# US 12,010,124 B2 · Methods and systems for prevention of vendor data abuse

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,010,124 B2
- Document ID: US12010124B2
- Status: Granted
- Kind: B2
- Application number: 17/335,932
- Filed: 2021-06-01
- Published: 2022-08-25
- Granted: 2024-06-11
- Earliest claimed: 2021-02-24
- Applicants: Supreeth Hosur Nagesh Rao; Navindra Yadav; Ravi Sankuratri; Alok Lalit Wadhwa; Aria Rahadian; Bharathwaj Sankara Viswanathan; Brady Schulman; Matthew Finn; Ravi Shanker Prasad; Vasil Dochkov Yordanov; Yiwei Wang; Zhiwen Zhang
- Inventors: Supreeth Hosur Nagesh Rao; Navindra Yadav; Ravi Sankuratri; Alok Lalit Wadhwa; Aria Rahadian; Bharathwaj Sankara Viswanathan; Brady Schulman; Matthew Finn; Ravi Shanker Prasad; Vasil Dochkov Yordanov; Yiwei Wang; Zhiwen Zhang
- Web page: https://patentgrep.com/patent/US12010124B2

## CPC

- H04L 63/1416: {Event detection, e.g. attack signature detection}
- G06F 9/541: {via adapters, e.g. between incompatible applications}
- G06F 16/2379: {Updates performed during online database operations; commit processing}
- G06F 21/577: {Assessing vulnerabilities and evaluating computer system security}
- G06F 21/604: {Tools and structures for managing or administering access control systems}
- G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes}
- H04L 63/0209: {Architectural arrangements, e.g. perimeter networks or demilitarized zones}
- H04L 63/0407: {wherein the identity of one or more communicating identities is hidden (cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00)}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/1433: {Vulnerability analysis}
- H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- G06F 2221/034: Test or assess a computer or a system
- H04L 63/0245: {Filtering by information in the payload}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

In one aspect, a computerized method for automatically identifying and solving for vendor data abuse in an enterprise network, includes the step of implementing a vendor detection at one or more gateways of the enterprise network. The method includes the step of mapping a set of data along with any associated data attributes of the set of data that are being shared with a vendor via the one or more gateways. The method includes the step of detecting and identifying an access anomaly with respect to the set of data associated with a vendor access. The method includes the step of implementing a specified data minimization process to the access anomaly.

## Claims

### Claim 1

A computerized method for automatically identifying and solving for vendor data abuse in an enterprise network, comprising:
implementing a vendor detection at one or more gateways of the enterprise network;
mapping a set of data along with any associated data attributes of the set of data that are being shared with a vendor via the one or more gateways;
detecting and identifying an access anomaly with respect to the set of data associated with a vendor access; and
implementing a specified data minimization process to the access anomaly,
wherein the data minimization process is applied for every vendor sharing agreement engaged in by the enterprise network that is associated with the vendor, and
wherein data minimization is implemented by prohibiting a vendor access to any sensitive data in the enterprise network.

### Claim 2 (depends on 1)

The computerized method of claim 1, wherein the data minimization processes comprises setting a limit to a use or a retention of the set of data by limiting a data collected by protocol elements to only what is necessary.

### Claim 3 (depends on 1)

The computerized method of claim 1, wherein data minimization is implemented by:
limiting data collection by the vendor.

### Claim 4 (depends on 3)

The computerized method of claim 3, wherein data minimization is implemented by:
detecting and identifying a violated data minimization scenario committed by the vendor.

### Claim 5 (depends on 4)

The computerized method of claim 4 further comprising:
communicating the violated data minimization scenario to the enterprise network.

### Claim 6 (depends on 1)

The computerized method of claim 1, wherein the step of implementing the vendor detection at the one or more gateways of the enterprise network further comprises:
identifying the vendor based on an API endpoint data, an API path data, a location data, and a region information data; and
fingerprinting a request and a header information from every vendor.

### Claim 7 (depends on 6)

The computerized method of claim 6, wherein the step of implementing the vendor detection at the one or more gateways of the enterprise network further comprises:
building an abnormal access list with respect to an API path and a content of an API for a vendor API key; and
fingerprinting an API endpoint exposed by the vendor.

### Claim 8 (depends on 7)

The computerized method of claim 7, further comprising:
fingerprinting a method type to obtain a vendor identification; and
associating the fingerprinted method type with at least one API call from or to the enterprise network.

### Claim 9

A computer system for automatically identifying and solving for vendor data abuse in an enterprise network, comprising:
a processor;
a memory containing instructions when executed on the processor, causes the processor to perform operations that:
implement a vendor detection at one or more gateways of the enterprise network;
map a set of data along with any associated data attributes of the set of data that are being shared with a vendor via the one or more gateways;
detect and identify an access anomaly with respect to the set of data associated with a vendor access; and
implement a specified data minimization process to the access anomaly wherein the data minimization process is applied for every vendor sharing agreement engaged in by the enterprise network that is associated with the vendor,
wherein data minimization is implemented by prohibiting a vendor access to any sensitive data in the enterprise network, and
wherein the step of implementing the vendor detection at the one or more gateways of the enterprise network further comprises:
implementing a match based on a vendor provided Internet Protocol (IP) identifier;
if no match is found, then identifying the vendor based on an API endpoint data, an API path data, a location data, and a region information data; and
fingerprinting a request and a header information from every vendor.

### Claim 10

A computerized method for determining abnormal vendor access:
fingerprinting a vendor behavior of a vendor and setting a normal fingerprint of the vendor behavior;
analyzing an abnormal vendor access based on access frequency of the vendor;
detecting that a vendor access has a different access frequency or a random-access frequency over a specified period of time;
setting a vendor abuse risk associated with the different access frequency or the random-access frequency over a specified period of time as high;
when the vendor abuse risk is set as high, determining that an abnormal access method is extant; and
disabling any vendor access permissions of the vendor associated with an abnormal vendor access frequency,
determines a new personal information (PII) type or PII data being transferred via a gateway in an enterprise network;
detecting that the vendor is consuming the new PII types or PII data; and
disabling any vendor access permissions of the vendor when it is detected that the vendor is consuming the new PII types or PII data;
detecting a critical PII type data is being transferred to the vendor; and
disabling any vendor access permissions of the vendor when it is detected that the vendor is receiving the critical PII type data; and
implementing vendor detection at the gateway of the enterprise network comprising:
implementing a match based on a vendor provided Internet Protocol (IP) identifier;
if no match is found, then identifying the vendor based on an API endpoint data, an API path data, a location data, and a region information data; and
fingerprinting a request and a header information from every vendor.

### Claim 11 (depends on 10)

The computerized method of claim 10, further comprising:
detecting an abnormal request response pattern when the vendor passes a different request pattern than the normal fingerprint;
disabling any vendor access permissions of the vendor associated with the abnormal request response pattern.

### Claim 12 (depends on 10)

The computerized method of claim 10, wherein the critical PII type data comprises a social security number (SSN) or a medical record number (MRN).