# US 2019/0318112 A1 · System and method for automatically securing sensitive data in public cloud using a serverless architecture > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0318112 A1 - Document ID: US20190318112A1 - Status: Published application - Kind: A1 - Application number: 16/294,630 - Filed: 2019-03-06 - Published: 2019-10-17 - Earliest claimed: 2018-04-11 - Assignees: Capital One Services, LLC - Applicants: Capital One Services, LLC. - Inventors: Nathal L. FONSEKA; Ankit PANSARI - Web page: https://patentgrep.com/patent/US20190318112A1 ## CPC - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F 16/162: {Delete operations (erasing in storage systems G06F3/0652)} - G06F 21/602: {Providing cryptographic facilities or services} - G06F 21/604: {Tools and structures for managing or administering access control systems} - G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes} - G06F 2221/2115: Third party - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Systems and methods are provided executing jobs immediately upon receipt of a notification. The systems and methods may include receiving, at a cloud compute service, a notification that a sensitive file comprising sensitive data has been received at a file receipt location, the sensitive file being sent by a client device; generating, by the cloud compute service, a container instance in response to the notification; retrieving, by the container instance, the sensitive file from the file receipt location; generating, by the container instance, a stripped file by stripping the sensitive data from the sensitive file based on a configuration file; transmitting, by the container instance, the stripped file to a storage location; deleting the sensitive file and associated file pointers from the file receipt location; and terminating the container instance, wherein terminating the container instance comprises deleting files comprising sensitive data and associated file pointers. ## Claims ### Claim at position 1 1-20. (canceled) ### Claim 21 A cloud compute service system comprising: one or more hardware processors; and a memory unit storing instructions executable by the one or more hardware processors to perform operations comprising: receiving a notification that a sensitive file comprising sensitive data has been received at a file receipt location; selecting a first warm container instance for completing a job comprising stripping the sensitive data from the first sensitive file; receiving, from the first warm container instance, a report to the cloud compute service; terminating the first warm container instance based on the report; and selecting a second warm container instance for completing the job. ### Claim 22 (depends on 21) The system of claim 21, wherein the operations further comprise: retrieving, through the second warm container instance, the sensitive file from the file receipt location; generating, at the second warm container instance, a stripped file by stripping the sensitive data from the sensitive file based on a configuration file; transmitting the stripped file from the second warm container instance to a first storage location. deleting the sensitive file and associated file pointers from the file receipt location; and terminating the second warm container instance based on the report. ### Claim 23 (depends on 21) The system of claim 21, wherein the report comprises at least one of a job status or an error message. ### Claim 24 (depends on 21) The system of claim 21, wherein selecting the first warm container instance is based on at least one of performance criteria or security criteria. ### Claim 25 (depends on 24) The system of claim 24, wherein the performance criteria comprises at least one of an estimated processing cost or an estimated runtime. ### Claim 26 (depends on 24) The system of claim 24, wherein the security criteria comprises at least one of comparing the total runtime of the first warm container instance to a threshold runtime or comparing the total number of jobs performed to threshold number of jobs. ### Claim 27 (depends on 21) The system of claim 21, wherein terminating the first warm container instance comprises: deleting the sensitive data from the first warm container instance; and deleting file pointers associated with the sensitive data from the first warm container instance, the file pointers indicating a memory address of blocks of sensitive data. ### Claim 28 (depends on 21) The system of claim 21, wherein selecting the first warm container instance is based on at least one of performance criteria or security criteria. ### Claim 29 (depends on 28) The system of claim 28, wherein the performance criteria comprises at least one of an estimated processing cost or an estimated runtime. ### Claim 30 (depends on 28) The system of claim 28, wherein the security criteria comprises at least one of comparing the total runtime of the second warm container instance to a threshold runtime or comparing the total number of jobs performed to threshold number of jobs. ### Claim 31 (depends on 22) The system of claim 22, wherein terminating the second warm container instance comprises: deleting sensitive data of the sensitive files from the second warm container instance; and deleting file pointers associated with the sensitive data from the second warm container instance, the file pointers indicating a memory address of blocks of sensitive data. ### Claim 32 (depends on 21) The system of claim 21, wherein receiving a notification comprises receiving a notification that a sensitive file has been received at a file receipt location from a client device. ### Claim 33 (depends on 22) The system of claim 22, wherein generating the stripped file further comprises: performing data analysis on data contained in the sensitive file; and including a result of the data analysis in the stripped file. ### Claim 34 (depends on 22) The system of claim 22, wherein deleting the sensitive file from the file receipt location comprises: sending, by the cloud compute service, an instruction to the file receipt location, the instruction comprising a command to destroy the sensitive file. ### Claim 35 A method for stripping sensitive data from files, comprising: receiving a notification that a sensitive file comprising sensitive data has been received at a file receipt location; selecting a first warm container instance for completing a job comprising stripping the sensitive data from the first sensitive file; receiving, from the first warm container instance, a report to the cloud compute service; terminating the first warm container instance based on the report; and selecting a second warm container instance for completing the job. ### Claim 36 (depends on 35) The method of claim 35, wherein the report comprises at least one of a job status or an error message. ### Claim 37 (depends on 35) The method of claim 35, wherein the operations further comprise: retrieving, through the second warm container instance, the sensitive file from the file receipt location; generating, at the second warm container instance, a stripped file by stripping the sensitive data from the sensitive file based on a configuration file; transmitting the stripped file from the second warm container instance to a first storage location; deleting the sensitive file and associated file pointers from the file receipt location; and terminating the second warm container instance based on the report. ### Claim 38 (depends on 35) The method of claim 35, wherein terminating the first warm container instance comprises: deleting the sensitive data from the first warm container instance; and deleting file pointers associated with the sensitive data from the first warm container instance, the file pointers indicating a memory address of blocks of sensitive data. ### Claim 39 (depends on 37) The method of claim 37, wherein terminating the second warm container instance comprises: deleting the sensitive data from the second warm container instance; and deleting file pointers associated with the sensitive data from the second warm container instance, the file pointers indicating a memory address of blocks of sensitive data. ### Claim 40 A cloud compute service system comprising: one or more hardware processors; and a memory unit storing instructions executable by the one or more hardware processors to perform operations comprising: receiving a notification that a sensitive file comprising sensitive data has been received at a file receipt location; selecting a first warm container instance in response to the notification; assigning, to the first warm container instance, a job comprising stripping the sensitive data from the first sensitive file, wherein the assigning comprises providing to the first warm container instance a file identifier of the sensitive file; receiving, from the first warm container instance, a report comprising at least one of a job status or an error message; and terminating the first warm container instance based on the report.