High performance distributed system of record with key management

Patent metadata

Field	Value
Publication number	US-11522676-B2
Application number	US-201916565672-A
Country	US
Kind code	B2
Filing date	Sep 10, 2019
Priority date	Nov 20, 2018
Publication date	Dec 6, 2022
Grant date	Dec 6, 2022

Abstract

A high-performance distributed ledger and transaction computing network fabric over which large numbers of transactions (involving the transformation, conversion or transfer of information or value) are processed concurrently in a scalable, reliable, secure and efficient manner. In one embodiment, the computing network fabric or “core” is configured to support a distributed blockchain network that organizes data in a manner that allows communication, processing and storage of blocks of the chain to be performed concurrently, with little synchronization, at very high performance and low latency, even when the transactions themselves originate from distant sources. This data organization relies on segmenting a transaction space within autonomous but cooperating computing nodes that are configured as a processing mesh. Each computing node typically is functionally-equivalent to all other nodes in the core. The nodes operate on blocks independently from one another while still maintaining a consistent and logically-complete view of the blockchain as a whole. According to another feature, secure transaction processing is facilitated by storing cryptographic key materials in secure and trusted computing environments associated with the computing nodes to facilitate construction mining proofs during the validation of a block.

First claim

The invention claimed is:

1. A method operative in association with a set of transaction handling computing elements that comprise a network core that receive and process transaction requests into an append-only immutable chain of data blocks, wherein a data block is a collection of transactions, and wherein presence of a transaction recorded within a data block is verifiable via a cryptographic hash, wherein the transaction requests originate from legacy computing infrastructure associated with a third party, wherein the legacy computing infrastructure comprises point-of-sale terminals, a point-of-sale terminal aggregator, and at least one merchant connector, comprising:
configuring an overlay network intermediate the legacy computing infrastructure and the network core, the overlay network comprising a plurality of edge servers that act an entry points for the transaction requests entering the network core; and
configuring a key management system to provide secure end-to-end communication among the legacy computing infrastructure, the network core computing elements and the overlay network edge servers, wherein the overlay network edge servers are configured without access to keying material useful to forge either transactions requests, or transaction responses to the transaction requests;
wherein the key management system has a unique root-of-trust, and wherein the merchant connector has an associated root-of-trust that differs from the unique root-of-trust.

2. The method as described in claim 1 wherein the root-of-trust comprises an asymmetric key pair, the asymmetric key pair comprising a public key, and an associated private key.

3. The method as described in claim 2 further including secret sharing shares of the associated private key.

4. The method as described in claim 1 further including establishing an attestation key pair to secure electronic exchange of keys in the key management system.

5. The method as described in claim 1 wherein the transaction requests are merchant connector transaction requests, and the transaction responses are merchant connector transaction responses.

6. The method as described in claim 1 wherein the append-only immutable chain of data blocks is a blockchain.

7. The method as described in claim 6 wherein a given transaction in the blockchain is digitally-signed and self-verifiable.

8. The method as described in claim 1 wherein keys are periodically rotated within the key management system.

9. The method as described in claim 1 wherein keys are segregated in time and domain within the key management system.

10. A method operative in association with a set of transaction handling computing elements that comprise a network core that receive and process transaction requests into an append-only immutable chain of data blocks, wherein a data block is a collection of transactions, and wherein presence of a transaction recorded within a data block is verifiable via a cryptographic hash, wherein the transaction requests originate from legacy computing infrastructure associated with a third party, comprising:
configuring an overlay network intermediate the legacy computing infrastructure and the network core, the overlay network comprising a plurality of edge servers that act an entry points for the transaction requests entering the network core; and
configuring a key management system to provide secure end-to-end communication among the legacy computing infrastructure, the network core computing elements and the overlay network edge servers, wherein the overlay network edge servers are configured without access to keying material useful to forge either transactions requests, or transaction responses to the transaction requests;
wherein the append-only immutable chain of data blocks is a blockchain, and wherein a given transaction in the blockchain is digitally-signed and self-verifiable.

11. The method as described in claim 10 wherein the key management system has a unique root-of-trust.

12. The method as described in claim 11 wherein the root-of-trust comprises an asymmetric key pair, the asymmetric key pair comprising a public key, and an associated private key.

13. The method as described in claim 12 further including secret sharing shares of the associated private key.

14. The method as described in claim 10 further including establishing an attestation key pair to secure electronic exchange of keys in the key management system.

15. The method as described in claim 10 wherein the legacy computing infrastructure comprises point-of-sale terminals, a point-of-sale terminal aggregator, and at least one merchant connector.

16. The method as described in claim 15 wherein the merchant connector has an associated root-of-trust that differs from the unique root-of-trust.

17. The method as described in claim 10 wherein the transaction requests are merchant connector transaction requests, and the transaction responses are merchant connector transaction responses.

Assignees

• Akamai Tech Inc

Inventors

• Carver David C
• Erb Samuel

Classifications

• H04L63/06

  for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08) · CPC title

• G06F16/2365

  Ensuring data consistency and integrity · CPC title

• H04L9/3073

  involving pairings, e.g. identity based encryption [IBE], bilinear mappings or bilinear pairings, e.g. Weil or Tate pairing · CPC title

• H04L9/0637 Primary

  Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM] · CPC title

• G06F16/2379

  Updates performed during online database operations; commit processing · CPC title