# US 2023/0053394 A1 · Object-Level Encryption

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2023/0053394 A1
- Document ID: US20230053394A1
- Status: Published application
- Kind: A1
- Application number: 17/406,660
- Filed: 2021-08-19
- Published: 2023-02-23
- Earliest claimed: 2021-08-19
- Assignees: Capital One Services, LLC
- Applicants: Capital One Services, LLC
- Inventors: Rocky Gray; Jeremy Green; Justin Bachorik; Irakli Nadareishvili
- Web page: https://patentgrep.com/patent/US20230053394A1

## CPC

- G06F 21/602: {Providing cryptographic facilities or services}
- H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates}
- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords}
- H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 9/14: using a plurality of keys or algorithms
- H04L 63/065: {for group communications (cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833)}
- H04L 63/068: {using time-dependent keys, e.g. periodically changing keys (cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088)}
- H04L 67/1097: for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
- G06F 2221/2107: File encryption
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A method, apparatus, system, or computer-readable medium for performing object-level encryption and key rotations is disclosed. A service platform may store data items organized into one or more asset clusters. A first content encryption key may be set as the active encryption key for an asset cluster. The active encryption key may be encrypted using the master encryption key. A first subset of data items may be encrypted using the active encryption key (e.g., the first content encryption key). After the number of data items encrypted using the active encryption key satisfies a threshold value, the first content encryption key may be set as an inactive encryption key and a second content encryption key may be set as the new active encryption key for the asset cluster. A second subset of the plurality of data items may be encrypted using the active encryption key (e.g., the second content encryption key).

## Claims

### Claim 1

A computer-implemented method comprising:
storing, using a data store, a plurality of asset clusters, each asset cluster comprising a plurality of data items and associated with an active encryption key; and
for each asset cluster in the plurality of asset clusters:
generating a master encryption key;
generating, based on the master encryption key for the asset cluster, a first content encryption key;
setting the first content encryption key associated with the asset cluster as the active encryption key for the asset cluster;
encrypting a first subset of the plurality of data items of the asset cluster using the active encryption key and maintaining a count of a number of data items encrypted using the active encryption key;
determining the number of data items encrypted using the active encryption key exceeds a threshold value;
setting the first content encryption key as an inactive encryption key for the asset cluster;
generating, for the asset cluster and based on the master encryption key for the asset cluster, a second content encryption key;
setting the second content encryption key as the active encryption key for the asset cluster; and
for a second subset of the plurality of data items in the asset cluster, encrypting the second subset of the plurality of data items using the active encryption key and maintaining a second count of the number of data items encrypted using the active encryption key.

### Claim 2 (depends on 1)

The computer-implemented method of claim 1, further comprising:
decrypting, based on generating the second content encryption key; each of the first subset of the plurality of data items for the asset cluster using the inactive encryption key; and
encrypting each of the first subset of the plurality of data items for the asset cluster using the active encryption key.

### Claim 3 (depends on 2)

The computer-implemented method of claim 2, further comprising:
resetting, based on decrypting each of the first subset of the plurality of data items, the inactive encryption key to a default value; and
deleting the first content encryption key.

### Claim 4 (depends on 1)

The computer-implemented method of claim 1, further comprising:
determining a threshold time period has elapsed;
setting the second content encryption key as an inactive encryption key for the asset cluster;
generating, for the asset cluster and based on the master encryption key for the asset cluster, a third content encryption key; and
setting the third content encryption key as the active encryption key for the asset cluster.

### Claim 5 (depends on 1)

The computer-implemented method of claim 1, wherein each asset cluster in the plurality of asset clusters is associated with a third-party service.

### Claim 6 (depends on 1)

The computer-implemented method of claim 1, wherein:
the master encryption key is stored using an external security store and inaccessible to any third-party services; and
the first content encryption key and the second content encryption key are generated by providing a request indicating an asset cluster in the plurality of asset clusters to the external security store and receiving a response from the external security store.

### Claim 7 (depends on 1)

The computer-implemented method of claim 1, further comprising:
obtaining, from a computing device, a request for a data item;
determining an asset cluster in the plurality of asset clusters storing the data item;
determining a content encryption key used to encrypt the data item, the content encryption key selected from the group consisting of the first content encryption key for the determined asset cluster and the second content encryption key for the determined asset cluster;
decrypting the data item using the determined content encryption key; and
transmitting the decrypted data item to the computing device.

### Claim 8 (depends on 1)

The computer-implemented method of claim 1, further comprising:
generating a second master encryption key for each asset cluster;
for each asset cluster in the plurality of asset clusters:
decrypting the active encryption key for the asset cluster using the master encryption key for the asset cluster;
encrypting the active encryption key for the asset cluster using the second master encryption key for the asset cluster;
decrypting the inactive encryption key for the asset cluster using the master encryption key for the asset cluster; and
encrypting the inactive encryption key for the asset cluster using the second master encryption key for the asset cluster; and
deleting the master encryption key for each asset cluster.

### Claim 9

An apparatus, comprising:
one or more processors; and
memory storing instructions that, when executed by the one or more processors, cause the apparatus to:
store, using a data store, a plurality of asset clusters, each asset cluster comprising a plurality of data items and associated with an active encryption key; and
for each asset cluster in the plurality of asset clusters:
generate a master encryption key;
generate, based on the master encryption key for the asset cluster, a first content encryption key;
set the first content encryption key associated with the asset cluster as the active encryption key for the asset cluster;
encrypt a first subset of the plurality of data items of the asset cluster using the active encryption key and maintaining a count of a number of data items encrypted using the active encryption key;
determine the number of data items encrypted using the active encryption key exceeds a threshold value;
set the first content encryption key as an inactive encryption key for the asset cluster;
generate, for the asset cluster and based on the master encryption key for the asset cluster, a second content encryption key;
set the second content encryption key as the active encryption key for the asset cluster; and
for a second subset of the plurality of data items in the asset cluster, encrypt the second subset of the plurality of data items using the active encryption key and maintaining a second count of the number of data items encrypted using the active encryption key;
obtain, from a computing device, a request for a data item;
determine an asset cluster in the plurality of asset clusters storing the data item;
determine a content encryption key used to encrypt the data item, the content encryption key selected from the group consisting of the first content encryption key for the determined asset cluster and the second content encryption key for the determined asset cluster;
decrypt the data item using the determined content encryption key; and
transmit the decrypted data item to the computing device.

### Claim 10 (depends on 9)

The apparatus of claim 9, wherein the instructions, when executed by the one or more processors, cause the apparatus to:
decrypt, based on generating the second content encryption key; each of the first subset of the plurality of data items using the inactive encryption key; and
encrypt each of the first subset of the plurality of data items using the active encryption key.

### Claim 11 (depends on 9)

The apparatus of claim 9, wherein the instructions, when executed by the one or more processors, cause the apparatus to:
reset, based on decrypting each of the first subset of the plurality of data items, the inactive encryption key to a default value; and
deleting the first content encryption key.

### Claim 12 (depends on 9)

The apparatus of claim 9, wherein the instructions, when executed by the one or more processors, cause the apparatus to:
determine a threshold time period has elapsed;
set the second content encryption key as an inactive encryption key for the asset cluster;
generate, for the asset cluster and based on the master encryption key for the asset cluster, a third content encryption key; and
set the third content encryption key as the active encryption key for the asset cluster.

### Claim 13 (depends on 9)

The apparatus of claim 9, wherein each asset cluster in the plurality of asset clusters is associated with a third-party service.

### Claim 14 (depends on 9)

The apparatus of claim 9, wherein:
the master encryption key is stored using an external security store and inaccessible to any third-party services; and
the first content encryption key and the second content encryption key are generated by providing a request indicating an asset cluster in the plurality of asset clusters to the external security store and receiving a response from the external security store.

### Claim 15 (depends on 9)

The apparatus of claim 9, wherein the instructions, when executed by the one or more processors, cause the apparatus to:
generate a second master encryption key for each asset cluster;
for each asset cluster in the plurality of asset clusters:
decrypt the active encryption key for the asset cluster using the master encryption key for the asset cluster;
encrypt the active encryption key for the asset cluster using the second master encryption key for the asset cluster;
decrypt the inactive encryption key for the asset cluster using the master encryption key for the asset cluster; and
encrypt the inactive encryption key for the asset cluster using the second master encryption key for the asset cluster; and
delete the master encryption key for each asset cluster.

### Claim 16

A non-transitory machine-readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to perform steps comprising:
storing, using a data store, a plurality of asset clusters, each asset cluster comprising a plurality of data items and associated with an active encryption key;
for each asset cluster in the plurality of asset clusters:
generating, for each asset cluster, a master encryption key;
generating, for each asset cluster and based on the master encryption key for the asset cluster, a first content encryption key; and
setting the first content encryption key associated with the asset cluster as the active encryption key for the asset cluster;
encrypting a first subset of the plurality of data items of the asset cluster using the active encryption key and maintaining a count of a number of data items encrypted using the active encryption key;
determining the number of data items encrypted using the active encryption key exceeds a threshold value;
setting the first content encryption key as an inactive encryption key for the asset cluster;
generating, for the asset cluster and based on the master encryption key for the asset cluster, a second content encryption key;
setting the second content encryption key as the active encryption key for the asset cluster; and
for a second subset of the plurality of data items in the asset cluster, encrypting the second subset of the plurality of data items using the active encryption key and maintaining a second count of the number of data items encrypted using the active encryption key;
decrypting, based on generating the second content encryption key; each of the first subset of the plurality of data items using the inactive encryption key;
encrypting each of the first subset of the plurality of data items using the active encryption key;
generating a second master encryption key for each asset cluster;
for each asset cluster in the plurality of asset clusters:
decrypting the active encryption key for the asset cluster using the master encryption key for the asset cluster;
encrypting the active encryption key for the asset cluster using the second master encryption key for the asset cluster;
decrypting the inactive encryption key for the asset cluster using the master encryption key for the asset cluster; and
encrypting the inactive encryption key for the asset cluster using the second master encryption key for the asset cluster; and
deleting the master encryption key for each asset cluster.

### Claim 17 (depends on 16)

The non-transitory machine-readable medium of claim 16, wherein the instructions, when executed by the one or more processors, cause the one or more processors to perform steps comprising:
obtaining, from a computing device, a request for a data item;
determining an asset cluster in the plurality of asset clusters storing the data item;
determining a content encryption key used to encrypt the data item, the content encryption key selected from the group consisting of the first content encryption key for the determined asset cluster and the second content encryption key for the determined asset cluster;
decrypting the data item using the determined content encryption key; and
transmitting the decrypted data item to the computing device.

### Claim 18 (depends on 16)

The non-transitory machine-readable medium of claim 16, wherein the instructions, when executed by the one or more processors, cause the one or more processors to perform steps comprising:
determining a threshold time period has elapsed;
setting the second content encryption key as an inactive encryption key for the asset cluster;
generating, for the asset cluster and based on the master encryption key for the asset cluster, a third content encryption key; and
setting the third content encryption key as the active encryption key for the asset cluster.

### Claim 19 (depends on 16)

The non-transitory machine-readable medium of claim 16, wherein the instructions, when executed by the one or more processors, cause the one or more processors to perform steps comprising:
resetting, based on decrypting each of the first subset of the plurality of data items, the inactive encryption key to a default value; and
deleting the first content encryption key.

### Claim 20 (depends on 16)

The non-transitory machine-readable medium of claim 16, wherein:
the master encryption key is stored using an external security store and inaccessible to any third-party services; and
the first content encryption key and the second content encryption key are generated by providing a request indicating an asset cluster in the plurality of asset clusters to the external security store and receiving a response from the external security store.