US 2023/0053394 A1Published application

Object-Level Encryption

AssigneeCapital One Services, LLC

InventorsRocky Gray, Jeremy Green, Justin Bachorik, Irakli Nadareishvili

Life of this patent

Estimating the term…

Loading patent…

Abstract

A method, apparatus, system, or computer-readable medium for performing object-level encryption and key rotations is disclosed. A service platform may store data items organized into one or more asset clusters. A first content encryption key may be set as the active encryption key for an asset cluster. The active encryption key may be encrypted using the master encryption key. A first subset of data items may be encrypted using the active encryption key (e.g., the first content encryption key). After the number of data items encrypted using the active encryption key satisfies a threshold value, the first content encryption key may be set as an inactive encryption key and a second content encryption key may be set as the new active encryption key for the asset cluster. A second subset of the plurality of data items may be encrypted using the active encryption key (e.g., the second content encryption key).

Claims20

Dependent claims

A computer-implemented method comprising:

storing, using a data store, a plurality of asset clusters, each asset cluster comprising a plurality of data items and associated with an active encryption key;
and
for each asset cluster in the plurality of asset clusters:
generating a master encryption key;
generating, based on the master encryption key for the asset cluster, a first content encryption key;
setting the first content encryption key associated with the asset cluster as the active encryption key for the asset cluster;
encrypting a first subset of the plurality of data items of the asset cluster using the active encryption key and maintaining a count of a number of data items encrypted using the active encryption key;
determining the number of data items encrypted using the active encryption key exceeds a threshold value;
setting the first content encryption key as an inactive encryption key for the asset cluster;
generating, for the asset cluster and based on the master encryption key for the asset cluster, a second content encryption key;
setting the second content encryption key as the active encryption key for the asset cluster;
and
for a second subset of the plurality of data items in the asset cluster, encrypting the second subset of the plurality of data items using the active encryption key and maintaining a second count of the number of data items encrypted using the active encryption key.

10 more elements

An apparatus, comprising:

one or more processors;
and
memory storing instructions that, when executed by the one or more processors, cause the apparatus to:
store, using a data store, a plurality of asset clusters, each asset cluster comprising a plurality of data items and associated with an active encryption key;
and
for each asset cluster in the plurality of asset clusters:
generate a master encryption key;
generate, based on the master encryption key for the asset cluster, a first content encryption key;
set the first content encryption key associated with the asset cluster as the active encryption key for the asset cluster;
encrypt a first subset of the plurality of data items of the asset cluster using the active encryption key and maintaining a count of a number of data items encrypted using the active encryption key;
determine the number of data items encrypted using the active encryption key exceeds a threshold value;
set the first content encryption key as an inactive encryption key for the asset cluster;
generate, for the asset cluster and based on the master encryption key for the asset cluster, a second content encryption key;
set the second content encryption key as the active encryption key for the asset cluster;
and
for a second subset of the plurality of data items in the asset cluster, encrypt the second subset of the plurality of data items using the active encryption key and maintaining a second count of the number of data items encrypted using the active encryption key;
obtain, from a computing device, a request for a data item;
determine an asset cluster in the plurality of asset clusters storing the data item;
determine a content encryption key used to encrypt the data item, the content encryption key selected from the group consisting of the first content encryption key for the determined asset cluster and the second content encryption key for the determined asset cluster;
decrypt the data item using the determined content encryption key;
and
transmit the decrypted data item to the computing device.

19 more elements

A non-transitory machine-readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to perform steps comprising:

storing, using a data store, a plurality of asset clusters, each asset cluster comprising a plurality of data items and associated with an active encryption key;
for each asset cluster in the plurality of asset clusters:
generating, for each asset cluster, a master encryption key;
generating, for each asset cluster and based on the master encryption key for the asset cluster, a first content encryption key;
and
setting the first content encryption key associated with the asset cluster as the active encryption key for the asset cluster;
encrypting a first subset of the plurality of data items of the asset cluster using the active encryption key and maintaining a count of a number of data items encrypted using the active encryption key;
determining the number of data items encrypted using the active encryption key exceeds a threshold value;
setting the first content encryption key as an inactive encryption key for the asset cluster;
generating, for the asset cluster and based on the master encryption key for the asset cluster, a second content encryption key;
setting the second content encryption key as the active encryption key for the asset cluster;
and
for a second subset of the plurality of data items in the asset cluster, encrypting the second subset of the plurality of data items using the active encryption key and maintaining a second count of the number of data items encrypted using the active encryption key;
decrypting, based on generating the second content encryption key;
each of the first subset of the plurality of data items using the inactive encryption key;
encrypting each of the first subset of the plurality of data items using the active encryption key;
generating a second master encryption key for each asset cluster;
for each asset cluster in the plurality of asset clusters:
decrypting the active encryption key for the asset cluster using the master encryption key for the asset cluster;
encrypting the active encryption key for the asset cluster using the second master encryption key for the asset cluster;
decrypting the inactive encryption key for the asset cluster using the master encryption key for the asset cluster;
and
encrypting the inactive encryption key for the asset cluster using the second master encryption key for the asset cluster;
and
deleting the master encryption key for each asset cluster.

22 more elements

Dependencies are inferred from the claim text.

Facts

Application: 17/406,660Filed 19 Aug 2021
Published: 23 Feb 2023
Term ends: Not estimatedThe source records don’t support an estimate.

Classification13 codes

G06F 21/602
Protecting data: providing cryptographic facilities or services
H04L 9/0825
Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely…: using…
G06F 21/6218
Protecting access to data via a platform, e.g. using keys or access control rules: to a system of files or objects, e.g. local or distributed file…
H04L 9/0861
Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords: generation of secret information…

Family

US 11,943,338 B2Related patent
US 2023/0053394 A1This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key