Abstract: Systems, methods, and apparatuses are described for securely federating data processing tasks on remote client devices. A computing device may cause one or more remote client devices to securely execute algorithms. The computing device may then receive, from one of those algorithms, a request for secure material usable to process data using the algorithm. The computing device may generate and transmit an encrypted challenge token, and the algorithm may respond with an updated request comprising a processed form of the challenge token. The computing device may then validate the request and, if validation succeeds, transmit the sensitive material. The computing device may then cause the remote client device to process data using the algorithm and the sensitive material.

Abstract: Systems, methods, and apparatuses are described for securely federating data processing tasks on remote client devices. A computing device may cause one or more remote client devices to securely execute algorithms. The computing device may then receive, from one of those algorithms, a request for secure material usable to process data using the algorithm. The computing device may generate and transmit an encrypted challenge token, and the algorithm may respond with an updated request comprising a processed form of the challenge token. The computing device may then validate the request and, if validation succeeds, transmit the sensitive material. The computing device may then cause the remote client device to process data using the algorithm and the sensitive material.

Abstract: Systems, methods, and apparatuses are described for crypto-material life-cycle management for tokenization and/or encryption. A computing device may generate cryptographic material comprising one or more blobs. Each of the blobs may be usable for encryption and/or tokenization for different field types and via various different encryption/tokenization algorithms. Multiple cryptographic blobs might be generated in advance for the same field type/algorithm, such that the cryptographic blobs are quickly available for use. In response to computing device requests for such cryptographic blobs, a cryptographic blob for a particular field/algorithm may be identified and transmitted. The cryptographic material may be refreshed periodically, when most and/or all of the cryptographic blobs are used up, or upon detection of a security breach. The cryptographic material may be appended based on new fields and/or algorithms such that the cryptographic material is backwards- and forwards-compatible.