analysis subsystem 354 are illustrated as two separate blocks, in some embodiments, these two subsystems may be combined a same system within the metrics calculation system 154. Further, the metrics calculation system 154 may also include other systems (such as data aggregation or synchronization system 156), which are not illustrated in this figure.


The dark web data analysis subsystem 352 can be configured to receive synchronized data from the dark web data store 142. As an example of data synchronization, the identity metrics data store 158 can maintain one or more counterpart tables which correspond to the tables in the dark web data store 142. As shown in FIG. 3A, the dark web data store 142 can be configured to store four tables related to aggregated statistics 224: the email data table 322, the address data table 324, the card data table 326, and the phone data table 328. Each data table can include a respective value, such as email domain, postal code, card BIN, and phone area code. The data tables can further include hits information such as hits date and hits count based on searches and analysis of compromised data from the dark web sites. Although in this example, four data tables are illustrated, fewer or more tables may also exist based on the identity metrics that the metrics calculation system is configured to generate. For example, where the metrics calculation system 154 is configured to calculate metrics related to social security number, the aggregated statistics 224 can also include a data table related to social security number values and hits information. The identity metrics data store 158 can maintain one or more counterpart tables corresponding to the tables in the aggregated statistics database 224. The tables in the aggregated statistics database 224 and the tables in the identity metrics database do not always remain a one-to-one correspondence. For example, the email data table 322 can correspond to two counterpart tables in the identity metrics data store 158, such as, for example, an email domain value data table and an email domain hits table. For other tables, one data table in the aggregated statistics 224 table can correspond to one data table in the identity metrics data store 340, or multiple data tables in the aggregated statistics database 224 can correspond to one data table in the identity metrics data store 340. Further, not all data tables in the dark web data store 142 have a counterpart table in the identity metrics data store 158. For example, the address data table 324, the card data table 326, or the phone data table 328 may not have a counterpart table in the identity metrics data store 158. This may be because the metrics calculation system 154 may not generate personalized metrics using data one or more of these three tables.


The dark web data analysis system can synchronize updates to the aggregated statistics database 224 (as well as updates to individual data tables in the aggregated statistics database 224) periodically or in real-time as the updates occur. Although not shown in FIGS. 3A and 3C, in some embodiments, the data synchronization with the dark web data store 142 can be performed by the data aggregation and synchronization system 156.


The dark web data analysis subsystem 352 can be configured to analyze the synchronized data and compute one or more identity statistics based on the synchronized data. The identity statistics may be stored in corresponding summary identity statistics tables. For example, identity metrics data store 158 can maintain an email domain statistics table 342 which include summary statistics of the email domains. The dark web data analysis subsystem 352 can synchronize data in the email data table 322 (from the dark web data store 142) with the counterpart tables associated with email domains stored in the identity metrics data store 158. The dark web data analysis subsystem 352 can access data in the counterpart tables to calculate summary statistics associated with the email domains. The calculated statistics maybe used to update the email domain statistics table 342. As further described with reference to FIG. 4A, the email domain statistics table 342 may be accessed by the report generation system 152 to generate personalized metrics of a user.



FIG. 3B illustrates an example embodiment of data synchronization between an identity metrics data store and a dark web data store. In this example, the dark web data store 142 can include an email data table 322, among other data. The identity metrics data store 158 can include an email domain value table 362a and email domain hits table 362 which are counterpart tables of the email data table 322. The identity metrics data store can also include an email domain statistics table 342, among other data.


At (1), the metrics calculation system 154 (such as, for example the dark web data analysis subsystem 352) can synchronize data between email data table and its counterpart tables. For example, the metrics calculation system 154 can read data from the email data table 322 at (1A) and write data obtained from the email data table 322 into the email domain value table 362a and email domain hits table 362b at (1B). The metrics calculation system 154 can use a query in a Structured Query Language (SQL) and/or JOIN command to achieve the synchronization.


At (2), the metrics calculation system 154 can use data in the counterpart tables to update the email domain statistics table 342. For example, at (2A), the metrics calculation system 154 can read the data from the email domain value table 362a and the email domain hits table 362b. In some embodiments, (2A) may be performed using a GROUP BY and a SUM( ) function in SQL. At (2B), the metrics calculation system 154 can write the results obtained from (2A) into the email domain statistics table 342.



FIG. 3C illustrates an example embodiment of calculating identity statistics based on data from a dark web data store. As in FIG. 3B, the email data table 322 corresponds to two counterpart tables: email domain value table 362a and email domain hits table 362b in the identity metrics data store 158. In some embodiments, each top-level domain can be stored only once in the email domain value table 362 (such as, for example, “email.com” is stored only once under the “value” column of the email domain value table 362a).


At (1), the metrics calculation system 154 can synchronize email data table 322 with the email domain value table 362a and the email domain hits table 362b. For example, the domain name can be stored in the email domain value table 362a while the hits information (for example the hit date and hit counts) can be stored in the email domain hits table 362b. The email domain hits table 362 can link a hit with a domain name, such as, for example, by referring to the ID of the email domain value in the email domain value table 362a. In some embodiments, this synchronization process can be performed by the dark web data analysis subsystem 352 or by the data aggregation and synchronization system 156.


At (2), the metrics calculation system 154 can aggregate data stored in the identity metrics data store 158 and use the data in the identity metrics data store 158 to compute statistics related to an identity metric. For example, the dark web data analysis subsystem 352 can execute a process which uses a SQL JOIN command to combine the email domain value table 362a and the email domain hits table 362, as well as apply SUMO and GROUP BY functions to obtain the results.


At (3), the metrics calculation system 154 can insert or incorporate the computation from (2) into the email domain statistics table 342. The email domain statistics table 342 can be consulted by a report generation system 152 to generate a personalized metrics report for a user as described in FIG. 4A.


Report and Alert Data Analysis Subsystem


The metrics calculation system 154 can also include a report and alert data analysis subsystem 354. The report and alert data analysis subsystem 352 can be configured to synchronize data with identity alerts data store(s) 144, analyze report data, and compute identity statistics based on data acquired from the identity alerts data store(s).


The identity metrics data store 158 can include one or more counterpart table corresponding to data in the identity alerts data store(s). For example, the identity metrics data store 158 can include a geographic record which can be a counterpart table corresponding to the report and alert metadata in the identity alert data store 144. Where multiple instances of the report and alert data acquisitions system 230 are instantiated, there may be multiple identity alerts data store(s) 144 or multiple reports and alert metadata table 332, each corresponding to an instance of the report and alert data acquisition system 230. However, one geographic record table may be maintained in the identity metrics data store 158 which can be configured to synchronize data from different instances of the report and alert data acquisition system 230. The report and alert data analysis subsystem 354 can update the one or more counterpart table periodically or in real time as updates in the identity alerts data store(s) 144 occur, and can use similar techniques as the dark web data analysis subsystem 352 to perform the synchronization. Although not shown in FIG. 3A, in some embodiments, the data synchronization with the identity alerts data store(s) 144 can be performed by the data aggregation and synchronization system 156.


The report and alert data analysis subsystem 354 can be configured to analyze the synchronized data and compute one or more notification related statistics based on the synchronized data. The report statistics may be stored in a corresponding summary report statistics table. For example, identity metrics data store 158 can maintain a geographical statistics table 344 which can include summary statistics related to report statistics for various geographic locations. The report and alert data analysis subsystem 354 can synchronize data in report and alert metadata tables 332 (from various instances of the identity alerts data store(s) 144) with the counterpart table (for example, the geographic record table) stored in the identity metrics data store 158. The report and alert data analysis subsystem 354 can access the data in the counterpart table to calculate summary report statistics associated with geographic regions. The calculated statistics may be used to update the geographical statistics table 344. In some embodiments, the metrics calculation system 154 can use a portion of the information the counterpart table to calculate summary report statistics. For example, the identity metrics data store 158 can maintain a zip code records table which serves as a counterpart table to the report and alert metadata tables 332 associated with respective instances of the report and alert data acquisition systems 230. The zip code records table can include a column on instance identifier (ID). The instance ID can keep track the report and alert acquisition system 230 from which the metadata is acquired. However, when computing the summary report statistics associated with the geographic regions, the metrics calculations system 154 can ignore the data in instance id column so that the statistics across multiple regions can be summed together. As further described with reference to FIG. 4A, the geographical statistics table 344 may be accessed by the report generation system 152 to show identity theft related statistics in the user's geographical region.



FIG. 3D illustrates an example embodiment of synchronizing the identity metrics database with a plurality of report and alert metadata databases. In this example, the zip code records table 378 in the identity metrics data store 158 can be a counterpart table of a plurality of report and alert metadata tables 332 (for example, the report and alert metadata table A 332a, the report and alert metadata table B 332b, and the report and alert metadata table C 332c, and so on). The report and alert metadata tables 332a-332c can be stored in respective report and metadata database 224 where each report and metadata database 224 can correspond to a report and alert data acquisition system 230.


The zip code records table 372 can include fields such as, for example, date, zip code, record type ID, and instance ID. The record type ID can indicate the type of record. The record type ID can be linked to the ID in the record type table 376a. Some example types of records can include dark web security alerts, sex offender notifications, court records notifications, SSN trace notification, non-credit loan notification, change of address notification, and early warning alerts. These record types can be used to generate personalized metrics which include statistics in one or more types of the records (as shown in FIG. 4B). The instance ID field in the zip code records table 378 can be derived from a synchronization configuration file 376b. The synchronization configuration file can set forth the instance information for the identity alerts data store(s) 144 or the report and alert data acquisition system(s) 230. Some example configuration can include which host and port number an instance of the identity alerts data store(s) 144 or the report and alert data acquisition system(s) 230 is corresponding to.


In some embodiments, the record type ID values and the instance ID field in the zipcode records table can be obtained at the initialization phase, such as, for example, during the initialization of the zip code records table 378, the identity metrics data store 158, the metrics calculation system 154, the identity data analysis system 150, the identity management system 130, the identity alerts data store(s) 144, or other components of the identity management system 130, alone or in combination.


At (1), the metrics calculation system 154 can synchronize with each instance of the report and alert metadata tables 332. The synchronization process can be performed, for example, using SQL (such as the SUMO and GROUP By function).


At (2), the result obtained from each instance can be written to the zip code records table 378 for storage. The zip code table 378 can be accessed by the metrics calculation system 154 for generating report statistics which can be stored into the geographical statistics table 344. The geographical statistics table 344 can be accessed by the report generation system 152 to generate a personalized metrics report including report statistics in a user's geographic region.


In some embodiments, the synchronization in (1) and (2) can be performed by the data aggregation and synchronization system 156. Although various examples in FIGS. 3B-3D refer to SQL commands or functions, the various methods and steps in these figures do not have to be performed by SQL. Other languages, such as Java, Ruby, Hypertext Pre-Processor (PHP), C++, or any language supported by the dark web data store 142, the identity alerts data store(s) 144, or the identity metrics data store 158, can also be used to implement the techniques described herein.


Statistical Computation Processes



FIG. 3E illustrates example embodiments of statistical computation processes, which include a dark web data analysis process 380 and a report and alert data analysis process 390. The process 380 can be implemented by the dark web data analysis subsystem 352 and the process 290 can be implemented by the report and alert data analysis subsystem 354, but could also be implemented by other systems.


Dark Web Data Analysis Process


With reference to the dark web data analysis process 380, at block 382, the dark web data analysis subsystem 352 can periodically synchronize with the dark web data store 142. For example, the dark web analysis subsystem can synchronize various aggregated statistics tables (for example, tables 322, 324, 326, 328) with the counterpart tables in the identity metrics data store 158. For example, the dark web data analysis subsystem 352 can periodically synchronize the email data table 322 stored in the dark web data store 142 with its counterparts tables (for example, email domain value table and email domain hits table) stored in the identity metrics data store 158.


At block 384, the dark web data analysis subsystem 352 updates the counterpart tables stored in the identity metrics data store based on the updates. For example, the updates may include updates to aggregated statistics due to analysis (for example, by the dark web data acquisition system 140) of recently acquired compromised data. In some embodiments, the updates may be appended to one or more counterpart tables. With reference to the example in the preceding paragraph, the dark web data analysis subsystem 352 can append new email domain names (acquired from updates to the email data table 322) to the email domain value table.


At block 386, the dark web data analysis subsystem 352 can compute identity statistics. The identity statistics can be calculated based on data in the counterpart tables or updates received from the dark web data store 142. Continuing with the above-mentioned example, one of the identity statistics may be email domain statistics, which can include the hit date of a domain name (for example, found in compromised data), the total number of hits historically or within a certain time period (for example, within the past 60 days), the number of distinct days where hits are found, and so on.


At block 388, the dark web data analysis subsystem 352 can update a summary identity statistics table (such as the email domain statistics table 342) with the computed identity statistics. For example, the number of hits in the past 60 days of an email domain name in the email domain statistics table may be updated to reflect the most recent calculation occurred at the block 386.


Report and Alert Data Analysis Process


With reference to the report and alert data analysis process 390, at block 392, the report and alert data analysis subsystem 354 can periodically synchronize with one or more identity alerts data store(s). For example, there may be multiple instances of the report and alert data acquisition system 230 and thus there may be multiple identity alerts data stores 144 or report and alert metadata databases 244. For example, each report and alert metadata database 244 may maintain a report and alert metadata table 332 corresponding to statistics associated with a particular report and an alert data acquisition system 230.


The report and alert data analysis subsystem 354 can acquire updates to the one or more alerts data store and update counterpart table stored in the identity metrics data store at block 394. For example, even though there may be multiple identity alerts data stores or report and alert metadata tables, there may be one counterpart table corresponding to these identity alerts data stores or report and alert metadata tables. Thus, the report and alert data analysis subsystem 354 can combine data from the multiple identity alerts data stores or report and alert metadata tables and update the counterpart table accordingly. In some implementations, the report and alert data analysis system 354 can append updates to the counterpart table.


At block 396, the report and alert data analysis subsystem 354 can compute report statistics. The report statistics can be calculated based on the data in the counterpart table or updates received from the one or more identity alerts data store. As an example, the report statistics may be based on geographic regions, which can include the number of hits found for a geographic location, earliest hit date or latest hit date, the total number of hits historically or within a certain time period (for example, within the past 60 days), and so on.


At block 398, the report and alert data analysis subsystem 354 can update a summary report statistics table (such as the geographical statistics table 344) with the computed report statistics. For example, the number of hits or reports delivered historically for a zip code stored in the geographical statistics table 344 may be updated to reflect the most recent calculation occurred at the block 396.


Examples of Report Generation


As described with reference to FIG. 1, the identity management system 130 can receive a request from a client computing device 110 and return a report comprising personalized identity metrics to the client computing device 110. FIG. 4A illustrates an example embodiment of a data flow diagram for report generation. The example data flow diagram 400 can involve a client computing device 110, a client gateway 162, a report generation system 152, a dark web data store 142, an identity alerts data store 144, and an identity metrics data store 158.


At (1), the client computing device 110 can send a request to the client gateway 162 for a report of a user's personalized metrics. The request can include the user's PII such as, for example, one or more of the user's email addresses (for example, “username1@email.comand “username2@anotheremail.com”), zip codes associated with the user's addresses (for example, the user's address in the past 2 years), the user's phone numbers (for example, the user's work phone and home phone numbers), and the financial card's BIN numbers (for example, the first five or six digits of a user's credit card numbers). The request may be in an XML format, although other formats such as, for example, txt or HTML are also possible. In some implementations, the request may also include authentication mechanisms such as password and username to increase the security of the user's personalized metrics.


The client gateway 162 can parse the request to extract the user's PII. At (2), the client gateway 162 can communicate the request to a report generation system 152 for generating a report based on the user's PII. Although in this example, the client gateway 162 communicates the request for report to the report generation system 152, in various implementations, the client gateway 162 can also communicate the request to other components of the identity data analysis system 150.


At (3), the report generation system 152 can communicate with the dark web data store 142 to obtain information specific to the user. For example, the report generation system 152 can use the received PII to obtain a report from the dark web data store 142. As the example shown in the code block 430, the report can include whether the user's email address was found on websites which had security breaches and the number of hits (for example, found in dark web sites 120) over a certain time period (for example, last 60 days or since when the user is subscribed to the identity management system 130).


At (4), the report generation system 152 can communicate with the identity metrics data store 158 to obtain summary statistics based on the user's PII. For example, as shown in the code block 440, the summary statistics can include total number of hits for all of the user's email addresses found in dark web data. Some of the summary statistics can be depersonalized, which can be calculated based on data for users having similar PIIs. For example, the report generation system 152 can include summary statistics related to the number of security breaches associated with an email domain over a time period. As shown in the example code block 440, the historical total number of hits for the email domain name “email.com” is around 500 million and the total number of hits in the past 60 days for “email.com” is about 15 million. These total numbers of hits can include hits associated with other user's email addresses having the same email domain name. The report generation system 152 can query the email domain statistics table 342 to obtain the summary statistics related to the email domain.


At (5), the report generation system 152 can communicate with the identity alerts data store(s) 144 to retrieve report statistics. As an example, the code block 450 shows that total number of reports sent to all users as well as the number of reports sent to users within a given zip code or a given state in the past 60 days and historically. As further described with reference to FIG. 4B, the report generation system 152 can also obtain statistics related to other types of notifications from the identity alerts data store(s) 144. Some example types of notifications include: criminal records, non-credit loans, change of address, financial account takeover, dark web related breaches, and so forth. These statistics can also be broken down by geographic regions. Although in this example, the report generation system 152 obtains report statistics from the identity alerts data store(s) 144, in some implementations, the report generation system 152 can also communicate with the identity metrics data store 158 to obtain at least a portion of the report statistics. For example, the report generation system 152 can obtain report statistics specific to user's geographic region by consulting the geographic statistics table 344 in the identity metrics data store 158 while obtain national report statistics from the identity alerts data store(s).


The report generation system 152 can generate the report compiling data obtained from (3) through (5). The report may be in an XML format (or any other suitable format). At (6), the report generation system 152 can provide the report to the client gateway 162 which, at (7), will pass the report to the client computing device 110 for display to a user. The report can be delivered in an email, a text message, or other types of messaging system. The report can also be rendered on a web portal.


Examples of Reports



FIG. 4B illustrates example embodiments of reports delivered to a client computing device. FIG. 4B illustrates two user interface screens 460 and 480. The user interface screen 460 may be part of an email message while the user interface screen 480 may be a user interface element (for example, a widget or a banner) displayed on a web portal.


The user interface screen 460 shows a monthly report. This monthly report may be generated as a result of a user's subscription to an identity monitoring service offered by the identity management system 130. For example, the report generation system 152 can automatically gather user specific data, summary identity statistics, and summary report statistics every month and deliver a monthly report to the user.


The monthly report in the user interface screen 460 shows a monthly summary of notifications (shown by the user interface element 462) which may include the number of notifications delivered by the identity management system 130 to the user. The monthly report can also include report statistics associated with the user's geographic region. As shown by the user interface element 464, report statistics can include the number of notifications related to the change of addresses, court records (for example, filings of court cases), dark web security alerts (for example, alerts regarding unauthorized use of the user's PII or potential breach of the user's PIM financial account takeovers, non-credit loans, sex offenders (for example, sex offenders identified as associated with the user's geographic region), and/or social security number traces.


Once receiving the report, the user can actuate the user interface element 466 to review further information of the report on a web portal. The user interface element 480 shows a user interface element on a web portal. This user interface element 480 shows summary statistics (as indicated by the arrow 482) related to the total number of notifications sent to all U.S. subscribers of the identity management system 130 in the past 60 days. The user interface element 480 also shows the summary report statistics (as shown by the arrow 484) in the user's city.


Example Processes for Generating and Monitoring Identity Metrics


The identity data management system 130 may implement processes for identity metrics analysis as well as an identity monitoring process.


Identity Metrics Analysis Process



FIG. 5A illustrates an example embodiment of an identity metrics analysis process. The process 500 can be performed by the identity data analysis system 150 described herein


At block 520, the identity data analysis system 150 can receive a request for a user's identity metrics. The identity metrics may include personalized metrics associated with a user's PII. The personalized metrics information specific to user's PII or depersonalized statistics based on information from a group of users. The request may be received from a client gateway 162, an identity monitoring system 164, or directly from a client computing device 110. The request may include a user's PII which the identity data analysis system can use to generate personalized metrics.


At block 530, the identity data analysis system 150 can access data from at least one of a dark web data store, an identity alerts data store 144, or an identity metrics data store 158. In some implementations, the identity metrics data store 158 can periodically synchronize with the dark web data store 142 and the identity alerts data store(s) 144 to include data in the dark web data store 142 and the identity alerts data store 144. Thus, the identity data analysis system 150 can communicate with the identity metrics data store 158 to acquire compromised PII, reports information, as well as aggregated statistics. In other implementations, the identity data analysis system 150 can communicate with the dark web data store 142 to acquire compromised PII, communicate with one or more identity alerts data store 144 to acquire information of various reports, and communicate with the identity metrics data store to retrieve aggregated statistics. In some situations, a request for user's identity metrics can cause the identity data analysis system 150 to synchronize the data in the identity metrics data store 158 with the dark web data store 142 and one or more identity alerts data store 144. For example, the request may trigger the data aggregation and synchronization system 156 to access an identity alerts data store report information of those individuals having similar demographic characteristics as the user.


At block 540, the identity data analysis system 150 can determine identity metrics related to the PII based on the accessed data. For example, the identity data analysis system 150 can determine the email domain associated with the user's email address. The identity data analysis system can find the number of compromises associated with the same email domain. As another example, the identity data analysis system can find the number of reports sent to users in the same geographical area. In some embodiments, the operations in the blocks 530 and 540 may be combined. For example, the identity data analysis system (or the metric calculation system 154 of the identity data analysis system 150) can execute a query including a portion of the PII and to retrieve the identity metrics associated with the user. For example, the identity data analysis system can query the identity metrics data store 340 for the statistics associated with the user's geographical region.


At block 550, the identity data analysis system 150 can compile the identity metrics into a report. The report may include various sections, such as a user specific section, a statistics section, a geographically related alerts section, and so on. Compromised data from the dark web may be used to populate the user specific section. For example, if the user's email address is flagged as compromised based on the analysis of the dark web data, the identity data analysis system can input the user's email address as well as the site where the compromise was discovered into the user specific portion of the report. As another example, the aggregated statistics may be accessed form the identity metrics data store 158 and populate the statistics section of the report. For example, statistics regarding the number of compromised email address having the same domain name as the user's email address may be added to the statistics portion of the report. The geographically related alerts section may be populated based on data from the identity alerts data store. Some example, data may include the number of notifications provided by the identity management system 130 to people in the same city as the user. As described with reference to FIG. 4A, the report generation system 152 of the identity data analysis system 150 may be configured to perform the process at block 550.


At block 560, the report can be communicated to a requesting entity for display to the user. As described with reference to FIG. 1, the requesting entity may be an identity monitoring service, a company or a person interested in learning a user's identity metrics (for example, an employer), or the user himself. The report may be in an XML format and may be communicated via an API. The identity data analysis stem 150 can communicate the report to the requesting entity via a client gateway 162, an identity monitoring system 164 or directly to the client computing device 110.


Identity Monitoring Process



FIG. 5B illustrates an example embodiment of an identity monitoring process. The process 510 may be performed by the identity monitoring system 164 alone or in combination with user identity registration system 166 or the identity data analysis system 150, as well as another system.


At block 502, the identity monitoring system 164 can receive a subscription request associated with a user. The subscription request may include a request to enroll a user into a periodic monitoring service of the user's identity metrics.


At block 504, the identity monitoring system 164 can determine the user's PII and store the PII in a data store. For example, the subscription request may include a user's PII and the identity monitoring system can parse the request to identify the user's PII and store the identified PII into a data store (such as, for example, the identity alerts data store 144). In some embodiments, the identity monitoring system can acquire additional PII based on the PII in the user's request. For example, the PII in the user's request may include the user's name and the social security number, the identity monitoring system can use this PII in the user's request to obtain the user's financial account information, the user's phone number, or the address information by communicating with another database (such as, for example, a database associated with a credit bureau). The additional PII can also be stored in the data store together with the PII received in the subscription request.


At block 506, the identity monitoring system 164 can periodically generate a request to invoke the process 500 in FIG. 5A. For example, the identity monitoring system can periodically request identity metrics using the user's PII (which can include the PII received form the subscription request alone or in combination with the additional PII acquired). In some embodiments, once the user is subscribed to the periodic monitoring service, identity data analysis system can periodically generate a report in the form of an alert for the user. For example, for every two months, the identity data analysis system can send a report including personalized metrics in the past 60 days. This alert may be automatically generated without the performing the process block 506.


Example Computing System Implementation and Architecture



FIG. 6 illustrates a general architecture of a computing system for processing attributes and implementing various other aspects of the present disclosure. Many or all of the components of the computing system shown in FIG. 6 may be included in the various computing devices and systems discussed herein. The computing system may include, for example, a personal computer (such as, for example, IBM, Macintosh, Microsoft Windows compatible, OS X compatible, Linux/Unix compatible, or other types of computing systems, alone or in combination), a server, a workstation, a laptop computer, a smart phone, a smart watch, a personal digital assistant, a kiosk, a car console, a tablet, or a media player. In one embodiment, the computing system's processing system 600 includes one or more central processing units (CPU) 612, which may each include a conventional or proprietary microprocessor specially configured to perform, in whole or in part, one or more of the features described above. The processing system 600 further includes one or more memory 618, such as random access memory (RAM) for temporary storage of information, one or more read only memory (ROM) for permanent storage of information, and one or more mass storage device 603, such as a hard drive, diskette, solid state drive, or optical media storage device. A data store 621 may also be included. In some implementations, the data store 621 may be designed to handle large quantities of data and provide fast retrieval of the records. To facilitate efficient storage and retrieval, the data store 621 may be indexed using one or more of compressed data, identifiers, or other data, such as that described above.


Typically, the components of the processing system 600 are connected using a standards-based bus system 624. In different embodiments, the standards-based bus system 624 could be implemented in Peripheral Component Interconnect (PCI), Microchannel, Small Computer System Interface (SCSI), Industrial Standard Architecture (ISA) and Extended ISA (EISA) architectures, for example. In addition, the functionality provided for in the components and modules of processing system 600 may be combined into fewer components and modules or further separated into additional components and modules.


The processing system 600 is generally controlled and coordinated by operating system software, such as Windows XP, Windows Vista, Windows 7, Windows 8, Windows 10, Windows Server, Unix, Linux, SunOS, Solaris, iOS, MAC OS X, Blackberry OS, Android, or other operating systems. In other embodiments, the processing system 600 may be controlled by a proprietary operating system. The operating system is configured to control and schedule computer processes for execution, perform memory management, provide file system, networking, I/O services, and provide a user interface, such as a graphical user interface (GUI), among other things. The GUI may include an application interface and/or a web-based interface including data fields for receiving input signals or providing electronic information and/or for providing information to the user in response to any received input signals. A GUI may be implemented in whole or in part using technologies such as HTML, Flash, Java, .net, web services, and RSS. In some implementations, a GUI may be included in a stand-alone client (for example, thick client, fat client) configured to communicate (for example, send or receive data) in accordance with one or more of the aspects described.


The processing system 600 may include one or more commonly available input/output (I/O) devices and interfaces 615, such as a keyboard, stylus, touch screen, mouse, touchpad, and printer. In one embodiment, the I/O devices and interfaces 615 include one or more display devices, such as a monitor, that allows the visual presentation of data to a user. More particularly, a display device provides for the presentation of GUIs, application software data, and multimedia presentations, for example. The processing system 600 may also include one or more multimedia devices 606, such as speakers, video cards, graphics accelerators, and microphones, for example.


In the embodiment of FIG. 6, the I/O devices and interfaces 615 provide a communication interface to various external devices. The processing system 600 may be electronically coupled to one or more networks, which comprise one or more of a LAN, WAN, cellular network, satellite network, and/or the Internet, for example, via a wired, wireless, or combination of wired and wireless communication link. The networks communicate with various computing devices and/or other electronic devices via wired or wireless communication links.


In some embodiments, information may be provided to the processing system 600 over a network from one or more data sources. The data sources may include one or more internal and/or external data sources. In some embodiments, one or more of the databases or data sources may be implemented using a relational database, such as Sybase, Oracle, CodeBase and Microsoft® SQL Server as well as other types of databases such as, for example, a flat file database, a non-relational database, an entity-relationship database, and object-oriented database, and/or a record-based database.


In general, the word “module,” as used herein, refers to logic embodied in hardware or firmware, or to a collection of software instructions, possibly having entry and exit points, written in a programming language, such as, for example, Java, Lua, C, or C++. A software module may be compiled and linked into an executable program, installed in a dynamic link library, or may be written in an interpreted programming language such as, for example, BASIC, Perl, or Python. It will be appreciated that software modules may be callable from other modules or from themselves, and/or may be invoked in response to detected events or interrupts. Software modules configured for execution on computing devices may be provided on a computer readable medium, such as a compact disc, digital video disc, flash drive, or any other tangible medium. Such software code may be stored, partially or fully, on a memory device of the executing computing device, such as the processing system 600, for execution by the computing device. Software instructions may be embedded in firmware, such as an EPROM. It will be further appreciated that hardware modules may be comprised of connected logic units, such as gates and flip-flops, and/or may be comprised of programmable units, such as programmable gate arrays or processors. The modules described herein are preferably implemented as software modules. They may be represented in hardware or firmware. Generally, the modules described herein refer to logical modules that may be combined with other modules or divided into sub-modules despite their physical organization or storage.


In the example of FIG. 6, the modules 609 may be configured for execution by the CPU 612 to perform, in whole or in part, any or all of the process discussed above, such as those shown in FIGS. 2B, 3E, 5A, and 5B. The processes may also be performed by one or more virtual machines. For example, the processes may be hosted by a cloud computing system. In some embodiments, one or more components of the processing system 600 may be part of the cloud computing system. Additionally or alternatively, the virtualization may be achieved at the operating system level. For example, the one or more processes described herein may be executed using application containerization. The one or more processes may also be implemented on a Lambda architecture designed to handle mass quantities of data by taking advantage of the batch processing and the stream processing.


It is to be understood that not necessarily all objects or advantages may be achieved in accordance with any particular embodiment described herein. Thus, for example, those skilled in the art will recognize that certain embodiments may be configured to operate in a manner that achieves or optimizes one advantage or group of advantages as taught herein without necessarily achieving other objects or advantages as may be taught or suggested herein.


All of the processes described herein may be embodied in, and fully automated, via software code modules executed by a computing system that includes one or more computers or processors. In some embodiments, at least some of the processes may be implemented using virtualization techniques such as, for example, cloud computing, application containerization, or Lambda architecture, etc., alone or in combination. The code modules may be stored in any type of non-transitory computer-readable medium or other computer storage device. Some or all the methods may be embodied in specialized computer hardware.


Many other variations than those described herein will be apparent from this disclosure. For example, depending on the embodiment, certain acts, events, or functions of any of the algorithms described herein can be performed in a different sequence or can be added, merged, or left out altogether (for example, not all described acts or events are necessary for the practice of the algorithms). Moreover, in certain embodiments, acts or events can be performed concurrently, for example, through multi-threaded processing, interrupt processing, or multiple processors or processor cores or on other parallel architectures, rather than sequentially. In addition, different tasks or processes can be performed by different machines and/or computing systems that can function together.


The various illustrative logical blocks and modules described in connection with the embodiments disclosed herein can be implemented or performed by a machine, such as a virtual machine, a processing unit or processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A processor can be a microprocessor, but in the alternative, the processor can be a controller, microcontroller, or state machine, combinations of the same, or the like. A processor can include electrical circuitry configured to process computer-executable instructions. In another embodiment, a processor includes an FPGA or other programmable device that performs logic operations without processing computer-executable instructions. A processor can also be implemented as a combination of computing devices, for example, a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a DSP core, or any other such configuration. Although described herein primarily with respect to digital technology, a processor may also include primarily analog components. For example, some or all of the signal processing algorithms described herein may be implemented in analog circuitry or mixed analog and digital circuitry. A computing environment can include any type of computer system, including, but not limited to, a computer system based on a microprocessor, a mainframe computer, a digital signal processor, a portable computing device, a device controller, or a computational engine within an appliance, to name a few.


Conditional language such as, among others, “can,” “could,” “might” or “may,” unless specifically stated otherwise, are understood within the context as used in general to convey that certain embodiments include, while other embodiments do not include, certain features, elements and/or steps. Thus, such conditional language is not generally intended to imply that features, elements and/or steps are in any way required for one or more embodiments or that one or more embodiments necessarily include logic for deciding, with or without user input or prompting, whether these features, elements and/or steps are included or are to be performed in any particular embodiment.


Disjunctive language such as the phrase “at least one of X, Y, or Z,” unless specifically stated otherwise, is understood with the context as used in general to present that an item, term, etc., may be either X, Y, or Z, or any combination thereof (for example, X, Y, and/or Z). Thus, such disjunctive language is not generally intended to, and should not, imply that certain embodiments require at least one of X, at least one of Y, or at least one of Z to each be present.


Any process descriptions, elements or blocks in the flow diagrams described herein and/or depicted in the attached figures should be understood as potentially representing modules, segments, or portions of code which include one or more executable instructions for implementing specific logical functions or elements in the process. Alternate implementations are included within the scope of the embodiments described herein in which elements or functions may be deleted, executed out of order from that shown, or discussed, including substantially concurrently or in reverse order, depending on the functionality involved as would be understood by those skilled in the art.


Unless otherwise explicitly stated, articles such as “a” or “an” should generally be interpreted to include one or more described items. Accordingly, phrases such as “a device configured to” are intended to include one or more recited devices. Such one or more recited devices can also be collectively configured to carry out the stated recitations. For example, “a processor configured to carry out recitations A, B and C” can include a first processor configured to carry out recitation A working in conjunction with a second processor configured to carry out recitations B and C.


It should be emphasized that many variations and modifications may be made to the above-described embodiments, the elements of which are to be understood as being among other acceptable examples. All such modifications and variations are intended to be included herein within the scope of this disclosure.

Claims
  • 1. A identity security system, the identity security system comprising: a non-transitory data storage configured to store computer executable instructions for an identity data analysis system; a dark web data store configured to store compromised data related to users' personal identifying information (PII) and aggregated statistics calculated based on the compromised data; a plurality of identity alerts data stores configured to store alerts sent to the users and metadata associated with the alerts; an identity metrics data store configured to store depersonalized summary statistics; and a hardware processor programmed to execute the computer executable instructions in the non-transitory data storage to cause the identity security system to: receive an instruction to generate an alert comprising personalized metrics of a user, wherein the instruction comprises PII of the user; query a dark web data store with the PII of the user to acquire information on security compromises related to the PII of the user; query an identity alerts data store with geographic location information of the user to obtain report statistics associated with a geographic region of the user; query an identity metrics database to obtain the depersonalized summary statistics, wherein the depersonalized summary statistics are generated based on a group of individuals whose PIIs overlaps at least with a portion of the user's PII; generate an alert which comprises information on security compromises related to the PII of the user, report statistics associated with a geographic region of the user, and the depersonalized summary statistics; and deliver the alert to a client computing device via a network, wherein compromised PIIs are acquired from dark web sites using one or more automated data collection processes.
  • 2. The identity security system of claim 1, wherein the identity metrics data store is further configured to store counterpart tables corresponding to the aggregated statistics in the a dark web data store and the metadata in the plurality of identity alerts data stores, and the hardware processor is further programmed to periodically synchronize the counterpart tables with data in the dark web data store and the identity alerts data store.
  • 3. The identity security system of claim 2, wherein the counterpart tables comprise a first counterpart table and a second counterpart table each of which corresponds to an aspect of a data table in the dark web data store.
  • 4. The identity security system of claim 2, wherein the counterpart tables comprise a third counterpart table which corresponds to metadata of the plurality of identity alerts data store.
  • 5. The identity security system of claim 2, wherein the hardware processor is programmed to update the summary statistics in the identity metrics data store based at least partly on updates to the counterpart tables in the periodic synchronization.
  • 6. The identity security system of claim 1, wherein the alert comprises a report in an extensible markup language format.
  • 7. A method for protecting identity security, the method comprising: receiving an instruction to generate an alert comprising personalized metrics of a user, wherein the instruction comprises PII of the user; querying a dark web data store with the PII of the user to acquire information on security compromises related to the PII of the user; querying an identity alerts data store with geographic location information of the user to obtain report statistics associated with a geographic region of the user; querying an identity metrics database to obtain depersonalized summary statistics, wherein the depersonalized summary statistics are generated based on a group of individuals whose PIIs overlaps at least with a portion of the user's PII; generating an alert which comprises information on security compromises related to the PII of the user, report statistics associated with a geographic region of the user, and the depersonalized summary statistics; and delivering the alert to a client computing device via a network, wherein compromised PIIs are acquired from dark web sites using one or more automated data collection processes.
  • 8. The method of claim 7, wherein the method further comprises periodically synchronizing counterpart tables in the identity metrics data store with data in the dark web data store and the identity alerts data store.
  • 9. The method of claim 8, wherein the counterpart tables comprise a first counterpart table and a second counterpart table each of which corresponds to an aspect of a data table in the dark web data store.
  • 10. The method of claim 8, wherein the counterpart tables comprise a third counterpart table which corresponds to metadata of a plurality of identity alerts data store.
  • 11. The method of claim 8, wherein the method further comprises updating the summary statistics in the identity metrics data store based at least partly on updates to the counterpart tables in the periodic synchronization.
  • 12. The method of claim 7, wherein the alert comprises a report in an extensible markup language format.
  • 13. Non-transitory computer readable medium storing computer executable instructions thereon, the computer executable instructions when executed cause an identity security system to: receive an instruction to generate an alert comprising personalized metrics of a user, wherein the instruction comprises PII of the user; query a dark web data store with the PII of the user to acquire information on security compromises related to the PII of the user; query an identity alerts data store with geographic location information of the user to obtain report statistics associated with a geographic region of the user; query an identity metrics database to obtain depersonalized summary statistics, wherein the depersonalized summary statistics are generated based on a group of individuals whose PIIs overlaps at least with a portion of the user's PII; generate an alert which comprises information on security compromises related to the PII of the user, report statistics associated with a geographic region of the user, and the depersonalized summary statistics; and deliver the alert to a client computing device via a network, wherein compromised PIIs are acquired from dark web sites using one or more automated data collection processes.
  • 14. The non-transitory computer readable medium of claim 13, wherein the computer executable instructions further causes the identity security system to periodically synchronize counterpart tables in the identity metrics data store with data in the dark web data store and the identity alerts data store.
  • 15. The non-transitory computer readable medium of claim 14, wherein the counterpart tables comprise a first counterpart table and a second counterpart table each of which corresponds to an aspect of a data table in the dark web data store.
  • 16. The non-transitory computer readable medium of claim 14, wherein the counterpart tables comprise a third counterpart table which corresponds to metadata of a plurality of identity alerts data store.
  • 17. The non-transitory computer readable medium of claim 14, wherein the computer executable instructions further causes the identity security system to update the summary statistics in the identity metrics data store based at least partly on updates to the counterpart tables in the periodic synchronization.
  • 18. The non-transitory computer readable medium of claim 13, wherein the alert comprises a report in an extensible markup language.
PRIORITY CLAIM

This application claims the benefit of priority under 35 U.S.C. § 119(e) of U.S. Provisional Application No. 62/565,014, filed on Sep. 28, 2017, the entire contents of which is hereby incorporated by reference in its entirety herein and should be considered part of this specification.

US Referenced Citations (997)
Number Name Date Kind
2074513 Mills Mar 1937 A
3316395 Lavin et al. Apr 1967 A
3752904 Waterbury Aug 1973 A
4163290 Sutherlin et al. Jul 1979 A
5274547 Zoffel et al. Dec 1993 A
5323315 Highbloom Jun 1994 A
5414833 Hershey et al. May 1995 A
5454030 de Oliveira et al. Sep 1995 A
5504675 Cragun et al. Apr 1996 A
5563783 Stolfo et al. Oct 1996 A
5627886 Bowman May 1997 A
5679940 Templeton et al. Oct 1997 A
5696907 Tom Dec 1997 A
5696965 Dedrick Dec 1997 A
5739512 Tognazzini Apr 1998 A
5742775 King Apr 1998 A
5745654 Titan Apr 1998 A
5752242 Havens May 1998 A
5754632 Smith May 1998 A
5774868 Cragun et al. Jun 1998 A
5809478 Greco et al. Sep 1998 A
5819226 Gopinathan et al. Oct 1998 A
5819260 Lu et al. Oct 1998 A
5822741 Fischthal Oct 1998 A
5832068 Smith Nov 1998 A
5842178 Giovannoli Nov 1998 A
5870721 Norris Feb 1999 A
5872921 Zahariev et al. Feb 1999 A
5878403 DeFrancesco Mar 1999 A
5879297 Haynor et al. Mar 1999 A
5884289 Anderson et al. Mar 1999 A
5912839 Ovshinsky et al. Jun 1999 A
5913196 Talmor et al. Jun 1999 A
5943666 Kleewein et al. Aug 1999 A
5950179 Buchanan et al. Sep 1999 A
5987440 O'Neil et al. Nov 1999 A
5999907 Donner Dec 1999 A
5999940 Ranger Dec 1999 A
6023694 Kouchi et al. Feb 2000 A
6029139 Cunningham et al. Feb 2000 A
6029149 Dykstra et al. Feb 2000 A
6029154 Pettitt Feb 2000 A
6029194 Tilt Feb 2000 A
6044357 Garg Mar 2000 A
6055570 Nielsen Apr 2000 A
6094643 Anderson et al. Jul 2000 A
6119103 Basch et al. Sep 2000 A
6125985 Amdahl et al. Oct 2000 A
6142283 Amdahl et al. Nov 2000 A
6144988 Kappel Nov 2000 A
6157707 Baulier et al. Dec 2000 A
6182219 Feldbau et al. Jan 2001 B1
6249228 Shirk et al. Jun 2001 B1
6253203 O'Flaherty et al. Jun 2001 B1
6254000 Degen et al. Jul 2001 B1
6263447 French et al. Jul 2001 B1
6269349 Aieta et al. Jul 2001 B1
6282658 French et al. Aug 2001 B2
6285983 Jenkins Sep 2001 B1
6285987 Roth et al. Sep 2001 B1
6292795 Peters et al. Sep 2001 B1
6311169 Duhon Oct 2001 B2
6317783 Freishtat et al. Nov 2001 B1
6321339 French et al. Nov 2001 B1
6330546 Gopinathan et al. Dec 2001 B1
6397197 Gindlesperger May 2002 B1
6418436 Degen et al. Jul 2002 B1
6424956 Werbos Jul 2002 B1
6448889 Hudson Sep 2002 B1
6456984 Demoff et al. Sep 2002 B1
6496936 French et al. Dec 2002 B1
6505193 Musgrave et al. Jan 2003 B1
6510415 Talmor et al. Jan 2003 B1
6513018 Culhane Jan 2003 B1
6532459 Berson Mar 2003 B1
6542894 Lee et al. Apr 2003 B1
6543683 Hoffman Apr 2003 B2
6553495 Johansson et al. Apr 2003 B1
6571334 Feldbau et al. May 2003 B1
6597775 Lawyer et al. Jul 2003 B2
6612488 Suzuki Sep 2003 B2
6615193 Kingdon et al. Sep 2003 B1
6658393 Basch et al. Dec 2003 B1
6700220 Bayeur et al. Mar 2004 B2
6714918 Hillmer et al. Mar 2004 B2
6735572 Landesmann May 2004 B2
6740875 Ishikawa et al. May 2004 B1
6748426 Shaffer et al. Jun 2004 B1
6751626 Brown et al. Jun 2004 B2
6796497 Benkert et al. Sep 2004 B2
6811082 Wong Nov 2004 B2
6829711 Kwok et al. Dec 2004 B1
6850606 Lawyer et al. Feb 2005 B2
6857073 French et al. Feb 2005 B2
6866586 Oberberger et al. Mar 2005 B2
6871287 Ellingson Mar 2005 B1
6873979 Fishman et al. Mar 2005 B2
6898574 Regan May 2005 B1
6907408 Angel Jun 2005 B2
6908030 Rajasekaran et al. Jun 2005 B2
6913194 Suzuki Jul 2005 B2
6918038 Smith et al. Jul 2005 B1
6920435 Hoffman et al. Jul 2005 B2
6928546 Nanavati et al. Aug 2005 B1
6930707 Bates et al. Aug 2005 B2
6934849 Kramer et al. Aug 2005 B2
6934858 Woodhill Aug 2005 B2
6965881 Brickell et al. Nov 2005 B1
6965997 Dutta Nov 2005 B2
6973462 Dattero et al. Dec 2005 B2
6973575 Arnold Dec 2005 B2
6983381 Jerdonek Jan 2006 B2
6983882 Cassone Jan 2006 B2
6991174 Zuili Jan 2006 B2
6993659 Milgramm et al. Jan 2006 B2
7007174 Wheeler et al. Feb 2006 B2
7028052 Chapman et al. Apr 2006 B2
7035855 Kilger et al. Apr 2006 B1
7069240 Spero et al. Jun 2006 B2
7083090 Zuili Aug 2006 B2
7089592 Adjaoute et al. Aug 2006 B2
7092891 Maus et al. Aug 2006 B2
7104444 Suzuki Sep 2006 B2
7158622 Lawyer et al. Jan 2007 B2
7162640 Heath et al. Jan 2007 B2
7174335 Kameda Feb 2007 B2
7188078 Arnett et al. Mar 2007 B2
7203653 McIntosh Apr 2007 B1
7212995 Schulkins May 2007 B2
7222779 Pineda-Sanchez et al. May 2007 B1
7225977 Davis Jun 2007 B2
7234156 French et al. Jun 2007 B2
7240059 Bayliss et al. Jul 2007 B2
7240363 Ellingson Jul 2007 B1
7246067 Austin et al. Jul 2007 B2
7246740 Swift et al. Jul 2007 B2
7254560 Singhal Aug 2007 B2
7263506 Lee et al. Aug 2007 B2
7272857 Everhart Sep 2007 B1
7277869 Starkman Oct 2007 B2
7277875 Serrano-Morales et al. Oct 2007 B2
7283974 Katz et al. Oct 2007 B2
7289607 Bhargava et al. Oct 2007 B2
7290704 Ball et al. Nov 2007 B1
7298873 Miller, Jr. et al. Nov 2007 B2
7310743 Gagne et al. Dec 2007 B1
7314162 Carr et al. Jan 2008 B2
7314167 Kiliccote Jan 2008 B1
7330871 Barber Feb 2008 B2
7333635 Tsantes et al. Feb 2008 B2
7340042 Cluff et al. Mar 2008 B2
7343149 Benco Mar 2008 B2
7356516 Richey et al. Apr 2008 B2
7370044 Mulhern et al. May 2008 B2
7370351 Ramachandran et al. May 2008 B1
7376618 Anderson et al. May 2008 B1
7383227 Weinflash et al. Jun 2008 B2
7386448 Poss et al. Jun 2008 B1
7386506 Aoki et al. Jun 2008 B2
7392534 Lu et al. Jun 2008 B2
7395273 Khan et al. Jul 2008 B2
7398915 Pineda-Sanchez et al. Jul 2008 B1
7418431 Nies et al. Aug 2008 B1
7428509 Klebanoff Sep 2008 B2
7433855 Gavan et al. Oct 2008 B2
7433864 Malik Oct 2008 B2
7438226 Helsper et al. Oct 2008 B2
7444518 Dharmarajan et al. Oct 2008 B1
7457401 Lawyer et al. Nov 2008 B2
7458508 Shao et al. Dec 2008 B1
7466235 Kolb et al. Dec 2008 B1
7467401 Cicchitto Dec 2008 B2
7480631 Merced et al. Jan 2009 B1
7481363 Zuili Jan 2009 B2
7490052 Kilger et al. Feb 2009 B2
7490356 Lieblich et al. Feb 2009 B2
7497374 Helsper et al. Mar 2009 B2
7509117 Yum Mar 2009 B2
7512221 Toms Mar 2009 B2
7519558 Ballard et al. Apr 2009 B2
7522060 Tumperi et al. Apr 2009 B1
7533808 Song et al. May 2009 B2
7536346 Aliffi et al. May 2009 B2
7540021 Page May 2009 B2
7542993 Satterfield et al. Jun 2009 B2
7543739 Brown et al. Jun 2009 B2
7543740 Greene et al. Jun 2009 B2
7546271 Chmielewski et al. Jun 2009 B1
7548886 Kirkland et al. Jun 2009 B2
7552467 Lindsay Jun 2009 B2
7562184 Henmi et al. Jul 2009 B2
7562814 Shao et al. Jul 2009 B1
7568616 Zuili Aug 2009 B2
7575157 Barnhardt et al. Aug 2009 B2
7580884 Cook Aug 2009 B2
7581112 Brown et al. Aug 2009 B2
7584146 Duhon Sep 2009 B1
7587368 Felsher Sep 2009 B2
7591425 Zuili et al. Sep 2009 B1
7593891 Kornegay et al. Sep 2009 B2
7606401 Hoffman et al. Oct 2009 B2
7606790 Levy Oct 2009 B2
7610216 May et al. Oct 2009 B1
7610229 Kornegay Oct 2009 B1
7610243 Haggerty et al. Oct 2009 B2
7620596 Knudson et al. Nov 2009 B2
7623844 Herrmann et al. Nov 2009 B2
7630924 Collins et al. Dec 2009 B1
7630932 Danaher et al. Dec 2009 B2
7636853 Cluts et al. Dec 2009 B2
7644868 Hare Jan 2010 B2
7647344 Skurtovich, Jr. et al. Jan 2010 B2
7647645 Edeki et al. Jan 2010 B2
7653593 Zarikian et al. Jan 2010 B2
7657431 Hayakawa Feb 2010 B2
7668769 Baker et al. Feb 2010 B2
7668840 Bayliss et al. Feb 2010 B2
7668921 Proux et al. Feb 2010 B2
7672865 Kumar et al. Mar 2010 B2
7673793 Greene et al. Mar 2010 B2
7676418 Chung et al. Mar 2010 B1
7676433 Ross et al. Mar 2010 B1
7685096 Margolus et al. Mar 2010 B2
7686214 Shao et al. Mar 2010 B1
7689007 Bous et al. Mar 2010 B2
7689505 Kasower Mar 2010 B2
7690032 Peirce Mar 2010 B1
7701364 Zilberman Apr 2010 B1
7702550 Perg et al. Apr 2010 B2
7707163 Anzalone et al. Apr 2010 B2
7708190 Brandt et al. May 2010 B2
7708200 Helsper et al. May 2010 B2
7711635 Steele et al. May 2010 B2
7711636 Robida et al. May 2010 B2
7720750 Brody May 2010 B2
7725300 Pinto et al. May 2010 B2
7734523 Cui et al. Jun 2010 B1
7735125 Alvarez et al. Jun 2010 B1
7742982 Chaudhuri et al. Jun 2010 B2
7747520 Livermore et al. Jun 2010 B2
7747521 Serio Jun 2010 B2
7747559 Leitner et al. Jun 2010 B2
7752084 Pettitt Jul 2010 B2
7752236 Williams et al. Jul 2010 B2
7752554 Biggs et al. Jul 2010 B2
7756783 Crooks Jul 2010 B2
7761379 Zoldi et al. Jul 2010 B2
7761384 Madhogarhia Jul 2010 B2
7774270 MacCloskey Aug 2010 B1
7778885 Semprevivo et al. Aug 2010 B1
7779456 Dennis et al. Aug 2010 B2
7779457 Taylor Aug 2010 B2
7783515 Kumar et al. Aug 2010 B1
7788184 Kane Aug 2010 B2
7792715 Kasower Sep 2010 B1
7792864 Rice et al. Sep 2010 B1
7793835 Coggeshall et al. Sep 2010 B1
7801811 Merrell et al. Sep 2010 B1
7801828 Candella et al. Sep 2010 B2
7802104 Dickinson Sep 2010 B2
7805362 Merrell et al. Sep 2010 B1
7805391 Friedlander et al. Sep 2010 B2
7813944 Luk et al. Oct 2010 B1
7827115 Weller et al. Nov 2010 B2
7832006 Chen et al. Nov 2010 B2
7835983 Lefner et al. Nov 2010 B2
7840459 Loftesness et al. Nov 2010 B1
7841004 Balducci et al. Nov 2010 B1
7844520 Franklin Nov 2010 B1
7848987 Haig Dec 2010 B2
7849029 Crooks et al. Dec 2010 B2
7853518 Cagan Dec 2010 B2
7853526 Milana Dec 2010 B2
7853533 Eisen Dec 2010 B2
7853998 Blaisdell et al. Dec 2010 B2
7856397 Whipple et al. Dec 2010 B2
7856494 Kulkarni Dec 2010 B2
7860769 Benson Dec 2010 B2
7860783 Yang et al. Dec 2010 B2
7865427 Wright et al. Jan 2011 B2
7865439 Seifert et al. Jan 2011 B2
7865937 White et al. Jan 2011 B1
7870078 Clark et al. Jan 2011 B2
7870599 Pemmaraju Jan 2011 B2
7874488 Parkinson Jan 2011 B2
7877304 Coulter Jan 2011 B1
7877784 Chow et al. Jan 2011 B2
7882548 Heath et al. Feb 2011 B2
7890433 Singhal Feb 2011 B2
7904360 Evans Mar 2011 B2
7904367 Chung et al. Mar 2011 B2
7908242 Achanta Mar 2011 B1
7909246 Hogg et al. Mar 2011 B2
7912865 Akerman et al. Mar 2011 B2
7917715 Tallman, Jr. Mar 2011 B2
7925582 Kornegay et al. Apr 2011 B1
7929951 Stevens et al. Apr 2011 B2
7933835 Keane et al. Apr 2011 B2
7941363 Tanaka et al. May 2011 B2
7945515 Zoldi et al. May 2011 B2
7950577 Daniel May 2011 B1
7958046 Doerner et al. Jun 2011 B2
7961857 Zoldi et al. Jun 2011 B2
7962404 Metzger, II et al. Jun 2011 B1
7962467 Howard et al. Jun 2011 B2
7970679 Kasower Jun 2011 B2
7970698 Gupta et al. Jun 2011 B2
7970701 Lewis et al. Jun 2011 B2
7971246 Emigh et al. Jun 2011 B1
7975299 Balducci et al. Jul 2011 B1
7983976 Nafeh et al. Jul 2011 B2
7983979 Holland, IV Jul 2011 B2
7984849 Berghel et al. Jul 2011 B2
7988043 Davis Aug 2011 B2
7991201 Bous et al. Aug 2011 B2
7991689 Brunzell et al. Aug 2011 B1
7991716 Crooks et al. Aug 2011 B2
7995994 Khetawat et al. Aug 2011 B2
7996521 Chamberlain et al. Aug 2011 B2
8001034 Chung et al. Aug 2011 B2
8001042 Brunzell et al. Aug 2011 B1
8001153 Skurtovich, Jr. et al. Aug 2011 B2
8001597 Crooks Aug 2011 B2
8005749 Ginsberg Aug 2011 B2
8006291 Headley et al. Aug 2011 B2
8009873 Chapman Aug 2011 B2
8019678 Wright et al. Sep 2011 B2
8020763 Kowalchyk et al. Sep 2011 B1
8024263 Zarikian et al. Sep 2011 B2
8024271 Grant Sep 2011 B2
8027439 Zoldi et al. Sep 2011 B2
8027518 Baker et al. Sep 2011 B2
8027947 Hinsz et al. Sep 2011 B2
8028168 Smithies et al. Sep 2011 B2
8028326 Palmer et al. Sep 2011 B2
8028329 Whitcomb Sep 2011 B2
8028896 Carter et al. Oct 2011 B2
8032448 Anderson et al. Oct 2011 B2
8032449 Hu et al. Oct 2011 B2
8032927 Ross Oct 2011 B2
8037097 Guo et al. Oct 2011 B2
8037512 Wright et al. Oct 2011 B2
8041597 Li et al. Oct 2011 B2
8042159 Basner et al. Oct 2011 B2
8042193 Piliouras Oct 2011 B1
8049596 Sato Nov 2011 B2
8055667 Levy Nov 2011 B2
8056128 Dingle et al. Nov 2011 B1
8058972 Mohanty Nov 2011 B2
8060424 Kasower Nov 2011 B2
8060915 Voice et al. Nov 2011 B2
8060916 Bajaj et al. Nov 2011 B2
8065233 Lee et al. Nov 2011 B2
8065525 Zilberman Nov 2011 B2
8069053 Gervais et al. Nov 2011 B2
8069084 Mackouse Nov 2011 B2
8069256 Rasti Nov 2011 B2
8069485 Carter Nov 2011 B2
8078569 Kennel Dec 2011 B2
8090648 Zoldi et al. Jan 2012 B2
8104679 Brown Jan 2012 B2
8116731 Buhrmann et al. Feb 2012 B2
8121962 Vaiciulis et al. Feb 2012 B2
8131615 Diev et al. Mar 2012 B2
8151327 Eisen Apr 2012 B2
8195549 Kasower Jun 2012 B2
8201257 Andres et al. Jun 2012 B1
8204774 Chwast et al. Jun 2012 B2
8214262 Semprevivo et al. Jul 2012 B1
8214285 Hu et al. Jul 2012 B2
8224723 Bosch et al. Jul 2012 B2
8225395 Atwood et al. Jul 2012 B2
8239677 Colson Aug 2012 B2
8244629 Lewis et al. Aug 2012 B2
8260914 Ranjan Sep 2012 B1
8280805 Abrahams et al. Oct 2012 B1
8280833 Miltonberger Oct 2012 B2
8285613 Coulter Oct 2012 B1
8285636 Curry et al. Oct 2012 B2
8296225 Maddipati et al. Oct 2012 B2
8296229 Yellin et al. Oct 2012 B1
8296250 Crooks et al. Oct 2012 B2
8332338 Vaiciulis et al. Dec 2012 B2
8346593 Fanelli Jan 2013 B2
8355896 Kumar et al. Jan 2013 B2
8359278 Domenikos et al. Jan 2013 B2
8364588 Celka et al. Jan 2013 B2
8374973 Herbrich et al. Feb 2013 B2
8386377 Xiong et al. Feb 2013 B1
8429070 Hu et al. Apr 2013 B2
8468090 Lesandro et al. Jun 2013 B2
8489479 Slater et al. Jul 2013 B2
8510329 Balkir et al. Aug 2013 B2
8515844 Kasower Aug 2013 B2
8543499 Haggerty et al. Sep 2013 B2
8548137 Zoldi et al. Oct 2013 B2
8549590 de Villiers Prichard et al. Oct 2013 B1
8559607 Zoldi et al. Oct 2013 B2
8567669 Griegel et al. Oct 2013 B2
8578496 Krishnappa Nov 2013 B1
8630938 Cheng et al. Jan 2014 B2
8639920 Stack et al. Jan 2014 B2
8645301 Vaiciulis et al. Feb 2014 B2
8671115 Skurtovich, Jr. et al. Mar 2014 B2
8676726 Hore et al. Mar 2014 B2
8682755 Bucholz et al. Mar 2014 B2
8683586 Crooks Mar 2014 B2
8694427 Maddipati et al. Apr 2014 B2
8725613 Celka et al. May 2014 B1
8781953 Kasower Jul 2014 B2
8781975 Bennett et al. Jul 2014 B2
8793777 Colson Jul 2014 B2
8805836 Hore et al. Aug 2014 B2
8812387 Samler et al. Aug 2014 B1
8819793 Gottschalk, Jr. Aug 2014 B2
8824648 Zoldi et al. Sep 2014 B2
8826393 Eisen Sep 2014 B2
8862514 Eisen Oct 2014 B2
8862526 Miltonberger Oct 2014 B2
8918891 Coggeshall et al. Dec 2014 B2
8949981 Trollope et al. Feb 2015 B1
9191403 Zoldi et al. Nov 2015 B2
9194899 Zoldi et al. Nov 2015 B2
9196004 Eisen Nov 2015 B2
9235728 Gottschalk, Jr. et al. Jan 2016 B2
9251541 Celka et al. Feb 2016 B2
9256624 Skurtovich, Jr. et al. Feb 2016 B2
9280658 Coggeshall et al. Mar 2016 B2
9361597 Britton et al. Jun 2016 B2
9367520 Zhao et al. Jun 2016 B2
9390384 Eisen Jul 2016 B2
9412141 Prichard et al. Aug 2016 B2
9531738 Zoldi et al. Dec 2016 B2
9558368 Gottschalk, Jr. et al. Jan 2017 B2
9595066 Samler et al. Mar 2017 B2
9652802 Kasower May 2017 B1
9704195 Zoldi Jul 2017 B2
9710523 Skurtovich, Jr. et al. Jul 2017 B2
9710868 Gottschalk, Jr. et al. Jul 2017 B2
9754256 Britton et al. Sep 2017 B2
9754311 Eisen Sep 2017 B2
9773227 Zoldi et al. Sep 2017 B2
9953321 Zoldi et al. Apr 2018 B2
10043213 Straub et al. Aug 2018 B2
10089679 Eisen Oct 2018 B2
10089686 Straub et al. Oct 2018 B2
10102530 Zoldi et al. Oct 2018 B2
10115153 Zoldi et al. Oct 2018 B2
10152736 Yang et al. Dec 2018 B2
10217163 Straub et al. Feb 2019 B2
10242540 Chen et al. Mar 2019 B2
10339527 Coleman et al. Jul 2019 B1
10373061 Kennel et al. Aug 2019 B2
20010014868 Herz et al. Aug 2001 A1
20010014878 Mitra et al. Aug 2001 A1
20010027413 Bhutta Oct 2001 A1
20010029470 Schultz et al. Oct 2001 A1
20010034631 Kiselik Oct 2001 A1
20010039523 Iwamoto Nov 2001 A1
20020010684 Moskowitz Jan 2002 A1
20020013899 Faul Jan 2002 A1
20020019804 Sutton Feb 2002 A1
20020019938 Aarons Feb 2002 A1
20020032635 Harris et al. Mar 2002 A1
20020040344 Preiser et al. Apr 2002 A1
20020042879 Gould et al. Apr 2002 A1
20020052841 Guthrie et al. May 2002 A1
20020059521 Tasler May 2002 A1
20020062185 Runge et al. May 2002 A1
20020062281 Singhal May 2002 A1
20020073044 Singhal Jun 2002 A1
20020077178 Oberberger et al. Jun 2002 A1
20020077964 Brody et al. Jun 2002 A1
20020080256 Bates et al. Jun 2002 A1
20020087460 Hornung Jul 2002 A1
20020099649 Lee et al. Jul 2002 A1
20020119824 Allen Aug 2002 A1
20020130176 Suzuki Sep 2002 A1
20020138417 Lawrence Sep 2002 A1
20020138751 Dutta Sep 2002 A1
20020147695 Khedkar et al. Oct 2002 A1
20020156676 Ahrens et al. Oct 2002 A1
20020161664 Shaya et al. Oct 2002 A1
20020161711 Sartor et al. Oct 2002 A1
20020173994 Ferguson, III Nov 2002 A1
20020178112 Goeller et al. Nov 2002 A1
20020184509 Scheidt et al. Dec 2002 A1
20020188544 Wizon et al. Dec 2002 A1
20030004879 Demoff et al. Jan 2003 A1
20030009426 Ruiz-Sanchez Jan 2003 A1
20030018549 Fei et al. Jan 2003 A1
20030033261 Knegendorf Feb 2003 A1
20030046554 Leydier et al. Mar 2003 A1
20030048904 Wang et al. Mar 2003 A1
20030050882 Degen et al. Mar 2003 A1
20030057278 Wong Mar 2003 A1
20030061163 Duffield Mar 2003 A1
20030065563 Elliott et al. Apr 2003 A1
20030070101 Buscemi Apr 2003 A1
20030078877 Beirne et al. Apr 2003 A1
20030093366 Halper et al. May 2003 A1
20030097320 Gordon May 2003 A1
20030105696 Kalotay et al. Jun 2003 A1
20030115133 Bian Jun 2003 A1
20030143980 Choi et al. Jul 2003 A1
20030149744 Bierre et al. Aug 2003 A1
20030153299 Perfit et al. Aug 2003 A1
20030158751 Suresh et al. Aug 2003 A1
20030158960 Engberg Aug 2003 A1
20030182214 Taylor Sep 2003 A1
20030195859 Lawrence Oct 2003 A1
20030200447 Sjoblom Oct 2003 A1
20030208428 Raynes et al. Nov 2003 A1
20030222500 Bayeur et al. Dec 2003 A1
20030225656 Aberman et al. Dec 2003 A1
20030225692 Bosch et al. Dec 2003 A1
20030225742 Tenner et al. Dec 2003 A1
20030233278 Marshall Dec 2003 A1
20040004117 Suzuki Jan 2004 A1
20040005912 Hubbe et al. Jan 2004 A1
20040010698 Rolfe Jan 2004 A1
20040024709 Yu et al. Feb 2004 A1
20040026496 Zuili Feb 2004 A1
20040030649 Nelson et al. Feb 2004 A1
20040039586 Garvey et al. Feb 2004 A1
20040054619 Watson et al. Mar 2004 A1
20040059653 Verkuylen et al. Mar 2004 A1
20040064401 Palaghita et al. Apr 2004 A1
20040078324 Lonnberg et al. Apr 2004 A1
20040103147 Flesher et al. May 2004 A1
20040107363 Monteverde Jun 2004 A1
20040110119 Riconda et al. Jun 2004 A1
20040111305 Gavan et al. Jun 2004 A1
20040111335 Black et al. Jun 2004 A1
20040117235 Shacham Jun 2004 A1
20040128227 Whipple et al. Jul 2004 A1
20040128232 Descloux Jul 2004 A1
20040133440 Carolan et al. Jul 2004 A1
20040143526 Monasterio et al. Jul 2004 A1
20040149820 Zuili Aug 2004 A1
20040149827 Zuili Aug 2004 A1
20040153330 Miller et al. Aug 2004 A1
20040153656 Cluts et al. Aug 2004 A1
20040158520 Noh Aug 2004 A1
20040158523 Dort Aug 2004 A1
20040158723 Root Aug 2004 A1
20040167793 Masuoka et al. Aug 2004 A1
20040177046 Ogram Sep 2004 A1
20040193538 Raines Sep 2004 A1
20040199456 Flint et al. Oct 2004 A1
20040199462 Starrs Oct 2004 A1
20040204948 Singletary et al. Oct 2004 A1
20040225594 Nolan, III et al. Nov 2004 A1
20040230448 Schaich Nov 2004 A1
20040230527 Hansen et al. Nov 2004 A1
20040230538 Clifton et al. Nov 2004 A1
20040234117 Tibor Nov 2004 A1
20040243514 Wankmueller Dec 2004 A1
20040243518 Clifton et al. Dec 2004 A1
20040243567 Levy Dec 2004 A1
20040250085 Tattan et al. Dec 2004 A1
20040255127 Arnouse Dec 2004 A1
20040260922 Goodman et al. Dec 2004 A1
20050001028 Zuili Jan 2005 A1
20050005168 Dick Jan 2005 A1
20050010513 Duckworth et al. Jan 2005 A1
20050010780 Kane et al. Jan 2005 A1
20050021476 Candella et al. Jan 2005 A1
20050021519 Ghouri Jan 2005 A1
20050027983 Klawon Feb 2005 A1
20050038726 Salomon et al. Feb 2005 A1
20050038737 Norris Feb 2005 A1
20050050577 Westbrook et al. Mar 2005 A1
20050058262 Timmins et al. Mar 2005 A1
20050065950 Chaganti et al. Mar 2005 A1
20050071282 Lu et al. Mar 2005 A1
20050075985 Cartmell Apr 2005 A1
20050081052 Washington Apr 2005 A1
20050086161 Gallant Apr 2005 A1
20050091164 Varble Apr 2005 A1
20050097039 Kulcsar et al. May 2005 A1
20050097051 Madill, Jr. et al. May 2005 A1
20050097364 Edeki et al. May 2005 A1
20050102206 Savasoglu et al. May 2005 A1
20050105719 Huda May 2005 A1
20050125226 Magee Jun 2005 A1
20050125686 Brandt Jun 2005 A1
20050138391 Mandalia et al. Jun 2005 A1
20050144143 Freiberg Jun 2005 A1
20050154664 Guy et al. Jul 2005 A1
20050154665 Kerr Jul 2005 A1
20050154671 Doan et al. Jul 2005 A1
20050165667 Cox Jul 2005 A1
20050197953 Broadbent et al. Sep 2005 A1
20050203885 Chenevich et al. Sep 2005 A1
20050216953 Ellingson Sep 2005 A1
20050229007 Bolle et al. Oct 2005 A1
20050240578 Biederman et al. Oct 2005 A1
20050242173 Suzuki Nov 2005 A1
20050251474 Shinn et al. Nov 2005 A1
20050256809 Sadri Nov 2005 A1
20050262014 Fickes Nov 2005 A1
20050273333 Morin et al. Dec 2005 A1
20050278542 Pierson et al. Dec 2005 A1
20050279827 Mascavage et al. Dec 2005 A1
20050279869 Barklage Dec 2005 A1
20060004663 Singhal Jan 2006 A1
20060014129 Coleman et al. Jan 2006 A1
20060032909 Seegar Feb 2006 A1
20060041464 Powers et al. Feb 2006 A1
20060045105 Dobosz et al. Mar 2006 A1
20060047605 Ahmad Mar 2006 A1
20060059073 Walzak Mar 2006 A1
20060059110 Madhok et al. Mar 2006 A1
20060064374 Helsper et al. Mar 2006 A1
20060074798 Din et al. Apr 2006 A1
20060074986 Mallalieu et al. Apr 2006 A1
20060080230 Freiberg Apr 2006 A1
20060080263 Willis et al. Apr 2006 A1
20060089905 Song et al. Apr 2006 A1
20060101508 Taylor May 2006 A1
20060106605 Saunders et al. May 2006 A1
20060112279 Cohen et al. May 2006 A1
20060112280 Cohen et al. May 2006 A1
20060129428 Wennberg Jun 2006 A1
20060129481 Bhatt et al. Jun 2006 A1
20060129840 Milgramm et al. Jun 2006 A1
20060131390 Kim Jun 2006 A1
20060136332 Ziegler Jun 2006 A1
20060140460 Coutts Jun 2006 A1
20060143073 Engel et al. Jun 2006 A1
20060144924 Stover Jul 2006 A1
20060149580 Helsper et al. Jul 2006 A1
20060149674 Cook et al. Jul 2006 A1
20060161435 Atef et al. Jul 2006 A1
20060173776 Shalley et al. Aug 2006 A1
20060173792 Glass Aug 2006 A1
20060177226 Ellis, III Aug 2006 A1
20060178971 Owen et al. Aug 2006 A1
20060179004 Fuchs Aug 2006 A1
20060195351 Bayburtian Aug 2006 A1
20060200855 Willis Sep 2006 A1
20060202012 Grano et al. Sep 2006 A1
20060204051 Holland, IV Sep 2006 A1
20060206725 Milgramm et al. Sep 2006 A1
20060212386 Willey et al. Sep 2006 A1
20060218069 Aberman et al. Sep 2006 A1
20060229961 Lyftogt et al. Oct 2006 A1
20060239512 Petrillo Oct 2006 A1
20060239513 Song et al. Oct 2006 A1
20060242046 Haggerty et al. Oct 2006 A1
20060242047 Haggerty et al. Oct 2006 A1
20060253358 Delgrosso et al. Nov 2006 A1
20060253583 Dixon et al. Nov 2006 A1
20060255914 Westman Nov 2006 A1
20060262929 Vatanen et al. Nov 2006 A1
20060265243 Racho et al. Nov 2006 A1
20060271456 Romain et al. Nov 2006 A1
20060271457 Romain et al. Nov 2006 A1
20060271633 Adler Nov 2006 A1
20060273158 Suzuki Dec 2006 A1
20060277043 Tomes et al. Dec 2006 A1
20060282285 Helsper et al. Dec 2006 A1
20060282372 Endres et al. Dec 2006 A1
20060282395 Leibowitz Dec 2006 A1
20060287765 Kraft Dec 2006 A1
20060288090 Kraft Dec 2006 A1
20060294023 Lu Dec 2006 A1
20070005508 Chiang Jan 2007 A1
20070011100 Libin et al. Jan 2007 A1
20070016500 Chatterji et al. Jan 2007 A1
20070016521 Wang Jan 2007 A1
20070016522 Wang Jan 2007 A1
20070022141 Singleton et al. Jan 2007 A1
20070038483 Wood Feb 2007 A1
20070038568 Greene et al. Feb 2007 A1
20070040017 Kozlay Feb 2007 A1
20070040019 Berghel et al. Feb 2007 A1
20070043577 Kasower Feb 2007 A1
20070047770 Swope et al. Mar 2007 A1
20070048765 Abramson Mar 2007 A1
20070050638 Rasti Mar 2007 A1
20070059442 Sabeta Mar 2007 A1
20070061273 Greene et al. Mar 2007 A1
20070067207 Haggerty et al. Mar 2007 A1
20070067297 Kublickis Mar 2007 A1
20070072190 Aggarwal Mar 2007 A1
20070073622 Kane Mar 2007 A1
20070073630 Greene et al. Mar 2007 A1
20070078786 Bous et al. Apr 2007 A1
20070078908 Rohatgi et al. Apr 2007 A1
20070078985 Shao et al. Apr 2007 A1
20070083460 Bachenheimer Apr 2007 A1
20070087795 Aletto et al. Apr 2007 A1
20070093234 Willis et al. Apr 2007 A1
20070094137 Phillips et al. Apr 2007 A1
20070094264 Nair Apr 2007 A1
20070100774 Abdon May 2007 A1
20070106517 Cluff et al. May 2007 A1
20070106582 Baker et al. May 2007 A1
20070106611 Larsen May 2007 A1
20070107050 Selvarajan May 2007 A1
20070109103 Jedrey et al. May 2007 A1
20070110282 Millsapp May 2007 A1
20070112667 Rucker May 2007 A1
20070112668 Celano et al. May 2007 A1
20070118393 Rosen et al. May 2007 A1
20070155411 Morrison Jul 2007 A1
20070157299 Hare Jul 2007 A1
20070168246 Haggerty et al. Jul 2007 A1
20070168480 Biggs et al. Jul 2007 A1
20070174208 Black et al. Jul 2007 A1
20070179903 Seinfeld et al. Aug 2007 A1
20070180209 Tallman Aug 2007 A1
20070180263 Delgrosso et al. Aug 2007 A1
20070186276 McRae et al. Aug 2007 A1
20070192248 West Aug 2007 A1
20070192853 Shraim et al. Aug 2007 A1
20070198410 Labgold et al. Aug 2007 A1
20070205266 Carr et al. Sep 2007 A1
20070208669 Rivette et al. Sep 2007 A1
20070214037 Shubert et al. Sep 2007 A1
20070214365 Cornett et al. Sep 2007 A1
20070219928 Madhogarhia Sep 2007 A1
20070220594 Tulsyan Sep 2007 A1
20070226093 Chan et al. Sep 2007 A1
20070226129 Liao et al. Sep 2007 A1
20070233614 McNelley et al. Oct 2007 A1
20070234427 Gardner et al. Oct 2007 A1
20070244782 Chimento Oct 2007 A1
20070244807 Andringa et al. Oct 2007 A1
20070250704 Hallam-Baker Oct 2007 A1
20070250920 Lindsay Oct 2007 A1
20070266439 Kraft Nov 2007 A1
20070282730 Carpenter et al. Dec 2007 A1
20070288355 Roland et al. Dec 2007 A1
20070288360 Seeklus Dec 2007 A1
20070288559 Parsadayan Dec 2007 A1
20070291995 Rivera Dec 2007 A1
20070292006 Johnson Dec 2007 A1
20070294104 Boaz et al. Dec 2007 A1
20070299759 Kelly Dec 2007 A1
20080010203 Grant Jan 2008 A1
20080010683 Baddour et al. Jan 2008 A1
20080010687 Gonen et al. Jan 2008 A1
20080015887 Drabek et al. Jan 2008 A1
20080021804 Deckoff Jan 2008 A1
20080027857 Benson Jan 2008 A1
20080027858 Benson Jan 2008 A1
20080052182 Marshall Feb 2008 A1
20080059236 Cartier Mar 2008 A1
20080059352 Chandran Mar 2008 A1
20080059364 Tidwell et al. Mar 2008 A1
20080059366 Fou Mar 2008 A1
20080063172 Ahuja et al. Mar 2008 A1
20080066188 Kwak Mar 2008 A1
20080071882 Hering et al. Mar 2008 A1
20080076386 Khetawat et al. Mar 2008 A1
20080077526 Arumugam Mar 2008 A1
20080098222 Zilberman Apr 2008 A1
20080103798 Domenikos et al. May 2008 A1
20080103799 Domenikos et al. May 2008 A1
20080103800 Domenikos et al. May 2008 A1
20080103811 Sosa May 2008 A1
20080103972 Lanc May 2008 A1
20080104021 Cai et al. May 2008 A1
20080104672 Lunde et al. May 2008 A1
20080109444 Williams et al. May 2008 A1
20080114837 Biggs et al. May 2008 A1
20080120237 Lin May 2008 A1
20080126116 Singhai May 2008 A1
20080126233 Hogan May 2008 A1
20080147454 Walker et al. Jun 2008 A1
20080154758 Schattmaier et al. Jun 2008 A1
20080162383 Kraft Jul 2008 A1
20080167883 Thavildar Khazaneh Jul 2008 A1
20080175360 Schwarz et al. Jul 2008 A1
20080177655 Zalik Jul 2008 A1
20080177841 Sinn et al. Jul 2008 A1
20080189789 Lamontagne Aug 2008 A1
20080208548 Metzger et al. Aug 2008 A1
20080208610 Thomas et al. Aug 2008 A1
20080208726 Tsantes et al. Aug 2008 A1
20080217400 Portano Sep 2008 A1
20080228635 Megdal et al. Sep 2008 A1
20080243680 Megdal et al. Oct 2008 A1
20080244717 Jelatis et al. Oct 2008 A1
20080255922 Feldman et al. Oct 2008 A1
20080255992 Lin Oct 2008 A1
20080256613 Grover Oct 2008 A1
20080281737 Fajardo Nov 2008 A1
20080281743 Pettit Nov 2008 A1
20080288382 Smith et al. Nov 2008 A1
20080288430 Friedlander et al. Nov 2008 A1
20080288790 Wilson Nov 2008 A1
20080294540 Celka et al. Nov 2008 A1
20080294689 Metzger et al. Nov 2008 A1
20080296367 Parkinson Dec 2008 A1
20080296382 Connell, II et al. Dec 2008 A1
20080300877 Gilbert et al. Dec 2008 A1
20080319889 Hammad Dec 2008 A1
20090007220 Ormazabal et al. Jan 2009 A1
20090018934 Peng et al. Jan 2009 A1
20090021349 Errico et al. Jan 2009 A1
20090024417 Marks et al. Jan 2009 A1
20090024505 Patel et al. Jan 2009 A1
20090024636 Shiloh Jan 2009 A1
20090024663 McGovern Jan 2009 A1
20090026270 Connell, II et al. Jan 2009 A1
20090043637 Eder Feb 2009 A1
20090044279 Crawford et al. Feb 2009 A1
20090048957 Celano Feb 2009 A1
20090079539 Johnson Mar 2009 A1
20090094311 Awadallah et al. Apr 2009 A1
20090099960 Robida et al. Apr 2009 A1
20090106153 Ezra Apr 2009 A1
20090106846 Dupray et al. Apr 2009 A1
20090112650 Iwane Apr 2009 A1
20090119106 Rajakumar et al. May 2009 A1
20090119299 Rhodes May 2009 A1
20090125369 Kloostra et al. May 2009 A1
20090125439 Zarikian et al. May 2009 A1
20090125463 Hido May 2009 A1
20090138391 Dudley et al. May 2009 A1
20090141318 Hughes Jun 2009 A1
20090151005 Bell et al. Jun 2009 A1
20090158404 Hahn et al. Jun 2009 A1
20090164380 Brown Jun 2009 A1
20090172815 Gu et al. Jul 2009 A1
20090182653 Zimiles Jul 2009 A1
20090199264 Lang Aug 2009 A1
20090205032 Hinton et al. Aug 2009 A1
20090206993 Di Mambro et al. Aug 2009 A1
20090216560 Siegel Aug 2009 A1
20090222308 Zoldi et al. Sep 2009 A1
20090222362 Stood et al. Sep 2009 A1
20090222373 Choudhuri et al. Sep 2009 A1
20090222374 Choudhuri et al. Sep 2009 A1
20090222375 Choudhuri et al. Sep 2009 A1
20090222376 Choudhuri et al. Sep 2009 A1
20090222377 Choudhuri et al. Sep 2009 A1
20090222378 Choudhuri et al. Sep 2009 A1
20090222379 Choudhuri et al. Sep 2009 A1
20090222380 Choudhuri et al. Sep 2009 A1
20090222897 Carow et al. Sep 2009 A1
20090224875 Rabinowitz et al. Sep 2009 A1
20090224889 Aggarwal et al. Sep 2009 A1
20090226056 Vlachos et al. Sep 2009 A1
20090240609 Cho et al. Sep 2009 A1
20090241168 Readshaw Sep 2009 A1
20090241173 Troyansky Sep 2009 A1
20090248198 Siegel et al. Oct 2009 A1
20090248497 Hueter Oct 2009 A1
20090248567 Haggerty et al. Oct 2009 A1
20090248568 Haggerty et al. Oct 2009 A1
20090248569 Haggerty et al. Oct 2009 A1
20090248570 Haggerty et al. Oct 2009 A1
20090248571 Haggerty et al. Oct 2009 A1
20090248572 Haggerty et al. Oct 2009 A1
20090248573 Haggerty et al. Oct 2009 A1
20090254476 Sharma et al. Oct 2009 A1
20090254484 Forero et al. Oct 2009 A1
20090257595 de Cesare et al. Oct 2009 A1
20090259470 Chang Oct 2009 A1
20090259560 Bachenheimer Oct 2009 A1
20090259588 Lindsay Oct 2009 A1
20090259855 de Cesare et al. Oct 2009 A1
20090261189 Ellis, Jr. Oct 2009 A1
20090270126 Liu Oct 2009 A1
20090271265 Lay et al. Oct 2009 A1
20090271617 Song et al. Oct 2009 A1
20090272801 Connell, II et al. Nov 2009 A1
20090276244 Baldwin, Jr. et al. Nov 2009 A1
20090281945 Shakkarwar Nov 2009 A1
20090281951 Shakkarwar Nov 2009 A1
20090289110 Regen et al. Nov 2009 A1
20090300066 Guo et al. Dec 2009 A1
20090307778 Mardikar Dec 2009 A1
20090326972 Washington Dec 2009 A1
20090328173 Jakobson et al. Dec 2009 A1
20100024037 Grzymala-Busse et al. Jan 2010 A1
20100030677 Melik-Aslanian et al. Feb 2010 A1
20100031030 Kao et al. Feb 2010 A1
20100037147 Champion et al. Feb 2010 A1
20100037308 Lin et al. Feb 2010 A1
20100042526 Martinov Feb 2010 A1
20100043055 Baumgart Feb 2010 A1
20100070620 Awadallah et al. Mar 2010 A1
20100077006 El Emam et al. Mar 2010 A1
20100085146 Johnson Apr 2010 A1
20100088233 Tattan et al. Apr 2010 A1
20100088338 Pavoni, Jr. et al. Apr 2010 A1
20100094664 Bush et al. Apr 2010 A1
20100094767 Miltonberger Apr 2010 A1
20100094768 Miltonberger Apr 2010 A1
20100094910 Bayliss Apr 2010 A1
20100095357 Willis et al. Apr 2010 A1
20100100406 Lim Apr 2010 A1
20100100945 Ozzie et al. Apr 2010 A1
20100107225 Spencer et al. Apr 2010 A1
20100114724 Ghosh et al. May 2010 A1
20100114744 Gonen May 2010 A1
20100121767 Coulter et al. May 2010 A1
20100130172 Vendrow et al. May 2010 A1
20100131273 Aley-Raz et al. May 2010 A1
20100132043 Bjorn et al. May 2010 A1
20100145836 Baker et al. Jun 2010 A1
20100158207 Dhawan et al. Jun 2010 A1
20100169210 Bous et al. Jul 2010 A1
20100169947 Sarmah et al. Jul 2010 A1
20100188684 Kumara Jul 2010 A1
20100205662 Ibrahim et al. Aug 2010 A1
20100217837 Ansari et al. Aug 2010 A1
20100218255 Ritman et al. Aug 2010 A1
20100228649 Pettitt Sep 2010 A1
20100228657 Kagarlis Sep 2010 A1
20100229225 Sarmah et al. Sep 2010 A1
20100229230 Edeki et al. Sep 2010 A1
20100229245 Singhal Sep 2010 A1
20100241501 Marshall Sep 2010 A1
20100250364 Song et al. Sep 2010 A1
20100250411 Ogrodski Sep 2010 A1
20100250509 Andersen Sep 2010 A1
20100250955 Trevithick et al. Sep 2010 A1
20100268557 Faith et al. Oct 2010 A1
20100274679 Hammad Oct 2010 A1
20100275265 Fiske et al. Oct 2010 A1
20100293090 Domenikos et al. Nov 2010 A1
20100293114 Khan et al. Nov 2010 A1
20100302157 Zilberman Dec 2010 A1
20100306101 Lefner et al. Dec 2010 A1
20100313273 Freas Dec 2010 A1
20100325035 Hilgers et al. Dec 2010 A1
20100325442 Petrone et al. Dec 2010 A1
20100332292 Anderson Dec 2010 A1
20100332362 Ramsey et al. Dec 2010 A1
20110004498 Readshaw Jan 2011 A1
20110016042 Cho et al. Jan 2011 A1
20110040983 Grzymala-Busse et al. Feb 2011 A1
20110047071 Choudhuri et al. Feb 2011 A1
20110066547 Clark et al. Mar 2011 A1
20110082768 Eisen Apr 2011 A1
20110093383 Haggerty et al. Apr 2011 A1
20110112958 Haggerty et al. May 2011 A1
20110119291 Rice May 2011 A1
20110126024 Beatson et al. May 2011 A1
20110126275 Anderson et al. May 2011 A1
20110145899 Cao et al. Jun 2011 A1
20110166988 Coulter Jul 2011 A1
20110184838 Winters et al. Jul 2011 A1
20110184851 Megdal et al. Jul 2011 A1
20110196791 Dominguez Aug 2011 A1
20110238566 Santos Sep 2011 A1
20110260832 Ross et al. Oct 2011 A1
20110276496 Neville et al. Nov 2011 A1
20110282778 Wright et al. Nov 2011 A1
20110289032 Crooks et al. Nov 2011 A1
20110289322 Rasti Nov 2011 A1
20110295721 MacDonald Dec 2011 A1
20110295750 Rammal Dec 2011 A1
20110296529 Bhanoo et al. Dec 2011 A1
20110302412 Deng et al. Dec 2011 A1
20110302641 Hald et al. Dec 2011 A1
20120030080 Slater et al. Feb 2012 A1
20120030083 Newman Feb 2012 A1
20120030771 Pierson et al. Feb 2012 A1
20120066073 Dilip et al. Mar 2012 A1
20120101939 Kasower Apr 2012 A1
20120158574 Brunzell et al. Jun 2012 A1
20120158654 Behren et al. Jun 2012 A1
20120198556 Patel et al. Aug 2012 A1
20120215682 Lent et al. Aug 2012 A1
20120278227 Kolo et al. Nov 2012 A1
20120290660 Rao et al. Nov 2012 A1
20130004033 Trugenberger et al. Jan 2013 A1
20130185293 Boback Jul 2013 A1
20130218797 Prichard et al. Aug 2013 A1
20140007238 Magee et al. Jan 2014 A1
20140058910 Abeles Feb 2014 A1
20140149304 Bucholz et al. May 2014 A1
20150186901 Miltonberger Jul 2015 A1
20150199784 Straub et al. Jul 2015 A1
20150295924 Gottschalk, Jr. Oct 2015 A1
20160012561 Lappenbusch Jan 2016 A1
20160063645 Houseworth et al. Mar 2016 A1
20160071208 Straub et al. Mar 2016 A1
20160086262 Straub et al. Mar 2016 A1
20160328814 Prichard et al. Nov 2016 A1
20160344758 Cohen et al. Nov 2016 A1
20170053369 Gottschalk, Jr. et al. Feb 2017 A1
20170099314 Klatt et al. Apr 2017 A1
20170278182 Kasower Sep 2017 A1
20170287065 Samler et al. Oct 2017 A1
20170374076 Pierson et al. Dec 2017 A1
20180101890 Eisen Apr 2018 A1
20180130157 Gottschalk, Jr. et al. May 2018 A1
20180322572 Straub et al. Nov 2018 A1
Foreign Referenced Citations (31)
Number Date Country
91 08 341 Oct 1991 DE
0 554 083 Aug 1993 EP
2 392 748 Mar 2004 GB
10-2004-0034063 Apr 2004 KR
256569 Jun 2006 TW
WO 94006103 Mar 1994 WO
WO 96041488 Dec 1996 WO
WO 00055778 Sep 2000 WO
WO 00055789 Sep 2000 WO
WO 00055790 Sep 2000 WO
WO 01011522 Feb 2001 WO
WO 02027610 Apr 2002 WO
WO 02097563 Dec 2002 WO
WO 03071388 Aug 2003 WO
WO 02037219 May 2004 WO
WO 2004046882 Jun 2004 WO
WO 2006069199 Jun 2006 WO
WO 2007106393 Sep 2007 WO
WO 2008054403 May 2008 WO
WO 2008054849 May 2008 WO
WO 2008147918 Dec 2008 WO
WO 2009062111 May 2009 WO
WO 2009117518 Sep 2009 WO
WO 2011044036 Apr 2011 WO
WO 2012054646 Apr 2012 WO
WO 2012112781 Aug 2012 WO
WO 2013026343 Feb 2013 WO
WO 2013126281 Aug 2013 WO
WO 2014008079 Jan 2014 WO
WO 2014008247 Jan 2014 WO
WO 2014150987 Sep 2014 WO
Non-Patent Literature Citations (102)
Entry
Extended European Search Report for Application No. EP18207755, dated Dec. 13, 2018.
U.S. Appl. No. 12/705,49, filed Feb. 12, 2010, Bargoli et al.
U.S. Appl. No. 12/705,511, filed Feb. 12, 2010, Bargoli et al.
U.S. Appl. No. 09/557,252, filed Apr. 24, 2000, Page.
“A New Approach to Fraud Solutions”, BasePoint Science Solving Fraud, pp. 8, 2006.
Aad et al., “NRC Data Collection and the Privacy by Design Principles”, IEEE, Nov. 2010, pp. 5.
“Arizona Company Has Found Key in Stopping ID Theft,” PR Newswire, New York, Aug. 10, 2005 http://proquest.uml.com/pqdweb?did=880104711&sid=1&Fmt=3&clientId=19649&ROT=309&Vname=PQD.
ABC News Now: Money Matters, as broadcasted Nov. 15, 2005 with guest Todd Davis (CEO of Lifelock), pp. 6.
Anonymous, “Feedback”, Credit Management, ABI/INFORM Global, Sep. 2006, pp. 6.
“Beverly Hills Man Convicted of Operating ‘Bust-Out’ Schemes that Caused More than $8 Million in Losses”, Department of Justice, Jul. 25, 2006, 2 Pgs.
Bielski, Lauren, “Will you Spend to Thwart ID Theft?” ABA Banking Journal, Apr. 2005, pp. 54, 56-57, 60.
BlueCava, “What We Do”, http://www.bluecava.com/what-we-do/, printed Nov. 5, 2012 in 3 pages.
“Bust-Out Schemes”, Visual Analytics Inc. Technical Product Support, Newsletter vol. 4, Issue 1, Jan. 2005, pp. 7.
Chores & Allowances, “Do Kids Have Credit Reports?” Oct. 15, 2007, http://choresandallowances.blogspot.com/2007/10/do-kids-have-credit-reports.html, pp. 5.
Cowie, Norman, “Warning Bells & ‘The Bust-Out’”, Business Credit, Jul. 1, 2000, pp. 5.
Cullen, Terri; “The Wall Street Journal Complete Identity Theft Guidebook:How to Protect Yourself from the Most Pervasive Crime in America”; Chapter 3, pp. 59-79; Jul. 10, 2007.
“Data Loss Prevention (DLP) Software”, http://www.symantec.com/data-loss-prevention/ printed Apr. 8, 2013 in 8 pages.
“Data Protection”, http://compliantprocessing.com/data-protection/ printed Apr. 8, 2013 in 4 pages.
Day, Jo and Kevin; “ID-ology: A Planner's Guide to Identity Theft”; Journal of Financial Planning:Tech Talk; pp. 36-38; Sep. 2004.
EFunds Corporation, “Data & Decisioning: Debit Report” printed Apr. 1, 2007, http://www.efunds.com/web/industry-solutions/financial-services/frm-debit-report/htm in 1 page.
Equifax; “Equifax Credit Watch”; https://www.econsumer.equifax.co.uk/consumer/uk/sitepage.ehtml, dated Jun. 27, 2007 on www.archive.org.
Experian Team, “Impact on Credit Scores of Inquiries for an Auto Loan,” Ask Experian, Mar. 1, 2009, pp. 5.
“Fair Isaac Introduces Falcon One System to Combat Fraud at Every Customer Interaction”, Business Wire, May 5, 2005, pp. 3.
“Fair Isaac Offers New Fraud Tool”, National Mortgage News & Source Media, Inc., Jun. 13, 2005, pp. 2.
FamilySecure.com, “Frequently Asked Questions”, http://www.familsecure.com/FAQ.aspx as archived Jul. 15, 2007 in 3 pages.
FamilySecure.com; “Identity Theft Protection for the Whole Family | FamilySecure.com” http://www.familysecure.com/, as retrieved on Nov. 5, 2009.
“Fighting the New Face of Fraud”, FinanceTech, http://www.financetech.com/showArticle.jhtml?articleID=167100405, Aug. 2, 2005.
“FinExtra, Basepoint Analytics Introduces Predictive Technology for Mortgage Fraud”, Oct. 5, 2005, pp. 3.
Fisher, Joseph, “Access to Fair Credit Reports: Current Practices and Proposed Legislation,” American Business Law Journal, Fall 1981, vol. 19, No. 3, p. 319.
“Fraud Alert | Learn How”. Fight Identity Theft. http://www.fightidentitytheft.com/flag.html, accessed on Nov. 5, 2009.
Gibbs, Adrienne; “Protecting Your Children from Identity Theft,” Nov. 25, 2008, http://www.creditcards.com/credit-card-news/identity-ID-theft-and-kids-children-1282.php, pp. 4.
“GLBA Compliance and FFIEC Compliance” http://www.trustwave.com/financial-services.php printed Apr. 8, 2013 in 1 page.
Gordon et al., “Identity Fraud: A Critical National and Global Threat,” LexisNexis, Oct. 28, 2003, pp. 1-48.
Haglund, Christoffer, “Two-Factor Authentication With a Mobile Phone”, Fox Technologies, Uppsala, Department of Information Technology, Nov. 2, 2007, pp. 62.
Herzberg, Amir, “Payments and Banking with Mobile Personal Devices,” Communications of the ACM, May 2003, vol. 46, No. 5, pp. 53-58.
“ID Analytics ID Network”, from www.idanalytics.com, as retrieved from www.archive.org, dated Nov. 20, 2005 or earlier; attached as “ID Network (IDNb)”, pp. 8.
ID Cops, www.idcops.com; retrieved from www.archive.org any linkage Feb. 16, 2007.
ID Theft Assist, “Do You Know Where Your Child's Credit Is?”, Nov. 26, 2007, http://www.idtheftassist.com/pages/story14, pp. 3.
“ID Thieves These Days Want Your Number, Not Your Name”, The Columbus Dispatch, Columbus, Ohio, http://www.dispatch.com/content/stories/business/2014/08/03/id-thieves-these-days-want-your-number-not-your-name.html, Aug. 3, 2014 in 2 pages.
Identity Theft Resource Center; Fact Sheet 120 A'To Order a Credit Report for a Child; Fact Sheets, Victim Resources; Apr. 30, 2007.
“Identity Thieves Beware: Lifelock Introduces Nation's First Guaranteed Proactive Solution to Identity Theft Protection,” PR Newswire, New York, Jun. 13, 2005 http://proquest.umi.com/pqdweb?did=852869731&sid=1&Fmt=3&clientId=19649&RQT=309&Vname=POD.
“Industry News, New Technology Identifies Mortgage Fraud: Basepoint Analytics Launches FraudMark”, Inman News, American Land Title Association, Oct. 5, 2005, pp. 1.
Information Brokers of America, “Information Brokers of America Child Identity Theft Protection” http://web.archive.org/web/20080706135451/http://iboainfo.com/child-order.html as archived Jul. 6, 2008 in 1 page.
Information Brokers of America, “Safeguard Your Child's Credit”, http://web.archive.org/web/20071215210406/http://www.iboainfo.com/child-id-protect.html as archived Dec. 15, 2007 in 1 page.
“Intersections, Inc. Identity Guard”, from www.intersections.com and www.identityguard.com, as retrieved from Internet Archive, dated Nov. 25, 2005 or earlier; attached as “Identity Guard (IDG)”, pp. 7.
Iovation, Device Identification & Device Fingerprinting, http://www.iovation.com/risk-management/device-identification printed Nov. 5, 2012 in 6 pages.
Jacob et al., A Case Study of Checking Account Inquiries and Closures in Chicago, The Center for Financial Services Innovation, Nov. 2006.
Karlan et al., “Observing Unobservables:Identifying Information Asymmetries with a Consumer Credit Field Experiment”, Jun. 17, 2006, pp. 58, http://aida.econ.vale.edu/karlan/papers/ObservingUnobservables.KarlanZinman.pdf.
Khan, Muhammad Khurram, PhD., “An Efficient and Secure Remote Mutual Authentication Scheme with Smart Cards” IEEE International Symposium on Biometrics & Security Technologies (ISBAST), Apr. 23-24, 2008, pp. 1-6.
Lamons, Bob, “Be Smart: Offer Inquiry Qualification Services,” Marketing News, ABI/Inform Global, Nov. 6, 1995, vol. 29, No. 23, pp. 13.
Lee, Timothy B., “How America's Broken Tax System Makes Identity Theft Easy”, http://www.vox.com/2014/4/14/5608072/how-americas-broken-tax-system-makes-identity-theft-easy, Apr. 14, 2014, pp. 10.
Lee, W.A.; “Experian, on Deal Hunt, Nets Identity Theft Insurer”, American Banker: The Financial Services Daily, Jun. 4, 2003, New York, NY, 1 page.
Lefebvre et al., “A Robust Soft Hash Algorithm for Digital Image Signature”, International Conference on Image Processing 2:11 (ICIP), vol. 3, Oct. 2003, pp. 495-498.
LifeLock, “How LifeLock Works,” http://www.lifelock.com/lifelock-for-people printed Mar. 14, 2008 in 1 page.
LifeLock, “LifeLock Launches First ID Theft Prevention Program for the Protection of Children,” Press Release, Oct. 14, 2005, http://www.lifelock.com/about-us/press-room/2005-press-releases/lifelock-protection-for-children.
LifeLock; “How Can LifeLock Protect My Kids and Family?” http://www.lifelock.com/lifelock-for-people/how-we-do-it/how-can-lifelock-protect-my-kids-and-family printed Mar. 14, 2008 in 1 page.
LifeLock, “Personal Identity Theft Protection & Identity Theft Products,” http://www.lifelock.com/lifelock-for-people, accessed Nov. 5, 2007.
LifeLock, Various Pages, www.lifelock.com/, 2007.
My Call Credit http://www.mycallcredit.com/products.asp?product=ALR dated Dec. 10, 2005 on www.archive.org.
My Call Credit http://www.mycredit.com/rewrite.asp?display=faq dated Dec. 10, 2005 on www.archive.org.
MyReceipts, http://www.myreceipts.com/, printed Oct. 16, 2012 in 1 page.
MyReceipts—How it Works, http://www.myreceipts.com/howItWorks.do, printed Oct. 16, 2012 in 1 page.
National Alert Registry Launches RegisteredOffendersList.org to Provide Information on Registered Sex Offenders, May 16, 2005, pp. 2, http://www.prweb.com/printer/240437.htm accessed on Oct. 18, 2011.
National Alert Registry Offers Free Child Safety “Safe From Harm DVD and Child Identification Kit”, Oct. 24, 2006. pp. 2, http://www.prleap.com/pr/53170 accessed on Oct. 18, 2011.
National Alert Registry website titled, “Does a sexual offender live in your neighborhood”, Oct. 22, 2006, pp. 2, http://web.archive.org/wb/20061022204835/http://www.nationallertregistry.com/ accessed on Oct. 13, 2011.
Ogg, Erica, “Apple Cracks Down on UDID Use”, http://gigaom.com/apple/apple-cracks-down-on-udid-use/ printed Nov. 5, 2012 in 5 Pages.
Organizing Maniac's Blog—Online Receipts Provided by MyQuickReceipts.com, http://organizingmaniacs.wordpress.com/2011/01/12/online-receipts-provided-by-myquickreceipts.com/ dated Jan. 12, 2011 printed Oct. 16, 2012 in 3 pages.
Pagano, et al., “Information Sharing in Credit Markets,” Dec. 1993, The Journal of Finance, vol. 48, No. 5, pp. 1693-1718.
Partnoy, Frank, Rethinking Regulation of Credit Rating Agencies: An Institutional Investor Perspective, Council of Institutional Investors, Apr. 2009, pp. 21.
Planet Receipt—Home, http://www.planetreceipt.com/home printed Oct. 16, 2012 in 1 page.
Planet Receipt—Solutions & Features, http://www.planetreceipt.com/solutions-features printed Oct. 16, 2012 in 2 pages.
Press Release—“Helping Families Protect Against Identity Theft—Experian Announces FamilySecure.com; Parents and guardians are alerted for signs of potential identity theft for them and their children; product features an industry-leading $2 million guarantee”; PR Newswire; Irvine, CA; Oct. 1, 2007.
Privacy Rights Clearinghouse, “Identity Theft: What to do if it Happens to You,” http://web.archive.org/web/19990218180542/http://privacyrights.org/fs/fs17a.htm printed Feb. 18, 1999.
Quinn, Tom, “Low Credit Inquiries Affect Your Credit Score”, Credit.com, May 2, 2011, pp. 2.
Rivera, Barbara, “New Tools for Combating Income Tax Refund Fraud”, https://gcn.com/Articles/2014/05/08/Insight-tax-fraud-tools.aspx?Page=1, May 8, 2014, pp. 3.
Scholastic Inc.:Parent's Request for Information http://web.archive.org/web/20070210091055/http://www.scholastic.com/inforequest/index.htm as archived Feb. 10, 2007 in 1 page.
Scholastic Inc.:Privacy Policy http://web.archive.org/web/20070127214753/http://www.scholastic.com/privacy.htm as archived Jan. 27, 2007 in 3 pages.
ShoeBoxed, https://www.shoeboxed.com/sbx-home/ printed Oct. 16, 2012 in 4 pages.
Singletary, Michelle, “The Littlest Victims of ID Theft”, The Washington Post, The Color of Money, Oct. 4, 2007.
Sumner, Anthony, “Tackling the Issue of Bust-Out Fraud”, Retail Banker International, Jul. 24, 2007, pp. 4.
Sumner, Anthony, “Tackling the Issue of Bust-Out Fraud”, Experian: Decision Analytics, Dec. 18, 2007, pp. 24.
Sumner, Anthony, “Tackling the Issue of Bust-Out Fraud”, e-News, Experian: Decision Analytics, pp. 4, [Originally Published in Retail Banker International Magazine Jul. 24, 2007].
TheMorningCall.Com, “Cheap Ways to Foil Identity Theft,” www.mcail.com/business/columnists/all-karo.5920748iul01.0..., published Jul. 1, 2007.
“TransUnion—Child Identity Theft Inquiry”, TransUnion, http://www.transunion.com/corporate/personal/fraudIdentityTheft/fraudPrevention/childIDInquiry.page as printed Nov. 5, 2009 in 4 pages.
Truston, “Checking if your Child is an ID Theft Victim can be Stressful,” as posted by Michelle Pastor on Jan. 22, 2007 at http://www.mytruston.com/blog/credit/checking_if_your_child_is_an_id_theft_vi.html.
Vamosi, Robert, “How to Handle ID Fraud's Youngest Victims,” Nov. 21, 2008, http://news.cnet.com/8301-10789_3-10105303-57.html.
Webpage printed out from http://www.jpmorgan.com/cm/ContentServer?c=TS_Content&pagename=jpmorgan%2Fts%2FTS_Content%2FGeneral&cid=1139403950394 on Mar. 20, 2008, Feb. 13, 2006, New York, NY.
Wilson, Andrea, “Escaping the Alcatraz of Collections and Charge Offs”, http://www.transactionworld.net/articles/2003/october/riskMgrnt1.asp, Oct. 2003.
International Search Report and Written Opinion for Application No. PCT/US2007/06070, dated Nov. 10, 2008.
International Search Report and Written Opinion for Application No. PCT/US2008/064594, dated Oct. 30, 2008.
International Preliminary Report and Written Opinion in PCT/US2008/064594, dated Dec. 10, 2009.
International Search Report and Written Opinion for Application No. PCT/US09/37565, dated May 12, 2009.
Official Communication in Australian Patent Application No. 2012217565, dated May 12, 2017.
Official Communication in Canadian Patent Application No. 2,827,478, dated Jun. 29, 2017.
Official Communication in Canadian Patent Application No. 2,827,478, dated May 31, 2018.
Extended European Search Report for Application No. EP12747205, dated Sep. 25, 2014.
Supplementary European Search Report for Application No. EP12747205, dated Jun. 19, 2015.
International Search Report and Written Opinion for Application No. PCT/US2012/025456, dated May 21, 2012.
International Preliminary Report on Patentability in Application No. PCT/US2012/025456, dated Aug. 21, 2013.
International Search Report and Written Opinion for Application No. PCT/US2011/033940, dated Aug. 22, 2011.
Official Communication in Australian Patent Application No. 2017203586, dated Jun. 18, 2019.
Official Communication in Canadian Patent Application No. 2,827,478, dated Mar. 27, 2019.
Provisional Applications (1)
Number Date Country
62565014 Sep 2017 US