Multi-instance architecture supporting trusted blockchain-based network

Patent metadata

Field	Value
Publication number	US-10826682-B2
Application number	US-201816026625-A
Country	US
Kind code	B2
Filing date	Jul 3, 2018
Priority date	Jul 3, 2018
Publication date	Nov 3, 2020
Grant date	Nov 3, 2020

Abstract

An example embodiment performed by a scoped software application executable on a computing device of a computational instance within a trust group of computational instances of a remote network management platform may involve obtaining a representation of one or more transactions involving the computational instance. The embodiment may also involve encrypting the representation, using a pre-shared key to which at least some computational instances within the trust group have access. The embodiment may also involve placing the encrypted representation into a data block that also includes: (i) a first output generated by applying a hash function to content from a previous data block of a blockchain-based transaction ledger, and (ii) a second output generated by applying the hash function to the encrypted representation and the first output. The embodiment may also involve distributing copies of the data block to blockchain-based transaction ledgers within each computational instance of the trust group.

First claim

What is claimed is:

1. A system comprising:
a plurality of computational instances disposed within a remote network management platform, each of which is communicatively coupled and dedicated to a respective managed network, wherein the managed networks are controlled by respective different entities, and wherein a subset of the computational instances forms a trust group and at least some of the computational instances in the trust group have access to a pre-shared key; and
a scoped software application, executable on a computing device of a computational instance within the trust group, and configured to:
receive an input that identifies the different entities within the trust group and enables one of the entities with administrative permission to control, via the scoped software application, which computational instances of the subset of the computational instances have access to the pre-shared key;
obtain a representation of one or more transactions involving the computational instance;
encrypt, using the pre-shared key, the representation of the one or more transactions;
place the encrypted representation into a data block that also includes: (i) a first hash of content from a previous data block of a blockchain-based transaction ledger, and (ii) a second hash of the encrypted representation and the first hash; and
distribute copies of the data block to blockchain-based transaction ledgers within each computational instance of the trust group.

2. The system of claim 1 , wherein the pre-shared key is a symmetric key.

3. The system of claim 1 , wherein the pre-shared key is an asymmetric public key of an asymmetric key pair comprising the asymmetric public key and an asymmetric private key corresponding to the asymmetric public key.

4. The system of claim 1 , wherein the scoped software application is configured to:
determine that a copy of a second data block has been added to a blockchain-based transaction ledger within the computational instance, wherein the second data block includes an encrypted representation of one or more other transactions; and
in response to determining that the copy of the second data block has been added to the blockchain-based transaction ledger within the computational instance:
decrypt the encrypted representation of the one or more other transactions; and
store the decrypted representation of the one or more other transactions in a database associated with the scoped software application.

5. The system of claim 1 , wherein the scoped software application is a software asset management application,
wherein the trust group is a software license contract trust group including the computational instance and a second computational instance,
wherein the computational instance is associated with a software publisher and the second computational instance is associated with an enterprise obtaining software from the software publisher,
wherein the one or more transactions include a software license contract between the software publisher and the enterprise,
wherein the pre-shared key is an asymmetric public key associated with the second computational instance, and
wherein distributing copies of the data block to the blockchain-based transaction ledgers within each computational instance of the trust group comprises distributing copies of the data block to the blockchain-based transaction ledgers within each computational instance of the software license contract trust group.

6. The system of claim 5 , wherein the scoped software application is configured to:
determine that a copy of a second data block has been added to a blockchain-based transaction ledger within the computational instance, wherein the second data block includes an encrypted representation of one or more other transactions; and
in response to determining that the copy of the second data block has been added to the blockchain-based transaction ledger within the computational instance:
decrypt the encrypted representation of the one or more other transactions; and
update, based on the decrypted representation of the one or more other transactions, software entitlement records stored in a database associated with the scoped software application.

7. The system of claim 1 , wherein the trust group is an auditing trust group including the computational instance, a second computational instance, and a third computational instance,
wherein the second computational instance and the third computational instance are each associated with a respective auditor of transactions involving the computational instance,
wherein encrypting the representation of the one or more transactions using the pre-shared key comprises (i) encrypting, using a first asymmetric public key associated with the second computational instance, the representation of the one or more transactions to generate a first encrypted representation of the one or more transactions and (ii) encrypting, using a second asymmetric public key associated with the third computational instance, the representation of the one or more transactions to generate a second encrypted representation of the one or more transactions, and
wherein distributing copies of the data block to the blockchain-based transaction ledgers within each computational instance of the trust group comprises distributing, to a first blockchain-based ledger within the second computational instance, a first copy of the data block including the first encrypted representation, and distributing, to a second blockchain-based ledger within the third computational instance, a second copy of the data block including the second encrypted representation.

8. The system of claim 1 , wherein the scoped software application is configured to:
before encrypting the representation of the one or more transactions using the pre-shared key, generate, using an asymmetric private key of an asymmetric key pair that includes an asymmetric public key corresponding to the asymmetric private key and does not include the pre-shared key, a digital signature for at least one of the one or more transactions,
wherein encrypting the representation of the one or more transactions using the pre-shared key comprises encrypting, using the pre-shared key, the digital signature and the representation of the one or more transactions, and
wherein the asymmetric public key is accessible to one or more computational instances in the trust group and enables the one or more computational instances in the trust group to verify that the digital signature was performed using the asymmetric private key.

9. A method comprising:
receiving, by a scoped software application, an input that identifies different entities within a trust group and enables one of the entities with administrative permission to control which computational instances of a subset of computational instances have access to a pre-shared key;
obtaining, by the scoped software application, a representation of one or more transactions involving a computational instance, wherein the scoped software application is executable on a computing device of the computational instance, wherein the computational instance is one of a plurality of the computational instances disposed within a remote network management platform, each of which is communicatively coupled and dedicated to a respective managed network, wherein the managed networks are controlled respectively by the different entities, wherein the subset of the computational instances forms the trust group and at least some of the computational instances in the trust group have access to the pre-shared key, and wherein the computational instance is within the trust group;
encrypting, by the scoped software application, using the pre-shared ke

Assignees

• Servicenow Inc

Inventors

• Subramaniam Sreenevas

Classifications

• H04L9/50 Primary

  using hash chains, e.g. blockchains or hash trees · CPC title

• H04L9/3239

  involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD · CPC title

• G06Q30/0633

  Managing shopping lists, e.g. compiling or processing purchase lists (shipping orders G06Q10/083; order filling G06Q10/087) · CPC title

• H04L9/0825

  using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates · CPC title

• H04L9/085

  Secret sharing or secret splitting, e.g. threshold schemes · CPC title