Back to results
US 11,689,535 B2Granted
Systems and methods for secure data access control
AssigneeCapital One Services, LLC
InventorsSuresh Pandey, Sebastian Smith, Hala Salim El-Ali
Life of this patent
Estimating the term…
Abstract
A computer system for secure data access control, according to some examples, may perform operations including: receiving first data from a first client associated with a first user; using a first data access agent to store the first data in a first data store, the first data access agent having access to the first data store and not having access to a second data store; receiving second data from a second client associated with a second user; and using a second data access agent to store the second data in the second data store, the second data access agent having access to the second data store and not having access to the first data store.
Claims20
A computer-implemented method for secure data access control, comprising:
- receiving, by a main application, a request to retrieve, store, or modify data in a data store from a client associated with a user;
- based on the request, determining, by a routing application, an identifier of the user, wherein the routing application has an access account without permission to access the data store;
- retrieving, by the routing application, an encryption key corresponding to the identifier of the user;
- generating, by the routing application, a hash using a hash function of the encryption key;
- based on the request and the hash, invoking, by the routing application, a data access agent corresponding to the identifier of the user, the data access agent having an access account with a set of permissions permitting the data access agent to access the data store and not permitting the data access agent to access data stores accessible to other data access agents;
- retrieving, by the invoked data access agent, the encryption key using the identifier of the user;
- generating, by the invoked data access agent, a new hash using the hash function of the encryption key;
- verifying, by the invoked data access agent, the hash generated by the routing application based on a determination that the new hash is the same as the hash;
- and
- accessing, by the invoked data access agent, the data store accessible to the invoked data access agent to perform the request.
7 more elements
A computer system for secure data access control, comprising:
- a memory storing instructions;
- and
- one or more processors configured to execute the instructions to perform operations including:
- receiving, by a main application, a request to retrieve, store, or modify data in a data store from a client associated with a user;
- based on the request, determining, by a routing application, an identifier of the user, wherein the routing application has an access account without permission to access the data store;
- retrieving, by the routing application, an encryption key corresponding to the identifier of the user;
- generating, by the routing application, a hash using a hash function of the encryption key;
- based on the request and the hash, invoking, by the routing application, a data access agent corresponding to the identifier of the user, the data access agent having an access account with a set of permissions permitting the data access agent to access the data store and not permitting the data access agent to access data stores accessible to other data access agents;
- retrieving, by the invoked data access agent, the encryption key using the identifier of the user;
- generating, by the invoked data access agent, a new hash using the hash function of the encryption key;
- verifying, by the invoked data access agent, the hash generated by the routing application based on a determination that the new hash is the same as the hash;
- and
- accessing, by the invoked data access agent, the data store accessible to the invoked data access agent to perform the request.
10 more elements
A computer-implemented method for secure data access control, comprising:
- receiving, by a main application, a request to retrieve, store, or modify data in a data store from a client associated with a user;
- based on the request, determining, by a routing application, an identifier of the user, wherein the routing application has an access account without permission to access the data store, wherein the main application and the routing application are separate applications;
- retrieving, by the routing application, an encryption key corresponding to the identifier of the user;
- generating, by the routing application, a hash using a hash function of the encryption key;
- based on the request and the hash, invoking, by the routing application, a data access agent corresponding to the identifier of the user, the data access agent having an access account with a set of permissions permitting the data access agent to access the data store and not permitting the data access agent to access data stores accessible to other data access agents;
- retrieving, by the invoked data access agent, the encryption key using the identifier of the user, wherein the data access agent has access to only encryption keys that are associated with the identifier of the user;
- generating, by the invoked data access agent, a new hash of the encryption key using the hash function;
- determining, by the invoked data access agent, whether the new hash is the same as the hash generated by the routing application;
- in accordance with a determination that the new hash is the same as the hash generated by the routing application, verifying, by the invoked data access agent, the hash generated by the routing application;
- and
- accessing, by the invoked data access agent, the data store accessible to the invoked data access agent to perform the request.
8 more elements
Dependencies are inferred from the claim text.