US 12,088,596 B2
Systems and methods for secure data access control
Suresh Pandey, McKinney, TX (US); Sebastian Smith, Plano, TX (US); and Hala Salim El-Ali, Murphy, TX (US)
Assigned to Capital One Services, LLC, McLean, VA (US)
Filed by Capital One Services, LLC, McLean, VA (US)
Filed on May 12, 2023, as Appl. No. 18/316,487.
Application 18/316,487 is a continuation of application No. 17/128,716, filed on Dec. 21, 2020, granted, now 11,689,535.
Application 17/128,716 is a continuation of application No. 16/358,106, filed on Mar. 19, 2019, granted, now 10,873,586, issued on Dec. 22, 2020.
Prior Publication US 2023/0283613 A1, Sep. 7, 2023
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01); G06F 3/06 (2006.01); G06F 9/455 (2018.01); G06F 21/62 (2013.01); H04L 9/06 (2006.01)
CPC H04L 63/102 (2013.01) [G06F 3/0622 (2013.01); G06F 3/0664 (2013.01); G06F 3/067 (2013.01); G06F 9/45558 (2013.01); G06F 21/6245 (2013.01); H04L 9/0643 (2013.01); H04L 63/062 (2013.01); H04L 63/08 (2013.01); G06F 2009/45587 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A computer-implemented method for secure data access control performed by a data access agent having access to a data store associated with a user, the computer-implemented method comprising:
receiving, by the data access agent from a routing application that lacks access to the data store, a request to retrieve, store, or modify data in the data store, wherein the request includes a first hash generated by the routing application using a hash function of an encryption key that corresponds to an identifier of the user;
in response to receiving the request, retrieving, by the data access agent, the encryption key using the identifier of the user, wherein the identifier of the user is known to the data access agent;
generating, by the data access agent, a second hash using the hash function of the encryption key retrieved in response to receiving the request;
determining, by the data access agent, the second hash generated by the data access agent matches the first hash generated by the routing application and included in the request; and
in response to determining the match, accessing, by the data access agent, the data store to perform the request.