# US 12,603,768 B2 · Systems and methods for providing and maintaining secure client-based permission lists

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,603,768 B2
- Document ID: US12603768B2
- Status: Granted
- Kind: B2
- Application number: 18/499,137
- Filed: 2023-10-31
- Published: 2025-05-01
- Granted: 2026-04-14
- Earliest claimed: 2023-10-31
- Assignees: JPMorgan Chase Bank, N.A.
- Applicants: Jpmorgan Chase Bank, N.A.
- Inventors: Ryan Boucher; Aswathram Thirupulisamy Ravisankar; Sujon Abul
- Web page: https://patentgrep.com/patent/US12603768B2

## CPC

- H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords}
- H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates}
- H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC}
- H04L 9/3247: {involving digital signatures}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

In some aspects, the techniques described herein relate to a method including: receiving, at an entitlement service and from a client application, a request for an entitlement token; signing, by the entitlement service, a permission file with a private key from a public-private key pair; generating, by the entitlement service, a composite key using a public key from the public-private key pair; encrypting, by the entitlement service, the permission file using the composite key as an encryption key in a symmetric encryption function, wherein encrypting the permission file generates the entitlement token; and sending the entitlement token to the client application.

## Claims

### Claim 1

A method comprising:
receiving, at a decoder library executing on a client device, a public key from a public-private key pair and a salt value;
generating, by the decoder library, a composite key using the public key from the public-private key pair, wherein generating the composite key includes providing a first output from a hashing function by hashing the public key as an input, wherein generating the composite key includes appending the salt value to the first output from the hashing function and providing the first output from the hashing function and the salt value appended to the first output from the hashing function to the hashing function as input, and receiving a second output from the hashing function, wherein the second output from the hashing function is converted into a byte array, and wherein the byte array is the composite key;
receiving, at the decoder library and from a client application, an encrypted entitlement token;
decrypting, by the decoder library, the encrypted entitlement token using the composite key as a symmetric key, wherein decrypting the encrypted entitlement token generates a signed permission file, and wherein the signed permission file is in clear text;
verifying, using the public key, that the signed permission file was signed using a private key from the public-private key pair;
determining, via a query of the signed permission file a permission indication for a service request; and
sending the permission indication to the client application.

### Claim 2 (depends on 1)

The method of claim 1, wherein the first output from the hashing function is converted into a base64 string value.

### Claim 3

A system comprising at least one computer including a processor and a memory, wherein the at least one computer is configured to:
receive, at a decoder library executing on the at least one computer, a public key from a public-private key pair and a salt value;
generate, by the decoder library, a composite key using the public key from the public-private key pair, wherein generating the composite key includes providing a first output from a hashing function by hashing the public key as an input, wherein generating the composite key includes appending the salt value to the first output from the hashing function and providing the first output from the hashing function and the salt value appended to the first output from the hashing function to the hashing function as input, and receiving a second output from the hashing function, wherein the second output from the hashing function is converted into a byte array, and wherein the byte array is the composite key;
receive, at the decoder library and from a client application, an encrypted entitlement token;
decrypt, by the decoder library, the encrypted entitlement token using the composite key as a symmetric key, wherein decrypting the encrypted entitlement token generates a signed permission file, and wherein the signed permission file is in clear text;
verify, using the public key, that the signed permission file was signed using a private key from the public-private key pair;
determine, via a query of the signed permission file a permission indication for a service request; and
send the permission indication to the client application.

### Claim 4

A non-transitory computer readable storage medium, including instructions stored thereon, which instructions, when read and executed by one or more computer processors, cause the one or more computer processors to perform steps comprising:
receiving, at a decoder library executing on a client device, a public key from a public-private key pair and a salt value;
generating, by the decoder library, a composite key using the public key from the public-private key pair, wherein generating the composite key includes providing a first output from a hashing function by hashing the public key as an input, wherein generating the composite key includes appending the salt value to the first output from the hashing function and providing the first output from the hashing function and the salt value appended to the first output from the hashing function to the hashing function as input, and receiving a second output from the hashing function, wherein the second output from the hashing function is converted into a byte array, and wherein the byte array is the composite key;
receiving, at the decoder library and from a client application, an encrypted entitlement token;
decrypting, by the decoder library, the encrypted entitlement token using the composite key, wherein decrypting the encrypted entitlement token generates a signed permission file, and wherein the signed permission file is in clear text;
verifying, using the public key, that the signed permission file was signed using a private key from the public-private key pair;
determining, via a query of the signed permission file a permission indication for a service request; and
sending the permission indication to the client application.