Granted Patent B2

US 12,381,883 · App. 18/103,779 · Granted Aug 5, 2025

Inventors: Praveen Yedluri (Hyderabad, IN); Vittal Surya Narayana Goli (Hyderabad, IN); Saurabh Kumar (Haryana, IN); Swati Pandey (Hyderabad, IN); Vishal Prasad Gupta (Hyderabad, IN); Ashisa Kumar Nayak (Miyapur, IN)

Assignee: Bank of America Corporation

H04L63/105H04L9/083H04L9/08H04L63/0428H04L67/306

Abstract

Claims (99)

1. A computing platform comprising:

at least one processor;

a communication interface communicatively coupled to the at least one processor; and

memory storing computer-readable instructions that, when executed by the processor, cause the computing platform to:

receive, from a first user device of a first user, a request to encrypt a file;

generate, for the file, a symmetric key;

encrypt, using the symmetric key, the file to produce an encrypted file;

receive, from a second user device of a second user, a request to decrypt the encrypted file;

identify a classification of the encrypted file;

based on identifying a first classification:

obtain, using a first application programming interface (API) call to an employee hub, an employee hierarchy corresponding to the first user, wherein the employee hub comprises a computer system storing employee information including the employee hierarchy,

compare the second user to the employee hierarchy, and

based on identifying that the second user is included in the employee hierarchy:

decrypt, using the symmetric key, the encrypted file, and

grant access, to the second user, to the file; and

based on identifying a second classification:

obtain, using a second API call to the employee hub, personnel information indicating one or more employees within an authorized department of a company corresponding to the second classification, wherein the authorized department is automatically identified based on contents of the file, wherein a subset of the authorized department is further identified based on the contents of the file, and wherein the personnel information indicates the subset of the authorized department,

compare the second user to the personnel information,

based on identifying that the second user is included in the personnel information:

decrypt, using the symmetric key, the encrypted file, and

grant access, by the second user, to the file.

2. The computing platform of claim 1 , wherein the memory stores additional computer-readable instructions that, when executed by the one or more processors, cause the computing platform to:

based on identifying that the first user is not included in the employee hierarchy:

deny access, to the second user, to the encrypted file, and

send, to the second user device, an error notification and one or more commands directing the second user device to display the error notification, wherein sending the one or more commands directing the second user device to display the error notification causes the second user device to display the error notification.

3. The computing platform of claim 1 , wherein the first classification comprises a proprietary classification.

4. The computing platform of claim 1 , wherein the memory stores additional computer-readable instructions that, when executed by the one or more processors, cause the computing platform to:

based on identifying that the first user is not included in the personnel information:

deny access, by the second user, to the encrypted file, and

send, to the second user device, an error notification and one or more commands directing the second user device to display the error notification, wherein sending the one or more commands directing the second user device to display the error notification causes the second user device to display the error notification.

5. The computing platform of claim 1 , wherein the second classification comprises a company related classification.

6. The computing platform of claim 1 , wherein the memory stores additional computer-readable instructions that, when executed by the one or more processors, cause the computing platform to:

based on identifying a second classification:

compare the second user to the first user, and

based on identifying that the second user is different than the first user:

deny access, by the second user, to the encrypted file, and

send, to the second user device, an error notification and one or more commands directing the second user device to display the error notification, wherein sending the one or more commands directing the second user device to display the error notification causes the second user device to display the error notification.

7. The computing platform of claim 6 , wherein the second classification comprises a personal classification.

8. The computing platform of claim 1 , wherein the memory stores additional computer-readable instructions that, when executed by the one or more processors, cause the computing platform to:

receive, from the first user device, a second request to decrypt the encrypted file; and

based on validating an identity of the first user:

decrypt, using the symmetric key, the encrypted file, and

grant access, to the first user, to the file.

9. The computing platform of claim 1 , wherein the symmetric key is stored in a hardware security module (HSM) of the computing platform, and wherein the computing platform is configured with a unique protocol to access the HSM.

10. The computing platform of claim 1 , wherein identifying the classification of the encrypted file comprises identifying, based on classification information included in the request to encrypt the file.

11. The computing platform of claim 1 , wherein identifying the classification of the encrypted file comprises automatically identifying, based on contents of the file, the classification.

12. The computing platform of claim 1 , wherein the symmetric key is unique to the first user.

13. The computing platform of claim 1 , wherein enterprise access permissions for the first user are revoked, and wherein the revocation occurs:

after encrypting the file using the symmetric key, and

before receiving the request to decrypt the encrypted file.

14. The computing platform of claim 1 , wherein the symmetric key is specific to the classification of the encrypted file.

15. The computing platform of claim 1 , wherein the symmetric key is useable to validate only the first user until departure of the first user from an enterprise associated with the encrypted file, and wherein the symmetric key becomes useable to validate the second user upon a confirmation of the departure of the first user.

16. The computing platform of claim 1 , wherein identifying the classification of the encrypted file comprises using one or more of: natural language processing (NLP), natural language understanding (NLU), or machine learning to identify the classification of the encrypted file.

17. The computing platform of claim 16 , wherein identifying the classification of the encrypted file comprises:

receiving, from the first user, an initial classification;

analyze, using one or more of: the NLP, the NLU, or the machine learning, the encrypted file to validate the initial classification; and

based on detecting that the initial classification is invalid through the analysis, replacing the initial classification with the classification of the encrypted file.

18. A method comprising:

at a computing device comprising at least one processor, a communication interface, and memory:

receiving, from a first user device of a first user, a request to encrypt a file;

generating, for the file, a symmetric key;

encrypting, using the symmetric key, the file to produce an encrypted file;

receiving, from a second user device of a second user, a request to decrypt the encrypted file;

identifying a classification of the encrypted file;

based on identifying a first classification:

obtaining, using a first application programming interface (API) call to an employee hub, an employee hierarchy corresponding to the first user, wherein the employee hub comprises a computer system storing employee information including the employee hierarchy,

comparing the second user to the employee hierarchy, and

based on identifying that the second user is included in the employee hierarchy:

decrypting, using the symmetric key, the encrypted file, and

granting access, to the second user, to the file; and

based on identifying a second classification:

obtaining, using a second API call to the employee hub, personnel information indicating one or more employees within an authorized department of a company corresponding to the second classification, wherein the authorized department is automatically identified based on contents of the file, wherein a subset of the authorized department is further identified based on the contents of the file, and wherein the personnel information indicates the subset of the authorized department,

comparing the second user to the personnel information, and

based on identifying that the second user is included in the personnel information:

decrypting, using the symmetric key, the encrypted file, and

granting access, by the second user, to the file.

19. The method of claim 18 , further comprising:

based on identifying that the first user is not included in the employee hierarchy:

denying access, to the second user, to the encrypted file, and

sending, to the second user device, an error notification and one or more commands directing the second user device to display the error notification, wherein sending the one or more commands directing the second user device to display the error notification causes the second user device to display the error notification.

20. One or more non-transitory computer-readable media storing instructions that, when executed by a computing device comprising at least one processor, a communication interface, and memory, cause the computing device to:

receive, from a first user device of a first user, a request to encrypt a file;

generate, for the file, a symmetric key;

encrypt, using the symmetric key, the file to produce an encrypted file;

receive, from a second user device of a second user, a request to decrypt the encrypted file;

identify a classification of the encrypted file;

based on identifying a first classification:

obtain, using a first application programming interface (API) call to an employee hub, an employee hierarchy corresponding to the first user, wherein the employee hub comprises a computer system storing employee information including the employee hierarchy,

compare the second user to the employee hierarchy, and

based on identifying that the second user is included in the employee hierarchy:

decrypt, using the symmetric key, the encrypted file, and

grant access, to the second user, to the file; and

based on identifying a second classification:

obtain, using a second API call to the employee hub, personnel information indicating one or more employees within an authorized department of a company corresponding to the second classification, wherein the authorized department is automatically identified based on contents of the file, wherein a subset of the authorized department is further identified based on the contents of the file, and

wherein the personnel information indicates the subset of the authorized department,

compare the second user to the personnel information,

based on identifying that the second user is included in the personnel information:

decrypt, using the symmetric key, the encrypted file, and

grant access, by the second user, to the file.

Assignments (1)

Continuity (1)

References Cited (23)