Patent ID: 11943338
Assignee: CAPITAL ONE SERVICES, LLC
Field: Digital communication (Electrical engineering)
Classification: CPC G  H | IPC H

Claim 7:
8. An apparatus, comprising:
one or more processors; and
memory storing instructions that, when executed by the one or more processors, cause the apparatus to:
store, using a data store, a plurality of asset clusters, each asset cluster comprising

a plurality of data items and associated with an active encryption key; and
for each asset cluster in the plurality of asset clusters:
generate a master encryption key;
generate, based on the master encryption key for the asset cluster, a first content encryption key;
set the first content encryption key associated with the asset cluster as the active encryption key for the asset cluster;
encrypt a first subset of the plurality of data items of the asset cluster using the active encryption key and maintaining a count of a number of data items encrypted using the active encryption key;
determine the number of data items encrypted using the active encryption key exceeds a threshold value;
set the first content encryption key as an inactive encryption key for the asset cluster;
generate, for the asset cluster and based on the master encryption key for the asset cluster, a second content encryption key;
set the second content encryption key as the active encryption key for the asset cluster;
for a second subset of the plurality of data items in the asset cluster, encrypt the second subset of the plurality of data items using the active encryption key and maintaining a second count of the number of data items encrypted using the active encryption key;
based on generating the second content encryption key, decrypting, using the first content encryption key that is set as the inactive encryption key, each of the first subset of the plurality of data items for the asset cluster; and
encrypting, using the active encryption key, each of the first subset of the plurality of data items for the asset cluster;

obtain, from a computing device, a request for a data item;
determine an asset cluster, in the plurality of asset clusters, that stores the data item;
determine a content encryption key used to encrypt the data item, the content encryption key selected from the group consisting of the first content encryption key for the determined asset cluster and the second content encryption key for the determined asset cluster;
decrypt the data item using the determined content encryption key; and
transmit the decrypted data item to the computing device.