Abstract: Methods and systems related to near field communication (NFC) front ends for point of sale terminals are disclosed. One point of sale system includes an applications microprocessor programmed to: (i) instantiate an operating system for the point of sale system and (ii) generate a set of data packets. The system also includes a discrete microcontroller communicatively coupled with the applications microprocessor and programmed to: (i) selectively operate in an unsecure mode and a secure mode; and (ii) filter, when operating in the unsecure mode, the set of data packets received from the applications microprocessor using a filter and a whitelist for the filter. The system also includes a near field communication front end communicatively coupled to the discrete microcontroller and an antenna, for transmitting a near field communication signal based on information from the set of data packets via the antenna.

Abstract: A method, performed by a user equipment (UE), of deciphering data in wireless communication system is provided. The method includes receiving a packet data convergence protocol (PDCP) data packet data unit (PDU), determining a RCVD_COUNT of the PDCP data PDU, determining whether integrity protection is performed to the PDCP data PDU, and performing, based on whether the integrity protection is performed to the PDCP data PDU, deciphering of the PDCP data PDU using the RCVD_COUNT, wherein the RCVD_COUNT is determined based on hyper frame number (HFN) of the PDCP data PDU determined according to RCVD_DELIV and sequence number (SN) of the PDCP data PDU, and wherein RX_DELIV is a count value of a first PDCP service data unit (SDU) not delivered to an upper layer of PDCP and waiting to be delivered to the upper layer of PDCP.

Abstract: The present disclosure relates to a wireless token capable of representing a user network, the token being used to automatically provision an IoT enabled device to connect to the user network. Functions required to achieve this include: authenticate the token with the user network, and responsive to said authentication, obtain and store configuration information for enabling the token to communicatively couple one or more devices at or within a defined proximity to the token, with the user network; responsive to a wireless signal received from a given device among the one or more devices, establish a temporary secure communication channel between the given device and the token; and provide the configuration information from the token to the given device using the temporally secure communication channel, wherein the configuration information enables the given device to establish a connection with and operate in the user network based on the obtained configuration information.

Abstract: This disclosure includes a method, alone or in combination with other methods or steps described herein. The method may include defining, based on a multipath option and an identifier, a first connection with user equipment according to a first network provider over a path of a first network that comprises packet-switched signaling. The method may include defining, based on the identifier, a second connection with the user equipment according to a second network provider over a path of a second network that comprises the packet-switched signaling. The method may include receiving first data over the path of the first network and second data over the path of the second network. The method may include sending a combination of the first data and the second data to an application server. The method may include receiving, based on the combination, a response. The method may include sending the response to the user equipment.

Abstract: A computing device may receive, from an electronic device and via a wireless connection, a request to securely transmit user information using a secure data exchange module of the computing device. The computing device may configure the secure data exchange module for conducting a secure transmission of the user information and transmit a notification to the electronic device. The computing device may provide a user interface on the computing device for conducting the secure transmission of the user information. The computing device may receive and/or send, via the secure data exchange module, the user information. The computing device may transmit, via the wireless connection, the user information to the electronic device. The computing device may receive, from the electronic device, confirmation of a successful processing of the user information. The computing device may provide an indication of the confirmation of the successful processing of the user information.

Abstract: A server can receive a device public key and forward the device public key to a key server. The key server can perform a first elliptic curve Diffie-Hellman (ECDH) key exchange using the device public key and a network private key to derive a secret X1. The key server can send the secret X1 to the server. The server can derive an ECC PKI key pair and send to the device the server public key. The server can conduct a second ECDH key exchange using the derived server secret key and the device public key to derive a secret X2. The server can perform an ECC point addition using the secret X1 and secret X2 to derive a secret X3. The device can derive the secret X3 using (i) the server public key, a network public key, and the device private key and (ii) a third ECDH key exchange.

Abstract: A system, method and device for enhanced authentication of network elements are provided. The device may be configured to: obtain device information from a network element, transmit the obtained device information to a storage device in order to determine whether the network element supports authentication in accordance with a first authentication protocol, based on determining that the network element supports the authentication in accordance with the first authentication protocol, facilitate authentication of the network element with a first authentication server configured to perform the authentication in accordance with the first authentication protocol, and based on determining that the network element does not support the authentication in accordance with the first authentication protocol, facilitate the authentication of the network element with at least one server configured to perform authentication in accordance with a second authentication protocol.

Abstract: Methods, systems, and devices for providing computer implemented services using managed systems are disclosed. To provide the computer implemented services, the managed systems may be deployed to a location and operate in a predetermined manner conducive to, for example, execution of applications that provide the computer implemented services. When deployed to a location, the managed systems may be housed in a managed system frame. The managed system frames may include systems to guide placement of managed system in preferred frame units, remotely identify occupancy of the frame units, and/or the frame units against unexpected removals of or insertion of devices in the frame units.

Abstract: A method and system for updating firmware of a device. A method includes receiving a decryption engine for decrypting encrypted firmware, loading the decryption engine into a first memory of a device, and receiving the encrypted firmware. The method may include obtaining a pre-stored encryption key from a second memory of the device, wherein the second memory is a different type of memory than the first memory, and decrypting the encrypted firmware using the encryption key and the decryption engine, wherein the decryption of the encrypted firmware occurs in the first memory.

Abstract: An encryption mechanism used on cooperative multi-band wireless STA architecture that enables full duplex operations. In encrypting a frame, an AAD can be constructed by using a selected MAC address, which may not be associated with a band to be used for transmitting the frame in an upcoming TXOP. An STA that supports simultaneous transmission in a multi-band operation uses the same MAC address to encrypt the frames to be transmitted on different bands. An AAD is constructed by using a same MAC address corresponding to one of the transceivers. A transmit STA may specify band information used for encryption in the MAC header, which serves to signal the receive STA to decrypt the frame by using the proper information.

Abstract: The present disclosure provides techniques that may be applied, for example, for providing network policy information in a secure manner. In some cases, a UE may receive a first message for establishing a secure connection with a network, wherein the first message comprises network policy information, generate a first key based in part on the network policy information, and use the first key to verify the network policy information.

Abstract: This disclosure describes systems, methods, and devices related to security for multi-link operations. A multi-link device (MLD) may establish a first communication link between a first device of the MLD and a first device of a second MLD, and a second communication link between a second device of the MLD and a second device of the second MLD. The MLD may generate a group-addressed message. The MLD may protect the group-addressed message using a first key or a first integrity key. The MLD may protect the group-addressed message using a second key or a second integrity key. The MLD may send, using the first communication link, the group-addressed message protected using the first key or the first integrity key, and may send, using the second communication link, the group-addressed message protected using the second key or the second integrity key.

Abstract: Because of the line-of-sight character of optical wireless communication and a limited field-of-view of optical receivers, the coverage of an access point (120) and the overlapping coverage area of adjacent access points (120) in an optical system are smaller as compared to a RF system. It turns more challenging to support an end point (110) to roam securely in an optical multi-cell wireless communication network (100). To address that problem, a subsystem is disclosed to select for the end point (110) a candidate access point out of the plurality of access points (120) in view of one or more neighbor relationships, and to inform the end point (110) about the candidate access point to trigger the end point (110) to start a procedure for pre-establishing a new pairwise transient key between the end point (110) and the candidate access point (120) for a secure handover.

Abstract: Methods, systems, and devices for wireless communications are described. In some wireless communications systems, a user equipment (UE) may receive, from a base station, control signaling identifying a configuration of a set of time intervals for communication with the base station, the set of time intervals including a subset of the time intervals for which the UE is to perform a physical layer security procedure. In some cases, the UE may activate a timer associated with performing the physical layer security procedure in response to a trigger. The UE and the base station may communicate one or more messages using the physical layer security procedure, for example, in the subset of the time intervals identified by the control signaling, while the timer is active, or both. The physical layer security procedure may involve the UE performing physical layer security encoding, signal jamming, or both.

Abstract: A system and method for proximity-based authentication are provided. The method conducted at a server includes receiving identification data from a primary user session on a session end point hosted on a computing device, the identification data being usable in linking the primary user session to a user record associated with a registered user. The server provides a token to one of the session end point and a registered end point hosted on a computing device, the registered end point associated with the user record, for local transmission from the end point for proximity-based acquisition by the other one of the session end point and a registered end point. The server receives the token from the other one of the session end point and the registered end point to establish physical proximity of the session end point and the registered end point during the primary user session.

Abstract: An integrated-circuit radio transmitter chip comprises a transmitter, a cryptographic engine and control circuitry for the cryptographic engine. The cryptographic engine performs a cryptographic operation by receiving input data, performing a first process to generate first result data and a second process to generate second result data. The first and second result data are used to generate output data. In response to determining that the transmitter is active, the control circuity controls the cryptographic engine to perform the first process and prevents the cryptographic engine from performing the second process while the transmitter is active. The control circuitry controls the cryptographic engine to perform the second process in response to determining that the transmitter is not active.

Abstract: A method for implementing requests from an app by a SIM in a mobile phone comprises the steps of: binding an app to a BIP server by a mobile phone; delivering a request command to the BIP server from the mobile phone; converting the request command to an APDU format, packing the converted request command in the APDU format in a request packet, and delivering the request packet to an IP of a SIM by the BIP server; receiving and unpacking the request packet to have the converted request command, and providing the converted request command to the SIM; executing the request command to have a result by the SIM; delivering the result in a response packet to the BIP server via the mobile network relayed; unpacking the response packet to fetch the result, and delivering the result to the mobile phone for the app by the BIP server.

Abstract: A synthetic judgment section performs synthetic judgment of randomness test for shared random numbers by combining a result of a first randomness test and a result of a second randomness test, the first randomness test being performed on the shared random numbers by a first communication device and the second randomness test being performed on the shared random numbers by a second communication device wherein a result of the synthetic judgment is safely notified to at least one of the first communication device and the second communication device, wherein the first randomness test and the second randomness test are different with respect to at least one of randomness test to be used and random number portion to be tested.

Abstract: Provided is a method for authenticating a user communicating with an enterprise via a network. The method includes receiving, via the network, authenticators for a user from a first user device associated with the user, and storing the received authenticators. A first authenticator from the stored authenticators is selected to be used for authenticating the user based on an authentication policy received from the enterprise. An authentication request is transmitted to a user device requesting the first authenticator and the user is authentication by comparing the received authenticator with the stored first authenticator.

Abstract: A token is transmitted to a certification computing system, and a piece of information is received in association with the token from a source computing system. The piece of information is accepted according to the token, which provides a certification relating to the piece of information being granted by a transmission of the token from the certification computing system to the source computing system.

Abstract: The present disclosure relates to a communication method and system for converging a 5th-Generation (5G) communication system for supporting higher data rates beyond a 4th-Generation (4G) system with a technology for Internet of Things (IoT). A method performed by a user equipment (UE) in a wireless network, the method comprising: establishing a communication with an application function (AF) server using a first authentication and key management for applications (AKMA) application key (KAF); receiving a message over the established communication from the AF server, the message indicating that a lifetime of the first KAF has expired; and configuring a back-off flag in the UE to optimize an AKMA key refresh mechanism in the wireless network in response to receiving the message, wherein the back-off flag prevents a request for a first AKMA anchor key (KAKMA) until a fresh primary authentication is performed.

Abstract: Techniques and mechanisms to reduce double encryption of packets that are transmitted using encrypted tunnels. The techniques described herein include determining that portions of the packets are already encrypted, identifying portions of the packets that are unencrypted, and selectively encrypting the portions of the packets that are unencrypted prior to transmission through the encrypted tunnel. In this way, potentially private or sensitive data in the packets that is unencrypted, such as information in the packet headers, will be encrypted using the encryption protocol of the encrypted tunnel, but the data of the packets that is already encrypted, such as the payload, may avoid unnecessary double encryption. By reducing (or eliminating) the amount of data in data packets that is double encrypted, the amount of time taken by computing devices, and computing resources consumed, to encrypted traffic for encrypted tunnels may be reduced.

Abstract: Methods, systems, and apparatus, including a method for determining network measurements. In some aspects, a method includes receiving, by a first aggregation server and from each of multiple client devices, encrypted impression data. A second aggregation server receives, from each of at least a portion of the multiple client devices, encrypted conversion data. The first aggregation server and the second aggregation server perform a multi-party computation process to generate chronological sequences of encrypted impression data and encrypted conversion data and to decrypt the encrypted impression data and the encrypted conversion data.

Abstract: According to an example aspect of the present invention, there is provided method, comprising: generating or receiving a first hash on the basis of the mobile network data change by a source network function, providing the first hash and security credentials information of the source network function for validation by a set of validator entities, and in response to detecting validation of the first hash and the security credentials information, generating a first transaction for a first blockchain, the first transaction being indicative of the mobile network data change and comprising the first hash.

Abstract: A device implementing a system for device-relationship based communication includes at least one processor configured to establish, by a first device associated with a first user, a secure communication channel with a second device associated with a second user via a direct wireless connection. The at least one processor is configured to transmit, over the secure communication channel, first device-identifying information to the second device, and receive, over the secure communication channel, second device-identifying information from the second device. The at least one processor is configured to establish a particular type of relationship with the second device, store the second device-identifying information in association with an indication of the particular type of relationship established with the second device, and transmit, to the second device and over the secure communication channel, the indication of the particular type of relationship established with the second device.

Abstract: Systems and methods for providing authentication and authorization for software license management of a particular software-controlled application are disclosed. Exemplary implementations may: store information electronically, including different types of user information, hardware information, key information, and license information; receive a user request for user-specific authentication and device-specific authorization to access and/or use the particular software-controlled application; perform different types of (automated) verification based on the user identifier, the hardware identifier, and the machine identifier in the user request; and, responsive to particular results from the different types of verification, perform some combination of transferring a response to the user request and performing registration and/or assignment as requested.

Abstract: A signal-of-interest is received by using a first and second planar electrically conductive disc to define an antenna. The antenna produces RF signal outputs at three output ports Ex, Ey and Ez, each having a different associated gain pattern and polarization response. At least one null is automatically asserted in a pattern defined by the antenna in a specified direction by selectively weighting a gain and a phase of the RF signals respectively produced from the three output ports and then combining the RF signals to produce a first receiver signal output.

Abstract: A system for detecting and mitigating attacks using forged authentication objects within a domain is provided, comprising an authentication object inspector configured to observe a new authentication object generated by an identity provider, and retrieve the new authentication object; and a hashing engine configured to retrieve the new authentication object from the authentication object inspector, calculate a cryptographic hash for the new authentication object, and store the cryptographic hash for the new authentication object in a data store; wherein subsequent access requests accompanied by authentication objects are validated by comparing hashes for each authentication object to previous generated hashes.

Abstract: Methods and apparatus to support scheduled access control for an electronic lock are described herein. An initiating central wireless device obtains an ephemeral identity resolving key (IRK) to use in resolving an ephemeral resolvable private address (RPA) of a peripheral wireless device. The initiating central wireless device can subsequently connect securely to the peripheral wireless device in order to unlock an electronic lock controlled by the peripheral wireless device to gain access during a scheduled time period. The ephemeral IRK and ephemeral RPA can be used for a limited period of time and/or for a predetermined number of usages during the scheduled time period.

Abstract: Systems and methods are provided for use in appending log entries to a data structure. One exemplary method includes receiving, at a communication device, a log entry from a terminal and signing the log entry with a private key of a key pair specific to the communication device. The method also includes transmitting the signed log entry to an identity provider (IDP) and receiving, by the communication device, from the IDP, a signed, encrypted log entry. The method further includes verifying, by the communication device, a signature of the signed, encrypted log entry based on a public key associated with a key pair specific to the IDP and then appending the encrypted log entry to a digital identity included in the communication device.

Abstract: The present disclosure relates to authentication methods supported by the User Equipment (UE) to the core network and authentication method (selected by the core network) to the UE. These can be used for negotiating any primary or secondary (or any) authentication method and are applicable when multiple authentication methods are supported at the UE and the network (authentication server). Further, the present disclosure also offers security solution to prevent modification or tampering of the parameters in the mechanisms in order to prevent attacks such as bidding-down, Denial of Service (DoS) and Man-In-The-Middle (MITM).

Abstract: Embodiments of the present invention provide a system for executing audio cryptology in real-time for audio misappropriation prevention. The system is configured for identifying, via a cryptographic device, one or more audio signals, causing the cryptographic device to generate and emit a dynamically varying continuous audio tone, continuously monitoring in real-time the one or more audio signals, via the cryptographic device, determining, via the cryptographic device, termination of the one or more audio signals based on continuously monitoring the one or more audio signals in real-time, and causing the cryptographic device to stop generating and emitting the dynamically varying continuous audio tone.

Abstract: A network node configured to perform a process that includes receiving a PDU Session Establishment Request message for establishing a PDU session, wherein the PDU Session Establishment Request message was transmitted by a UE and includes a PDU session ID. The process also includes communicating a Session Management (SM) Request comprising the PDU Session Establishment Request to an SMF. The process also includes receiving from the SMF a message that includes: i) the PDU Session ID identifying the PDU session, ii) a PDU Session Establishment Accept message, and iii) a user plane (UP) security policy for the PDU session, wherein the UP security policy for the PDU session indicates: i) whether UP confidentiality protection shall be activated or not for all data radio bearers (DRBs) belonging to the PDU session, and/or ii) whether UP integrity protection shall be activated or not for all data radio bearers (DRBs) belonging to the PDU session.

Abstract: Techniques, methods and/or apparatuses are disclosed that enable of cyber risks on assets of networks to be evaluated in presence of security controls on the assets. In this way, effect of security controls already in place may be quantified. A novel scoring technique is presented. Also, use of causal inference is in the context of security risk assessment is described.

Abstract: A vehicle control method applied to a smart car key includes receiving a connection request sent by a mobile terminal, establishing a communication connection with the mobile terminal in response to the connection request, receiving identity information and authorization request information sent by the mobile terminal, determining whether the identity information is correct, and in response that the identity information is correct, sending pairing information to the mobile terminal in response to the authorization request information and sending the identity information to a vehicle to be controlled. The mobile terminal controls the vehicle through the pairing information and the identity information to perform at least one operation.

Abstract: Disclosed are a control method, a node and a computer storage medium. The method may include: sending instruction information to a second node when a data bearer for a User Equipment (UE) is established, wherein the instruction information is used for turning on or off the control on a data replication function of the UE by the second node.

Abstract: [Problem] Provided is an authorization system capable of reducing a load on a host regarding an invitation procedure in a case where there is a large number of guests or guests are frequently invited, and preventing identity theft or invitation of an unwanted third party.

Abstract: The invention provides a method for managing access to a network resource on a network from a mobile device, the method including the steps of intercepting a data stream from the mobile device attempting to access the network resource, extracting information from the intercepted data stream relating to at least one of the mobile device or a user of the mobile device, accessing at least one of enterprise service based information and third party information regarding at least one of the mobile device or the user of the mobile device, determining whether the mobile device is authorized to access the network resource, preparing an access decision that specifies whether the mobile device is authorized to access the network resource, and storing the access decision in a database on the network.

Abstract: The technology disclosed herein enables a computing device to use a trusted execution environment in an untrusted mobile device to distribute protected content to computing devices at different locations. An example method may include: establishing, by a processor of a mobile device, a trusted execution environment in the mobile device, wherein the trusted execution environment uses memory encryption; loading data of a computing device into the trusted execution environment in the mobile device, wherein the data comprises protected content and comprises executable code to control access to the protected content; receiving, by the mobile device, authentication data from a set of computing devices; and executing, by the mobile device, the executable code in the trusted execution environment to analyze the authentication data and to provide one or more of the computing devices of the set with access to the protected content.

Abstract: A server can receive a device public key and forward the device public key to a key server. The key server can perform a first elliptic curve Diffie-Hellman (ECDH) key exchange using the device public key and a network private key to derive a secret X1. The key server can send the secret X1 to the server. The server can derive an ECC PKI key pair and send to the device the server public key. The server can conduct a second ECDH key exchange using the derived server secret key and the device public key to derive a secret X2. The server can perform an ECC point addition using the secret X1 and secret X2 to derive a secret X3. The device can derive the secret X3 using (i) the server public key, a network public key, and the device private key and (ii) a third ECDH key exchange.

Abstract: Disclosed herein are embodiments providing coordinated privacy for targeted communications and reporting. In particular, the embodiments provide a source user querying an information system to generally identify target users for a communication campaign. A privacy controller alters a first dataset of a query response by a first alteration quantity for transmission to the source user. The source user then generally identifies target users within the first dataset for development of a communication campaign of targeted communications directed to the target users. Subsequently, a reporting system generates a report with a second dataset detailing viewership by target users. The privacy controller alters a second dataset of a report by a second alteration quantity for transmission to the source user. The second alteration quantity is based on the first alteration quantity.

Abstract: An access point (AP) multi-link device (MLD) and a non-AP station (STA) MLD perform a fast initial link setup (FILS) procedure to establish wireless communications over a plurality of links. The AP MLD and the non-AP STA MLD communicate over one or more links of the plurality of links upon completion of the FILS procedure with a FILS Discovery frame transmitted in the FILS procedure indicating whether a service set identifier (SSID) of the AP MLD is different from a SSID of an AP of a plurality of APs in the AP MLD transmitting the FILS Discovery frame.

Abstract: A method for fetching a content from a web server to a client device is disclosed, using tunnel devices serving as intermediate devices. The client device accesses an acceleration server to receive a list of available tunnel devices. The requested content is partitioned into slices, and the client device sends a request for the slices to the available tunnel devices. The tunnel devices in turn fetch the slices from the data server, and send the slices to the client device, where the content is reconstructed from the received slices. A client device may also serve as a tunnel device, serving as an intermediate device to other client devices. Similarly, a tunnel device may also serve as a client device for fetching content from a data server. The selection of tunnel devices to be used by a client device may be in the acceleration server, in the client device, or in both.

Abstract: A method of digital radio communication between a first device and a second device is disclosed. An advertising packet is transmitted between first and second devices, wherein the packet includes a first address and a data portion. Additionally, an encryption key is transmitted between the devices. The first device generates a second address by encrypting an identity value derived from part of the first address using the encryption key and the data portion. The result is encrypted to generate second portion of the second address. The first device then transmits a connection request including the second address. The second device decrypts the second portion and uses the encryption key to determine correspondence with the first portion. If said correspondence is determined, the second device decrypts the first portion using at least the encryption key and compares it to an expected identity value derived from the first address.

Abstract: Embodiments of the present disclosure relate to systems and methods for monitoring and verifying latency on TSN-configured networks. The disclosure describes a novel and inventive time capture location protocol that supplements existing TSN protocols. This supplemental TSN protocol details a way to capture the time at which a message arrives at various points in a TSN-configured network. The captured times allow for monitoring and verification of TSN based features and their underlying systems, including run-time diagnostics to detect problems and delays.

Abstract: The described technology is generally directed towards caching session state data on a client device, so that services called by the client device and other services can use the session state data without having to recollect such information from a server or servers that maintain the ground truth values for the session state data. The session state data can be divided into payload datasets based on domains or the like, so that only a relevant part of the session state data need be attached to a given communication, and/or updated when a session variable changes in some way. A payload dataset can be encoded or encrypted so that a service can verify the integrity of the payload dataset before using it, such as for service-to-service communication.

Abstract: A wireless communication device includes a processor and a memory configured to store a program for establishing a wireless connection with a terminal device. The processor establishes, in accordance with the program stored in the memory, the wireless connection with the terminal device upon request for the wireless connection from one of the wireless communication device and the terminal device. Upon establishment of the wireless connection with the terminal device, the processor queries the terminal device with which the wireless connection is established to check a state of an application program for causing the wireless communication device to execute a specific function. The processor maintains or cuts off the wireless connection with the terminal device based on a state of a response of the terminal device with respect to the query.

Abstract: A session configuration method and a session configuration apparatus are disclosed. According to the session configuration method, a terminal device sends, to a session management network element, a session establishment request used to request to establish a first session. After receiving the session establishment request, the session management network element sends redundant transmission security information to an access network device. After receiving the redundant transmission security information, the access network device sends the redundant transmission security information to the terminal device. The redundant transmission security information is used to indicate security keys and security policies of the first session and a second session that need to be established by the terminal device. The second session is a redundant session of the first session.

Abstract: A network node operates a Session Management Function (SMF) in a control plane of a core network of a wireless network. The network node authenticates a User Equipment (UE) with an Extensible Authentication Protocol (EAP) server in a secondary authentication process that uses the SMF as an EAP authenticator. The EAP server is outside of the core network and the UE is separately authenticated with a further network node in the control plane of the core network via a primary authentication process. Authenticating the UE in the secondary authentication process comprises exchanging EAP messages between the SMF and the UE and between the SMF and the EAP server. The SMF authorizes a data session between the UE and the external network through a user plane of the core network based on the UE having successfully authenticated via both the primary authentication process and the secondary authentication process.

Abstract: An initiator device can broadcast a witness request to one or more authentication devices. The one or more authentication devices can then determine an assurance level from a range of assurance levels and determine a token share corresponding to the assurance level. The initiator device can then receive, from the one or more authentication devices, at least one witness response comprising the token share corresponding to the assurance level. The initiator device can generate an authentication token using a set of token shares. The initiator device can then transmit the authentication token to an authentication server, wherein the authentication server verifies the authentication token.