# US 10,872,144 B1 · Systems and methods for secure processing of data streams having differing security level classifications > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,872,144 B1 - Document ID: US10872144B1 - Status: Granted - Kind: B1 - Application number: 15/834,258 - Filed: 2017-12-07 - Granted: 2020-12-22 - Earliest claimed: 2017-12-07 - Assignees: Ent. Services Development Corporation LP - Applicants: Ent. Services Development Corporation LP - Inventors: Jeff Kalibjian; Scott Lopez; Peter Eugene Schmidt, II; Mari Mortell Kwee - Web page: https://patentgrep.com/patent/US10872144B1 ## CPC - G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - G06F 21/554: {involving event detection and direct action} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying} - H04L 9/12: Transmitting and receiving encryption devices synchronised or initially set up in a particular manner - H04L 9/3297: {involving time stamps, e.g. generation of time stamps} - G06F 2221/033: Test or assess software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems, methods, and non-transitory computer-readable media can receive a notification of a user request to securely process a first set of data. A time estimate is calculated, wherein the time estimate is indicative of an expected amount of time for a secure data processing application to process the first set of data. An actual utilization time required for a first instance of the secure data processing application to process the first set of data is measured. A determination is made as to whether the secure data processing application may be compromised based on a comparison of the time estimate and the actual utilization time. In various embodiments, a re-cryptor process is used to change the cryptographic keys accessed by the secure data processing application. In various embodiments, a re-credentialer is used to change the database access credentials the secure data processing application used to access the encrypted data. ## Claims ### Claim 1 A computer-implemented method comprising: receiving, by a computing system, a notification of a user request to securely process a first set of data; calculating, by the computing system, a time estimate indicative of an expected amount of time for a secure data processing application to process the first set of data; measuring, by the computing system, an actual utilization time required for a first instance of the secure data processing application to process the first set of data, wherein the first instance of the secure data processing application utilizes a first set of database access credentials associated with a first set of databases to process the first set of data; determining, by the computing system, whether the secure data processing application may be compromised based on a comparison of the time estimate and the actual utilization time; and invalidating, by the computing system, the first set of database access credentials based on a determination that the first instance of the secure data processing application has terminated. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein the time estimate is calculated based on at least one of: an expected computer processing unit (CPU) usage, an expected input output utilization, or a number of data elements associated with the user request. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein the first set of data is associated with a security classification level and the first set of data is encrypted using a cryptographic key associated with the security classification level. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, further comprising generating new database access credentials for each database in the first set of databases. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein the first instance of the secure data processing application utilizes a first set of cryptographic keys to process the first set of data. ### Claim 6 (depends on 5) The computer-implemented method of claim 5, further comprising: based on the determination that the first instance of the secure data processing application has terminated, decrypting a first set of data elements that have been encrypted using the first set of cryptographic keys, and re-encrypting the first set of data elements using a second set of cryptographic keys. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, wherein the determining whether the secure data processing application may be compromised based on a comparison of the time estimate and the actual utilization time comprises: determining that the actual utilization time does not exceed the time estimate by greater than a threshold amount, and determining that the secure data processing application is not compromised based on the determining that the actual utilization time does not exceed the time estimate by greater than the threshold amount. ### Claim 8 (depends on 1) The computer-implemented method of claim 1, wherein the determining whether the secure data processing application may be compromised based on a comparison of the time estimate and the actual utilization time comprises: determining that the actual utilization time exceeds the time estimate by greater than a threshold amount, and determining that the secure data processing application may be compromised based on the determining that the actual utilization time exceeds the time estimate by greater than the threshold amount. ### Claim 9 (depends on 8) The computer-implemented method of claim 8, further comprising generating a notification for a user indicating that the secure data processing application may be compromised. ### Claim 10 (depends on 8) The computer-implemented method of claim 8, further comprising halting the first instance of the secure data processing application based on the determining that the secure data processing application may be compromised. ### Claim 11 A system comprising: at least one processor; and a memory storing instructions that, when executed by the at least one processor, cause the system to perform a method comprising: receiving a notification of a user request to securely process a first set of data; calculating a time estimate indicative of an expected amount of time for a secure data processing application to process the first set of data; measuring an actual utilization time required for a first instance of the secure data processing application to process the first set of data, wherein the first instance of the secure data processing application utilizes a first set of database access credentials associated with a first set of databases to process the first set of data; determining whether the secure data processing application may be compromised based on a comparison of the time estimate and the actual utilization time; and invalidating the first set of database access credentials based on a determination that the first instance of the secure data processing application has terminated. ### Claim 12 (depends on 11) The system of claim 11, wherein the time estimate is calculated based on at least one of: an expected computer processing unit (CPU) usage, an expected input output utilization, or a number of data elements associated with the user request. ### Claim 13 (depends on 11) The system of claim 11, wherein the first set of data is associated with a security classification level and the first set of data is encrypted using a cryptographic key associated with the security classification level. ### Claim 14 (depends on 11) The system of claim 11, wherein the method further comprises generating new database access credentials for each database in the first set of databases. ### Claim 15 (depends on 11) The system of claim 11, wherein the first instance of the secure data processing application utilizes a first set of cryptographic keys to process the first set of data, and the method further comprises: based on a determination that the first instance of the secure data processing application has terminated, decrypting a first set of data elements that have been encrypted using the first set of cryptographic keys, and re-encrypting the first set of data elements using a second set of cryptographic keys. ### Claim 16 A non-transitory computer-readable storage medium including instructions that, when executed by at least one processor of a computing system, cause the computing system to perform a method comprising: receiving a notification of a user request to securely process a first set of data; calculating a time estimate indicative of an expected amount of time for a secure data processing application to process the first set of data; measuring an actual utilization time required for a first instance of the secure data processing application to process the first set of data, wherein the first instance of the secure data processing application utilizes a first set of database access credentials associated with a first set of databases to process the first set of data; determining whether the secure data processing application may be compromised based on a comparison of the time estimate and the actual utilization time; and invalidating the first set of database access credentials based on a determination that the first instance of the secure data processing application has terminated. ### Claim 17 (depends on 16) The non-transitory computer-readable storage medium of claim 16, wherein the time estimate is calculated based on at least one of: an expected computer processing unit (CPU) usage, an expected input output utilization, or a number of data elements associated with the user request. ### Claim 18 (depends on 16) The non-transitory computer-readable storage medium of claim 16, wherein the first set of data is associated with a security classification level and the first set of data is encrypted using a cryptographic key associated with the security classification level. ### Claim 19 (depends on 16) The non-transitory computer-readable storage medium of claim 16, wherein the method further comprises generating new database access credentials for each database in the first set of databases. ### Claim 20 (depends on 16) The non-transitory computer-readable storage medium of claim 16, wherein the first instance of the secure data processing application utilizes a first set of cryptographic keys to process the first set of data, and the method further comprises: based on a determination that the first instance of the secure data processing application has terminated, decrypting a first set of data elements that have been encrypted using the first set of cryptographic keys, and re-encrypting the first set of data elements using a second set of cryptographic keys.