Systems and methods for remotely storing security credentials in cloud computing systems featuring partitioned network structures

Patent metadata

Field	Value
Publication number	US-12524562-B2
Application number	US-202318163747-A
Country	US
Kind code	B2
Filing date	Feb 2, 2023
Priority date	Feb 2, 2023
Publication date	Jan 13, 2026
Grant date	Jan 13, 2026

Abstract

Systems and methods generate requests for encrypted (e.g., secured) credentials and data using one of a plurality of API plugins that are selected based on an access protocol for a network partition at which requested data is determined to be stored. Through the use of the dynamically-selected API plugins, the systems and methods may provide the aforementioned functions while being compatible with the different access protocols that may be encountered when providing central management across a diverse spectrum of user accounts, networks, and/or cloud platforms.

First claim

What is claimed is:

1 . A system of remotely monitoring secured data in cloud computing systems featuring partitioned network structures with respective access protocols using dynamically-selected application programming interface (“API”) plugins, the system comprising:
one or more processors; and
a non-transitory, computer-readable medium comprising instructions recorded thereon that when executed by the one or more processors cause operations comprising:
receiving, at an abstraction layer, a first request, from a first device, to retrieve a first usage file for a first encrypted data, wherein the first encrypted data is stored on a cloud computing system, and wherein the first usage file indicates one or more characteristics of usage or storage of the first encrypted data in the cloud computing system;
in response to the first request, determining, by the abstraction layer, a first network partition of the cloud computing system that comprises the first encrypted data;
determining a first access protocol for the first network partition;
selecting, based on the first access protocol, a first API plugin from a plurality of API plugins;
generating, using the first API plugin, a second request corresponding to the first access protocol;
querying, using the second request, the cloud computing system for the first usage file;
retrieving from the first usage file an operation log of operations performed on the first encrypted data; and
generating for display, on a user interface, a first recommendation based on the operation log.

2 . A method of remotely monitoring secured data in cloud computing systems featuring partitioned network structures with respective access protocols using dynamically-selected application programming interface (“API”) plugins, the method comprising:
receiving, at an abstraction layer, a first notification related to a first usage file for a first encrypted data, wherein the first encrypted data is stored on a plurality of devices comprising a cloud computing system, and wherein the first usage file indicates one or more characteristics of usage or storage of the first encrypted data in the cloud computing system;
in response to the first notification, determining, by the abstraction layer, a first network partition of the cloud computing system that comprises the first encrypted data;
determining a first access protocol for the first network partition;
selecting, based on the first access protocol, a first API plugin from a plurality of API plugins;
retrieving, using the first API plugin, the first usage file; and
generating for display, on a user interface, a first recommendation based on the first usage file.

3 . The method of claim 2 , further comprising:
in response to the first notification, transmitting the first notification to a first user device; and receiving, at the abstraction layer, a first request, to retrieve the first usage file for the first encrypted data.

4 . The method of claim 2 , further comprising:
receiving, at the abstraction layer, a data refreshment schedule; determining, at the abstraction layer, that the first encrypted data has been refreshed based on the data refreshment schedule; and transmitting, by the abstraction layer, a first request, from a first device, to retrieve the first usage file for the first encrypted data.

5 . The method of claim 2 , wherein retrieving, using the first API plugin, the first usage file further comprises:
generating, using the first API plugin, a second request corresponding to the first access protocol; and querying, using the second request, the cloud computing system for the first usage file.

6 . The method of claim 2 , wherein generating for display, on a user interface, a first recommendation based on the first usage file further comprises:
retrieving from the first usage file a device identifier for a device that previously accessed the first encrypted data; and determining the first recommendation based on the device identifier.

7 . The method of claim 2 , wherein generating for display, on a user interface, a first recommendation based on the first usage file further comprises:
retrieving from the first usage file a first frequency at which the first encrypted data is accessed from the cloud computing system; and determining the first recommendation based on the first frequency.

8 . The method of claim 2 , wherein generating for display, on a user interface, a first recommendation based on the first usage file further comprises:
generating first decrypted data file corresponding to the first encrypted data; and comparing the first decrypted data file to data in known data breaches to determine whether the first encrypted data is subject to a data breach.

9 . The method of claim 2 , wherein generating for display, on a user interface, a first recommendation based on the first usage file further comprises:
retrieving from the first usage file a network partition identifier for the first network partition; and determining the first recommendation based on the network partition identifier.

10 . The method of claim 2 , wherein generating for display, on a user interface, a first recommendation based on the first usage file further comprises:
retrieving from the first usage file an operation log of operations performed on the first encrypted data; and determining the first recommendation based on the operation log.

11 . The method of claim 2 , wherein generating for display, on a user interface, a first recommendation based on the first usage file further comprises:
retrieving from the first usage file a first frequency at which the first encrypted data is refreshed on the cloud computing system; and determining the first recommendation based on the first frequency.

12 . The method of claim 2 , wherein generating for display, on a user interface, a first recommendation based on the first usage file further comprises:
retrieving from the first usage file an access protocol identifier for the first access protocol; and determining the first recommendation based on the access protocol identifier.

13 . The method of claim 2 , wherein determining the first access protocol for the first network partition further comprises:
determining an encrypted data management platform corresponding to the first network partition; and determining the first access protocol based on the encrypted data management platform.

14 . The method of claim 2 , wherein determining, by the abstraction layer, the first network partition of the cloud computing system that comprises the first encrypted data further comprises:
receiving a first device identifier corresponding to a first device of the plurality of devices; determining a first user account corresponding to the first device identifier using a database, wherein the database comprises a listing of device identifiers corresponding to user accounts; and selecting the first network partition based on the first user account.

15 . The method of claim 2 , wherein determining, by the abstraction layer, the first network partition of the cloud computing system that comprises the first encrypted data further comprises:
receiving a platform identifier corresponding to the first encrypted data; determining a first cloud platform corresponding to the first encrypted data using a database, wherein the database comprises a listing of cloud platforms storing respective data files; and selecting the first network partition based on the first cloud platform.

16 . A non-transitory, computer-readable

Assignees

• Capital One Services Llc

Inventors

• Wang Jinlian
• Zeller Peter
• Schultz Christopher

Classifications

• G06F9/547

  Remote procedure calls [RPC]; Web services · CPC title

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• G06F21/602

  Providing cryptographic facilities or services · CPC title

• G06F9/541

  via adapters, e.g. between incompatible applications · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title