# US 10,873,586 B2 · Systems and methods for secure data access control

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,873,586 B2
- Document ID: US10873586B2
- Status: Granted
- Kind: B2
- Application number: 16/358,106
- Filed: 2019-03-19
- Published: 2020-09-24
- Granted: 2020-12-22
- Earliest claimed: 2019-03-19
- Assignees: Capital One Services, LLC
- Applicants: Capital One Services, LLC
- Inventors: Suresh Pandey; Sebastian Smith; Hala Salim El-Ali
- Web page: https://patentgrep.com/patent/US10873586B2

## CPC

- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- H04L 63/102: {Entity profiles}
- G06F 3/0622: {in relation to access}
- G06F 3/0637: {Permissions}
- G06F 3/0644: {Management of space entities, e.g. partitions, extents, pools}
- G06F 3/0664: {at device level, e.g. emulation of a storage device or system}
- G06F 3/067: {Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]}
- G06F 9/45558: {Hypervisor-specific management and integration aspects}
- G06F 21/602: {Providing cryptographic facilities or services}
- G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes}
- H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 9/14: using a plurality of keys or algorithms
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)}
- H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/10: {for controlling access to devices or network resources}
- G06F 2009/45587: {Isolation or security of virtual machine instances}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A computer system for secure data access control, according to some examples, may perform operations including: receiving first data from a first client associated with a first user; using a first data access agent to store the first data in a first data store, the first data access agent having access to the first data store and not having access to a second data store; receiving second data from a second client associated with a second user; and using a second data access agent to store the second data in the second data store, the second data access agent having access to the second data store and not having access to the first data store.

## Claims

### Claim 1

A computer system for secure data access control, comprising:
a memory storing instructions; and
one or more processors configured to execute the instructions to perform operations including:
receiving, by a main application, first data from a first client associated with a first user;
receiving, by a routing application, a first request to store the first data in a first data store;
sending, by the routing application, the first data from the main application to a first data access agent, wherein the main application and the routing application do not have direct access to the first data store, the first data access agent being an application or process and having a first access account, the first access account permitting the first data access agent to access the first data store and not permitting the first data access agent to access a second data store;
based on the first request, retrieving, by the first data access agent from an encryption key store, a first encryption key using a first identifier associated with the first user;
verifying, by the first data access agent, a first hash of the first encryption key generated by the routing application using the first encryption key;
when the first data access agent has verified the first hash, storing, by the first data access agent, the first data in the first data store based on the first request;
receiving, by the main application, second data from a second client associated with a second user;
receiving, by the routing application, a second request to store the second data in the second data store;
sending, by the routing application, the second data from the main application to a second data access agent, wherein the main application and the routing application do not have direct access to the second data store, the second data access agent being an application or process having a second access account, the second access account permitting the second data access agent to access the second data store and not permitting the second data access agent to access the first data store;
based on the second request, retrieving, by the second data access agent from the encryption key store, a second encryption key using a second identifier associated with the second user;
verifying, by the second data access agent, a second hash of the second encryption key generated by the routing application using the second encryption key;
when the second data access agent has verified the second hash, storing, by the second data access agent, the second data in the second data store based on the second request,
wherein the routing application is a compute configured to invoke the first and second data access agents, and wherein the routing application has an access account without permission to access the first and second data stores, and
wherein the first access account has a set of identity access management (IAM) permissions permitting access to the first data store and not permitting access to the second data store.

### Claim 2 (depends on 1)

The computer system of claim 1, wherein the storing the first data includes, by the first data access agent:
encrypting the first data using the first encryption key; and
storing the encrypted first data in the first data store.

### Claim 3 (depends on 2)

The computer system of claim 2, wherein the operations further include:
receiving, by the routing application, a request to retrieve the first data from the first client; and
based on the request, retrieving, by the routing application, the first data using the first data access agent.

### Claim 4 (depends on 3)

The computer system of claim 3, wherein the retrieving, by the routing application, the first data includes:
retrieving, by the routing application, the first encryption key from the encryption key store;
generating, by the routing application, the hash of the encryption key and
invoking, by the routing application, the first data access agent, so that the first data access agent retrieves the first encryption key from the encryption key store, verifies the first hash using the first encryption key, and decrypts the first data.

### Claim 5 (depends on 4)

The computer system of claim 4, wherein the retrieving, by the routing application, the first encryption key includes:
determining, by the routing application, the first identifier associated with the first user based on the request; and
retrieving, by the routing application, the first encryption key from the encryption key store based on the first identifier.

### Claim 6 (depends on 1)

The computer system of claim 1, wherein
the first and second data access agents are respectively associated with the first and second users,
the operations further include receiving, by the main application, from the first client, a request to store the first data in the computer system,
sending, by the routing application, the first data from the main application to the first data access agent, and
wherein the storing, by the first data access agent, the first data includes:
determining, by the routing application, that the request originated from the first user;
determining, by the routing application, that the first data access agent is associated with the first user; and
invoking, by the routing application, the first data access agent upon determining that the request is associated with the first user.

### Claim 7 (depends on 1)

The computer system of claim 1, wherein
each of the first data store and the second data store is a cloud storage resource, and
each of the first data access agent and the second data access agent is a serverless compute.

### Claim 8 (depends on 1)

The computer system of claim 1, wherein the main application and the routing application are separate applications.

### Claim 9 (depends on 1)

The computer system of claim 1, wherein the first data access agent has access to only encryption keys in the encryption store that are associated with the first identifier associated with the first user.

### Claim 10 (depends on 1)

The computer system of claim 1, wherein the operations further include:
retrieving, by the routing application from the encryption key store, the first encryption key corresponding to the first identifier associated with the first user;
generating, by the routing application, the first hash based on the first encryption key.

### Claim 11 (depends on 10)

The computer system of claim 10, wherein the first hash is generated using a first hash function of the first encryption key, and wherein the verifying, by the first data access agent, the first hash includes:
generating, by the first data access agent, a new first hash of the first encryption key using the first hash function;
comparing, by the first data access agent, the new first hash to the first hash generated by the routing application; and
if the new first hash generated by the first data access agent matches the first hash generated by the routing application, verifying, by the first data access agent, the first hash generated by the routing application.

### Claim 12 (depends on 11)

The computing system of claim 11, wherein the operations further include:
retrieving, by the routing application from the encryption key store, the second encryption key corresponding to the second identifier associated with the second user; and
generating, by the routing application, the second hash based on the second encryption key using a second hash function of the second encryption key,
wherein the verifying, by the second data access agent, the second hash includes:
generating, by the second data access agent, a new second hash of the second encryption key using the second hash function;
comparing, by the second data access agent, the new second hash to the second hash generated by the routing application; and
if the new second hash generated by the second data access agent matches the second hash generated by the routing application, verifying, by the second data access agent, the second hash generated by the routing application.

### Claim 13

A computer-implemented method for secure data access control, comprising:
receiving, by a main application, a request to retrieve data from a client associated with a user;
based on the request, determining, by a routing application, an identifier of the user;
based on the identifier, identifying, from a plurality of data access agents by the routing application, a data access agent having permission to access a data store in which the data is stored, the data access agent being an application or process and having an access account, the access account having a set of identity access management (IAM) permissions permitting the data access agent to access the data store and not permitting the data access agent to access data stores accessible to other data access agents of the plurality of data access agents, wherein the routing application is a compute configured to invoke the data access agent and the routing application has an access without permission to access the data store such that the routing application does not have direct access to the data store;
invoking, by the routing application, the identified data access agent so that the identified data access agent:
retrieves, from an encryption key store, an encryption key corresponding to the identifier of the user;
verifies a hash of the encryption key generated by the routing application using the encryption key;
when the hash has been verified, retrieves the data from the data store, the invoking including providing, by the routing application, the data access agent with a request to retrieve the data; and
decrypts the retrieved data;
sending, by the routing application, the retrieved data from the identified data access agent to the main application; and
transmitting, by the main application, the retrieved data to the client.

### Claim 14 (depends on 13)

The method of claim 13, further comprising:
retrieving, by the routing application, from the encryption key store, the encryption key corresponding to the identifier; and
generating, by the routing application, the hash of the encryption key.

### Claim 15 (depends on 14)

The method of claim 14, wherein, of the plurality of data access agents, only the identified data access agent has access to the encryption key corresponding to the identifier.

### Claim 16 (depends on 15)

The method of claim 15, wherein the identified data access agent does not have access to encryption keys corresponding to identifiers of other users.

### Claim 17 (depends on 14)

The method of claim 14, wherein the hash is generated using a hash function of the encryption key, and wherein the verifying the hash includes the identified data access agent:
generating a new hash of the encryption key using the hash function;
comparing the new hash to the hash generated by the routing application; and
if the new hash generated by the data access agent matches the hash generated by the routing application, verifying the hash generated by the routing application.

### Claim 18 (depends on 13)

The method of claim 13, wherein
the data store is a cloud storage resource, and
each of the plurality of data access agents is a serverless compute.

### Claim 19 (depends on 13)

The method of claim 13, wherein the main application and the routing application are separate applications.

### Claim 20

A computer system for secure data access control, comprising:
a memory storing instructions; and
one or more processors configured to execute the instructions to perform operations including:
generating, by a main application, a user-specific identifier for a user;
creating, by the main application, a data store and an access account that has a set of identity access management (IAM) permissions to access the data store and does not have permission to access data stores created for other users;
creating, by the main application, a user-specific data access agent corresponding to the user, the data access agent being an application or process, the data access agent having the access account and being one of a plurality of data access agents;
receiving, by the main application, a request to store data from a client associated with the user;
based on the request, determining, by a routing application, an identifier of the user as being the user-specific identifier, wherein the routing application is a compute configured to invoke the data access agent and the routing application has an access account without permission to access the data stores such that the main application and the routing application do not have direct access to the data store;
based on the user-specific identifier, identifying, from the plurality of data access agents by the routing application, the user-specific data access agent;
invoking, by the routing application, the user-specific data access agent so that the user-specific data access agent:
retrieves, from an encryption key store, an encryption key corresponding to the user-specific identifier;
verifies a hash of the encryption key generated by the routing application using the encryption key;
when the hash has been verified, encrypts the data; and
stores the data in the data store, the invoking including providing the data access agent with a request to retrieve the data.