Efficient validation of transaction policy compliance in a distributed ledger system

Patent metadata

Field	Value
Publication number	US-11238449-B2
Application number	US-201815916293-A
Country	US
Kind code	B2
Filing date	Mar 9, 2018
Priority date	Dec 18, 2017
Publication date	Feb 1, 2022
Grant date	Feb 1, 2022

Abstract

Systems and methods for validation of transaction policy compliance are provided. Code is implemented, including a transaction policy compliance check, in a form of a trusted application to be executed in a trusted execution environment (TEE). A secret is attested and provisioned to a trusted application instance in the TEE. The trusted application instance is executed on a client transaction request to generate a policy compliance result. A transaction object is generated, including the policy compliance result and a proof of the execution. The transaction object is proposed to a distributed ledger system. The policy compliance result and a proof of the execution during transaction validation in the distributed ledger system is verified.

First claim

What is claimed is:

1. A method for validation of transaction policy compliance comprising:
receiving, by a proposing node, a transaction policy compliance check trusted application from a regulator;
implementing, by the proposing node, the transaction policy compliance check trusted application, in a trusted execution environment (TEE);
receiving, by the proposing node, remote attesting and provisioning of a secret to a trusted application instance in the TEE from the regulator;
producing, by the proposing node, with the secret inside the trusted application instance, a digital signature over an input combined with a result of the trusted application execution;
executing, by the proposing node, the trusted application instance on a client transaction request to generate a policy compliance result;
generating, by the proposing node, a transaction object including the policy compliance result and a proof of the execution;
enforcing, by the regulator, policies in a distributed ledger system, wherein the regulator does not directly participate in a consensus protocol of the distributed ledger system; and
proposing, by the proposing node, the transaction object to the distributed ledger system, wherein the policy compliance result and a proof of the execution during transaction validation are verified in the distributed ledger system, and the transaction policy compliance check trusted application includes distributed ledger policies from the regulator.

2. The method according to claim 1 , further comprising:
verifying, with a public certificate corresponding to the provisioned secret, the digital signature produced by the trusted application instance as a proof of the trusted application execution.

3. The method according to claim 1 , wherein the verifying the policy compliance result and a proof of the execution during transaction validation in the distributed ledger system is performed by a plurality of validating nodes.

4. The method of claim 1 , wherein producing, with the secret inside the trusted application instance, a digital signature over an input combined with a result of the trusted application execution is performed by an executor.

5. The method of claim 1 , wherein the distributed ledger system is a blockchain network.

6. The method of claim 1 , wherein the distributed ledger system is a Ethereum platform.

7. The method of claim 1 , wherein the distributed ledger system uses Hyperledger Fabric.

8. The method of claim 1 , wherein the TEE uses the software guard extensions platform.

9. The method of claim 1 , wherein the TEE is in a proposing node.

10. A proposing node comprising one or more processors which, alone or in combination, are configured to provide for performance of the following steps:
receiving, by a proposing node, a transaction policy compliance check trusted application from a regulator;
implementing, by the proposing node, the transaction policy compliance check trusted application, in a trusted execution environment (TEE);
receiving, by the proposing node, remote attesting and provisioning of a secret to an instance of the trusted application instance in the TEE from the regulator;
producing, by the proposing node, with the secret inside the trusted application instance, a digital signature over an input combined with a result of the trusted application execution;
executing, by the proposing node, the trusted application instance on a client transaction request to generate a policy compliance result;
generating, by the proposing node, a transaction object including the policy compliance result and a proof of the execution;
enforcing, by the regulator, policies in a distributed ledger system, wherein the regulator does not directly participate in a consensus protocol of the distributed ledger system; and
proposing, by the proposing node, the transaction object to the distributed ledger system, wherein the policy compliance result and a proof of the execution during transaction validation are verified in the distributed ledger system, and the transaction policy compliance check trusted application includes distributed ledger policies from the regulator.

11. The system according to claim 10 , further comprising a step for:
verifying, with a public certificate corresponding to the provisioned secret, the digital signature produced by the trusted application instance as a proof of the trusted application execution.

12. The system according to claim 10 , wherein the verifying the policy compliance result and a proof of the execution during transaction validation in the distributed ledger system is performed by a plurality of validating nodes.

13. The system according to claim 10 , wherein producing, with the secret inside the trusted application instance, a digital signature over an input combined with a result of the trusted application execution is performed by an executor.

14. The system according to claim 10 , wherein the distributed ledger system is a blockchain network.

15. The system according to claim 10 , wherein the TEE is in a proposing node.

Assignees

• NEC Laboratories Europe GmbH
• Nec Corp

Inventors

• Fedorov Sergey
• Li Wenting
• Karame Ghassan

Classifications

• G06Q20/401 Primary

  Transaction verification · CPC title

• H04L9/50 Primary

  using hash chains, e.g. blockchains or hash trees · CPC title

• H04L9/3239

  involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD · CPC title

• H04L9/3263

  involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823) · CPC title

• H04L9/3247

  involving digital signatures · CPC title