Sealed distributed ledger system

Patent metadata

Field	Value
Publication number	US-11362807-B2
Application number	US-201916540824-A
Country	US
Kind code	B2
Filing date	Aug 14, 2019
Priority date	Aug 14, 2019
Publication date	Jun 14, 2022
Grant date	Jun 14, 2022

Abstract

A system for ensuring privacy of transactions is provided. The system may be performed by a computing system during execution of trusted code within a secure enclave of the computing system. The system receives an indication of a transaction. The system validates the transaction. The system encrypts the validated transaction using an encryption key of the trusted code. The system requests untrusted code of the computing system to store the encrypted validated transaction in a portion of a data store. The untrusted code cannot decrypt the encrypted validated transaction that is stored in the data store. Rather, only the trusted code can decrypt the encrypted validated transaction.

First claim

The invention claimed is:

1. A method performed by a computing system during execution of trusted code of a secure enclave of the computing system for ensuring privacy of transactions, the method comprising:
receiving an indication of a transaction;
validating the transaction;
encrypting the validated transaction using an encryption key of the trusted code;
requesting untrusted code of the computing system to store the encrypted validated transaction in a portion of a data store wherein the untrusted code cannot decrypt the encrypted validated transaction that is stored in the data store;
receiving a request from other trusted code of a secure enclave of another computing system to provide the transaction; and
in response to receiving the request from the other trusted code,
requesting the untrusted code to provide the encrypted validated transaction to the trusted code; and
upon being provided the encrypted validated transaction, decrypting the encrypted validated transaction using a decryption key of the trusted code that corresponds to the encryption key.

2. The method of claim 1 wherein the other trusted code sends the request to provide the transaction during validation of another transaction.

3. The method of claim 1 further comprising encrypting the decrypted validated transaction using a send encryption key and sending the encrypted validated transaction to the other trusted code so that the other trusted code can decrypt the encrypted validated transaction using a send decryption key corresponding to the send encryption key.

4. The method of claim 3 wherein the send encryption key and the send decryption key are a symmetric keypair.

5. The method of claim 3 wherein the send encryption key and the send decryption key are a public/private keypair.

6. The method of claim 3 wherein the trusted code and the other trusted code establish a secure connection and wherein the encrypted validated transaction is sent via the secure connection.

7. A method performed by a computing system during execution of trusted code within a secure enclave of the computing system for ensuring privacy of transactions, the method comprising:
receiving an indication of a transaction;
validating the transaction;
encrypting the validated transaction using an encryption key of the trusted code; and
requesting untrusted code of the computing system to store the encrypted validated transaction in a portion of a data store;
wherein the untrusted code cannot decrypt the encrypted validated transaction that is stored in the data store,
wherein the transaction includes an input state that is an output state of another transaction,
wherein the validating of the transaction comprises:
requesting the untrusted code to provide the other transaction; and
receiving an encrypted form of the other transaction, and

wherein the untrusted code retrieves the encrypted form of the other transaction from the data store and provides the encrypted form to the trusted code, and the trusted code decrypts the encrypted form.

8. A method performed by a computing system during execution of trusted code of a secure enclave of the computing system for ensuring privacy of transactions, the method comprising:
receiving an indication of a transaction;
validating the transaction;
encrypting the validated transaction using an encryption key of the trusted code; and
requesting untrusted code of the computing system to store the encrypted validated transaction in a portion of a data store;
wherein the untrusted code cannot decrypt the encrypted validated transaction that is stored in the data store,
wherein the transaction includes an input state that is an output state of another transaction, and
wherein the validating of the transaction comprises:
requesting the untrusted code to provide the other transaction;
receiving from the untrusted code an indication that the other transaction is not stored in the data store; and
requesting other trusted code of a secure enclave of another computing system to provide the other transaction, wherein an encrypted form of the other transaction is provided by the other trusted code.

9. The method of claim 8 wherein the encryption key is a private key of a public/private keypair.

10. The method of claim 8 wherein the transaction has an output state and further comprising sending the output state to the untrusted code.

11. A method performed by a computing system during execution of untrusted code for supporting secure storage of transactions, the computing system being a node that maintains a portion of a sealed distributed ledger, the method comprising:
receiving an encrypted transaction from trusted code of a secure enclave of the computing system, the encrypted transaction encrypted with an encryption key of the trusted code;
storing the encrypted transaction in the portion of the sealed distributed ledger;
receiving from the trusted code a request for the encrypted transaction;
retrieving the encrypted transaction from the portion of the sealed distributed ledger;
providing the encrypted transaction to the trusted code;
receiving from the trusted code a request for another transaction; and
when the other transaction is not stored in the portion of the sealed distributed ledger, notifying the trusted code that the other transaction is not stored in the portion of the sealed distributed ledger;
wherein the trusted code requests other trusted code of a secure enclave of another node to provide the other transaction.

12. One or more computing systems that, during execution of trusted code within a secure enclave of the one or more computing systems, ensure privacy of transactions, the one or more computing systems comprising:
one or more computer-readable storage mediums storing computer-executable instructions for controlling the one or more computing systems to:
encrypt a validated transaction using an encryption key of the trusted code;
request untrusted code of the one or more computing systems to store the encrypted validated transaction in a portion of a data store, wherein the untrusted code cannot decrypt the encrypted validated transaction;
receive a request from other trusted code of a secure enclave of another computing system to provide the transaction;
in response to receiving the request from the other trusted code, request the untrusted code to provide the encrypted validated transaction to the trusted code; and
upon being provided the encrypted validated transaction, decrypt the encrypted validated transaction using a decryption key of the trusted code that corresponds to the encryption key; and

one or more processors for executing the computer-executable instructions stored in the one or more computer-readable storage mediums.

13. The one or more computing systems of claim 12 wherein the other trusted code sends the request to provide the transaction during validation of another transaction.

14. One or more computing systems that, during execution of trusted code within a secure enclave of the one or more computing systems, ensure privacy of transactions, the one or more computing systems comprising:
one or more computer-readable storage mediums storing computer-executable instructions for controlling the one or more computing systems to:
encrypt a validated transaction using an encryption key of the trusted code;
request untrusted code of the one or more computing systems to store the encrypted validated transaction in a portion of a data store, wherein the untrusted code cannot decrypt the encrypted validated transaction that is stored in the data store;
encrypt the v

Assignees

• R3 Ltd
• R3 Llc

Inventors

• Hearn Michael Christopher

Classifications

• G06F16/184

  implemented as replicated file system · CPC title

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• H04L9/50

  using hash chains, e.g. blockchains or hash trees · CPC title

• G06F21/62 Primary

  Protecting access to data via a platform, e.g. using keys or access control rules · CPC title

• H04L9/3247

  involving digital signatures · CPC title