# US 2016/0260002 A1 · Access Control for Encrypted Data in Machine-Readable Identifiers > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2016/0260002 A1 - Document ID: US20160260002A1 - Status: Published application - Kind: A1 - Application number: 15/058,366 - Filed: 2016-03-02 - Published: 2016-09-08 - Earliest claimed: 2015-03-03 - Assignees: Wonderhealth, LLC - Applicants: WonderHealth, LLC - Inventors: Kenneth Hill; Katherine S. Hill - Web page: https://patentgrep.com/patent/US20160260002A1 ## CPC - G06F 21/36: by graphic or iconic representation - G06K 19/06037: {multi-dimensional coding} - G06F 21/6209: {to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself} - G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes} - G06K 7/10722: {Photodetector array or CCD scanning} - G06K 7/1443: {locating of the code in an image} - G06K 19/06028: {using bar codes} - G16H 10/65: stored on portable record carriers, e.g. on smartcards, RFID tags or CD - H04L 9/0816: {Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use} - H04L 9/0819: {Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) (network architectures or network communication protocols for key distribution in a packet data network H04L63/062)} - H04L 9/088: {Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068)} - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - H04L 9/14: using a plurality of keys or algorithms - H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy - G06F 2221/2149: Restricted operating environment - G16H 10/60: for patient-specific data, e.g. for electronic patient records - H04W 12/77: Graphical identity - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06K: GRAPHICAL DATA READING (image or video recognition or understanding G06V); PRESENTATION OF DATA; RECORD CARRIERS; HANDLING RECORD CARRIERS - G16H: HEALTHCARE INFORMATICS, i.e. INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR THE HANDLING OR PROCESSING OF MEDICAL OR HEALTHCARE DATA - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Disclosed are various embodiments for providing access control to the underlying data of a single machine-readable identifier when read by various reader devices. A client device may receive a first cryptographic key associated with a first device profile and a second cryptographic key associated with a second device profile. Data provided through an ingestion process is formatted into at least a first portion of data and a second portion of data, where the first portion of data is intended for a first reader device and the second portion of data is intended for a second reader device. The first portion of data may be encrypted using the first cryptographic key while the second portion of data is encrypted using the second cryptographic key. A machine-readable identifier may be generated using the first portion of data as encrypted and the second portion of data as encrypted. ## Claims ### Claim 1 A system, comprising: a client device comprising at least one hardware processor; a client application executable in the client device comprising program instructions that, when executed, cause the client device to: receive a first cryptographic key associated with a first device profile and a second cryptographic key associated with a second device profile over a network; access input data from a data store of the client device, the input data provided via at least one user interface generated by the client application; format the input data into at least a first portion of data and a second portion of data; encrypt the first portion of data using the first cryptographic key and the second portion of data using the second cryptographic key; and generate a machine-readable identifier using the first portion of data as encrypted and the second portion of data as encrypted for rendering in a display accessible by the client device. ### Claim 2 (depends on 1) The system of claim 1, wherein the machine-readable identifier is a first machine-readable identifier and the client application further comprises program instructions that, when executed, cause the client device to: identify a second machine-readable identifier in an image captured by a camera in communication with the client device, the second machine-readable identifier being generated by a device different than the client device; identify an amount of encrypted data from the second machine-readable identifier; decrypt the amount of encrypted data to identify decrypted data using the first cryptographic key or the second cryptographic key; and store the decrypted data in the data store for access by the client application. ### Claim 3 (depends on 2) The system of claim 2, wherein storing the decrypted data in the data store further comprises: identifying whether a conflict exists between the input data stored in the data store and the decrypted data; and storing the decrypted data in place of the input data stored in the data store. ### Claim 4 (depends on 1) The system of claim 1, further comprising: a first reader device associated with the first device profile having the first cryptographic key stored thereon; a second reader device associated with the second device profile having the second cryptographic key stored thereon; and wherein the first reader device is configured to access the first portion of data from the machine-readable identifier using the first cryptographic key and the second reader device is configured to access the second portion of data from the machine-readable identifier using the second cryptographic key. ### Claim 5 (depends on 4) The system of claim 4, wherein the first reader device comprises a first imaging device and the second reader device comprises a second imaging device, the machine-readable identifier being captured by the first imaging device or the second imaging device. ### Claim 6 (depends on 1) The system of claim 1, wherein the client application further comprises program instructions that, when executed, cause the client device to send the machine-readable identifier to another client device different from the client device. ### Claim 7 (depends on 1) The system of claim 1, wherein the machine-readable identifier is generated using an amount of decrypted data from the input data. ### Claim 8 (depends on 1) The system of claim 1, wherein the first cryptographic key associated with the first device profile is received by the client device from at least one remote computing device over the network in response to a selection of the first device profile made on the client device; and wherein the second cryptographic key associated with the second device profile is received by the client device from at least one remote computing device over the network in response to a selection of the second device profile made on the client device. ### Claim 9 (depends on 1) The system of claim 1, wherein encrypt the first portion of data using the first cryptographic key and the second portion of data using the second cryptographic key further comprises: identifying a first access level associated with the first portion of data; identifying a second access level associated with the second portion of data; encrypting the first portion of data using the first cryptographic key based at least in part on the first access level; and encrypting the second portion of data using the second cryptographic key based at least in part on the second access level, wherein the first access level is different than the second access level. ### Claim 10 (depends on 1) The system of claim 1, wherein the machine-readable identifier is a quick-response (QR) code or a bar code. ### Claim 11 A computer-implemented method, comprising: receiving, by a client device comprising at least one hardware processor, a first cryptographic key associated with a first device profile and a second cryptographic key associated with a second device profile over a network; accessing, by the client device, input data from a data store of the client device, the input data provided via at least one user interface generated by a client application executable on the client device; formatting, by the client device, the input data into at least a first portion of data and a second portion of data; encrypting, by the client device, the first portion of data using the first cryptographic key and the second portion of data using the second cryptographic key; and generating, by the client device, a machine-readable identifier using the first portion of data as encrypted and the second portion of data as encrypted for rendering in a display accessible by the client device. ### Claim 12 (depends on 11) The computer-implemented method of claim 11, wherein the machine-readable identifier is a first machine-readable identifier and the method further comprises: identifying, by the client device, a second machine-readable identifier in an image captured by a camera in communication with the client device, the second machine-readable identifier being generated by a device different than the client device; identifying, by the client device, an amount of encrypted data from the second machine-readable identifier; decrypting, by the client device, the amount of encrypted data to identify decrypted data using the first cryptographic key or the second cryptographic key; and storing, by the client device, the decrypted data in the data store for access by a client application. ### Claim 13 (depends on 12) The computer-implemented method of claim 12, wherein storing the decrypted data in the data store further comprises: identifying, by the client device, whether a conflict exists between the input data stored in the data store and the decrypted data; and storing, by the client device, the decrypted data in place of the input data stored in the data store. ### Claim 14 (depends on 11) The computer-implemented method of claim 11, further comprising: accessing, by a first reader device, the first portion of data from the machine-readable identifier using the first cryptographic key, the first reader device being associated with the first device profile and having the first cryptographic key stored thereon; and accessing, by a second reader device, the second portion of data from the machine-readable identifier using the second cryptographic key, the second reader device being associated with the second device profile and having the second cryptographic key stored thereon. ### Claim 15 (depends on 14) The computer-implemented method of claim 14, wherein the first reader device comprises a first imaging device and the second reader device comprises a second imaging device, the machine-readable identifier being captured by the first imaging device or the second imaging device. ### Claim 16 (depends on 11) The computer-implemented method of claim 11, further comprising sending, by the client device, the machine-readable identifier to another client device different from the client device over the network. ### Claim 17 (depends on 11) The computer-implemented method of claim 11, wherein the machine-readable identifier is generated using an amount of decrypted data from the input data. ### Claim 18 (depends on 11) The computer-implemented method of claim 11, wherein the first cryptographic key associated with the first device profile is received by the client device from at least one remote computing device over the network in response to a selection of the first device profile made on the client device; and wherein the second cryptographic key associated with the second device profile is received by the client device from at least one remote computing device over the network in response to a selection of the second device profile made on the client device. ### Claim 19 (depends on 11) The computer-implemented method of claim 11, wherein encrypting the first portion of data using the first cryptographic key and the second portion of data using the second cryptographic key further comprises: identifying, by the client device. a first access level associated with the first portion of data; identifying, by the client device. a second access level associated with the second portion of data; encrypting, by the client device. the first portion of data using the first cryptographic key based at least in part on the first access level; and encrypting, by the client device. the second portion of data using the second cryptographic key based at least in part on the second access level, wherein the first access level is different than the second access level. ### Claim 20 (depends on 11) The computer-implemented method of claim 11, wherein the machine-readable identifier is a quick-response (QR) code or a bar code.