# US 10,313,315 B2 · Ensuring information security in data transfers by utilizing proximity keys > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,313,315 B2 - Document ID: US10313315B2 - Status: Granted - Kind: B2 - Application number: 15/686,762 - Filed: 2017-08-25 - Published: 2019-02-28 - Granted: 2019-06-04 - Earliest claimed: 2017-08-25 - Assignees: Bank of America Corporation - Applicants: Bank of America Corporation - Inventors: Manu Kurian - Web page: https://patentgrep.com/patent/US10313315B2 ## CPC - H04L 63/0464: {using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it} - H04L 9/08: Key distribution {or management, e.g. generation, sharing or updating, of cryptographic keys or passwords (network architectures or network communication protocols for supporting key management in a packet data network H04L63/06)} - H04L 9/0872: {using geo-location information, e.g. location data, time, relative position or proximity to other entities} - H04L 9/14: using a plurality of keys or algorithms - H04L 9/3231: {Biological data, e.g. fingerprint, voice or retina (network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861)} - H04L 9/3247: {involving digital signatures} - H04L 63/065: {for group communications (cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833)} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/10: {for controlling access to devices or network resources} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Aspects of the disclosure relate to ensuring information security in data transfers by utilizing proximity keys. A computing platform may receive a data collection comprising one or more data sets to be transferred to one or more remote recipient systems, as well as one or more transfer path specifications defining a specific sequence of hop points via which the data collection is to be transferred. Subsequently, the computing platform may receive, from a quorum of authorization devices, a plurality of authorization keys. Based on validating the plurality of authorization keys, the computing platform may encrypt the data collection using the plurality of authorization keys. Then, the computing platform may send the encrypted data collection to a first hop point associated with the specific sequence of hop points defined by the one or more transfer path specifications, so as to initiate a transfer of the data collection to a decryption platform. ## Claims ### Claim 1 A computing platform, comprising: at least one hardware processor; a communication interface communicatively coupled to the at least one hardware processor; and memory storing computer-readable instructions that, when executed by the at least one hardware processor, cause the computing platform to: receive, via the communication interface, from a first data source user computing device, a data collection comprising one or more data sets to be transferred to one or more remote recipient computer systems; receive, via the communication interface, from the first data source user computing device, one or more transfer path specifications defining a specific sequence of hop points via which the data collection comprising the one or more data sets is to be transferred to the one or more remote recipient computer systems; receive, via the communication interface, from a quorum of authorization devices, a plurality of authorization keys; validate the plurality of authorization keys received from the quorum of authorization devices; based on validating the plurality of authorization keys received from the quorum of authorization devices, encrypt the data collection comprising the one or more data sets using the plurality of authorization keys received from the quorum of authorization devices to produce an encrypted data collection; and send, via the communication interface, to a first hop point associated with the specific sequence of hop points defined by the one or more transfer path specifications, the encrypted data collection to initiate a transfer of the data collection comprising the one or more data sets to a data decryption computing platform comprising one or more computing devices. ### Claim 2 (depends on 1) The computing platform of claim 1, wherein the first data source user computing device is linked to a first user associated with a first organization, and wherein the quorum of authorization devices comprises the first data source user computing device and at least one other registered user computing device linked to a second user associated with the first organization. ### Claim 3 (depends on 2) The computing platform of claim 2, wherein the quorum of authorization devices comprises at least half of all available authorization devices associated with the first organization. ### Claim 4 (depends on 2) The computing platform of claim 2, wherein the memory stores additional computer-readable instructions that, when executed by the at least one hardware processor, cause the computing platform to: prior to receiving the plurality of authorization keys from the quorum of authorization devices: identify one or more available authorization devices associated with the first organization; generate one or more authorization prompts for the one or more available authorization devices associated with the first organization; and send, via the communication interface, to the one or more available authorization devices associated with the first organization, the one or more authorization prompts generated for the one or more available authorization devices associated with the first organization. ### Claim 5 (depends on 4) The computing platform of claim 4, wherein a first authorization key of the plurality of authorization keys received from the quorum of authorization devices is a biometric authorization key encoded with biometric information specific to a first authorization device that returned the first authorization key in response to a first authorization prompt. ### Claim 6 (depends on 5) The computing platform of claim 5, wherein a second authorization key of the plurality of authorization keys received from the quorum of authorization devices is a geo-location authorization key encoded with geo-location information specific to a second authorization device that returned the second authorization key in response to a second authorization prompt. ### Claim 7 (depends on 6) The computing platform of claim 6, wherein a third authorization key of the plurality of authorization keys received from the quorum of authorization devices is a device-signature authorization key encoded with device-signature information specific to a third authorization device that returned the third authorization key in response to a third authorization prompt. ### Claim 8 (depends on 1) The computing platform of claim 1, wherein the first hop point is configured to: apply a first alternating encryption method to the encrypted data collection using a first proximity key associated with a location of the first hop point to produce a first re-encrypted data collection; and send the first re-encrypted data collection to a second hop point associated with the specific sequence of hop points defined by the one or more transfer path specifications. ### Claim 9 (depends on 8) The computing platform of claim 8, wherein the second hop point is configured to: apply a second alternating encryption method to the first re-encrypted data collection using a second proximity key associated with a location of the second hop point to produce a second re-encrypted data collection; and send the second re-encrypted data collection to the data decryption computing platform. ### Claim 10 (depends on 9) The computing platform of claim 9, wherein the data decryption computing platform is configured to decrypt the second re-encrypted data collection using a third proximity key associated with a location of the data decryption computing platform to reproduce the data collection comprising the one or more data sets. ### Claim 11 (depends on 10) The computing platform of claim 10, wherein the data decryption computing platform is configured to provide one or more data recipient user computing devices with selective access to the data collection comprising the one or more data sets. ### Claim 12 A method, comprising: at a computing platform comprising at least one hardware processor, memory, and a communication interface: receiving, by the at least one hardware processor, via the communication interface, from a first data source user computing device, a data collection comprising one or more data sets to be transferred to one or more remote recipient computer systems; receiving, by the at least one processor hardware processor, via the communication interface, from the first data source user computing device, one or more transfer path specifications defining a specific sequence of hop points via which the data collection comprising the one or more data sets is to be transferred to the one or more remote recipient computer systems; receiving, by the at least one hardware processor, via the communication interface, from a quorum of authorization devices, a plurality of authorization keys; validating, by the at least one hardware processor, the plurality of authorization keys received from the quorum of authorization devices; based on validating the plurality of authorization keys received from the quorum of authorization devices, encrypting, by the at least one hardware processor, the data collection comprising the one or more data sets using the plurality of authorization keys received from the quorum of authorization devices to produce an encrypted data collection; and sending, by the at least one hardware processor, via the communication interface, to a first hop point associated with the specific sequence of hop points defined by the one or more transfer path specifications, the encrypted data collection to initiate a transfer of the data collection comprising the one or more data sets to a data decryption computing platform comprising one or more computing devices. ### Claim 13 (depends on 12) The method of claim 12, wherein the first data source user computing device is linked to a first user associated with a first organization, and wherein the quorum of authorization devices comprises the first data source user computing device and at least one other registered user computing device linked to a second user associated with the first organization. ### Claim 14 (depends on 13) The method of claim 13, wherein the quorum of authorization devices comprises at least half of all available authorization devices associated with the first organization. ### Claim 15 (depends on 13) The method of claim 13, comprising: prior to receiving the plurality of authorization keys from the quorum of authorization devices: identifying, by the at least one hardware processor, one or more available authorization devices associated with the first organization; generating, by the at least one hardware processor, one or more authorization prompts for the one or more available authorization devices associated with the first organization; and sending, by the at least one hardware processor, via the communication interface, to the one or more available authorization devices associated with the first organization, the one or more authorization prompts generated for the one or more available authorization devices associated with the first organization. ### Claim 16 (depends on 15) The method of claim 15, wherein a first authorization key of the plurality of authorization keys received from the quorum of authorization devices is a biometric authorization key encoded with biometric information specific to a first authorization device that returned the first authorization key in response to a first authorization prompt. ### Claim 17 (depends on 16) The method of claim 16, wherein a second authorization key of the plurality of authorization keys received from the quorum of authorization devices is a geo-location authorization key encoded with geo-location information specific to a second authorization device that returned the second authorization key in response to a second authorization prompt. ### Claim 18 (depends on 17) The method of claim 17, wherein a third authorization key of the plurality of authorization keys received from the quorum of authorization devices is a device-signature authorization key encoded with device-signature information specific to a third authorization device that returned the third authorization key in response to a third authorization prompt. ### Claim 19 (depends on 12) The method of claim 12, wherein the first hop point is configured to: apply a first alternating encryption method to the encrypted data collection using a first proximity key associated with a location of the first hop point to produce a first re-encrypted data collection; and send the first re-encrypted data collection to a second hop point associated with the specific sequence of hop points defined by the one or more transfer path specifications. ### Claim 20 One or more non-transitory computer-readable media storing instructions that, when executed by a computing platform comprising at least one hardware processor, memory, and a communication interface, cause the computing platform to: receive, via the communication interface, from a first data source user computing device, a data collection comprising one or more data sets to be transferred to one or more remote recipient computer systems; receive, via the communication interface, from the first data source user computing device, one or more transfer path specifications defining a specific sequence of hop points via which the data collection comprising the one or more data sets is to be transferred to the one or more remote recipient computer systems; receive, via the communication interface, from a quorum of authorization devices, a plurality of authorization keys; validate the plurality of authorization keys received from the quorum of authorization devices; based on validating the plurality of authorization keys received from the quorum of authorization devices, encrypt the data collection comprising the one or more data sets using the plurality of authorization keys received from the quorum of authorization devices to produce an encrypted data collection; and send, via the communication interface, to a first hop point associated with the specific sequence of hop points defined by the one or more transfer path specifications, the encrypted data collection to initiate a transfer of the data collection comprising the one or more data sets to a data decryption computing platform comprising one or more computing devices.