# US 11,308,234 B1 · Methods for protecting data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,308,234 B1 - Document ID: US11308234B1 - Status: Granted - Kind: B1 - Application number: 16/838,149 - Filed: 2020-04-02 - Granted: 2022-04-19 - Earliest claimed: 2020-04-02 - Assignees: Wells Fargo Bank, N.A. - Applicants: Wells Fargo Bank, N.A. - Inventors: Jeff J. Stapleton - Web page: https://patentgrep.com/patent/US11308234B1 ## CPC - G06F 21/6227: {where protection concerns the structure of data, e.g. records, types, queries} - G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes} - G06F 21/602: {Providing cryptographic facilities or services} - G06F 21/64: Protecting data integrity, e.g. using checksums, certificates or signatures - H04L 9/008: {involving homomorphic encryption} - G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems and methods utilized to protect data. One method includes maintaining, by one or more processing circuits in a production environment, encrypted data associated with a cryptographic function. The method further includes decrypting, by the one or more processing circuits in the production environment, the encrypted data to generate cleartext data. The method further includes encrypting, by the one or more processing circuits, the cleartext data using a homomorphic encryption function to generate ciphertext data. The method further includes masking, by the one or more processing circuits, the ciphertext data using a masking function to generate alternate ciphertext data. The method further includes decrypting, by the one or more processing circuits, the alternate ciphertext data to generate masked cleartext data and storing, by the one or more processing circuits in a lower environment, the masked cleartext data. ## Claims ### Claim 1 A method of protecting data, the method comprising: maintaining, by one or more processing circuits in a production database of a production environment system, encrypted data associated with a cryptographic function, wherein the production environment system is associated with a first access level; decrypting, by the one or more processing circuits in the production environment system, the encrypted data utilizing a first symmetric key to generate cleartext data; encrypting, by a second one or more processing circuits in a middle environment system, the cleartext data using a homomorphic encryption function to generate ciphertext data wherein the middle environment system is associated with a second access level, and wherein the middle environment system is a proxy and communicably coupled with the product environment system over a secure network; masking, by the second one or more processing circuits in the middle environment system, the ciphertext data using a masking function to generate alternate ciphertext data; decrypting, by the second one or more processing circuits in the middle environment system, the alternate ciphertext data utilizing a second symmetric key to generate masked cleartext data; and storing, by the second one or more processing circuits in a lower environment system, the masked cleartext data in a lower database, wherein the lower environment system is associated with a third access level, and wherein the middle environment system is the proxy and communicably coupled with the lower environment system over a network. ### Claim 2 (depends on 1) The method of claim 1, wherein the production environment system is inaccessible to a party having control over the lower environment system based on the first access level. ### Claim 3 (depends on 2) The method of claim 2, wherein both the production environment system and the lower environment system are associated with a provider institution, and wherein the production environment system is associated with applications available to external parties of the provider institution and the lower environment system is associated with applications available to internal parties of the provider institution. ### Claim 4 (depends on 1) The method of claim 1, wherein the encrypted data is the cleartext data that is encrypted using the cryptographic function in the production environment system, and wherein the encrypted data is associated with the first symmetric key. ### Claim 5 (depends on 4) The method of claim 4, wherein both the cleartext data and the first symmetric key is inaccessible to a party having control over the lower environment system based on the first access level, and wherein the party having control over the lower environment system executes experiments utilizing the masked cleartext data based on the third access level. ### Claim 6 (depends on 4) The method of claim 4, wherein the cleartext data comprises a plurality of data structures, and wherein the encrypted data is encrypted at a data structure level, the data structure level indicative of encrypting each individual data structure of the plurality of data structures. ### Claim 7 (depends on 1) The method of claim 1, wherein maintaining the encrypted data in the production environment system further comprises executing production environment code that generates the cleartext data and removes the cleartext data. ### Claim 8 (depends on 7) The method of claim 7, wherein the cleartext data generated by the production environment code is encrypted with the cryptographic function and stored in the production environment system. ### Claim 9 (depends on 1) The method of claim 1, wherein the homomorphic encryption function comprises manipulating the cleartext data using a plurality of mathematical operators. ### Claim 10 A method of protecting data, the method comprising: maintaining, by one or more processing circuits in a product database of a production environment system, ciphertext data associated with a homomorphic encryption function, wherein the production environment system is associated with a first access level; masking, by a second one or more processing circuits in a middle environment system, the ciphertext data using a masking function to generate alternate ciphertext data, wherein the middle environment system is associated with a second access level, and wherein the middle environment system is a proxy and communicably coupled with the product environment system over a secure network; decrypting, by the second one or more processing circuits in a middle environment system, the alternate ciphertext data utilizing a symmetric key to generate masked cleartext data; and storing, by the second one or more processing circuits in a lower environment system, the masked cleartext data in a lower database, wherein the lower environment system is associated with a third access level, and wherein the middle environment system is the proxy and communicably coupled with the lower environment system over a network. ### Claim 11 (depends on 10) The method of claim 10, wherein the production environment system is inaccessible to a party having control over the lower environment system based on the first access level. ### Claim 12 (depends on 11) The method of claim 11, wherein both the production environment system and the lower environment system are associated with a provider institution, and wherein the production environment system is associated with applications available to external parties of the provider institution and the lower environment system is associated with applications available to internal parties of the provider institution. ### Claim 13 (depends on 10) The method of claim 10, wherein the ciphertext data is cleartext data that is encrypted using the homomorphic encryption function in the production environment system, and wherein the ciphertext data is associated with the symmetric key. ### Claim 14 (depends on 13) The method of claim 13, wherein both the cleartext data and the symmetric key is inaccessible to a party having control over the lower environment system, and wherein the party having control over the lower environment system executes experiments utilizing the masked cleartext data based on the third access level. ### Claim 15 (depends on 13) The method of claim 13, wherein the cleartext data comprises a plurality of data structures, and wherein the ciphertext data is encrypted at a data structure level, the data structure level indicative of encrypting each individual data structure of the plurality of data structures. ### Claim 16 (depends on 10) The method of claim 10, wherein maintaining the ciphertext data in the production environment system further comprises executing production environment code that generates cleartext data and removes the cleartext data. ### Claim 17 (depends on 16) The method of claim 16, wherein the cleartext data generated by the production environment code is encrypted with the homomorphic encryption function and stored in the production environment system. ### Claim 18 (depends on 10) The method of claim 10, wherein the homomorphic encryption function comprises manipulating cleartext data using a plurality of mathematical operators. ### Claim 19 A system comprising: a first processing circuit configured to: maintain, in a production environment system, encrypted data associated with a cryptographic function, wherein the production environment system is associated with a first access level; decrypt, in the production environment, the encrypted data utilizing a first symmetric key to generate cleartext data; a second processing circuit configured to: encrypt, in a middle environment system, the cleartext data using a homomorphic encryption function to generate ciphertext data, wherein the middle environment system is associated with a second access level, and wherein the middle environment system is a proxy and communicably coupled with the product environment system over a secure network; mask, in a middle environment system, the ciphertext data using a masking function to generate alternate ciphertext data; decrypt, in a middle environment system, the alternate ciphertext data utilizing a second symmetric key to generate masked cleartext data; and store, in a lower environment system, the masked cleartext data in a lower database, wherein the lower environment system is associated with a third access level, and wherein the middle environment system is the proxy and communicably coupled with the lower environment system over a network. ### Claim 20 (depends on 19) The system of claim 19, wherein the encrypted data is the cleartext data that is encrypted using the cryptographic function in the production environment system, and wherein the production environment system is inaccessible to a party having control over the lower environment system based on the first access level.