Abstract: Systems and methods in accordance with present implementations can include decrypting, by one or more processors, a data packet using a session key to recover a decrypted data packet, the data packet comprising a data element encrypted with a first content-specific key associated with a shared secret, the data packet encrypted with the session key, and decrypting, by the one or more processors, the data element of the decrypted data packet using a second content-specific key corresponding to a data type of the data element, to recover a decrypted data element.

Abstract: A biometric electronic signature authenticated key exchange (“BESAKE”) token processing system. The system includes a storage location having a plurality of biometric reference templates. The system further includes an authentication computing system having a processor and instructions. The instructions configured to cause the authentication computing system to receive a signing party identifier and the BESAKE token from a signing party. The BESAKE token having a biometric sample encrypted using an encryption key. The instructions further configured to generate a decryption key and decrypt the encrypted biometric sample from the BESAKE token. The instructions further configured to match the biometric sample with a biometric reference template and transmit to a biometric service provider computing system a match request. The instructions further configured to determine a signing party identity via a binary match value.

Abstract: Systems, methods, and apparatuses of creating a repair token for a distributed ledger are provided. A method includes identifying an error in the distributed ledger via a computing system. The error is associated with a first block on the distributed ledger. The method further includes creating the repair token having content of the first block and a correction to the error via the computing system.

Abstract: A method for gesture-based multi-factor authentication includes mapping a gesture password to a first substitution string, generating a cryptographic key using the first substitution string as an input to a password authenticated key exchange protocol, encrypting a challenge response with the cryptographic key to generate an encrypted challenge response, and transmitting, to a relying party computing system, a first authentication message comprising the encrypted challenge response and a user identifier identifying a user.

Abstract: A method includes receiving an update biometric reference sample and a user identifier by a computing system and retrieving a previous biometric reference template record in a storage location based on the user identifier by the computing system. The previous biometric reference template record includes a previous biometric reference template generated using a previous biometric reference sample. The method further includes comparing the update biometric reference sample to the previous biometric reference template by the computing system and, responsive to determining that a biometric data type of the update biometric reference sample is different than that of the previous biometric reference template, generating an update biometric reference template by the computing system. The method further includes generating an update biometric reference template record by the computing system.

Abstract: A unique transaction key (Tk) is established amongst multiple entities using a common hardware security module (HSM) with a common HMAC key (HK) and transaction scheme name (T). The transaction key (Tk) can be used for various cryptographic functions (e.g. encryption, MAC, HMAC, key management) with one or more messages at the transaction or session level.

Abstract: Example implementations include a method for using tokens between two entities including a client device and a server, by generating, by a first one-way function of the client device, a first intermediate value from a transaction count corresponding to a number of transactions involving an original data, the first intermediate value being unique to a first verification transaction at a server, generating, by a second one-way function of the client device, a second intermediate value from the first intermediate value, the second intermediate value being unique to a second verification transaction at the server, sending, by the client device, a first token based on the first intermediate value to the server to execute the first verification transaction, and sending, by the client device, a second token based on the second intermediate value to the server to execute the second verification transaction.

Abstract: Systems and methods in accordance with present implementations can include decrypting, by one or more processors, a data packet using a session key to recover a decrypted data packet, the data packet comprising a data element encrypted with a first content-specific key associated with a shared secret, the data packet encrypted with the session key, and decrypting, by the one or more processors, the data element of the decrypted data packet using a second content-specific key corresponding to a data type of the data element, to recover a decrypted data element.

Abstract: Examples described herein relate to systems, apparatuses, methods, and non-transitory computer-readable medium for recovering a session object associated with a secure session established by a security protocol server, including receiving, by a recovery server, an encrypted session object from the security protocol server, wherein the encrypted session object is unique to the secure session, generating, by the recovery server, a recovery key based on a first initial key and a recovery key sequence number, wherein the recovery key sequence number corresponds to a number of times that secure sessions have been established since the first initial key is received by the security protocol server, and decrypting, by the recovery server, the encrypted session object using the recovery key to generate the session object associated with the secure session.

Abstract: Various embodiments relate to a method of receiving an original message, share-holder list, and threshold amount. The original message is tokenized resulting in a tokenized message. A plurality of shares are generated from the tokenized message using a message sharing algorithm of a secret sharing scheme. Each of the plurality of shares is signcrypted using a public key and a private key associated with the shared secret provider computing system and a public key of a respective one of the share-holders included in the share-holders list, resulting in a plurality of signcrypted shares. The plurality of signcrypted shares is distributed to the respective ones of the share-holders according to the public key used to signcrypt the respective signcrypted share. The authenticity and data integrity of the first share of the plurality of signcrypted shares can be determined by using the public key associated and a public/private key pair associated with the share-holder.

Abstract: A method for gesture-based multi-factor authentication includes mapping a gesture password to a first substitution string, generating a cryptographic key using the first substitution string as an input to a password authenticated key exchange protocol, encrypting a challenge response with the cryptographic key to generate an encrypted challenge response, and transmitting, to a relying party computing system, a first authentication message comprising the encrypted challenge response and a user identifier identifying a user.

Abstract: Various arrangements relate to a method performed by a processor of a computing system. An example method includes tokenizing a first value using a tokenization algorithm to generate a first token. The first value and first key are inputs of the tokenization algorithm. A message is generated. The message includes a first value identifier associated with the first value and a first key generation identifier associated with the generation of the first key. The message is associated with the first token. A second key is generated. A second value is tokenized using a tokenization algorithm to generate a second token. The second value and second key are inputs of the tokenization algorithm.

Abstract: A method can include generating a cryptogram by encrypting, by a hardware security module (HSM), a keyed-hash message authentication code (HMAC) key by a master key encryption key (MK); transmitting, a database server, the cryptogram; destroying the cryptogram at the HSM, in response to the transmitting the cryptogram to the database server; receiving, from the database server, the cryptogram and an ID generated by the database server; generating a wallet password based on the ID and the cryptogram; generating a data encryption key (DK) retrievable via the wallet password; transmitting, to the database server, the DK without the wallet password; destroying the wallet password in response to the transmitting the DK to the database server; decrypting the cryptogram into a decrypted HMAC key; regenerating the wallet password using the ID and the decrypted HMAC key; encrypting the regenerated wallet password; transmitting, to the database server, the encrypted regenerated wallet password.

Abstract: A biometric electronic signature authenticated key exchange (“BESAKE”) token processing system. The system includes a storage location having a plurality of biometric reference templates. The system further includes an authentication computing system having a processor and instructions. The instructions configured to cause the authentication computing system to receive a signing party identifier and the BESAKE token from a signing party. The BESAKE token having a biometric sample encrypted using an encryption key. The instructions further configured to generate a decryption key and decrypt the encrypted biometric sample from the BESAKE token. The instructions further configured to match the biometric sample with a biometric reference template and transmit to a biometric service provider computing system a match request. The instructions further configured to determine a signing party identity via a binary match value.

Abstract: A method for a key management server to manage encryption for data stored by a cloud provider server includes receiving, by the key management server from the cloud provider server, a request for a drop key. The request includes a hash drop identifier that uniquely identifies a cipher drop, and the cipher drop comprises a unit of data stored by the cloud provider server. The method further includes generating the drop key based on at least the hash drop and the drop identifier and encrypting the drop key. A response comprising the encrypted drop key is sent to the cloud provider server.

Abstract: A system and method for establishing secure communications over a network based on combined capabilities of classical and quantum computers. The system and method include transmitting, via a network and by a classical computer to a quantum computer, a request for client data associated with a client device. The request causes the quantum computer to retrieve client data associated with the client device. The request causes the quantum computer to generate a signed data packet by digitally signing the client data. The request causes the quantum computer to transmit the signed data packet to the classical computer.

Abstract: Example implementations include a method for using tokens between two entities including a client device and a server, by generating, by a first one-way function of the client device, a first intermediate value from a transaction count corresponding to a number of transactions involving an original data, the first intermediate value being unique to a first verification transaction at a server, generating, by a second one-way function of the client device, a second intermediate value from the first intermediate value, the second intermediate value being unique to a second verification transaction at the server, sending, by the client device, a first token based on the first intermediate value to the server to execute the first verification transaction, and sending, by the client device, a second token based on the second intermediate value to the server to execute the second verification transaction.

Abstract: Various embodiments relate to a method performed by a processor of a computing system. An example method includes determining a first cryptographic algorithm utilized in a first block of a first blockchain. The first block of the first blockchain has a first unique block identifier. A second cryptographic algorithm utilized in a second block of the first blockchain is determined. The second block of the first blockchain having a second unique block identifier. A first cryptographic algorithm status transition (“CAST”) event is defined if the second cryptographic algorithm is different than the first cryptographic algorithm. A first CAST record is defined upon occurrence of the first CAST event. The first CAST record includes the second cryptographic algorithm and the second unique block identifier. The first CAST record is digitally signed and stored on a second blockchain. The second blockchain may be referenced out-of-band of the first blockchain.

Abstract: In a system, computer-readable media and methods for secure ledger assurance tokenization (SLAT), a block content of a first blockchain is audited, which includes accessing, by a request circuit of a SLAT computing system, a retrievably stored cross-reference content and generating an audit result. Generating an audit result includes evaluating, by a SLAT circuit of the SLAT computing system, the cross-reference content such that the audit result is informed at least by the cross-reference content. The audit result is included in a secure ledger assurance token generated by a SLAT generation circuit of the SLAT computing system and stored relationally to the block content of the first blockchain.

Abstract: A method of generating a trusted chain code (“TCC”) message, comprising: receiving a smart contract whose execution causes a transfer of value in response to at least one of an occurrence of an event or a fulfillment of a condition, wherein the smart contract is digitally signed by a first entity private key and a second entity private key; generating a chain code comprising a hash of a chain code of the smart contract, the chain code corresponding to at least one of an occurrence of an event or a fulfillment of a condition of the smart contract; and posting the TCC message to a distributed ledger, wherein an execution of a portion of the chain code in response to at least one of the occurrence of the event or the fulfillment of the condition is validated against corresponding chain code in the chain code manifest.