Abstract: Various arrangements relate to a method performed by a processor of a computing system. An example method includes tokenizing a first value using a tokenization algorithm to generate a first token. The first value and first key are inputs of the tokenization algorithm. A message is generated. The message includes a first value identifier associated with the first value and a first key generation identifier associated with the generation of the first key. The message is associated with the first token. A second key is generated. A second value is tokenized using a tokenization algorithm to generate a second token. The second value and second key are inputs of the tokenization algorithm.

Abstract: The arrangements disclosed herein relate to systems, apparatus, methods, and non-transitory computer readable media for receiving, by a client from a terminal, an External Pre-Shared Key (EPKS) package comprising a transaction key, wherein the transaction key is derived by the terminal using an Initial Key (IK) and a counter, sending, by the client to a server, a first message comprising the TID and the counter, receiving, by the client from the server, a second message in response to the first message, determining, by the client, a session key using the EPKS package, and communicating by the client with the server via a communication session using the session key.

Abstract: The arrangements disclosed herein relate to generating, by a first server, a first seed using a Hash-Based Message Authentication Code (HMAC) based at least in part on a Hash Key (HK), providing, by the first server to each of a first device and a second device, the first seed, providing, by a second server to each of the first device or the second device, a second seed. The second seed is based at least in part on a stream of photons. Each of the first device or the second device generates a Derived Key (DK) based at least in part on the first seed and the second seed. Each of the first device or the second device generates a first key based at least in part on the DK and a first random number generated by a Quantum Random Number Generator (QRNG). The first device encrypts first data using the first key to obtain first ciphertext and provides the first ciphertext to the second device. The second device derives the first key and decrypts the first ciphertext using the first key.

Abstract: The present disclosure is directed to systems, methods, and non-transitory computer-readable media including storing, by a server, cryptographically protected information related to a bar code, the information configured to be accessible via at least one link to the cryptographically protected information. The server determines that the at least one link is accessed by the bar code being read. The server sends to a receiver device the cryptographically protected information.

Abstract: The present disclosure is directed to systems, methods, and non-transitory computer-readable media including storing, by a server, cryptographically protected information related to a bar code, the information configured to be accessible via at least one link to the cryptographically protected information. The server determines that the at least one link is accessed by the bar code being read. The server sends to a receiver device the cryptographically protected information.

Abstract: The present disclosure is directed to systems, methods, and non-transitory computer-readable media for generating, by a first node, an encrypted protected message. Generating the encrypted protected message includes generating an obfuscated message by intercalating a second message into the first message, generating a protected message by applying a plurality of data protection mechanisms to the obfuscated message, and generating the encrypted protected message by applying a plurality of confidentiality techniques to the protected message. The first node transmits to a second node the encrypted protected message using a plurality of communication channels.

Abstract: The arrangements disclosed herein relate to systems, apparatus, methods, and non-transitory computer readable media for Secure Node Exchange Attribute-based Keys (SNEAK) including secure exchange of sensitive message elements between sequential message nodes using attribute-based key management. Each message node can access none, one, some, or all encrypted message elements based on assigned attributes of that message node. A key management node provides key exchange for each Content Encryption Key (CEK) used to protect the message elements based on attributes of the message nodes.

Abstract: The arrangements disclosed herein relate to receiving, by a key management node, a first encrypted message element which is encrypted using a first symmetric key established between the key management node and a first node, decrypting, by the key management node, the first encrypted message element using the first symmetric key to obtain a first message element of a message, encrypting, by the key management node, the first message element using a second symmetric key established between the key management node and a second node to obtain a second encrypted message element, and sending, by the key management node, the second encrypted message element.

Abstract: The present disclosure relates to exchanging information between a start node and an end node. Based on the information session keys for a connection comprising the start node, the end node, and at least one intermediate node are established. The session keys include a data encryption session key and a Message Authentication Code (MAC) session key. The data is encrypted using the data encryption session key at the start node. MAC is generated using the MAC session key. The encrypted data is relayed, via the at least one intermediate node, from the start node to the end node without the at least one intermediate node re-encrypting the data.

Abstract: The present disclosure is directed to systems, methods, and non-transitory computer-readable media including providing an attribute certificate to a Key Receiving Device (KRD). The attribute certificate indicates that the KRD is bound to a Key Distribution Host (KDH) for key distribution. A whitelist is provided to the KDH. The whitelist includes a list of at least one KRD bound to the KDH.

Abstract: The arrangements disclosed herein relate to systems, apparatus, methods, and non-transitory computer readable media for Quantum for DUKPT (Q-DUKPT), where an Initialization Key (IK) using a Quantum Random Number Generator (QRNG). An identifier for a device is generated by performing XOR on a Base Derivation Key (BDK) and the IK. The device derives a key for each transaction to encrypt original data using IK or a previous key. The host receives from the device the encrypted original, the identifier, and a counter that indicates a current number of transactions. The host runs the same derive function used by the device for a number of iterations equal to the current number of transactions with IK as the initial input, to derive the key used to by the device to encrypt the original data.

Abstract: The arrangements disclosed herein relate to systems, apparatus, methods, and non-transitory computer readable media for receiving, by a client from a terminal, an External Pre-Shared Key (EPKS) package comprising a transaction key, wherein the transaction key is derived by the terminal using an Initial Key (IK) and a counter, sending, by the client to a server, a first message comprising the TID and the counter, receiving, by the client from the server, a second message in response to the first message, determining, by the client, a session key using the EPKS package, and communicating by the client with the server via a communication session using the session key.

Abstract: The arrangements disclosed herein relate to generating, by a first server, a first seed using a Hash-Based Message Authentication Code (HMAC) based at least in part on a Hash Key (HK), providing, by the first server to each of a first device and a second device, the first seed, providing, by a second server to each of the first device or the second device, a second seed. The second seed is based at least in part on a stream of photons. Each of the first device or the second device generates a Derived Key (DK) based at least in part on the first seed and the second seed. Each of the first device or the second device generates a first key based at least in part on the DK and a first random number generated by a Quantum Random Number Generator (QRNG). The first device encrypts first data using the first key to obtain first ciphertext and provides the first ciphertext to the second device. The second device derives the first key and decrypts the first ciphertext using the first key.

Abstract: The arrangements disclosed herein relate to generating, by a first server, a first seed using a Hash-Based Message Authentication Code (HMAC) based at least in part on a Hash Key (HK), providing, by the first server to each of a first device and a second device, the first seed, providing, by a second server to each of the first device or the second device, a second seed. The second seed is based at least in part on a stream of photons. Each of the first device or the second device generates a Derived Key (DK) based at least in part on the first seed and the second seed. Each of the first device or the second device generates a first key based at least in part on the DK and a first random number generated by a Quantum Random Number Generator (QRNG). The first device encrypts first data using the first key to obtain first ciphertext and provides the first ciphertext to the second device. The second device derives the first key and decrypts the first ciphertext using the first key.

Abstract: The present disclosure is directed to systems, methods, and non-transitory computer-readable media for generating, by a first node, an encrypted protected message. Generating the encrypted protected message includes generating an obfuscated message by intercalating a second message into the first message, generating a protected message by applying a plurality of data protection mechanisms to the obfuscated message, and generating the encrypted protected message by applying a plurality of confidentiality techniques to the protected message. The first node transmits to a second node the encrypted protected message using a plurality of communication channels.

Abstract: The arrangements disclosed herein relate to systems, apparatus, methods, and non-transitory computer readable media for a network of plurality of roving cryptography devices. Each of the plurality of roving cryptography devices includes a locomotion system configured to move each of the plurality of roving cryptography devices to a respective one of a plurality of locations of the plurality of roving cryptography devices, a network interface circuit configured to provide wireless communication services to a user device of a plurality of user devices through a network of the plurality of roving cryptography devices, and a cryptography service system configured to provide cryptographic material to the user device. The plurality of roving cryptography devices at the plurality of locations form the network for providing the wireless communication services and the cryptographic materials to the plurality of user devices.

Abstract: The arrangements disclosed herein relate to receiving, by a key management node, a first encrypted message element which is encrypted using a first symmetric key established between the key management node and a first node, decrypting, by the key management node, the first encrypted message element using the first symmetric key to obtain a first message element of a message, encrypting, by the key management node, the first message element using a second symmetric key established between the key management node and a second node to obtain a second encrypted message element, and sending, by the key management node, the second encrypted message element.

Abstract: In one arrangement, a non-transitory computer readable media having computer-executable instructions embodied therein that, when executed by at least one processor of a computing system, cause the computing system to process an electronic transaction using a schema. The schema includes a first unique entity object identifier identifying a sender, a second unique entity object identifier identifying a receiver, and a first transaction object identifier identifying the transaction. The first transaction object identifier is located at a top level of a hierarchy of a plurality of transaction object identifiers. The schema further includes transaction information comprising the first unique entity object identifier, the second unique entity object identifier, and the unique transaction object identifier.

Abstract: A method for a key management server to manage encryption for data stored by a cloud provider server includes receiving, by the key management server from the cloud provider server, a request for a drop key. The request includes a hash drop identifier that uniquely identifies a cipher drop, and the cipher drop comprises a unit of data stored by the cloud provider server. The method further includes generating the drop key based on at least the hash drop and the drop identifier and encrypting the drop key. A response comprising the encrypted drop key is sent to the cloud provider server.

Abstract: The present disclosure relate to exchanging information between a start node and an end node. Based on the information session keys for a connection comprising the start node, the end node, and at least one intermediate node are established. The session keys include a data encryption session key and a Message Authentication Code (MAC) session key. The data is encrypted using the data encryption session key at the start node. MAC is generated using the MAC session key. The encrypted data is relayed, via the at least one intermediate node, from the start node to the end node without the at least one intermediate node re-encrypting the data.