Abstract: A server includes a memory and a message processor. The memory stores a data record that includes a credential stored in association with an access restriction indicator, and further includes a cryptographic key. The processor is configured to receive from a network device an access request that includes the credential and a token. The token includes a first data layer and a second data layer that incorporates the first data layer and is encrypted with the cryptographic key. The processor is configured to determine that, prior to the access request, the credential was stored in the data record in association with the access restriction indicator; recover the first data layer from the token by (i) locating the cryptographic key in the data record, and (ii) decrypting the second encrypted data layer with the cryptographic key. The processor is configured to provide the network device with the first data layer.

Abstract: A server includes a memory and a message processor. The memory stores a data record that includes a credential stored in association with an access restriction indicator, and further includes a cryptographic key. The processor is configured to receive from a network device an access request that includes the credential and a token. The token includes a first data layer and a second data layer that incorporates the first data layer and is encrypted with the cryptographic key. The processor is configured to determine that, prior to the access request, the credential was stored in the data record in association with the access restriction indicator; recover the first data layer from the token by (i) locating the cryptographic key in the data record, and (ii) decrypting the second encrypted data layer with the cryptographic key. The processor is configured to provide the network device with the first data layer.

Abstract: A message processing server includes a memory and a message processor. The message processor is configured to receive first data; save an identifier in association with a first-layer access restriction indicator and a first key, generate a first encrypted layer by encrypting the first data with the first key, and generate a token from the identifier and the first encrypted layer; receive second data and the token; recover the identifier and the first encrypted layer from the token; confirm that the identifier was saved in the memory in association with the first indicator; save the identifier in association with a second-layer access restriction indicator and a second key, generate a second encrypted layer by encrypting the first encrypted layer and the second data with the second key, and regenerate the token from the identifier and the second encrypted layer.

Abstract: A message processing server includes a memory and a message processor. The message processor is configured to receive first data; save an identifier in association with a first-layer access restriction indicator and a first key, generate a first encrypted layer by encrypting the first data with the first key, and generate a token from the identifier and the first encrypted layer; receive second data and the token; recover the identifier and the first encrypted layer from the token; confirm that the identifier was saved in the memory in association with the first indicator; save the identifier in association with a second-layer access restriction indicator and a second key, generate a second encrypted layer by encrypting the first encrypted layer and the second data with the second key, and regenerate the token from the identifier and the second encrypted layer.