# US 12,113,800 B2 · System and method for security management of a plurality of invalid interactions

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,113,800 B2
- Document ID: US12113800B2
- Status: Granted
- Kind: B2
- Application number: 18/477,308
- Filed: 2023-09-28
- Published: 2024-01-18
- Granted: 2024-10-08
- Earliest claimed: 2021-09-22
- Assignees: Bank of America Corporation
- Applicants: Bank of America Corporation
- Inventors: Peter G. Kurrasch; Nathan A. Dalpini
- Web page: https://patentgrep.com/patent/US12113800B2

## CPC

- H04L 63/102: {Entity profiles}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- G06Q 20/40: Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
- G06Q 20/4016: {involving fraud or risk level assessment in transaction processing}
- H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint}
- H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR

## Abstract

An apparatus for security management of a plurality of interactions comprises a processor operable to receive a plurality of interactions, where each interaction comprises interaction information associated with at least one of a plurality of users and a first entity. The processor is operable to determine a threshold value of the plurality of interactions and a threshold volume of the plurality of interactions, determine that a value of each of the plurality of interactions has not exceeded the threshold value of the plurality of interactions, and determine that the plurality of interactions has not exceeded the threshold volume of the plurality of interactions. The processor is operable to determine a number of instances of the plurality of interactions that were invalid, determine that the number of instances of the plurality of interactions that were invalid exceeds a threshold, and determine that the first entity is associated with suspicious indicators.

## Claims

### Claim 1

An apparatus for security management of a plurality of interactions, comprising:
a memory, associated with a server, operable to:
store interaction information associated with at least one of a plurality of users and a first entity;
store entity account data for at least the first entity; and
a processor, associated with the server, operably coupled to the memory, configured to:
receive the plurality of interactions, each interaction comprising interaction information associated with a particular one of the plurality of users and the first entity;
determine a threshold value of the plurality of interactions and a threshold volume of the plurality of interactions;
determine that a value of each of the received plurality of interactions has not exceeded the threshold value of the plurality of interactions;
determine that the plurality of interactions has not exceeded the threshold volume of the plurality of interactions;
determine a number of instances of the plurality of interactions that were invalid;
determine that the number of instances of the plurality of interactions that were invalid exceeds a threshold; and
in response to determining that the number of instances of the plurality of interactions that were invalid exceeds the threshold, determine that the first entity is associated with suspicious indicators, wherein suspicious indicators indicate that there is unauthorized activity associated with the first entity.

### Claim 2 (depends on 1)

The apparatus of claim 1, wherein the processor is further configured to transmit an alert indicating that that the first entity is associated with suspicious indicators.

### Claim 3 (depends on 2)

The apparatus of claim 2, wherein the processor is further configured to:
send a request to a first entity device associated with the first entity to initiate an authentication session between the first entity device and the server; and
receive, from the first entity device, entity device information during the authentication session.

### Claim 4 (depends on 3)

The apparatus of claim 3, wherein the processor is further configured to:
analyze the entity device information to determine that the first entity has engaged in unauthorized activity; and
in response to determining that the first entity has engaged in unauthorized activity, block interactions associated with the first entity.

### Claim 5 (depends on 2)

The apparatus of claim 2, wherein the processor is further configured to:
send a request to a particular user to verify that a particular interaction was authorized by that particular user; and
receive a response indicating that the particular interaction was or was not authorized by that particular user.

### Claim 6 (depends on 5)

The apparatus of claim 5, wherein the processor is further configured to:
if the received response indicates that the particular interaction was authorized, send a request to the memory to store the received interaction information as user account data for that particular user.

### Claim 7 (depends on 5)

The apparatus of claim 5, wherein the processor is further configured to:
if the received response indicates that the particular interaction was not authorized, determine a location of that particular user and a location of a first entity device associated with the first entity; and
determine that the location of that particular user is not located within a distance threshold from the location of the first entity device.

### Claim 8

A method for security management of a plurality of interactions, comprising:
receiving, by a server, the plurality of interactions, each interaction comprising interaction information associated with a particular one of the plurality of users and a first entity;
determining a threshold value of the plurality of interactions a threshold volume of the plurality of interactions;
determining that a value of each of the received plurality of interactions has not exceeded the threshold value of the plurality of interactions;
determining that the plurality of interactions has not exceeded the threshold volume of the plurality of interactions;
determining a number of instances of the plurality of interactions that were invalid;
determining that the number of instances of the plurality of interactions that were invalid exceeds a threshold; and
in response to determining that the number of instances of the plurality of interactions that were invalid exceeds the threshold, determining that the first entity is associated with suspicious indicators, wherein suspicious indicators indicate that there is unauthorized activity associated with the first entity.

### Claim 9 (depends on 8)

The method of claim 8, further comprising transmitting an alert indicating that that the first entity is associated with suspicious indicators.

### Claim 10 (depends on 9)

The method of claim 9, further comprising:
sending a request to a first entity device associated with the first entity to initiate an authentication session between the first entity device and the server; and
receiving, from the first entity device, entity device information during the authentication session.

### Claim 11 (depends on 10)

The method of claim 10, further comprising:
analyzing the entity device information to determine that the first entity has engaged in unauthorized activity; and
in response to determining that the first entity has engaged in unauthorized activity, blocking interactions associated with the first entity.

### Claim 12 (depends on 9)

The method of claim 9, further comprising:
sending a request to a particular user to verify that a particular interaction was authorized by that particular user; and
receiving a response indicating that the particular interaction was or was not authorized by that particular user.

### Claim 13 (depends on 12)

The method of claim 12, further comprising:
if the received response indicates that the particular interaction was authorized, storing the received interaction information as user account data for that particular user.

### Claim 14 (depends on 12)

The method of claim 12, further comprising:
if the received response indicates that the particular interaction was not authorized, determining a location of that particular user and a location of a first entity device associated with the first entity; and
determining that the location of that particular user is not located within a distance threshold from the location of the first entity device.

### Claim 15

A non-transitory computer-readable medium storing instructions that when executed by a processor cause the processor to:
receive a plurality of interactions, each interaction comprising interaction information associated with a particular of the plurality of users and a first entity;
determine a threshold value of the plurality of interactions and a threshold volume of the plurality of interactions;
determine that a value of each of the received plurality of interactions has not exceeded the threshold value of the plurality of interactions;
determine that the plurality of interactions has not exceeded the threshold volume of the plurality of interactions;
determine a number of instances of the plurality of interactions that were invalid;
determine that the number of instances of the plurality of interactions that were invalid exceeds a threshold; and
in response to determining that the number of instances of the plurality of interactions that were invalid exceeds the threshold, determine that the first entity is associated with suspicious indicators, wherein suspicious indicators indicate that there is unauthorized activity associated with the first entity.

### Claim 16 (depends on 15)

The non-transitory computer-readable medium of claim 15, wherein the instructions further cause the processor to:
transmit an alert indicating that the first entity is associated with suspicious indicators.

### Claim 17 (depends on 16)

The non-transitory computer-readable medium of claim 16, wherein the instructions further cause the processor to:
send a request to a first entity device associated with the first entity to initiate an authentication session between the first entity device and the server; and
receive, from the first entity device, entity device information during the authentication session;
analyze the entity device information to determine that the first entity has engaged in unauthorized activity; and
in response to determining that the first entity has engaged in unauthorized activity, block interactions associated with the first entity.

### Claim 18 (depends on 16)

The non-transitory computer-readable medium of claim 16, wherein the instructions further cause the processor to:
send a request to a particular user to verify that a particular instruction was authorized by that particular user; and
receive a response indicating that the particular interaction was or was not authorized by that particular user.

### Claim 19 (depends on 18)

The non-transitory computer-readable medium of claim 18, wherein the instructions further cause the processor to:
if the received response indicates that the particular interaction was authorized, send a request to a memory associated with the server to store the received interaction information as user account data for that particular user.

### Claim 20 (depends on 18)

The non-transitory computer-readable medium of claim 18, wherein the instructions further cause the processor to:
if the received response indicates that the particular interaction was not authorized, determine a location of that particular user and a location of a first entity device associated with the first entity; and
determine that the location of that particular user is not located within a distance threshold from the location of the first entity device.