# US 2020/0401728 A1 · Systems and methods of determining compromised identity information

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2020/0401728 A1
- Document ID: US20200401728A1
- Status: Published application
- Kind: A1
- Application number: 17/009,401
- Filed: 2020-09-01
- Published: 2020-12-24
- Earliest claimed: 2015-12-04
- Assignees: Early Warning Services, LLC
- Applicants: Early Warning Services, LLC
- Inventors: Lester Leland Lockhart, III; David Hugh Munson; Gregor R. Bonin; Michael Cook
- Web page: https://patentgrep.com/patent/US20200401728A1

## CPC

- G06F 21/6263: {during internet communication, e.g. revealing personal data from cookies}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A compromised data exchange system extracts data from websites using a crawler, detects portions within the extracted data that resemble personally identifying information (PII) data based on PII data patterns using a risk assessment module, and compares a detected portion to data within a database of disassociated compromised PII data to determine a match using the risk assessment module. A risk score may be assigned to a data item within the database in response to determining the match. In some embodiments, URL data may also be detected in the extracted data. The detected URL data represents further web sites that can be automatically crawled by the system to detect further PII data.

## Claims

### Claim 1

A compromised data exchange system comprises:
a memory including a database configured to store compromised personal identifying information (PII);
an interface configured to receive encrypted PII data to be processed by the compromised data exchange system and stored in the memory;
a processor coupled to the interface and the memory, the processor configured to perform operations including:
receiving, at the interface, encrypted PII data from a compromised entity, wherein the encrypted PII data is associated with the compromised entity;
disassociating elements of the encrypted PII data from the compromised entity and from each other;
unencrypting the PII data;
re-encrypting the PII data to produce re-encrypted PII data, wherein re-encrypting the PII data includes independently encrypting each data filed using a different encryption key;
storing, at the memory, the re-encrypted PII data as compromised PII data in the memory, the stored compromised PII data disassociated into unlinked fields such that the unlinked fields of the compromised PII data cannot be correlated by anyone other than a holder of a mapping key that maps identity elements of the compromised PII data to each other;
receiving, via the interface, a PII request with submitted PII data for comparison to the compromised PII data;
determining a risk score based at least in part on the result of the comparison, wherein the risk score reflects a probability that an element of the encrypted PII data received from the compromised entity may be misused; and
providing the risk score to the compromised entity, wherein the risk score is used to change a decision by the compromised entity.

### Claim 2 (depends on 1)

The compromised data exchange system of claim 1, wherein the stored compromised PII data includes a unique identifier for each unlinked field of the compromised data, the unique identifier used to reassemble the unlinked fields of the PII data by mapping the unique ID of each field back to the PII data.

### Claim 3 (depends on 1)

The compromised data exchange system of claim 1, wherein the risk score corresponds to the submitted PII data in the PII request.

### Claim 4 (depends on 1)

The compromised data exchange of claim 1, wherein the mapping key maps identity elements of the compromised PII data together to form a full identity.

### Claim 5 (depends on 1)

The compromised data exchange of claim 1, wherein the PII may be received from multiple sources in addition to the compromised entity.

### Claim 6 (depends on 1)

The compromised data exchange system of claim 1, wherein the processor is further configured to perform operations including:
unencrypting the submitted data in the received PII request; and
re-encrypting the submitted data in the received PII request using the different encryption key for each field.

### Claim 7 (depends on 6)

The compromised data exchange of claim 6, wherein the processor is further configured to perform operations including:
determining an exposure event identifier associated with comparison;
determining a statistical probability of misuse of the data based on information about an exposure event corresponding to the exposure event identifier; and
determining the risk score based on the result of the comparison and based on the information about the exposure event.

### Claim 8 (depends on 6)

The compromised data exchange of claim 6, wherein the processor is further configured to transmit data related to the risk score to a computing device via the interface.

### Claim 9 (depends on 1)

The compromised data exchange of claim 1, wherein the processor is further configured to perform operations including:
re-encrypting the submitted data in the received PII request for transmission to one or more compromised companies via the interface;
receiving data corresponding to matches from results determined from comparisons by the one or more compromised companies to their own data; and
determining the risk score based on the result of the comparison and based on the received data from the one or more compromised companies.

### Claim 10

A computer-implemented method comprising
receiving, at the interface, encrypted PII data from a compromised entity, wherein the encrypted PII data is associated with the compromised entity;
disassociating elements of the encrypted PII data from the compromised entity and from each other;
unencrypting the PII data;
re-encrypting the PII data to produce re-encrypted PII data, wherein re-encrypting the PII data includes independently encrypting each data filed using a different encryption key;
storing, at the memory, the re-encrypted PII data as compromised PII data in the memory, the stored compromised PII data disassociated into unlinked fields such that the unlinked fields of the compromised PII data cannot be correlated by anyone other than a holder of a mapping key that maps identity elements of the compromised PII data to each other;
receiving, via the interface, a PII request with submitted PII data for comparison to the compromised PII data;
determining a risk score based at least in part on the result of the comparison, wherein the risk score reflects a probability that an element of the encrypted PII data received from the compromised entity may be misused; and
providing the risk score to the compromised entity, wherein the risk score is used to change a decision by the compromised entity.

### Claim 11 (depends on 10)

The method of claim 10, wherein the stored compromised PII data includes a unique identifier for each unlinked field of the compromised data, the unique identifier used to reassemble the unlinked fields of the PII data by mapping the unique ID of each field back to the PII data.

### Claim 12 (depends on 10)

The method of claim 10, wherein the risk score corresponds to the submitted PII data in the PII request.

### Claim 13 (depends on 10)

The method of claim 10, wherein the mapping key maps identity elements of the compromised PII data together to form a full identity.

### Claim 14 (depends on 10)

The method of claim 10, wherein the PII may be received from multiple sources in addition to the compromised entity.

### Claim 15 (depends on 10)

The method of claim 10, further comprising:
unencrypting the submitted data in the received PII request; and
re-encrypting the submitted data in the received PII request using the different encryption key for each field.

### Claim 16 (depends on 15)

The method of claim 15, further comprising:
determining an exposure event identifier associated with comparison;
determining a statistical probability of misuse of the data based on information about an exposure event corresponding to the exposure event identifier; and
determining the risk score based on the result of the comparison and based on the information about the exposure event.

### Claim 17 (depends on 15)

The method of claim 15, wherein the processor is further configured to transmit data related to the risk score to a computing device via the interface.

### Claim 18 (depends on 10)

The method of claim 10, further comprising:
re-encrypting the submitted data in the received PII request for transmission to one or more compromised companies via the interface;
receiving data corresponding to matches from results determined from comparisons by the one or more compromised companies to their own data; and
determining the risk score based on the result of the comparison and based on the received data from the one or more compromised companies.

### Claim 19

A computer-program product tangibly embodied in a non-transitory machine-readable storage medium of a gateway device, including instructions configured to cause one or more data processors to perform operations including:
receiving, at the interface, encrypted PII data from a compromised entity, wherein the encrypted PII data is associated with the compromised entity;
disassociating elements of the encrypted PII data from the compromised entity and from each other;
unencrypting the PII data;
re-encrypting the PII data to produce re-encrypted PII data, wherein re-encrypting the PII data includes independently encrypting each data filed using a different encryption key;
storing, at the memory, the re-encrypted PII data as compromised PII data in the memory, the stored compromised PII data disassociated into unlinked fields such that the unlinked fields of the compromised PII data cannot be correlated by anyone other than a holder of a mapping key that maps identity elements of the compromised PII data to each other;
receiving, via the interface, a PII request with submitted PII data for comparison to the compromised PII data;
determining a risk score based at least in part on the result of the comparison, wherein the risk score reflects a probability that an element of the encrypted PII data received from the compromised entity may be misused; and
providing the risk score to the compromised entity, wherein the risk score is used to change a decision by the compromised entity.

### Claim 20 (depends on 19)

The computer-program product of claim 19, wherein the stored compromised PII data includes a unique identifier for each unlinked field of the compromised data, the unique identifier used to reassemble the unlinked fields of the PII data by mapping the unique ID of each field back to the PII data.