# US 11,907,400 B2 · Methods and systems for leveraging existing user data to verify user credentials

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,907,400 B2
- Document ID: US11907400B2
- Status: Granted
- Kind: B2
- Application number: 18/183,105
- Filed: 2023-03-13
- Published: 2023-07-06
- Granted: 2024-02-20
- Earliest claimed: 2019-10-16
- Assignees: Capital One Services, LLC
- Applicants: Capital One Services, LLC
- Inventors: Ya Liu; Matthew Carson
- Web page: https://patentgrep.com/patent/US11907400B2

## CPC

- G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes}
- G06F 16/2455: Query execution
- G06F 21/31: User authentication
- H04L 63/0407: {wherein the identity of one or more communicating identities is hidden (cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00)}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/101: {Access control lists [ACL]}
- H04W 12/02: Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
- H04W 12/06: Authentication
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

Methods, systems, and devices for leveraging data already collected on a user in a secure and private manner, in particular to verify user credentials for third parties. The methods, systems, and devices innovate beyond traditional security and privacy platforms in computer systems by processing the data to create a useable metric for the purposes of the third parties, in which the useable metric preserves the security and privacy of the underlying data.

## Claims

### Claim 1

A system for protecting personal data while verifying user credentials, the system comprising:
a database configured to store user data for a user; and
control circuitry configured to:
receive, from a remote server, a verification request for credentials of the user and user-provided data corresponding to the verification request;
determine whether the user-provided data includes a category of required data for the verification request based on a type of the verification request, an identity of a requestor of the verification request, and a verification request purpose of the verification request;
in response to determining that the user-provided data includes the category:
verify the user-provided data in the category using the stored user data;
in response to verifying the user-provided data in the category, select a default algorithm for responding to the verification request, wherein the default algorithm is selected by the requestor;
generate an assurance level of the credentials of the user based on the default algorithm;
in response to determining that the user-provided data does not include the category:
determine whether the stored user data includes the category;
determine whether criteria associated with the stored user data in the category is approved by the user for use in responding to the verification request to protect the stored user data in response to determining that the stored user data includes the category;
generate the assurance level of the credentials of the user in response to determining that the criteria is approved by the user for use in responding to the verification request to protect the stored user data; and
transmitting the assurance level to the remote server.

### Claim 2 (depends on 1)

The system of claim 1, wherein the control circuitry is further configured to query the requestor for data in the category in response to determining that the criteria based on the stored user data in the category is not approved for use in responding to the verification request.

### Claim 3 (depends on 1)

The system of claim 1, wherein the control circuitry is further configured to:
input the category into a database listing sources of categories of user data to determine a source to query for the category in response to determining that the stored user data does not include the category;
query the source for source data corresponding to the category; and
receive the source data corresponding to the category.

### Claim 4 (depends on 1)

The system of claim 1, wherein the control circuitry configured to determine whether the criteria based on the stored user data in the category is approved by the user for use in responding to the verification request is further configured to:
receive user inputs selecting privacy settings that indicate: (i) types of verification requests and (ii) requestors for which the stored user data is candidate criteria for responding to verification requests; and
compare the type of the verification request and the identity of the requestor to the privacy settings.

### Claim 5 (depends on 1)

The system of claim 1, wherein the control circuitry configured to select an algorithm for responding to the verification request from a plurality of potential algorithms for responding to the verification request based on the type of the verification request, the identity of the requestor, and the verification request purpose.

### Claim 6

A method for protecting personal data while verifying user credentials, the method comprising:
receiving, from a remote server, a verification request for credentials of a user;
determining whether stored user data includes a category of required data for the verification request based on a type of the verification request, an identity of a requestor of the verification request, and a verification request purpose of the verification request;
in response to determining that the stored user data includes the category, determining whether criteria associated with the stored user data in the category is approved by the user for use in responding to the verification request to protect the stored user data;
in response to determining that the criteria is approved by the user for use in responding to the verification request to protect the stored user data, generating an assurance level of the credentials of the user; and
transmitting the assurance level to the remote server.

### Claim 7 (depends on 6)

The method of claim 6, further comprising:
determining whether user-provided data corresponding to the verification request was received from the remote server;
in response to determining that the user-provided data corresponding to the verification request was received, determining whether the user-provided data includes the category;
in response to determining that the user-provided data includes the category, verifying the user-provided data in the category using the stored user data; and
in response to verifying the user-provided data in the category, selecting a default algorithm for responding to the verification request, wherein the default algorithm is selected by the requestor.

### Claim 8 (depends on 6)

The method of claim 6, further comprising in response to determining that the criteria based on the stored user data in the category is not approved by the user for use in responding to the verification request, querying the requestor for data in the category.

### Claim 9 (depends on 6)

The method of claim 6, further comprising:
in response to determining that the stored user data does not include the category, inputting the category into a database listing sources of categories of user data to determine a source to query for the category;
querying the source for source data corresponding to the category; and
receiving the source data corresponding to the category.

### Claim 10 (depends on 6)

The method of claim 6, wherein determining whether the criteria based on the stored user data in the category is approved by the user for use in responding to the verification request, further comprises:
receiving user inputs selecting privacy settings that indicate: (i) types of verification requests and (ii) requestors for which the stored user data is candidate criteria for responding to verification requests; and
comparing the type of the verification request and the identity of the requestor to the privacy settings.

### Claim 11 (depends on 6)

The method of claim 6, further comprising:
selecting an algorithm for responding to the verification request from a plurality of potential algorithms for responding to the verification request, wherein each of the plurality of potential algorithms uses the criteria and generates assurance levels, wherein selecting the algorithm, further comprises:
determining a number of verification requests received from the requestor during a time period;
comparing the number of verification requests received from the requestor during the time period to a respective number for each of the plurality of potential algorithms; and
matching the number of verification requests received from the requestor during the time period to the respective number of the selected algorithm.

### Claim 12 (depends on 6)

The method of claim 6, further comprising:
selecting an algorithm for responding to the verification request from a plurality of potential algorithms for responding to the verification request, wherein each of the plurality of potential algorithms uses the criteria and generates assurance levels, wherein selecting the algorithm, further comprises:
determining a time limit for outputting the assurance level;
comparing the time limit to a respective time limit for each of the plurality of potential algorithms; and
matching the time limit to the respective time limit for the selected algorithm.

### Claim 13 (depends on 6)

The method of claim 6, further comprising:
selecting an algorithm for responding to the verification request from a plurality of potential algorithms for responding to the verification request, wherein each of the plurality of potential algorithms uses the criteria and generates assurance levels, wherein selecting the algorithm, further comprises:
determining a geographic location of the remote server;
comparing the geographic location to a respective geographic location for each of the plurality of potential algorithms; and
matching the geographic location to the respective geographic location for the selected algorithm.

### Claim 14 (depends on 6)

The method of claim 6, further comprising:
selecting an algorithm for responding to the verification request from a plurality of potential algorithms for responding to the verification request, wherein each of the plurality of potential algorithms uses the criteria and generates assurance levels, wherein selecting the algorithm, further comprises:
determining that the category includes a type of personally identifying information; and
determining that the selected algorithm is approved for personally identifying information.

### Claim 15 (depends on 6)

The method of claim 6, further comprising:
selecting an algorithm for responding to the verification request from a plurality of potential algorithms for responding to the verification request, wherein each of the plurality of potential algorithms uses the criteria and generates assurance levels, wherein selecting the algorithm is based on the type of the verification request, the identity of the requestor, and the verification request purpose.

### Claim 16

A non-transitory computer-readable medium comprising instructions that, when executed by one or more processors, cause operations comprising:
receiving a verification request for credentials of a user;
determining whether stored user data includes a category of required data for the verification request based on a type of the verification request, an identity of a requestor of the verification request, and a verification request purpose of the verification request;
in response to determining that the stored user data includes the category, determining whether criteria associated with the stored user data in the category is approved by the user for use in responding to the verification request to protect the stored user data;
in response to determining that the criteria is approved by the user for use in responding to the verification request to protect the stored user data, generating an assurance level of the credentials of the user; and
transmitting the assurance level to the requestor associated with the verification request.

### Claim 17 (depends on 16)

The non-transitory computer-readable medium of claim 16, the operations further comprising:
determining whether user-provided data corresponding to the verification request was received;
determining whether the user-provided data includes the category;
verifying the user-provided data in the category using the stored user data; and
selecting a default algorithm for responding to the verification request in response to verifying the user-provided data in the category, wherein the default algorithm is selected by the requestor.

### Claim 18 (depends on 16)

The non-transitory computer-readable medium of claim 16, the operations further comprising:
inputting the category into a database listing sources of categories of user data to determine a source to query for the category in response to determining that the stored user data does not include the category;
querying the source for source data corresponding to the category; and
receiving the source data corresponding to the category.

### Claim 19 (depends on 16)

The non-transitory computer-readable medium of claim 16, the operations further comprising:
receiving user inputs selecting privacy settings that indicate: (i) types of verification requests and (ii) requestors for which stored user data is candidate criteria for responding to verification requests; and
comparing the type of the verification request and the identity of the requestor to the privacy settings.

### Claim 20 (depends on 16)

The non-transitory computer-readable medium of claim 16, the operations further comprising selecting an algorithm for responding to the verification request from a plurality of potential algorithms for responding to the verification request, wherein each of the plurality of potential algorithms uses the criteria and generates assurance levels, wherein selecting the algorithm is based on the type of the verification request, the identity of the requestor, and the verification request purpose.