# US 2026/0074884 A1 · Data scheme for dynamic encryption

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2026/0074884 A1
- Document ID: US20260074884A1
- Status: Published application
- Kind: A1
- Application number: 18/830,144
- Filed: 2024-09-10
- Published: 2026-03-12
- Earliest claimed: 2024-09-10
- Assignees: Mastercard International Incorporated
- Applicants: Mastercard International Incorporated
- Inventors: Preeti RAWAT; Prasan PAI; Shrill SHRESTHA
- Web page: https://patentgrep.com/patent/US20260074884A1

## CPC

- H04L 9/0819: {Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) (network architectures or network communication protocols for key distribution in a packet data network H04L63/062)}
- H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A system may access a data model comprising a plurality of field names and, for each field name from among the plurality of field names, a target encryption state that indicates whether data identified by the field name is to be encrypted. The system may receive an encryption trigger. The system may, responsive to the encryption trigger, for each encryption event from among one or more encryption events: identify a target encryption state for the data based on the data model, and execute an encryption process on the data based on the target encryption state. The encryption process may cause the data to be in the target encryption state.

## Claims

### Claim 1

A system for data model-based encryption, comprising:
a processor programmed to:
access a data model comprising a plurality of field names and, for each field name from among the plurality of field names, a target encryption state that indicates whether data identified by the field name is to be encrypted;
receive an encryption trigger;
responsive to the encryption trigger, for each encryption event from among one or more encryption events, execute an encryption process that causes the processor to:
identify a target encryption state for the data based on the data model; and
execute an encryption process on the data based on the target encryption state, the encryption process causing the data to be in the target encryption state.

### Claim 2 (depends on 1)

Then system of claim 1, wherein the encryption event is a key rotation event in which a prior encryption key is replaced with a current encryption key, and wherein the processor is further programmed to:
identify, based on the data model, data that is encrypted using the prior encryption key;
access the prior encryption key;
decrypt the data using the prior encryption key;
re-encrypt the decrypted data using the current encryption key; and
store an indication of the current encryption key used to encrypt the data.

### Claim 3 (depends on 1)

Then system of claim 1, wherein the encryption event is a new column event in which a new column is added to a table of a database, and wherein the processor is further programmed to:
identify, based on the data model, the new column; and
encrypt the data in the new column.

### Claim 4 (depends on 1)

Then system of claim 1, wherein the encryption event is a column removal event in which a column is to be removed from a table of a database, and wherein the processor is further programmed to:
identify, based on the data model, the column to be removed; and
decrypt the data in the column to be removed.

### Claim 5 (depends on 1)

Then system of claim 1, wherein the encryption event is a new row event in which a new row is added to a table of a database, and wherein the processor is further programmed to:
identify, based on the data model, the new row;
identify one or more columns in the new row to be encrypted; and
encrypt the data in each of the one or more columns.

### Claim 6 (depends on 1)

The system of claim 1, wherein the processor is programmed to:
determine that a current encryption state is unencrypted and the target encryption state is encrypted, and wherein to execute the encryption process, the processor is programmed to encrypt the data.

### Claim 7 (depends on 1)

The system of claim 1, wherein the processor is programmed to:
determine that a current encryption state is encrypted and the target encryption state is unencrypted, and wherein to execute the encryption process, the processor is programmed to decrypt the data.

### Claim 8 (depends on 1)

The system of claim 1, wherein the processor is further programmed to:
receive an input that changes an existing target encryption state corresponding to an existing field name; and
update the data model based on the input, wherein a subsequent execution of the encryption process changes the target encryption state of the existing field name consistent with the update.

### Claim 9 (depends on 1)

The system of claim 1, wherein to execute the encryption process, the processor is further programmed to:
encrypt the data based on an encryption key for application-level encryption.

### Claim 10 (depends on 1)

The system of claim 1, wherein each field name and corresponding target encryption state is stored as a key-value pair in the data model.

### Claim 11

A method, comprising:
accessing, by a processor, a data model comprising a plurality of field names and, for each field name from among the plurality of field names, a target encryption state that indicates whether data identified by the field name is to be encrypted;
receiving, by the processor, an encryption trigger;
responsive to the encryption trigger, for each encryption event from among one or more encryption events, executing, by the processor, an encryption process comprising:
identifying a target encryption state for the data based on the data model; and
executing an encryption process on the data based on the target encryption state, the encryption process causing the data to be in the target encryption state.

### Claim 12 (depends on 11)

Then method of claim 11, wherein the encryption event is a key rotation event in which a prior encryption key is replaced with a current encryption key, the method further comprising:
identifying, based on the data model, data that is encrypted using the prior encryption key;
accessing the prior encryption key;
decrypting the data using the prior encryption key;
re-encrypting the decrypted data using the current encryption key; and
storing an indication of the current encryption key used to encrypt the data.

### Claim 13 (depends on 11)

The method of claim 11, wherein the encryption event is a new column event in which a new column is added to a table of a database, the method further comprising:
identifying, based on the data model, the new column; and
encrypting the data in the new column.

### Claim 14 (depends on 11)

The method of claim 11, wherein the encryption event is a column removal event in which a column is to be removed from a table of a database, the method further comprising:
identifying, based on the data model, the column to be removed; and
decrypting the data in the column to be removed.

### Claim 15 (depends on 11)

The method of claim 11, wherein the encryption event is a new row event in which a new row is added to a table of a database, the method further comprising:
identifying, based on the data model, the new row;
identifying one or more columns in the new row to be encrypted; and
encrypting the data in each of the one or more columns.

### Claim 16 (depends on 11)

The method of claim 11, the method further comprising:
determining that a current encryption state is unencrypted and the target encryption state is encrypted, and wherein to execute the encryption process, the processor is programmed to encrypt the data.

### Claim 17 (depends on 11)

The method of claim 11, wherein the processor is programmed to:
determining that a current encryption state is encrypted and the target encryption state is unencrypted, and wherein executing the encryption process comprises decrypting the data.

### Claim 18 (depends on 1)

The system of claim 1, wherein executing the encryption process comprises:
encrypting the data based on an encryption key for application-level encryption.

### Claim 19

A non-transitory computer readable medium storing instructions that, when executed by a processor, program the processor to:
access a data model comprising at least a first database table and a second database table, wherein the first database table identifies a table having a plurality of columns that are subject to dynamic encryption, and the second database table stores, for each column from among the plurality of columns, a corresponding target encryption state for the data stored in that column,
receive an encryption trigger;
responsive to the encryption trigger, identify the table, one or more columns in the table, and the corresponding target encryption state of the one or more columns; and
execute an encryption process that causing the data in each of the one or more columns to be in the target encryption state based on the data model.

### Claim 20 (depends on 19)

The non-transitory computer readable medium of claim 19, wherein to execute the encryption process, the instructions when executed further program the processor to:
encrypt or decrypt the data in the one or more columns depending on whether or not the data is encrypted.