SYSTEM, METHOD, AND COMPUTER PROGRAM PRODUCT FOR PRIVACY-PRESERVING TRANSACTION VALIDATION MECHANISMS FOR SMART CONTRACTS THAT ARE INCLUDED IN A LEDGER

• US 20170155515A1
• Filed: 12/03/2015
• Published: 06/01/2017
• Est. Priority Date: 11/26/2015
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Androulaki, Elli, DeCaro, Angelo, Kramp, Thorsten, Vukolic, Marko, Sorniotti, Alessandro
• Granted Patent: US 9,992,028 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06Q 20/065 using e-cash
• CPC Class Codes: G06Q 20/0658 e-cash managed locally
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 2220/00 Business processing using cryptography postage metering system using cryptography G06Q2250/05
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/008 involving homomorphic encryption
• CPC Class Codes: H04L 9/0833 involving conference or group key network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees

Abstract

The system, method, and computer program product described herein may provide the capability to handle a variety of types of transactions, not just payment transactions. In addition, system, method, and computer program product described herein may provide the capability for users to be able to control the confidentiality of their transactions, for the system to control access to transactions, for the system to be capable of auditing transactions, and to provide accountability of the validating entities.

Claims

1. A method of processing digital transactions in a network of computer systems comprising:

creating a digital message including;

a specification of a set of validator computer systems to validate the computer program instructions and results of execution of the computer program instructions, wherein each validator computer system is provided with a signing key, and

computer program instructions to be executed to perform at least one function relating to a digital transaction, wherein the computer program instructions are encrypted so that the computer program instructions are accessible only by the specified set of validator computer systems;

signing the digital message using a user-private system key;

generating a copy of the digital message for each specified validator computer system and signing the copy for each specified validator computer system with that validator computer system'"'"'s public signing key;

transmitting the digital messages over the network to at least the plurality of validator computer systems; and

receiving a validation result from at least some of the plurality of validator computer systems, wherein a validation result is generated at a validator computer system by;

decrypting the signed digital message,

executing the computer program instructions in the digital message to determine if the computer program instructions are valid,

generating a result indicating whether the computer program instructions are valid, and

signing the result with a system provided signing key and with the signing key provided in the digital message.

2. The method of claim 1, further comprising:

determining that the digital message is valid if at least a threshold number of validation results indicate that the digital message is valid.

3. The method of claim 1, wherein the digital message further comprises a specification of a set of user computer systems to be parties to the transaction, wherein each user computer system is provided with a signing key, and the method further comprises providing access to the computer program instructions only to the specified user computer systems using the signing key.

4. The method of claim 3, wherein the digital message further comprises a specification of a computer program instruction execution role for each of the specified user computer systems.

5. The method of claim 3, wherein the specified validator computer systems do not have access to identities of the specified user computer systems.

6. The method of claim 1, wherein the result further comprises a result of execution of the computer program instructions.

7. The method of claim 1, wherein the result is encrypted so that only authorized parties can see the result.

8. A system for processing digital transactions in a network of computer systems, the system comprising a processor, memory accessible by the processor, and computer program instructions stored in the memory and executable by the processor to perform:

creating a digital message including;

a specification of a set of validator computer systems to validate the computer program instructions and results of execution of the computer program instructions, wherein each validator computer system is provided with a signing key, and

computer program instructions to be executed to perform at least one function relating to a digital transaction, wherein the computer program instructions are encrypted so that the computer program instructions are accessible only by the specified set of validator computer systems;

signing the digital message using a user-private system key;

generating a copy of the digital message for each specified validator computer system and signing the copy for each specified validator computer system with that validator computer system'"'"'s public signing key;

transmitting the digital messages over the network to at least the plurality of validator computer systems; and

receiving a validation result from at least some of the plurality of validator computer systems, wherein a validation result is generated at a validator computer system by;

decrypting the signed digital message,

executing the computer program instructions in the digital message to determine if the computer program instructions are valid,

generating a result indicating whether the computer program instructions are valid, and

signing the result with a system provided signing key and with the signing key provided in the digital message.

9. The system of claim 8, further comprising:

determining that the digital message is valid if at least a threshold number of validation results indicate that the digital message is valid.

10. The system of claim 8, wherein the digital message further comprises a specification of a set of user computer systems to be parties to the transaction, wherein each user computer system is provided with a signing key, and the method further comprises providing access to the computer program instructions only to the specified user computer systems using the signing key.

11. The system of claim 10, wherein the digital message further comprises a specification of a computer program instruction execution role for each of the specified user computer systems.

12. The system of claim 10, wherein the specified validator computer systems do not have access to identities of the specified user computer systems.

13. The system of claim 8, wherein the result further comprises a result of execution of the computer program instructions.

14. The system of claim 8, wherein the result is encrypted so that only authorized parties can see the result.

15. A computer program product for processing digital transactions in a network of computer systems, the computer program product comprising a non-transitory computer readable medium and computer program instructions stored on the non-transitory computer readable medium and executable by a processor to perform:

creating a digital message including;

a specification of a set of validator computer systems to validate the computer program instructions and results of execution of the computer program instructions, wherein each validator computer system is provided with a signing key, and

computer program instructions to be executed to perform at least one function relating to a digital transaction, wherein the computer program instructions are encrypted so that the computer program instructions are accessible only by the specified set of validator computer systems;

signing the digital message using a user-private system key;

generating a copy of the digital message for each specified validator computer system and signing the copy for each specified validator computer system with that validator computer system'"'"'s public signing key;

transmitting the digital messages over the network to at least the plurality of validator computer systems; and

receiving a validation result from at least some of the plurality of validator computer systems, wherein a validation result is generated at a validator computer system by;

decrypting the signed digital message,

executing the computer program instructions in the digital message to determine if the computer program instructions are valid,

generating a result indicating whether the computer program instructions are valid, and

signing the result with a system provided signing key and with the signing key provided in the digital message.

16. The computer program product of claim 15, further comprising:

determining that the digital message is valid if at least a threshold number of validation results indicate that the digital message is valid.

17. The computer program product of claim 15, wherein the digital message further comprises a specification of a set of user computer systems to be parties to the transaction, wherein each user computer system is provided with a signing key, and the method further comprises providing access to the computer program instructions only to the specified user computer systems using the signing key.

18. The computer program product of claim 17, wherein the digital message further comprises a specification of a computer program instruction execution role for each of the specified user computer systems.

19. The computer program product of claim 17, wherein the specified validator computer systems do not have access to identities of the specified user computer systems.

20. The system of claim 15, wherein the result further comprises a result of execution of the computer program instructions.

21. The system of claim 15, wherein the result is encrypted so that only authorized parties can see the result.