# US 11,308,231 B2 · Security control management for information security > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,308,231 B2 - Document ID: US11308231B2 - Status: Granted - Kind: B2 - Application number: 16/862,795 - Filed: 2020-04-30 - Published: 2021-11-04 - Granted: 2022-04-19 - Earliest claimed: 2020-04-30 - Assignees: Bank of America Corporation - Applicants: Bank of America Corporation - Inventors: Jo-Ann Taylor; Amelia B. Hartman - Web page: https://patentgrep.com/patent/US11308231B2 ## CPC - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F 21/85: interconnection devices, e.g. bus-connected or in-line devices - G06F 21/602: {Providing cryptographic facilities or services} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A device configured to receive a data storage request that identifies a data content type for a data element and a target data storage device. The device is further configured to determine the target data storage device does not match an approved data storage device. The device is further configured to determine a security level associated with the target data storage device and to determine vulnerability types associated with the determined security level of the target data storage device. The device is further configured to identify security controls based on the determined vulnerability types and to output the identified security controls. Each security control comprises a hardware configuration for data storage devices that are associated with mitigating one or more vulnerability types. ## Claims ### Claim 1 An information security device, comprising: a memory operable to store: data storage device information comprising approved data storage devices, wherein each approved data storage device is associated with one or more data content types; and security control information comprising a plurality of security controls, wherein: each security control is associated with mitigating one or more vulnerability types; and each security control comprises a hardware configuration for data storage devices; and a processor operably coupled to the memory, configured to: receive a data storage request comprising context information associated with storing a data element, wherein the context information identifies: a data content type for the data element; and a target data storage device; identify approved data storage devices corresponding with the data content type for the data element; compare the target data storage device to the approved data storage devices corresponding with the data content type for the data element; determine the target data storage device does not match an approved data storage device; determine a security level associated with the target data storage device, wherein the security level is based on security features associated with the target data storage device; determine vulnerability types associated with the determined security level of the target data storage device; identify security controls for the target data storage device based on the determined vulnerability types; and apply the identified security controls to the target data storage device to increase a level of information security provided to the target data storage device. ### Claim 2 (depends on 1) The device of claim 1, wherein the processor is further configured to: receive the data element; and store the data element in the target data storage device after applying the identified security controls. ### Claim 3 (depends on 1) The device of claim 1, wherein determining the security level associated with the target data storage device is based at least in part on a physical location of the target data storage device. ### Claim 4 (depends on 1) The device of claim 1, wherein determining the security level associated with the target data storage device is based at least in part on authentication protocols used by the target data storage device. ### Claim 5 (depends on 1) The device of claim 1, wherein the identified security control further comprises an authentication protocol for the target data storage device. ### Claim 6 (depends on 1) The device of claim 1, wherein the identified security control further comprises an encryption protocol for storing the data element. ### Claim 7 (depends on 1) The device of claim 1, wherein determining the security level associated with the target data storage device is based at least in part on a tamper protection level for the target data storage device. ### Claim 8 An information security method, comprising: receiving a data storage request comprising context information associated with storing a data element, wherein the context information identifies: a data content type for the data element; and a target data storage device; identifying approved data storage devices within previously stored data storage information corresponding with the data content type for the data element, wherein: data storage device information comprising approved data storage devices; and each approved data storage device is associated with one or more data content types; comparing the target data storage device to approved data storage devices corresponding with the data content type for the data element; determining the target data storage device does not match an approved data storage device; determining a security level associated with the target data storage device, wherein the security level is based on security features associated with the target data storage device; determining vulnerability types associated with the determined security level of the target data storage device; identifying security controls for the target data storage device based on the determined vulnerability types, wherein: each security control is associated with mitigating one or more vulnerability types; and each security control comprises a hardware configuration for data storage devices; and applying the identified security controls to the target data storage device to increase a level of information security provided to the target data storage device. ### Claim 9 (depends on 8) The method of claim 8, further comprising: receiving the data element; and storing the data element in the target data storage device after applying the identified security controls. ### Claim 10 (depends on 8) The method of claim 8, wherein determining the security level associated with the target data storage device is based at least in part on a physical location of the target data storage device. ### Claim 11 (depends on 8) The method of claim 8, wherein determining the security level associated with the target data storage device is based at least in part on authentication protocols used by the target data storage device. ### Claim 12 (depends on 8) The method of claim 8, wherein the identified security control further comprises an authentication protocol for the target data storage device. ### Claim 13 (depends on 8) The method of claim 8, wherein the identified security control further comprises an encryption protocol for storing the data element. ### Claim 14 (depends on 8) The method of claim 8, wherein determining the security level associated with the target data storage device is based at least in part on a tamper protection level for the target data storage device. ### Claim 15 A computer program comprising executable instructions stored in a non-transitory computer readable medium that when executed by a processor causes the processor to: receive a data storage request comprising context information associated with storing a data element, wherein the context information identifies: a data content type for the data element; and a target data storage device; identify approved data storage devices within previously stored data storage information corresponding with the data content type for the data element, wherein: data storage device information comprising approved data storage devices; and each approved data storage device is associated with one or more data content types; compare the target data storage device to approved data storage devices corresponding with the data content type for the data element; determine the target data storage device does not match an approved data storage device; determine a security level associated with the target data storage device, wherein the security level is based on security features associated with the target data storage device; determine vulnerability types associated with the determined security level of the target data storage device; identify security controls for the target data storage device based on the determined vulnerability types, wherein: each security control is associated with mitigating one or more vulnerability types; and each security control comprises a hardware configuration for data storage devices; and apply the identified security controls to the target data storage device to increase a level of information security provided to the target data storage device. ### Claim 16 (depends on 15) The computer program of claim 15, further comprising instructions that when executed by the processor causes the processor to: receive the data element; and store the data element in the target data storage device after applying the identified security controls. ### Claim 17 (depends on 15) The computer program of claim 15, wherein determining the security level associated with the target data storage device is based at least in part on a physical location of the target data storage device. ### Claim 18 (depends on 15) The computer program of claim 15, wherein determining the security level associated with the target data storage device is based at least in part on authentication protocols used by the target data storage device. ### Claim 19 (depends on 15) The computer program of claim 15, wherein the identified security control further comprises an authentication protocol for the target data storage device. ### Claim 20 (depends on 15) The computer program of claim 15, wherein determining the security level associated with the target data storage device is based at least in part on a tamper protection level for the target data storage device.