Abstract: A method, apparatus, and computer program product for proactive offline authentication are provided. An example method includes determining a current offline condition of a computing device at a first time and determining a prior online condition of the computing device at a second time that is earlier than the first time at which the computing device generated second authentication credentials based upon one or more user attributes obtained from a digital identity construct database associated with a first user at the second time. The method further includes obtaining, at the first time, first authentication credentials associated with the first user and determining a discrepancy between the first and the second authentication credentials. In response to the determined discrepancy, the method includes generating an authentication token based upon the second authentication credentials for authenticating a first user device of the first user with the computing device.

Abstract: The arrangements disclosed herein relate to systems, apparatus, methods, and non-transitory computer readable media for receiving, by a client from a terminal, an External Pre-Shared Key (EPKS) package comprising a transaction key, wherein the transaction key is derived by the terminal using an Initial Key (IK) and a counter, sending, by the client to a server, a first message comprising the TID and the counter, receiving, by the client from the server, a second message in response to the first message, determining, by the client, a session key using the EPKS package, and communicating by the client with the server via a communication session using the session key.

Abstract: The arrangements disclosed herein relate to generating, by a first server, a first seed using a Hash-Based Message Authentication Code (HMAC) based at least in part on a Hash Key (HK), providing, by the first server to each of a first device and a second device, the first seed, providing, by a second server to each of the first device or the second device, a second seed. The second seed is based at least in part on a stream of photons. Each of the first device or the second device generates a Derived Key (DK) based at least in part on the first seed and the second seed. Each of the first device or the second device generates a first key based at least in part on the DK and a first random number generated by a Quantum Random Number Generator (QRNG). The first device encrypts first data using the first key to obtain first ciphertext and provides the first ciphertext to the second device. The second device derives the first key and decrypts the first ciphertext using the first key.

Abstract: Systems, apparatuses, methods, and computer program products are disclosed for estimating a crypto-agility score of a network of computing assets. An example method includes receiving a network graph and a set of expert-determined importance weights and selecting a first network node from a set of network nodes. The example method further includes computing an upgrade cost for the first network node based on a set of dependency network nodes and applying an expert-determined importance weight to the upgrade cost for the first network node to determine a weighted upgrade cost for the first network node. The example method further includes adding the weighted upgrade cost for the first network node to a set of weighted upgrade costs and summing, by the graph circuitry, each weighted upgrade cost from the set of weighted full upgrade costs to determine the crypto-agility score for the network of computer assets.

Abstract: The arrangements disclosed herein relate to generating, by a first server, a first seed using a Hash-Based Message Authentication Code (HMAC) based at least in part on a Hash Key (HK), providing, by the first server to each of a first device and a second device, the first seed, providing, by a second server to each of the first device or the second device, a second seed. The second seed is based at least in part on a stream of photons. Each of the first device or the second device generates a Derived Key (DK) based at least in part on the first seed and the second seed. Each of the first device or the second device generates a first key based at least in part on the DK and a first random number generated by a Quantum Random Number Generator (QRNG). The first device encrypts first data using the first key to obtain first ciphertext and provides the first ciphertext to the second device. The second device derives the first key and decrypts the first ciphertext using the first key.

Abstract: The present disclosure is directed to systems, methods, and non-transitory computer-readable media for generating, by a first node, an encrypted protected message. Generating the encrypted protected message includes generating an obfuscated message by intercalating a second message into the first message, generating a protected message by applying a plurality of data protection mechanisms to the obfuscated message, and generating the encrypted protected message by applying a plurality of confidentiality techniques to the protected message. The first node transmits to a second node the encrypted protected message using a plurality of communication channels.

Abstract: Systems, apparatuses, methods, and computer program products are disclosed for secure utilization of quick response (QR) codes. An example method includes obtaining a key known to an initiating device and a participating device, and receiving, by the communications hardware of the participating device, an indication of a secure character string extracted from a QR code. The example method further includes verifying, by security circuitry of the participating device and using the key, authenticity of the QR code, and performing by the participating device, an action set.

Abstract: The arrangements disclosed herein relate to systems, apparatus, methods, and non-transitory computer readable media for a network of plurality of roving cryptography devices. Each of the plurality of roving cryptography devices includes a locomotion system configured to move each of the plurality of roving cryptography devices to a respective one of a plurality of locations of the plurality of roving cryptography devices, a network interface circuit configured to provide wireless communication services to a user device of a plurality of user devices through a network of the plurality of roving cryptography devices, and a cryptography service system configured to provide cryptographic material to the user device. The plurality of roving cryptography devices at the plurality of locations form the network for providing the wireless communication services and the cryptographic materials to the plurality of user devices.

Abstract: The arrangements disclosed herein relate to receiving, by a key management node, a first encrypted message element which is encrypted using a first symmetric key established between the key management node and a first node, decrypting, by the key management node, the first encrypted message element using the first symmetric key to obtain a first message element of a message, encrypting, by the key management node, the first message element using a second symmetric key established between the key management node and a second node to obtain a second encrypted message element, and sending, by the key management node, the second encrypted message element.

Abstract: An example method includes receiving a network graph and selecting a first network node from the set of network nodes. The example method further includes computing a difficulty score based on the difficulty for an attacker to compromise a second network node in an instance in which the attacker compromises the first network node and computing a cumulative difficulty score for the attacker to compromise the second network node based on a set of difficulty scores for the first network node and each other network node from the set of network nodes. The example method further includes adding the second network node to a set of blast radius nodes and determining a total vulnerability score for the first network node based on the set of blast radius nodes.

Abstract: Systems, apparatuses, methods, and computer program products are disclosed for establishing cryptographic keys shared among three or more devices. An example method includes generating a set of particles and an entangled particle triplet based on the set of particles. The example method further includes transmitting the first set of entangled particles to a first host device, the second set of entangled particles to a second host device, and the third set of entangled particles to a third host device, and making a determination whether the three sets of bits are matching, where the three sets of bits are derived from the three sets of entangled particles sent to the three host devices. The example method further includes establishing the cryptographic keys based on the matching sets of bits.

Abstract: The arrangements disclosed herein relate to systems, apparatus, methods, and non-transitory computer readable media for a network of plurality of roving cryptography devices. Each of the plurality of roving cryptography devices includes a locomotion system configured to move each of the plurality of roving cryptography devices to a respective one of a plurality of locations of the plurality of roving cryptography devices, a network interface circuit configured to provide wireless communication services to a user device of a plurality of user devices through a network of the plurality of roving cryptography devices, and a cryptography service system configured to provide cryptographic material to the user device. The plurality of roving cryptography devices at the plurality of locations form the network for providing the wireless communication services and the cryptographic materials to the plurality of user devices.

Abstract: A method, apparatus, and computer program product for proactive offline authentication are provided. An example method includes determining a current offline condition of a computing device at a first time and determining a prior online condition of the computing device at a second time that is earlier than the first time at which the computing device generated second authentication credentials based upon one or more user attributes obtained from a digital identity construct database associated with a first user at the second time. The method further includes obtaining, at the first time, first authentication credentials associated with the first user and determining a discrepancy between the first and the second authentication credentials. In response to the determined discrepancy, the method includes generating an authentication token based upon the second authentication credentials for authenticating a first user device of the first user with the computing device.

Abstract: Systems, apparatuses, methods, and computer program products are disclosed for determining a security vulnerability of a computer system. An example method includes initializing a policy based on initial policy data. The example method further includes selecting an action based on the policy and executing, by agent circuitry, the action in the environment. The example method further includes, subsequent to executing the action in the environment, receiving an observation of the environment and determining an updated state from the set of states based on the observation. The example method further includes determining, by the policy, a reward based on the updated state and updating the policy based on the updated state.

Abstract: The arrangements disclosed herein relate to systems, apparatus, methods, and non-transitory computer readable media for receiving, by a client from a terminal, an External Pre-Shared Key (EPKS) package comprising a transaction key, wherein the transaction key is derived by the terminal using an Initial Key (IK) and a counter, sending, by the client to a server, a first message comprising the TID and the counter, receiving, by the client from the server, a second message in response to the first message, determining, by the client, a session key using the EPKS package, and communicating by the client with the server via a communication session using the session key.

Abstract: Disclosed are example methods, systems, and devices that allow for secure data processing using data packages generated by edge devices. A computing device can generate a biometric signature from a scan of a physical feature of a user and encrypt user data based on the biometric signature and a device identifier to produce encrypted user data decryptable with a first digital key. The first digital key can be transmitted to a first computing system to receive a security token indicating validity of at least part of the user data. The encrypted user data and security token can be stored in a data package such that alterations invalidate the token. A second digital key corresponding to the data package can be generated and transmitted with the data package to a second computing system to provide a service.

Abstract: An example method includes receiving a network graph and selecting a first network node from the set of network nodes. The example method further includes computing a difficulty score based on the difficulty for an attacker to compromise a second network node in an instance in which the attacker compromises the first network node and computing a cumulative difficulty score for the attacker to compromise the second network node based on a set of difficulty scores for the first network node and each other network node from the set of network nodes. The example method further includes adding the second network node to a set of blast radius nodes and determining a total vulnerability score for the first network node based on the set of blast radius nodes.

Abstract: Systems and methods are disclosed herein for providing qubits via a quantum communication channel. An example method includes receiving a set of quantum generator nodes, a request for the qubits and a profile for generating the qubits. The example method also includes determining a quantum generator node for delivering the qubits to the endpoint device based on properties of the quantum generator node and the profile and selecting a quantum circuit and a device configuration based on the properties of the quantum generator node and the profile. The example method also includes causing execution of the quantum circuit to generate the qubits. Finally, the example method further includes causing transfer of the qubits to the endpoint device.

Abstract: Systems, apparatuses, methods, and computer program products are disclosed for establishing cryptographic keys shared among three or more devices. An example method includes generating a set of particles and an entangled particle triplet based on the set of particles. The example method further includes transmitting the first set of entangled particles to a first host device, the second set of entangled particles to a second host device, and the third set of entangled particles to a third host device, and making a determination whether the three sets of bits are matching, where the three sets of bits are derived from the three sets of entangled particles sent to the three host devices. The example method further includes establishing the cryptographic keys based on the matching sets of bits.

Abstract: Systems, apparatuses, methods, and computer program products are disclosed for secure utilization of quick response (QR) codes. An example method includes obtaining a key known to the initiating device and a participating device, and identifying, by QR code processing circuitry of the initiating device, a payload to be encoded in a QR code. The example method further includes generating, by security circuitry of the initiating device and based on the payload and the key, a secure character string, creating, by the QR code processing circuitry of the initiating device, the QR code using the secure character string, and outputting the QR code by the communications hardware of the initiating device.