Patent ID: 11943338
Assignee: CAPITAL ONE SERVICES, LLC
Field: Digital communication (Electrical engineering)
Classification: CPC G  H | IPC H

Claim 13:
14. A non-transitory machine-readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to perform steps comprising:
storing, using a data store, a plurality of asset clusters, each asset cluster comprising a plurality of data items and associated with an active encryption key;
for each asset cluster in the plurality of asset clusters:
generating, for each asset cluster, a master encryption key;
generating, for each asset cluster and based on the master encryption key for the asset cluster, a first content encryption key; and
setting the first content encryption key associated with the asset cluster as the active encryption key for the asset cluster;
encrypting a first subset of the plurality of data items of the asset cluster using the active encryption key and maintaining a count of a number of data items encrypted using the active encryption key;
determining the number of data items encrypted using the active encryption key exceeds a threshold value;
setting the first content encryption key as an inactive encryption key for the asset cluster;
generating, for the asset cluster and based on the master encryption key for the asset cluster, a second content encryption key;
setting the second content encryption key as the active encryption key for the asset cluster; and
for a second subset of the plurality of data items in the asset cluster, encrypting the second subset of the plurality of data items using the active encryption key and maintaining a second count of the number of data items encrypted using the active encryption key;

based on generating the second content encryption key, decrypting, using the inactive encryption key, each of the first subset of the plurality of data items for the asset cluster;
encrypting, using the first content encryption key that is set as the active encryption key, each of the first subset of the plurality of data items;
generating a second master encryption key for each asset cluster; and
for each asset cluster in the plurality of asset clusters:
decrypting the active encryption key for the asset cluster using the master encryption key for the asset cluster;
encrypting the active encryption key for the asset cluster using the second master encryption key for the asset cluster;
decrypting the inactive encryption key for the asset cluster using the master encryption key for the asset cluster; and
encrypting the inactive encryption key for the asset cluster using the second master encryption key for the asset cluster; and

deleting the master encryption key for each asset cluster.