Systems and methods for establishing data provenance by generating one-time signatures

1 . A computer-implemented method, comprising:

generating, by at least one processor, a request for a one-time signature comprises including a public certificate in the request for the one-time signature that is mapped to one or more accounts indicating an identity of a client, the request based on data to be stored on a server;

providing, by the at least one processor and via an application programming interface (API) associated with a signing environment, the request and the data to be stored on the server to the signing environment to generate the one-time signature;

receiving, by the at least one processor and via the API, a response message comprising the one-time signature in response to generation of the one-time signature by a hardware security module (HSM) for the data to be stored on the server, the HSM configured to generate the one-time signature based on a mapping between a seed and an account of a plurality of accounts;

generating, by the at least one processor, an entry for a distributed ledger associated with the server based on the one-time signature, the entry indicating an association between the data to be stored on the server and the one-time signature; and

transmitting, by the at least one processor, to the server at least a portion of the entry for inclusion in the distributed ledger associated with the server.

2 . The computer-implemented method of claim 1 , further comprising: encrypting, by the at least one processor, the request based on a predetermined encryption scheme, wherein providing the request to the signing environment comprises: providing the request to the signing environment in response to encrypting the request.

3 . The computer-implemented method of claim 1 , wherein receiving the response message comprises: receiving, by the at least one processor, the response message in response to execution of one or more operations by the HSM involving a seed value corresponding to the seed.

4 . The computer-implemented method of claim 1 , wherein generating the entry comprises: updating the data to be stored on the server by hashing at least a portion of the data; and generating the entry in response to updating the data to be stored on the server.

5 . The computer-implemented method of claim 4 , wherein the server comprises a first server, the computer-implemented method further comprising:

providing the one-time signature to a second server to establish provenance of the data stored on the first server.

6 . A system, comprising:

at least one hardware processor programmed to:

generate a request for a one-time signature, the request based on data to be stored on a server, wherein the request includes a public certificate for the one-time signature that is mapped to one or more accounts indicating an identity of a client;

provide, via an application programming interface (API) associated with a signing environment, the request and the data to be stored on the server to the signing environment to generate the one-time signature;

receive, via the API, a response message comprising the one-time signature in response to generation of the one-time signature by a hardware security module (HSM) for the data to be stored on the server, the HSM configured to generate the one-time signature based on a mapping between a seed and an account of a plurality of accounts;

generate an entry for a distributed ledger associated with the server based on the one-time signature, the entry indicating an association between the data to be stored on the server and the one-time signature; and

transmit to the server at least a portion of the entry for inclusion in the distributed ledger associated with the server.

7 . The system of claim 6 , wherein the at least one hardware processor is further programmed to: encrypt the request based on a predetermined encryption scheme, wherein the at least one hardware processor programmed to provide the request to the signing environment is programmed to: provide the request to the signing environment in response to encrypting the request.

8 . The system of claim 6 , wherein the at least one hardware processor programmed to receive the response message is programmed to: receive the response message in response to execution of one or more operations by the HSM involving a seed value corresponding to the seed.

9 . The system of claim 6 , wherein the at least one hardware processor programmed to generating the entry is programmed to: update the data to be stored on the server by hashing at least a portion of the data; and generate the entry in response to updating the data to be stored on the server.

10 . The system of claim 9 , wherein the server comprises a first server, and wherein the at least one hardware processor is further programmed to: provide the one-time signature to a second server to establish provenance of the data to be stored on the first server.

11 . A non-transitory computer-readable medium storing instructions thereon that, when executed by at least one processor, cause the at least one processor to:

generate a request for a one-time signature, the request based on data to be stored on a server;

include a public certificate in the request for the one-time signature that is mapped to one or more accounts indicating an identity of a client;

provide, via an application programming interface (API) associated with a signing environment, the request and the data to be stored on the server to the signing environment to generate the one-time signature;

receive, via the API, a response message comprising the one-time signature in response to generation of the one-time signature by a hardware security module (HSM) for the data to be stored on the server, the HSM configured to generate the one-time signature based on a mapping between a seed and an account of a plurality of accounts;

generate an entry for a distributed ledger associated with the server based on the one-time signature, the entry indicating an association between the data to be stored on the server and the one-time signature; and

transmit to the server at least a portion of the entry for inclusion in the distributed ledger associated with the server.

12 . The non-transitory computer-readable medium of claim 11 , wherein the instructions further cause the at least one processor to: encrypt the request based on a predetermined encryption scheme; and wherein the instructions that cause the at least one processor to provide the request to the signing environment cause the at least one processor to: provide the request to the signing environment in response to encrypting the request.

13 . The non-transitory computer-readable medium of claim 11 , wherein the instructions that cause the at least one processor to receive the response message cause the at least one processor to: receive the response message in response to execution of one or more operations by the HSM involving a seed value corresponding to the seed.

14 . The non-transitory computer-readable medium of claim 11 , wherein the instructions that cause the at least one processor to generate the entry cause the at least one processor to: update the data to be stored on the server by hashing at least a portion of the data; and generate the entry in response to updating the data to be stored on the server.

15 . The non-transitory computer-readable medium of claim 11 , wherein the server comprises a first server, and wherein the instructions further cause the at least one processor to: provide the one-time signature to a second server to establish provenance of the data to be stored on the first server.