Establishment of consortium blockchain network

Patent metadata

Field	Value
Publication number	US-10484346-B2
Application number	US-201715638180-A
Country	US
Kind code	B2
Filing date	Jun 29, 2017
Priority date	Feb 7, 2017
Publication date	Nov 19, 2019
Grant date	Nov 19, 2019

Abstract

The disclosed technology is generally directed to blockchain and other security technology. In one example of the technology, a first node is endorsed. During endorsement of a first node, a pre-determined type of blockchain or other security protocol code to be authorized and a pre-determined membership list are stored in a trusted execution environment (TEE) of the first node. A determination is made as to whether the membership lists and pre-determined blockchain or other security protocol code to be authorized from the proposed members match. If so, TEE attestation is used to verify that nodes associated with prospective members of the consortium store the pre-determined type of blockchain or other security protocol code to be authorized. Upon TEE attestation being successful, a consortium network is bootstrapped such that the prospective members become members of the consortium network.

First claim

We claim:

1. An apparatus for a blockchain system, comprising:
a device including at least one memory adapted to store run-time data for the device, and at least one processor that is adapted to execute processor-executable code that, in response to execution, enables the device to perform actions, including:
storing pre-determined code of a pre-determined type of blockchain protocol code in a trusted execution environment (TEE) of a first validation node;
storing, in the first validation node: a first pre-determined membership list of a consortium, wherein the first pre-determined membership list includes a prospective member associated with the first validation node and a first authorization associated with the pre-determined type of blockchain protocol code;

receiving, from a plurality of prospective members of the consortium: a plurality of membership lists, and a plurality of authorizations from the plurality of prospective members of the consortium, wherein the plurality of authorizations are indications associated with the pre-determined type of blockchain protocol code;
making a determination as to whether the plurality of membership lists from the plurality of prospective members of the consortium match the first pre-determined membership list and the plurality of authorizations that are indications associated with the pre-determined type of blockchain protocol code match the first authorization;
upon determining that the plurality of membership lists from the plurality of prospective members of the consortium match the first pre-determined membership list and that the plurality of authorizations that are indications associated with the pre-determined type of blockchain protocol code match the first authorization, verifying, via TEE attestation, that validation nodes associated with prospective members of the consortium store the pre-determined type of blockchain protocol code that matches the first authorization; and
upon the TEE attestation being successful, bootstrapping a consortium network such that the prospective members become members of the consortium network.

2. The apparatus of claim 1 , the actions further including storing a public/private key pair in the TEE of the first validation node.

3. The apparatus of claim 1 , wherein bootstrapping the consortium network further includes generating a blockchain master key.

4. The apparatus of claim 1 , the actions further comprising:
discovering other validation nodes associated with the plurality of prospective members; and
receiving a private key from each of the other validation nodes.

5. A method for a blockchain system, comprising:
endorsing a first node, including: storing pre-determined code of the pre-determined type of blockchain protocol code in a trusted execution environment (TEE) of the first node; storing, in the first node, a first pre-determined membership list of a consortium, wherein the first pre-determined membership list includes a prospective member associated with the first node; and storing, in the first node, a first authorization associated with the pre-determined type of blockchain protocol code;
receiving, from a plurality of prospective members of the consortium: a plurality of membership lists, and a plurality of authorizations from the plurality of prospective members of the consortium, wherein the plurality of authorizations are indications associated with the pre-determined type of blockchain protocol code;
determining whether the plurality of membership lists from the plurality of prospective members of the consortium match the first pre-determined membership list and the plurality of authorizations that are indications associated with the pre-determined type of blockchain protocol code match the first authorization;
upon determining that the plurality of membership lists from the plurality of prospective members of the consortium match the first pre-determined membership list and that the plurality of authorizations that are indications associated with the pre-determined type of blockchain protocol code match the first authorization, using TEE attestation to verify that nodes associated with prospective members of the consortium store the pre-determined type of blockchain protocol code that matches the first authorization; and
upon the TEE attestation being successful, bootstrapping a consortium network such that the prospective members become members of the consortium network.

6. The method of claim 5 , wherein endorsing the first node further includes storing a public/private key pair in the TEE of the first node.

7. The method of claim 5 , wherein bootstrapping the consortium network further includes generating a blockchain master key.

8. The method of claim 5 , further comprising receiving a public transaction key associated with a participant.

9. The method of claim 5 , wherein determining whether the plurality of membership lists from the plurality of prospective members of the consortium match the first pre-determined membership list and the plurality of authorizations that are indications associated with the pre-determined type of blockchain protocol code match the first authorization further includes determining whether there is a match among at least one of the following: a type of TEE, a type of processor, a software version of blockchain protocol code, or a type of Confidential Consortium (COCO) Blockchain framework.

10. The method of claim 5 , wherein the TEE includes at least one protected region in a processor in the first node.

11. The method of claim 10 , wherein the TEE includes two separate protected regions in the processor in the first node.

12. The method of claim 5 , further comprising discovering other nodes associated with the plurality of prospective members.

13. The method of claim 12 , further comprising receiving a private key from each of the other nodes.

14. The method of claim 12 , wherein endorsing the first node further includes storing a public/private key pair in the TEE of the first node.

15. The method of claim 14 , further comprising establishing a trusted connection with at least one of the other nodes via creation of a mutually-authenticated secure tunnel built on public keys of the communicating nodes.

16. The method of claim 14 , further comprising, upon the TEE attestation being successful, exchanging the private key with each of the other nodes.

17. The method of claim 16 , further comprising:
receiving a private key from each of the other nodes, wherein bootstrapping the consortium network further includes generating a blockchain master key from the private keys.

18. A processor-readable storage medium, having stored thereon process-executable code that, upon execution by at least one processor, enables actions, comprising:
determining whether a plurality of membership lists from plurality of prospective members of a consortium match a first pre-determined membership list and a plurality of authorizations indicate that a pre-determined type of security protocol code matches a first authorization;
upon determining that the plurality of membership lists from the plurality of prospective members of the consortium match the first pre-determined membership list and that the plurality of authorizations that are indications that the pre-determined type of security protocol code matches the first authorization, using trusted execution environment (TEE) attestation to verify that nodes associated with prospective members of the consortium store the pre-determined type of security protocol code that matches the firs

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Russinovich Mark
• Costa Manuel
• Kerner Matthew
• Moscibroda Thomas

Classifications

• H04W4/06

  Selective distribution of broadcast services, e.g. multimedia broadcast multicast service [MBMS]; Services to user groups; One-way selective calling services · CPC title

• G06F21/74

  operating in dual or compartmented mode, i.e. at least one secure mode · CPC title

• H04L63/12

  Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32) · CPC title

• H04L63/104

  Grouping of entities · CPC title

• G06Q20/02

  involving a neutral party, e.g. certification authority, notary or trusted third party [TTP] · CPC title