# US 2025/0094618 A1 · Virtual keys for column dataset access management > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2025/0094618 A1 - Document ID: US20250094618A1 - Status: Published application - Kind: A1 - Application number: 18/369,942 - Filed: 2023-09-19 - Published: 2025-03-20 - Earliest claimed: 2023-09-19 - Assignees: Uber Technologies, Inc. - Applicants: Uber Technologies, Inc. - Inventors: Huicheng Song; Xinli Shang - Web page: https://patentgrep.com/patent/US20250094618A1 ## CPC - G06F 21/6227: {where protection concerns the structure of data, e.g. records, types, queries} - G06F 21/602: {Providing cryptographic facilities or services} - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - H04L 9/0822: {using key encryption key} - H04L 9/088: {Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068)} - H04L 9/3297: {involving time stamps, e.g. generation of time stamps} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A key management system can store, in a tag repository, information associating policy tags with column datasets. The system can receive a client request for an encrypted encryption key (EEK) to access a column dataset, where the client request includes a column name for the column dataset. Based on the client request, the system can perform a lookup in the tag repository to identify one or more tags associated with the column dataset and determine whether the client device is authorized to access the column dataset. Based on determining that the client device is authorized to access the column dataset, the system can generate an original encryption key, and generate the EEK using a shared master key, the original encryption key, and at least the column name for the column dataset. The system may then provide the EEK to the client device over the one or more networks. ## Claims ### Claim 1 A key management system implementing column-level access control, comprising: a tag repository storing information associating policy tags with column datasets; a network communication interface to communicate over one or more networks; one or more processors; and a memory storing instructions that, when executed by the one or more processors, cause the key management system to: receive, from a client device over the one or more networks, a client request for an encrypted encryption key (EEK) to access a column dataset, the client request including a column name for the column dataset; based on the client request, perform a lookup in the tag repository to identify one or more tags associated with the column dataset and determine whether the client device is authorized to access the column dataset; based on determining that the client device is authorized to access the column dataset, (i) generate an original encryption key, and (ii) generate the EEK using a shared master key, the original encryption key, and at least the column name for the column dataset; and provide the EEK to the client device over the one or more networks. ### Claim 2 (depends on 1) The key management system of claim 1, wherein the client request further includes (i) a dataset name for a data table that includes the column dataset and (ii) a timestamp for the column dataset, and wherein the instructions, when executed, cause the key management system to perform the lookup in the tag repository using the dataset name and the timestamp. ### Claim 3 (depends on 2) The key management system of claim 2, wherein the instructions, when executed, cause the key management system to generate the EEK using the dataset name and the timestamp. ### Claim 4 (depends on 3) The key management system of claim 3, wherein the instructions, when executed, further cause the key management system to: subsequent to providing the EEK to the client device, receive, over the one or more networks, a decrypt EEK request from the client device, the decrypt EEK request including data corresponding to the dataset name, the column name, the timestamp, and the EEK; query the tag repository to identify the one or more tags associated with the column dataset and determine whether the client device is authorized to access the column dataset; and based on determining that the client device is authorized to access the column dataset, decrypt the EEK using the shared master key and provide, over the one or more networks, the original encryption key to the client device to enable access to the column dataset. ### Claim 5 (depends on 2) The key management system of claim 2, wherein the shared master key is a time-based physical key that is associated with a time-to-live (TTL) to facilitate data retention enforcement. ### Claim 6 (depends on 5) The key management system of claim 5, wherein the TTL of the shared master key corresponds to the timestamp of the column dataset. ### Claim 7 (depends on 1) The key management system of claim 1, wherein the instructions, when executed, further cause the key management system to: receive data corresponding to a tag change for the column dataset; and configure the one or more tags associated with the column dataset in the tag repository to implement the tag change. ### Claim 8 (depends on 7) The key management system of claim 7, wherein the tag change does not require re-encryption or a rewrite of the column dataset. ### Claim 9 A non-transitory computer readable medium storing instructions that, when executed by one or more processors of a computing system, cause the computing system to: store, in a tag repository, information associating policy tags with column datasets; receive, from a client device over one or more networks, a client request for an encrypted encryption key (EEK) to access a column dataset, the client request including a column name for the column dataset; based on the client request, perform a lookup in the tag repository to identify one or more tags associated with the column dataset and determine whether the client device is authorized to access the column dataset; based on determining that the client device is authorized to access the column dataset, (i) generate an original encryption key, and (ii) generate the EEK using a shared master key, the original encryption key, and at least the column name for the column dataset; and provide the EEK to the client device over the one or more networks. ### Claim 10 (depends on 9) The non-transitory computer readable medium of claim 9, wherein the client request further includes (i) a dataset name for a data table that includes the column dataset and (ii) a timestamp for the column dataset, and wherein the instructions, when executed, cause the key management system to perform the lookup in the tag repository using the dataset name and the timestamp. ### Claim 11 (depends on 10) The non-transitory computer readable medium of claim 10, wherein the instructions, when executed, cause the computing system to generate the EEK using the dataset name and the timestamp. ### Claim 12 (depends on 11) The non-transitory computer readable medium of claim 11, wherein the instructions, when executed, further cause the computing system to: subsequent to providing the EEK to the client device, receive, over the one or more networks, a decrypt EEK request from the client device, the decrypt EEK request including data corresponding to the dataset name, the column name, the timestamp, and the EEK; query the tag repository to identify the one or more tags associated with the column dataset and determine whether the client device is authorized to access the column dataset; and based on determining that the client device is authorized to access the column dataset, decrypt the EEK using the shared master key and provide, over the one or more networks, the original encryption key to the client device to enable access to the column dataset. ### Claim 13 (depends on 10) The non-transitory computer readable medium of claim 10, wherein the shared master key is a time-based physical key that is associated with a time-to-live (TTL) to facilitate data retention enforcement. ### Claim 14 (depends on 13) The non-transitory computer readable medium of claim 13, wherein the TTL of the shared master key corresponds to the timestamp of the column dataset. ### Claim 15 (depends on 9) The non-transitory computer readable medium of claim 9, wherein the instructions, when executed, further cause the computing system to: receive data corresponding to a tag change for the column dataset; and configure the one or more tags associated with the column dataset in the tag repository to implement the tag change. ### Claim 16 (depends on 15) The non-transitory computer readable medium of claim 15, wherein the tag change does not require re-encryption or a rewrite of the column dataset. ### Claim 17 A computer-implemented method of managing column-level access control, the method being performed by one or more processors and comprising: storing, in a tag repository, information associating policy tags with column datasets; receiving, from a client device over one or more networks, a client request for an encrypted encryption key (EEK) to access a column dataset, the client request including a column name for the column dataset; based on the client request, performing a lookup in the tag repository to identify one or more tags associated with the column dataset and determine whether the client device is authorized to access the column dataset; based on determining that the client device is authorized to access the column dataset, (i) generating an original encryption key, and (ii) generating the EEK using a shared master key, the original encryption key, and at least the column name for the column dataset; and providing the EEK to the client device over the one or more networks. ### Claim 18 (depends on 17) The method of claim 17, wherein the client request further includes (i) a dataset name for a data table that includes the column dataset and (ii) a timestamp for the column dataset, and wherein the instructions, when executed, cause the key management system to perform the lookup in the tag repository using the dataset name and the timestamp. ### Claim 19 (depends on 18) The method of claim 18, wherein the one or more processors generate the EEK using the dataset name and the timestamp. ### Claim 20 (depends on 19) The method of claim 19, further comprising: subsequent to providing the EEK to the client device, receiving, over the one or more networks, a decrypt EEK request from the client device, the decrypt EEK request including data corresponding to the dataset name, the column name, the timestamp, and the EEK; querying the tag repository to identify the one or more tags associated with the column dataset and determine whether the client device is authorized to access the column dataset; and based on determining that the client device is authorized to access the column dataset, decrypting the EEK using the shared master key and provide, over the one or more networks, the original encryption key to the client device to enable access to the column dataset.