Sealed distributed ledger system

Patent metadata

Field	Value
Publication number	US-12003617-B2
Application number	US-202117407631-A
Country	US
Kind code	B2
Filing date	Aug 20, 2021
Priority date	Aug 14, 2019
Publication date	Jun 4, 2024
Grant date	Jun 4, 2024

Abstract

A system for ensuring privacy of transactions is provided. The system may be performed by a computing system during execution of trusted code within a secure enclave of the computing system. The system receives an indication of a transaction. The system validates the transaction. The system encrypts the validated transaction using an encryption key of the trusted code. The system requests untrusted code of the computing system to store the encrypted validated transaction in a portion of a data store. The untrusted code cannot decrypt the encrypted validated transaction that is stored in the data store. Rather, only the trusted code can decrypt the encrypted validated transaction.

First claim

The invention claimed is:

1. A method performed by trusted code of a secure enclave of a computing system for providing evidence that a transaction has been validated, wherein the secure enclave is a feature of a processing unit in the computing system in which the trusted code is stored in memory in encrypted form and decrypted for execution by the processing unit using a private key of a public/private keypair of the secure enclave, the method comprising:
receiving a transaction at the secure enclave;
decrypting the transaction, by the secure enclave, using the private key of the public/private keypair of the secure enclave;
validating the transaction by the secure enclave;
generating, by the secure enclave, an attestation that the transaction has been validated, the attestation being evidence that the transaction is valid and being signed using the private key of the public/private keypair of the secure enclave, the attestation including a hash of the transaction; and
providing the attestation to untrusted code for use in validating another transaction that inputs an output state of the transaction so that the trusted code can rely on the attestation as evidence that the transaction identified by the hash of the transaction is valid using a public key corresponding to the private key and to avoid the untrusted code accessing an input state of the transaction and thereby preserving confidentiality of the transaction.

2. The method of claim 1 wherein the untrusted code sends the other transaction, the attestation, and the output state to other trusted code of a secure enclave of another computing system so that the other trusted code can validate the other transaction.

3. The method of claim 2 wherein the other trusted code relies on the attestation as evidence that the transaction is valid and does not need to validate the transaction or its ancestor transactions.

4. The method of claim 1 wherein the attestation is part of a signature of attestation.

5. The method of claim 1 wherein the attestation includes a hash of the transaction.

6. The method of claim 1 wherein the computing system is a node that maintains a portion of a sealed distributed ledger and further comprising encrypting the transaction using an encryption key and providing to untrusted code of the computing system the encrypted transaction for storage in the portion of the sealed distributed ledger.

7. The method of claim 1 wherein the attestation includes a hash of the trusted code signed using an encryption key of the secure enclave.

8. A method performed by trusted code of a secure enclave of a computing system for validating a transaction that inputs an output state of another transaction, wherein the secure enclave is a feature of a processing unit in the computing system in which the trusted code is stored in memory in encrypted form and decrypted for execution by the processing unit using a private key of a public/private keypair of the secure enclave, the method comprising:
receiving the transaction at the secure enclave;
requesting untrusted code of the computing system to provide the other transaction;
receiving from the untrusted code a signature of attestation for the other transaction, the signature of attestation generated by another secure enclave as evidence of validity of the other transaction;
verifying that the signature of attestation is by a secure enclave that executes trusted code for the other transaction;
coordinating with a notary to determine whether the output state of the other transaction has been consumed; and
indicating that the transaction is valid when the signature of attestation is verified and the output state is not consumed.

9. The method of claim 8 further comprising generating a signature of attestation indicating that the transaction is valid.

10. The method of claim 9 further comprising providing the signature of attestation to untrusted code.

11. A computing system that, during execution of trusted code of a secure enclave of the computing system, provides evidence that a transaction has been validated, wherein the secure enclave is a feature of a processing unit in the computing system in which the trusted code is stored in memory in encrypted form and decrypted for execution by the processing unit using a private key of a public/private keypair of the secure enclave, the computing system comprising:
one or more computer-readable storage mediums for storing the trusted code, wherein the trusted code includes computer-executable instructions for controlling the computing system to:
generate an attestation that a transaction received has been validated, the attestation being evidence that the transaction is valid and being signed using a private key of the secure enclave, the attestation including a hash of the transaction;
provide the attestation to untrusted code for use in validating another transaction that inputs an output state of the transaction so that the trusted code can rely on the attestation as evidence that the transaction identified by the hash of the transaction is valid using a public key corresponding to the private key and to avoid the untrusted code accessing an input state of the transaction and thereby preserving confidentiality of the transaction; and

one or more processors for executing the computer-executable instructions stored in the one or more computer-readable storage mediums.

12. The computing system of claim 11 , wherein the computer-executable instructions further include instructions to:
receive the transaction;
decrypt the transaction using the private key; and
validate the transaction.

13. The computing system of claim 11 wherein the computer-executable instructions further include instructions to, when a secure enclave of another system is validating the other transaction, send the attestation and the output state to the secure enclave of the other computing system.

14. The computing system of claim 13 wherein the secure enclave of the other computing system relies on the attestation as evidence that the transaction is valid.

15. The computing system of claim 11 wherein the attestation is part of a signature of attestation.

16. The computing system of claim 11 ,
wherein the computing system is a node that maintains a portion of a sealed distributed ledger,
wherein the computer-executable instructions further include instructions to encrypt the transaction and provide to untrusted code of the computing system the encrypted transaction for storage in the portion of the sealed distributed ledger.

17. The computing system of claim 11 wherein the attestation includes a hash of the trusted code signed using an encryption key of the secure enclave.

18. A computing system that, during execution of trusted code of a secure enclave of the computing system, validates a transaction that inputs an output state of another transaction, wherein the secure enclave is a feature of a processing unit in the computing system in which the trusted code is stored in memory in encrypted form and decrypted for execution by the processing unit using a private key of a public/private keypair of the secure enclave, the computer system comprising:
one or more computer-readable storage mediums for storing computer-executable instructions for controlling the computing system to:
receive from untrusted code a signature of attestation for the other transaction, the signature of attestation including a hash of the trusted code that is signed by a private key of another computing system and a hash indicating that the o

Assignees

• R3 Ltd

Inventors

• Hearn Michael Christopher

Classifications

• H04L9/0637 Primary

  Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM] · CPC title

• G06F16/2379

  Updates performed during online database operations; commit processing · CPC title

• H04L9/0819

  Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) (network architectures or network communication protocols for key distribution in a packet data network H04L63/062) · CPC title

• H04L9/3073

  involving pairings, e.g. identity based encryption [IBE], bilinear mappings or bilinear pairings, e.g. Weil or Tate pairing · CPC title

• H04L9/50

  using hash chains, e.g. blockchains or hash trees · CPC title