Granted Patent B2

US 12,598,166 · App. 18/641,216 · Granted Apr 7, 2026

Inventor: Manikandan Rajaram (Ashburn, VA)

Assignee: Capital One Services, LLC

H04L63/0428H04L9/0861H04L9/30

Abstract

Claims (78)

1 . A system for facilitating ingestion of encrypted communications received across cloud computing networks with multi-tenancy architectures at document management systems featuring versioning capabilities, the system comprising:

one or more processors; and

one or more non-transitory, computer readable mediums comprising instructions recorded thereon that when executed by the one or more processors cause operations comprising:

receiving a first encrypted communication, wherein the first encrypted communication was encrypted using a first ephemeral key for a first tenant prior to an upload service application programming interface of a document management system being called;

calling the upload service application programming interface of the document management system;

processing, using a routing logic, the first encrypted communication by directing the first encrypted communication to an entitlement router, wherein the routing logic comprises a rule set for ingesting communications into the document management system;

processing, at the entitlement router, the first encrypted communication to determine that the first encrypted communication corresponds to the first tenant;

selecting a first compute instance container from a plurality of compute instance container based on the first tenant;

decrypting, at the first compute instance container, the first encrypted communication based on first permissions of the first tenant to generate a first decrypted communication;

storing the first decrypted communication at a first public cloud storage resource corresponding to the first tenant, wherein the first decrypted communication is re-encrypted using an encryption native to the document management system; and

providing a first reference to the first decrypted communication at the first public cloud storage resource to the document management system.

2 . A method of facilitating ingestion of encrypted communications received across cloud computing networks with multi-tenancy architectures at document management systems featuring versioning capabilities, the method comprising:

receiving a first encrypted communication, wherein the first encrypted communication was encrypted using a first ephemeral key for a first tenant prior to an upload service application programming interface of a document management system being called;

processing, using a routing logic, the first encrypted communication by directing the first encrypted communication to an entitlement router, wherein the routing logic comprises a rule set for ingesting communications into the document management system;

processing, at the entitlement router, the first encrypted communication to determine that the first encrypted communication corresponds to the first tenant;

storing a first decrypted communication corresponding to the first encrypted communication at a first public cloud storage resource, wherein the first public cloud storage resource corresponds to the first tenant, and wherein the first decrypted communication is re-encrypted using an encryption native to the document management system; and

providing a first reference to the first decrypted communication at the first public cloud storage resource to the document management system.

3 . The method of claim 2 , further comprising:

selecting a first compute instance container from a plurality of compute instance container based on the first tenant; and

decrypting, at the first compute instance container, the first encrypted communication based on first permissions of the first tenant to generate the first decrypted communication.

4 . The method of claim 2 , wherein receiving the first encrypted communication further comprises:

receiving a notification of delivery of a first communication from a first remote device; and

in response to receiving the notification, initiating a device session between the entitlement router and the first remote device.

5 . The method of claim 4 , wherein initiating the device session between the entitlement router and the first remote device further comprises:

generating a temporary key for encrypting the first communication; and

transmitting the temporary key to the first remote device.

6 . The method of claim 5 , wherein generating the temporary key for encrypting the first communication further comprises:

generating a public key for encrypting the first communication to generate the first encrypted communication; and

generating a private key for decrypting the first encrypted communication.

7 . The method of claim 5 , wherein generating the temporary key for encrypting the first communication further comprises:

retrieving a public key corresponding to the first remote device;

encrypting the temporary key using the public key to generate an encrypted temporary key; and

transmitting the encrypted temporary key to the first remote device, wherein the encrypted temporary key is decryptable using a private key corresponding to the first remote device.

8 . The method of claim 2 , further comprising:

calling the upload service application programming interface of the document management system; and

receiving the routing logic in response to calling the upload service application programming interface.

9 . The method of claim 2 , wherein processing the first encrypted communication using the routing logic further comprises:

determining, by the routing logic, a tenant identifier transmitted with the first encrypted communication; and

determining to direct the first encrypted communication to the entitlement router based on the tenant identifier.

10 . The method of claim 9 , wherein processing, at the entitlement router, the first communication to determine that the first communication corresponds to the first tenant further comprises:

comparing the tenant identifier to a plurality of tenant identifiers; and

selecting the first tenant based on comparing the tenant identifier to the plurality of tenant identifiers.

11 . The method of claim 2 , further comprising:

receiving, from a second remote device, a request to access the first decrypted communication using the first reference; and

in response to receiving the request, determining whether the second remote device corresponds to the first tenant.

12 . The method of claim 11 , wherein determining whether the second remote device corresponds to the first tenant further comprises:

receiving a tenant identifier in the request; and

determining that the tenant identifier corresponds to the first tenant.

13 . The method of claim 12 , further comprising:

in response to determining that the second remote device corresponds to the first tenant, removing the encryption native to the document management system;

generating a second encrypted communication, based on the first decrypted communication, using a second ephemeral key for the first tenant; and

transmitting the second encrypted communication to the second remote device.

14 . One or more non-transitory, computer-readable mediums, comprising instructions that, when executed by one or more processors, cause operations comprising:

receiving a first encrypted communication;

processing, using a routing logic, the first communication by directing the first encrypted communication to an entitlement router, wherein the routing logic comprises a rule set for ingesting communications into a document management system;

processing, at the entitlement router, the first communication to determine that the first encrypted communication corresponds to a first tenant;

decrypting the first encrypted communication based on first permissions of the first tenant to generate a first decrypted communication;

storing a first decrypted communication corresponding to the first encrypted communication at a first public cloud storage resource, wherein the first public cloud storage resource corresponds to the first tenant, and wherein the first decrypted communication is re-encrypted using an encryption native to the document management system; and

providing a first reference to the first decrypted communication at the first public cloud storage resource to the document management system.

15 . The one or more non-transitory, computer-readable mediums of claim 14 , wherein the operations further comprise:

selecting a first compute instance container from a plurality of compute instance container based on the first tenant; and

decrypting, at the first compute instance container, the first encrypted communication based on first permissions of the first tenant to generate the first decrypted communication.

16 . The one or more non-transitory, computer-readable mediums of claim 14 , wherein receiving the first encrypted communication further comprises:

receiving a notification of delivery of a first communication from a first remote device; and

in response to receiving the notification, initiating a device session between the entitlement router and the first remote device.

17 . The one or more non-transitory, computer-readable mediums of claim 16 , wherein initiating the device session between the entitlement router and the first remote device further comprises:

generating a temporary key for encrypting the first communication; and

transmitting the temporary key to the first remote device.

18 . The one or more non-transitory, computer-readable mediums of claim 17 , wherein generating the temporary key for encrypting the first communication further comprises:

generating a public key for encrypting the first communication to generate the first encrypted communication; and

generating a private key for decrypting the first encrypted communication.

19 . The one or more non-transitory, computer-readable mediums of claim 18 , wherein generating the temporary key for encrypting the first communication further comprises:

retrieving a public key corresponding to the first remote device;

encrypting the temporary key using the public key to generate an encrypted temporary key; and

transmitting the encrypted temporary key to the first remote device, wherein the encrypted temporary key is decryptable using a private key corresponding to the first remote device.

20 . The one or more non-transitory, computer-readable mediums of claim 19 , further comprising:

calling the upload service application programming interface of the document management system; and

receiving the routing logic in response to calling the upload service application programming interface.

Assignments (1)

Continuity (1)

References Cited (11)