Improved system and method for storage, generation and verification of tokens for controlling access to resources

Abstract

A computer-implemented access method is provided. The method comprises the steps of: i) submitting an access blockchain transaction addressed to a derived public key to the blockchain, the derived public key derived at least in part from a secret value and a public key; (ii) generating a verification public key based at least in part on the secret value and the public key; (iii) comparing the derived public key with the verification public key; and (iv) based on the comparison of step (iii): (a) assigning at least one of the derived public key and the verification public key as a further public key to verify the further derived public key; and (b) granting access to a resource associated with at least one of the secret value and the derived public key.

Description

[0001] This application is a divisional application of the invention patent application with Chinese application number 2019800325771 (corresponding to PCT international application number PCT / IB2019 / 053945), application date May 13, 2019, and invention name “Improved system and method for storage, generation and verification of tokens for controlling access to resources”. Technical Field

[0002] The present invention generally relates to secure and efficient schemes for transfer and access control of digital resources, and more particularly to the transfer, storage, communication, generation and verification of electronic / digital tokens used as access keys. Background Art

[0003] In this document, we use the term "blockchain" to include all forms of electronic, computer-based, distributed ledgers. These include consensus-based blockchain and transaction chain technologies, public and private ledgers, permissioned and unpermissioned ledgers, shared ledgers, and variations thereof. It should be noted that alternative blockchain implementations and protocols fall within the scope of the present invention. The term "user" herein may refer to a person or a processor-based resource.

[0004] A blockchain is a peer-to-peer electronic ledger implemented as a decentralized, distributed computer-based system consisting of blocks, which in turn consist of transactions. Each transaction is a data structure that encodes the transfer of control of digital assets between participants in the blockchain system and includes at least one input and at least one output. Each block contains a hash of the previous block so that blocks are linked together to create a permanent, unchangeable record of all transactions that have been written to the blockchain since its inception. Transactions contain small programs called scripts embedded in the transaction's inputs and outputs that specify how and by whom the transaction's outputs can be accessed. These scripts can be written using a stack-based scripting language.

[0005] In order for a transaction to be written to the blockchain, it must be “validated”. Network nodes perform work to ensure that each transaction is valid, and invalid transactions are rejected by the network. The software client installed on the node performs this validation work on unspent transactions (UTXOs) by executing their locking and unlocking scripts. If the execution of the locking and unlocking scripts evaluates to true (TRUE), then the transaction is valid and the transaction is written to the blockchain. Therefore, in order for a transaction to be written to the blockchain, it must: i) be validated by the first node that receives the transaction – if the transaction is validated, then that node relays it to other nodes in the network; ii) be added to a new block; iii) be added to the public ledger of past transactions.

[0006] One area of ​​current research is the use of tokens to represent and transfer resources or their control, or to allow access to these resources via a blockchain. The resources associated with a token can be electronic or physical, virtual or real world. Potentially sensitive or secret resources can be represented by tokens that have no clear meaning or value. Thus, the token serves as an identifier that allows the real world resource to be referenced from the blockchain. Summary of the invention

[0007] It would be desirable to provide a secure and efficient method of communicating, storing, generating and / or transferring tokens from one user to another while minimizing the use of computing resources. Such an improved scheme has now been devised.

[0008] Thus, according to the present invention there is provided a method as defined in the accompanying claims.

[0009] According to the present invention, a computer-implemented access or control method may be provided, comprising the following steps:

[0010] (i) submitting to a blockchain an access blockchain transaction addressed to a derived public key, the derived public key being derived at least in part from the secret value and the public key;

[0011] (ii) generating a verification public key based at least in part on the secret value and the public key;

[0012] (iii) comparing the derived public key to the verification public key; and

[0013] (iv) based on the comparison in step (iv): (a) assigning or designating the derived public key and / or the verification public key as another public key to verify another derived public key; and (b) granting access to resources associated with at least one of the secret value and / or the derived public key.

[0014] Steps (i) and (ii) may be performed by a first party. Steps (iii) and (iv) may be performed by a second party. The term "user" may be used interchangeably with "party" herein. The terms "party" and "user" are intended to include human users, computing resources, clients, servers, and / or network nodes.

[0015] The method may comprise the step of sending the secret value from the first user to the second user.

[0016] The method may include the step of generating a secret value. The secret value may be a token. This may be performed by the first user.

[0017] The comparison of step (iii) may include the application of at least one test or criterion. The test or criterion may include an assessment as to whether the derived public key matches or is identical to the verification public key. The test or criterion may include an assessment based on a threshold.

[0018] Such an approach improves security and reliability by providing a provenance check for each data item, improves efficiency by reducing the amount of storage space and memory required for authentication purposes, and improves security and reduces the likelihood of errors by reducing the amount of data communicated.

[0019] The method may further comprise repeating steps (ii) to (iv) using further secret values ​​and further public keys.

[0020] This records the event on the blockchain, which has the advantage of making the record public and immutable. Therefore, the blockchain can be used as a communication tool or mechanism for sharing, transmitting or transferring public keys from one user to another user. The second user can view the public key from the blockchain. This avoids or minimizes direct communication of public keys between the first user and the second user, which may cause interception by unauthorized parties. The present invention provides a solution in which users may not know each other or have a trusted relationship. This provides improved security and improved communication solutions for the transfer of data items. In addition, the public and immutable nature of the blockchain can be used to verify events that have occurred and the public key that the first user has used.

[0021] The secret value may be a data item of the first one-way function chain of data items, and the method may further include the following steps:

[0022] (v) providing a verification data item of the first one-way function chain;

[0023] (vi) applying the first one-way function to the data item;

[0024] (vii) comparing the output of step (vi) with the verification data item; and

[0025] (viii) further performing step (iv) based on the result of step (vii).

[0026] Applying a one-way function (e.g., a cryptographic hash function) to a data item produces another data item. A subsequent application of the one-way function to another data item produces yet another data item. In this way, a data necklace can be generated, wherein the members of the data necklace are deterministically linked to each other via the application of the one-way function. Such a chain is called a one-way function chain of data items. A verification data item is a data item that is a member of a one-way function chain and is used for verification purposes, which will be described in detail below.

[0027] This provides a secure and documented method of transferring the ability to access at least one resource associated with a respective at least one data item between users.

[0028] The method may further comprise the following steps:

[0029] (ix) providing a verification data item of a second one-way chain of functions of the data item;

[0030] (x) submitting an unlockable exchange blockchain transaction to the blockchain upon providing at least one verification item of the first chain and a verification data item of the second chain, wherein the unlocking associates the at least one data item of the second chain with the resource.

[0031] This provides a secure and documented method of transferring the ability to access at least one resource associated with a respective at least one data item between users.

[0032] The method may further include the steps of unlocking the exchange blockchain transaction and repeating steps (ii) to (iv) using the data item of the second chain and the verification data item of the second chain.

[0033] This provides the advantage of enabling new users to securely access at least one resource.

[0034] The method may further comprise the step of submitting a return blockchain transaction to the blockchain, the return blockchain transaction being arranged to return control of the input of the exchange blockchain transaction after a lock time has elapsed.

[0035] This prevents dishonest users from locking the inputs of a swap blockchain transaction indefinitely, providing the advantage of increasing the versatility of the method.

[0036] The method may further comprise the step of storing an initial data item of the one-way function chain, from which at least one data item of the one-way function chain is computable.

[0037] This offers the advantage of further reducing the storage requirements and correspondingly increasing the efficiency of the method.

[0038] Step (viii) may also include deleting the verification data item.

[0039] This offers the advantage of further reducing the storage requirements and correspondingly increasing the efficiency of the method.

[0040] Access blockchain transactions can include information identifying a resource. For example, a blockchain transaction can include a URL or a hash value thereof that points to an off-chain data repository containing information about the resource. The URL can be stored in the metadata of the transaction.

[0041] This provides an advantage that information about the resource can be securely communicated.

[0042] The present invention also provides a system, comprising:

[0043] Processor; and

[0044] A memory comprising executable instructions that, due to being executed by a processor, cause the system to perform any embodiment of the computer-implemented method described herein.

[0045] The present invention also provides a non-transitory computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor of a computer system, causes the computer system to at least perform an embodiment of the computer-implemented method described herein. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] These and other aspects of the invention will become apparent from and elucidated with reference to the embodiments described herein. Embodiments of the invention will now be described by way of example only and with reference to the accompanying drawings, in which:

[0047] Figure 1 is a flow chart showing steps for generating and activating a token;

[0048] Figure 2 is a flow chart showing the steps of control for exchanging tokens; and

[0049] Figure 3 is a flow chart showing the steps for activating a token using a public key. DETAILED DESCRIPTION

[0050] The present invention enables efficient creation and storage of tokens using a cryptographically secure one-way function chain such as a hash chain. The method has advantages in performance, storage, scalability, and reliability. Tokens can be securely sold to other users. Tokens can be verifiably linked to public keys, providing a universal method of activating and verifying tokens that is private and secure.

[0051] A token is a data structure or data item that ensures trusted communication between one or more different parties over a network. For example, a token can be used to represent the transfer of control of a resource from one party to another, and / or to access a controlled resource such as a good or service. For example, by activating a token, a customer can be granted access to: resources such as computing or electronic resources, hotel rooms, rental cars, or toll roads; goods such as prescription drugs, consumer goods, or items in a supply chain; and services such as a session on a website or computer application. The token itself can be used as a key to unlock these resources, or it can point to an external state that contains further information about the resource (e.g., a distributed hash table (DHT)).

[0052] Tokens are typically represented as 256-bit numbers and, once activated, may be time-limited (e.g., if a token represents permitted access to a secure data repository for 24 hours) and may have a limited number of uses (e.g., once a token is activated and 24 hours have passed, access to the secure data repository will be revoked until a new, different token is issued and activated).

[0053] We call the party that wants to activate the token the "client" and the party that wants to verify that the token has been activated the "server".

[0054]

[0055]

[0056] The client activates the token by providing it to the server. This can be performed by publicly revealing the token on the blockchain. This is achieved by completing a transaction that records the value of the token in the transaction data or metadata that the server can verify. Note that the output of this transaction does not need to be spent.

[0057] The number of tokens required may be linearly proportional to the number of events in which they are needed, for example, if a user needs to access a secure data repository multiple times, the same number of tokens may be generated. A known method of creating multiple tokens for future use is to generate each token separately, for example randomly. All tokens are then stored in a database by both the client and the server.

[0058] However, in the present invention, each of the client and server only needs to store one token at a time. This is achieved by implementing the following rule: each token is related to the token that preceded it through the successive application of a cryptographically secure one-way function such as a hash function. For example, token t i According to the rules and token t i-1 Related:

[0059] t i =H(t i-1 ) (1)

[0060] Where H is a hash function, such as SHA-256. To activate token t i-1 , will include t i-1 The transaction is submitted to the blockchain, where t i-1 is the token t that precedes it i The solution to the hash problem of t is thus publicly revealed i-1 Verifiably links each token in the chain.

[0061] Advantages of the present invention include:

[0062] The client and server only need to store one token at any given time, which saves memory. If a token is a 256-bit number, and Alice wants to use n tokens, then using this method saves (n-1)*256 bits of space compared to storing each token individually in the database.

[0063] Only a small amount of data needs to be transferred between the client and the server, which improves performance, security, and reliability.

[0064] Since the token is computed rather than stored, it is protected from accidental loss due to breach or data corruption.

[0065] • Since each token is verifiably linked to the previous token through the solution of a hash problem, a checkable record is available for the tokens.

[0066] refer to Figure 1 , a method (100) will now be described for client Alice to activate a sequence of tokens that server Bob can verify. The token is generated by Alice using a hash chain. The following steps are performed:

[0067] 1. Alice and Bob agree on n resources that require activation tokens to access (105).

[0068] 2. Alice generates a 256-bit number t 0 (110). This can be done by hashing some input data, or a number t 0 It can also be a random number. 0 will be the last token she uses. She hashes this number n times to calculate

[0069] t n =H n (t 0 )

[0070] Here, tn is a verification data item rather than a token. She will n Send to Bob (115).

[0071] Alice Storage 0 , and has no other value stored. She will use this value to calculate the n tokens t using rule (1) n-1 ,…,t 1 ,t 0 . This creates an access chain or hash chain of tokens that satisfy the following:

[0072] t n-1 =H(t n-2 )

[0073] tn-2 =H(t n-3 )

[0074] M

[0075] t 1 =H(t 0 ).

[0076] Also note that t n =H(t n-1 ).

[0077] The first token she uses will be t n-1 , and the last token she uses will be t 0 . Verify data item t n Used for authentication purposes only and is not a token in itself.

[0078] 3. Bob Storage n (120), and no other values ​​are stored. Note that Bob cannot calculate t 0 ,t 1 ,…,t n-1 .

[0079] 4. Alice calculates the value of her first token t n-1 =H n-1 (t 0 )(125) and activates it by creating a transaction containing the token (130). The token may be stored, for example, in transaction metadata or in a lock or unlock script. The token may even be stored in the public key of the recipient address itself; details of which are discussed below in conjunction with another embodiment of the invention. Alice submits the transaction to the blockchain, which reveals the token (135).

[0080] 5. Now, Bob can view and read the revealed token and verify the n =H(t n-1 ) to verify that Alice has activated the correct token (140). If the hash of the token revealed on the blockchain is different from the verification item Bob has stored (145), Bob denies access to the resource (150). Otherwise, Bob allows access (155), storing t n-1 And delete t n .t n-1 Becomes the next verification data item in the sequence.

[0081] 6. Alice repeats step 4 but uses t n-2 to activate another token. Bob does this by repeating step 5 but checking t n-1 =H(t n-2 ) to verify this token. The process (160) is repeated iteratively until all n tokens have been activated and verified (165).

[0082] refer to Figure 2 A method (200) for transferring the ability to access a resource is described.

[0083] Assume Alice has activated m tokens t of her tokens n-1 ,…,t n-m , and Charlie wants to obtain access to the remaining nm tokens t n-m-1 ,…,t 0 of control to satisfy one or more conditions. He can do this safely (without trusting Alice) as follows.

[0084] Alice and Charlie agree to transfer Alice's remaining tokens to Charlie (205). Alice sends Charlie the hash of her next unspent token H(t m-n-1 ).

[0085] Charlie creates new tokens 0 He then generates a sequence of nm tokens s using the following rule m-n-1 ,…,s 0 (210)

[0086] s m-n-1 =H(s m-n-2 )

[0087] s m-n-2 =H(s m-n-3 )

[0088] M

[0089] s 1 =H(s 0 ).

[0090] He also calculated s m-n =H(s m-n-1 ), which is a verification data item used for verification purposes. Charlie will s m-n Send to Alice (215).

[0091] Charlie submits a transaction to the blockchain that satisfies one or more conditions (220), where the unlocking script of the transaction has the following form:

[0092] LockingScript=CheckSigH(P A )AND Solve H(t n-m-1 )AND Solve H(s n-m ),

[0093] Among them, P A is Alice's public key.

[0094] Alice now notifies the server Bob that she has transferred the token to Charlie. She does this by transferring her next token t m-n-1 and verification data items m-n Notify Bob to do this (225). Bob can ensure that only Alice can do this because only Alice knows t which Bob can verify. m-n-1 The value is the token t that is hashed to the current verification item. m-n =H(t m-n-1 )'s token (235).

[0095] If Alice is dishonest and does not provide this information to server Bob, then once she spends the transaction from Charlie, the information will be publicly exposed on the blockchain anyway (230), because the transaction unlocking script has the form

[0096] UnlockingScript=[s m-n ][t n-m-1 ][SigP A ][P A ]

[0097] If the hash value is the same as the current verification item (240), Bob transfers control of the token to Charlie (245) and replaces t n-m-1 Replace with s n-m as the next verification data item (250). Otherwise, Bob does not transfer control of the token to Charlie (260).

[0098] Bob can now check s m-n =H(s m-n-1 ) to verify Charlie's first token s m-n-1 (255).

[0099] Thus, Charlie can prove to Bob that he has received the token from Alice.

[0100] It is also possible to include a timelock refund on transactions from Charlie to Alice, so that the inputs of transactions submitted by Charlie cannot be locked indefinitely by Alice.

[0101] The tokens in the access chain described above can be verifiably linked to a public / private key. Note that this method of linking public / private keys to tokens does not require the tokens to be linked via a one-way function or hash chain as described above, and works if each token is created individually without being associated with a previous token. However, the advantages of using a token access chain translate to linked keys. The linked keys then form an access chain, forming a checkable sequence of public / private keys that are verifiably linked to each other via the one-way function of the access chain.

[0102] One application for this is that Alice activates her tokens by making a transaction to these public key addresses. Bob can verify that the tokens have been activated by observing the public key addresses themselves.

[0103] This helps keep the size of transactions as small as possible and improves privacy, as only standard transactions are required, as opposed to custom transactions for token schemes. It is also a universal approach for any public / private key system that works on any blockchain protocol or platform.

[0104] refer to Figure 3 , a method (300) for client Alice to activate a sequence of tokens that server Bob can verify will now be described.

[0105] Let P 0 represents Alice's public key, S 0 represents her private key. In the Elliptic Curve Digital Signature Algorithm (ECDSA) system, the public / private key pair is related by the following formula: 0 =S 0 G, where G is the generator point of the elliptic curve. However, any equivalent public / private key system may be used to perform the steps of the method.

[0106] After agreeing on the number of tokens (305), the initial value t 0 Generate a token (310) and pass the chain's verification data item t n After sending it to Bob (315), Alice shares her public key P with Bob. 0 (320). Bob stores it as the verification data item (325).

[0107] After generating the first token t n-1 (330) Alice then uses this to create a derived public key

[0108] P 1 =(S 0 +t n-1 )·G=P 0 +t n-1 ·G (335)

[0109] Since only Alice knows t n-1 , so only she can create this public key. Public key P 1 can be verifiably linked to the first token in Alice's access chain.

[0110] Alice can use this public key as the address to which she can send a transaction to activate her first token. Alice generates a blockchain transaction (340) addressed to this public key and submits it to the blockchain (345), thereby publicly revealing the public key.

[0111] Then, Alice will n-1 Send to Bob (350). Bob can then check that Alice has sent 1 =P 0 +t n-1 G conducts a transaction to verify token t n-1 has been activated (355). If the public key revealed by the submitted transaction matches the public key P 0 and token t n-1 If the calculated public keys are the same (360), Bob allows Alice to access the resource (370). Otherwise, Bob denies access (365).

[0112] This process may be repeated iteratively (375): if the final token has not yet been activated, Bob stores the revealed public key as the next verification data item (380) and the process continues; otherwise, the process ends (385).

[0113] This method creates n public keys, each of which is provably uniquely linked to a token in the access chain, as follows:

[0114] P 1 =P 0 +t n-1 ·G

[0115] P 2 =P 1 +t n-2 ·G

[0116] M

[0117] P n =P n-1 +t 0 G.

[0118] This process relies on the token taking on a value that is in the same set as the private key, which is Where n is the order of the elliptic curve generator G. This number is slightly less than 2 256 If the token is not in the set, the token can be put through a hash function (e.g., SHA-256) and then modulo n. If any token is 0 after this process, Alice must start over and choose a different seed token t 0 .

[0119] It should be noted that the above embodiments illustrate rather than limit the present invention, and that those skilled in the art will be able to design many alternative embodiments without departing from the scope of the present invention as defined by the appended claims. In the claims, any reference numerals in parentheses shall not be interpreted as limiting the claims. The words "comprise" and "comprising" and the like do not exclude the presence of elements or steps other than those listed in any claim or the entire specification. In this specification, "comprise" means "include or consist of...", and "comprising" means "including or consist of...". The singular reference of an element does not exclude the plural reference of such elements, and vice versa. The present invention can be implemented by hardware comprising several different elements and by a suitably programmed computer. In a device claim that lists several components, several of these components may be implemented by one and the same hardware. The fact that certain means are recorded in mutually different dependent claims does not mean that a combination of these means cannot be used advantageously.

Claims

1. A computer-implemented access method, performed by a first party, comprising the following steps: (i) determining a number n of tokens to be generated by the first party, the number of tokens corresponding to a number of resources that need to be accessed by activating the corresponding tokens; (ii) Generate the first verification data item t n and initial verification data item t0; (iii) the first verification data item t n Sending to the second party and storing the initial verification data item t0; (iv) generating a first token t to be activated using the initial verification data item t0 and a one-way function n-1 ; (v) generating a blockchain transaction including the token and submitting the blockchain transaction to the blockchain network; as well as (vi) receiving access to a resource in response to the second party verifying that the token has been properly activated.

2. The method according to claim 1, wherein: Step (vi) includes applying at least one test or criterion by the second party.

3. The method according to claim 2, wherein: The test or criterion comprises a determination as to whether the one-way function, when applied to the token, matches the verification data item t n Matching or identical evaluations.

4. The method according to any one of the preceding claims, further comprising the steps of: (vii) activating another token by repeating steps (iv) and (v); (viii) Receiving access to further resources by repeating step (vi).

5. The method of claim 4, further comprising the step of iteratively repeating steps (vii) and (viii) until the number of tokens determined in step (i) has been activated. 6 . The method according to claim 1 , wherein the initial verification data item t0 comprises a one-way function chain from which at least one data item in the one-way function can be calculated.

7. A method according to any preceding claim, wherein step (vi) further comprises deleting the verification data item.

8. A method according to any of the preceding claims, wherein access to a blockchain transaction includes information identifying the resource.

9. A system comprising: processor; as well as A memory comprising executable instructions which, as a result of being executed by a processor, cause the system to perform a computer-implemented access method according to any one of the preceding claims.

10. A non-transitory computer-readable storage medium having executable instructions stored thereon, wherein the executable instructions, when executed by a processor of a computer system, cause the computer system to at least perform the computer-implemented access method according to any one of claims 1 to 8.

Images