Allocating digital assets using blockchain transactions

Abstract

A computer-implemented method for generating transactions associated with a blockchain, the transactions for distributing a total amount of an allocation of a digital asset, each allocating party being associated with an allocation public key linked to the allocation, and each recipient being associated with a respective ownership public key. The method includes obtaining a respective ownership public key for each of the one or more recipients. For each of the one or more recipients, a respective payment public key is generated based on (i) an ownership public key associated with the recipient user and (ii) the allocation public key. The transactions include one or more output scripts, each output script configured to transfer a respective amount of the allocation to a respective payment address, the respective payment address being based on the respective payment public key.

Description

[Technical field]

[0001] The present disclosure relates to a method for securely allocating or distributing amounts of digital assets to one or more recipient parties using blockchain transactions. In particular, the method ensures that only intended recipients have access to their respective amounts of digital assets. [Background technology]

[0002] Blockchain refers to a form of distributed data structure in which a duplicate copy of the blockchain is maintained at each of multiple nodes in a peer-to-peer (P2P) network. The blockchain includes a chain of blocks of data, where each block contains one or more transactions. Each transaction can point back to a previous transaction in a sequence that may span one or more blocks. Transactions can be submitted to the network for inclusion in a new block by a process known as "mining." This involves multiple mining nodes each competing to perform a "proof-of-work," i.e., solving a cryptographic puzzle based on a pool of pending transactions waiting to be included in a block.

[0003] Traditionally, transactions in a blockchain are used to convey digital assets, i.e. data that acts as a store of value. However, blockchains can also be used to layer additional functionality on top of the blockchain. For example, blockchain protocols allow for additional user data to be stored in the output of a transaction. Modern blockchains increase the maximum amount of data that can be stored in a single transaction, allowing more complex data to be incorporated. For example, this could be used to store electronic documents or even audio or video data in the blockchain.

[0004] Each node in the network can have any one, two, or all three roles: forwarding, mining, and storage. A forwarding node propagates a transaction throughout the nodes of the network. A mining node mines the transaction into a block. A storage node stores its own copy of the mined block of the blockchain. To have a transaction recorded in the blockchain, a party sends the transaction to one of the nodes of the network to be propagated. Mining nodes that receive a transaction may compete to mine the transaction into a new block. Each node is configured to respect the same node protocol, which includes one or more conditions for a transaction to be valid. Invalid transactions are not propagated or mined into a block. Assuming the transaction has been verified and is thereby accepted into the blockchain, the additional user data therefore remains stored at each node in the P2P network as an immutable public record.

[0005] In a typical blockchain protocol, a party possesses a unique private key that can be used to identify that party. However, due to the need to maintain the privacy of the private key, the private key cannot be used directly to identify the party. Instead, a cryptographic signature scheme is used in which each private key is paired with a corresponding public key. The public key also uniquely identifies the party, can be shared with other parties, and can be made publicly available. Summary of the Invention

[0006] According to one aspect disclosed herein, there is provided a computer-implemented method for generating at least one transaction associated with a blockchain, the at least one transaction for distributing an allocation amount of a digital asset from an Allocating Party to one or more Recipients, the Allocating Party being associated with an allocation public key linked to the allocation, and each Recipient being associated with a respective ownership public key, the method including the steps of obtaining respective ownership public keys of the one or more Recipients, generating, for each of the one or more Recipients, (i) an ownership public key associated with a Recipient user, and (ii) a respective payment public key based on the allocation public key, and generating the at least one transaction, the at least one transaction including one or more output scripts, each output script configured to transfer a respective amount of the allocation to a respective payment address, the respective payment address being based on the respective payment public key.

[0007] The present disclosure recognizes a method of utilizing public and private key pairs to ensure that amounts of digital assets are distributed to and accessible only by specific parties (i.e., intended recipients). In other words, an allocating party allocates payments to specific recipients, and only those recipients have access to those payments. The disclosure also ensures that multiple recipients can simultaneously and transparently securely access their respective amounts of digital assets. The allocating party has access to the allocation of digital assets and can generate a payment public key unique to each intended recipient. The payment public key is based on an ownership public key unique to the recipient. The public key can serve as a blockchain address for transferring the amount (or share) of the digital assets using blockchain transactions. Alternatively, the address can be generated based on a public key, e.g., a pay-to-public-key-hash (P2PKH). Each public key is part of a public-private key pair. To access digital assets transferred to a blockchain payment address, a private key from a public / private key pair is required (e.g., corresponding public key or P2PKH). Given that the recipient's (e.g., Alice's) payment public key is based on Alice's ownership public key, and only Alice has access to the corresponding ownership private key, only Alice can generate the payment private key needed to access the funds transferred to the payment address.

[0008] By obtaining each Recipient's ownership public key, the Assigning Party can generate a set of corresponding payment public keys, each linked to a specific Recipient. The Assigning Party can assign an amount of digital assets (e.g., tokens representing ownership of real-world assets) to the Recipient's payment addresses.

[0009] According to another aspect disclosed herein, there is provided a computer-implemented method for accessing an aggregate amount of digital assets transferred from an assignment public key of an assigning party to a payment address of a recipient, the recipient being associated with an ownership public key, using a transaction associated with a blockchain, the method including: effecting a first transaction including the ownership public key contained within the blockchain; obtaining an assignment private key paired with the assignment public key; determining a payment address based on a payment public key, the payment public key being generated based on the ownership public key and the assignment public key; and determining a payment private key paired with the payment public key using the assignment private key.

[0010] In this method, a recipient (e.g., Alice) registers a unique ownership public key using a blockchain transaction, either directly or indirectly. For example, Alice can register ownership directly by including it in the output of a blockchain transaction. Alice can indirectly register her ownership public key by asking a third party to include her ownership public key in the output of a blockchain transaction. Once committed to the blockchain, the transaction serves as an immutable record linking Alice to her ownership public key. Furthermore, by storing the ownership public key on the blockchain, the allocating party can obtain it to generate a payment public key, and thus a payment address, for Alice. Alice can also use her ownership private key and knowledge of the allocating party's private key to determine the payment public key to which the share (total) of the digital asset was transferred. Alice can then access her share of the digital asset. Because other parties do not have access to Alice's ownership private key, they cannot access the digital assets transferred to Alice's payment address. [Brief description of the drawings]

[0011] To facilitate an understanding of embodiments of the present disclosure and to show how such may be carried into effect, reference will now be made, by way of example only, to the accompanying drawings in which: [Figure 1] FIG. 1 is a schematic block diagram of a system that implements a blockchain. [Diagram 2] Figure 2 shows a schematic of an example of a transaction that may be recorded in a blockchain. [Diagram 3] FIG. 3 is a schematic block diagram of a system for allocating an amount of digital assets to recipients. [Figure 4] Figure 4 is a schematic representation of a blockchain transaction for allocating an aggregate amount of digital assets to multiple recipients. [Figure 5a] Figure 5a illustrates a schematic of an example blockchain transaction for registering a recipient's ownership public key. [Figure 5b] Figure 5b illustrates a schematic of an example blockchain transaction for registering a recipient's ownership public key. [Figure 6] FIG. 6 illustrates a schematic of another example of a blockchain transaction for registering a recipient's ownership public key. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] Exemplary System Overview FIG. 1 illustrates an exemplary system 100 for generally implementing a blockchain 150. The system 100 includes a packet-switched network 101, typically a wide area internetwork such as the Internet. The packet-switched network 101 includes a plurality of nodes 104 arranged to form a peer-to-peer (P2P) overlay network 106 within the packet-switched network 101. Each node 104 includes a peer computer device, with different ones of the nodes 104 belonging to different peers. Each node 104 includes one or more processors, such as one or more central processing units (CPUs), accelerator processors, application specific processors, and / or field programmable gate arrays (FPGAs). Each node also includes a memory, i.e., a computer-readable storage device in the form of a non-transitory computer-readable medium or media. The memory may include one or more memory units using one or more memory media. For example, magnetic media such as a hard disk, electronic media such as a solid state drive (SSD), flash memory, or EEPROM, and / or optical media such as an optical disk drive.

[0013] The blockchain 150 includes a chain of blocks of data 151, with a respective copy of the blockchain 150 maintained at each of multiple nodes in the P2P network 160. Each block 151 in the chain includes one or more transactions 152, where transaction in this context refers to a type of data structure. The nature of the data structure depends on the type of transaction protocol used as part of the transaction model or scheme. A given blockchain typically uses one particular transaction protocol throughout. In one common type of transaction protocol, the data structure of each transaction 152 includes at least one input and at least one output. Each output specifies an amount that represents the total amount of digital assets belonging to the user 103 to which the output is cryptographically locked (requiring that user's signature to unlock and thereby redeem or spend). Each input points back to the output of a previous transaction 152, thereby linking the transactions.

[0014] At least some of the nodes 104 take on the role of transfer nodes 104F, transferring and thereby propagating transactions 152. At least some of the nodes 104 take on the role of miners 104M, mining blocks 151. At least some of the nodes 104 take on the role of storage nodes 104S (sometimes also referred to as “full-copy” nodes), with each node storing a respective copy of the same blockchain 150 in its respective memory. Each miner node 104M also maintains a pool 154 of transactions 152 waiting to be mined into blocks 151. A given node 104 may be a transfer node 104, a miner 104M, a storage node 104S, or any combination of two or all of these.

[0015] For a given current transaction 152j, the input (or each input) contains a pointer that references the output of a previous transaction 152i in the sequence of transactions, specifying that this output is redeemed or "spent" in the current transaction 152j. In general, the previous transaction can be any transaction in the pool 154 or any block 151. The previous transaction 152i does not necessarily have to exist when the current transaction 152j is created or even when it is sent to the network 106, but the previous transaction 152i must exist and be verified for the current transaction to be valid. Thus, "preceding" herein refers to the preceding in the logical order linked by the pointer, and not necessarily to the time of creation or transmission in the chronological order, and thus does not necessarily exclude transactions 152i, 152j from being created or transmitted out-of-order (see later discussion of orphan transactions). The prior transaction 152i may similarly be referred to as a prior transaction or a preceding transaction.

[0016] The input of the current transaction 152j also includes the signature of the user 103a to which the output of the previous transaction 152i is locked. The output of the current transaction 152j can then be cryptographically locked to the new user 103b. Thus, the current transaction 152j can transfer the total amount defined in the input of the previous transaction 152i to the new user 103b defined in the output of the current transaction 152j. In some cases, a transaction 152 may have multiple outputs to split the input total amount among multiple users (one of which may be the original user 103a to provide the changes). In some cases, a transaction may also have multiple inputs, collecting total amounts from multiple outputs of one or more previous transactions and redistributing them to one or more outputs of the current transaction.

[0017] The above is called an “output-based” transaction protocol, also sometimes called an Unspent Transaction Output (UTXO) type protocol (where the outputs are referred to as UTXOs). A user's total balance is not defined in any one number stored in the blockchain 151; instead, the user needs a special “wallet” application 105 to collate the values ​​of all of the user's UTXOs, which are spread across many different transactions 152 in the blockchain 151.

[0018] An alternative type of transaction protocol, as part of the account-based transaction model, can be called an “account-based” protocol. In the account-based case, each transaction does not define the amount transferred by referencing back the UTXO of a previous transaction in a sequence of past transactions, but rather by referencing the absolute balance of the account. The current state of every account is kept by a separate miner in the blockchain and is constantly updated. In such a system, transactions are ordered using the running transaction tally of the account (also called the “position”). This value is signed by the sender as part of the cryptographic signature and is hashed as part of the transaction reference calculation. In addition, an optional data field can also be signed in the transaction. This data field can point back to a previous transaction, for example if a previous transaction ID is included in the data field.

[0019] In either type of transaction protocol, when a user 103 wants to enact a new transaction 152j, he / she sends the new transaction from his / her computer terminal 102 to one of the nodes 104 of the P2P network 106 (which today is typically a server or a data center, but in principle could be another user terminal). This node 104 checks whether the transaction is valid or not according to a node protocol applied at each node 104. The details of the node protocol form the overall transaction model and correspond to the type of transaction protocol used in the blockchain 150 in question. The node protocol typically requires the node 104 to check that the cryptographic signature in the new transaction 152j matches an expected signature that depends on the previous transaction 152i in the ordered sequence of transactions 152. In the output-based case, this may involve checking that the user's cryptographic signature included in the input of the new transaction 152j matches a condition defined on the output of the previous transaction 152i that the new transaction pays. Here, the conditions typically include at least checking that a cryptographic signature on the input of the new transaction 152j unlocks the output of the previous transaction 152i to which the input of the new transaction points. In some transaction protocols, the conditions may be defined, at least in part, by custom scripts included in the inputs and / or outputs. Alternatively, they may be fixed solely in the node protocol, or by a combination of these. In any case, if the new transaction 152j is valid, the current node transfers it to one or more other of the nodes 104 in the P2P network 106. At least some of these nodes 104 also act as transfer nodes 104F, applying the same tests according to the same node protocol, and transferring the new transaction 152j to one or more further nodes 104, and so on.In this manner, the new transaction is propagated throughout the network of nodes 104.

[0020] In an output-based model, the definition of whether a given output (e.g., UTXO) is paid or not is whether it has still been validly redeemed by another, onward transaction 152j input according to the node protocol. Another condition for a transaction to be valid is that the output of a prior transaction 152i that it attempts to pay or redeem has not already been paid / redeemed by another valid transaction. Again, if not valid, the transaction 152j is not propagated or recorded in the blockchain. This prevents double spending, which is an attempt to spend the same transaction output more than once. On the other hand, an account-based model prevents double spending by maintaining account balances. Again, since there is a defined order of transactions, the account balance has a single defined state at any time.

[0021] In addition to validating, at least some of the nodes 104M also compete to be the first to create a block of transactions in a process known as mining, which is underpinned by a "proof of work." In the mining nodes 104M, new transactions are added to a pool of valid transactions that have not yet appeared in a block. The miners then compete to assemble a new valid block 151 of transactions 152 from the pool of transactions 154 by attempting to solve a cryptographic puzzle. Typically, this involves searching for a "nonce" value so that when the nonce is concatenated with the pool of transactions 154 and hashed, the output of the hash satisfies a prescribed condition. For example, the prescribed condition may be that the output of the hash has a predefined, predefined number of leading zeros. A property of a hash function is that it has an output that is unpredictable with respect to the input. This search can therefore only be performed by brute force, thus consuming a significant amount of processing resources at each node 104M attempting to solve the puzzle.

[0022] The first minor node 104M to solve the puzzle announces this to the network 106 and provides its solution as a proof, which can be easily checked by other nodes 104 in the network (once the solution is given for the hash, it is easy to check that it matches the output of the hash). The pool of transactions 154 for which the winner solved the puzzle is then recorded as a new block 151 in the blockchain 150 by at least some of the nodes 104 acting as storage nodes 104S, based on checking the winner's announced solution in each such node. A block pointer 155 is also assigned to the new block 151n that points back to the previously generated block 151n-1 in the chain. Proof of work helps reduce the risk of double spending, since it takes a lot of effort to create a new block 151. And since any block containing a double spend is likely to be rejected by other nodes 104, mining nodes 104M are incentivized not to allow double spends to be included in their blocks. Once created, blocks 151 cannot be modified because they are known and maintained at each storage node 104S in the P2P network 106 according to the same protocol. Block pointers 155 also impose a sequential order on blocks 151. This therefore provides an immutable public ledger of transactions, as transactions 152 are recorded in ordered blocks at each storage node 104S in the P2P network 106.

[0023] Note that different 104M miners are competing at any given time, and may do so based on different snapshots of the unmined transaction pool 154 at any given time, depending on when they started looking for a solution. Whoever solves the respective puzzle first defines which transactions 152 will be included in the next new block 151n, and the current unmined transaction pool 154 is updated. The miners 104M then continue competing to generate blocks from the newly defined pending pool 154, and so on. There is also a protocol to resolve any “forks” that may arise, such that two miners 104M solve the puzzle within a very short time of each other, resulting in the propagation of inconsistent views of the blockchain. In essence, whatever prongs of the fork are extended, the longest one becomes the final blockchain 150.

[0024] In most blockchains, the winning miner 104M is automatically rewarded with a special type of new transaction that creates a new amount of digital assets out of thin air (as opposed to a regular transaction that transfers an amount of digital assets from one user to another). Thus, the winning node is said to have “mined” the amount of digital assets. This special type of transaction is sometimes called a “generation” transaction. It automatically forms part of a new block 151n. This reward incentivizes the miners 104M to participate in the proof-of-work competition. A regular (non-generational) transaction 152 also specifies an additional transaction fee in one of its outputs, further rewarding the winning miner 104M that produced the block 151n that contained the transaction.

[0025] Due to the computational resources involved in mining, typically at least each of the minor nodes 104M takes the form of a server, including one or more physical server units or entire data centers. Each transfer node 104M and / or storage node 104S can also take the form of a server or data center. However, in principle, any given node 104 can take the form of a user terminal or a group of user terminals networked together.

[0026] The memory of each node 104 stores software configured to execute on the node's 104 processing unit to perform its role and process transactions 152 according to the node protocol. It will be understood that any action attributed to a node 104 herein may be performed by software executing on the processing unit of the respective computing device. Additionally, the term "blockchain" as used herein is a general term that refers to a general type of technology and is not limited to any particular proprietary blockchain protocol or service.

[0027] Also connected to the network 101 are computer devices 102 of a number of parties 103 in the role of consuming users. These play the role of payers and payees in transactions, but do not necessarily participate in mining or propagating transactions for other parties. They do not necessarily execute the mining protocol. Two parties 103 and their respective devices 102 are shown for illustration purposes: a first party 103a and his / her respective computer device 102a, and a second party 103b and his / her respective computer device 102b. It will be understood that more such parties 103 and their respective computer devices 102 can exist and participate in the system, but for convenience they are not shown. Each party 103 may be an individual or an organization. Purely by way of example, the first party 103a will be referred to herein as Alice and the second party 103b will be referred to as Bob, but it will be understood that this is not limiting and that references herein to Alice or Bob can be replaced with "first party" and "second party," respectively.

[0028] The computer equipment 102 of each party 103 includes a respective processing device including one or more processors, e.g., one or more CPUs, GPUs, other accelerator processors, application specific processors, and / or. The computer equipment 102 of each party 103 further includes a memory, i.e., a computer readable storage device in the form of a non-transitory computer readable medium or media. The memory may include one or more memory units using one or more memory media, e.g., a magnetic medium such as a hard disk, an electronic medium such as a SSD, a flash memory, or an EEPROM, and / or an optical medium such as an optical disk drive. The memory on the computer equipment 102 of each party 103 stores software including at least one respective instance of a client application 105 arranged to operate on the processing device. It will be understood that any operation attributed herein to a given party 103 may be performed using software executing on the processing device of the respective computer equipment 102. The computer equipment 102 of each party 103 includes at least one user terminal. For example, a desktop or laptop computer, a tablet, a smartphone, or a wearable device such as a smart watch. The computing equipment 102 of a given party 103 may also include one or more other networked resources, such as cloud computing resources, accessed via a user terminal.

[0029] The client application or software 105 may be initially provided to the computing equipment 102 of any given party 103 on any suitable computer readable storage medium or media, such as downloaded from a server, or stored on a removable SSD, flash memory key, removable EEPROM, removable magnetic disk drive, magnetic floppy disk or tape, optical disk such as a CD or DVD ROM, or removable optical drive, etc.

[0030] The client application 105 comprises at least a “wallet” functionality. It has two main functions. One of these is to allow each user party 103 to create, sign and send transactions 152 to be propagated throughout the network of nodes 104 and thereby included in the blockchain 150. The other is to report back to each party the total amount of digital assets it currently owns. In an output-based system, this second function involves reconciling the total amount defined in the outputs of the various transactions 152 scattered throughout the blockchain 150 belonging to the party in question.

[0031] An instance of a client application 105 on each computing device 102 is operatively coupled to at least one of the transfer nodes 104F of the P2P network 106. This allows the wallet function of the client 105 to send transactions 152 to the network 106. The client 105 can also contact one, some, or all of the storage nodes 104 to query the blockchain 150 for any transactions for which the respective party 103 is a recipient (or, indeed, to inspect other parties' transactions in the blockchain 150, since in an embodiment the blockchain 150 is a public facility that provides trust in transactions in part due to its public visibility). The wallet function on each computing device 102 is configured to form and send transactions 152 according to a transaction protocol. Each node 104 executes software configured to validate transactions 152 according to the node protocol, and, in the case of the transfer node 104F, transfer the transactions 152 in order to propagate them throughout the network 106. The transaction protocol and the node protocol correspond to each other, and a given transaction protocol together with a given node protocol implements a given transaction model. The same transaction protocol is used for all transactions 152 in the blockchain 150 (although the transaction protocol may allow different subtypes of transactions). The same node protocol is used by all nodes 104 in the network 106 (although many nodes process different transaction subtypes differently according to rules defined for that subtype, and also different nodes may take on different roles and thus implement different corresponding aspects of the protocol).

[0032] As mentioned above, the blockchain 150 includes a chain of blocks 151, where each block 151 includes a set of one or more transactions 152 created by the proof of work process, as described above. Each block 151 also includes a block pointer 155 that points back to a previously generated block 151 in the chain, so as to define the sequential order of the blocks 151. The blockchain 150 also includes a pool of valid transactions 154 waiting to be included in a new block by the proof of work process. Each transaction 152 includes a pointer back to a previous transaction, so as to define the order of the transactions (note that the shields of transactions 152 allow for branching). The chain of blocks 151 goes all the way back to a genesis block 153 (Gb) that was the first block in the chain. One or more original transactions 152 earlier in the chain 150 pointed to the genesis block 153, not to a previous transaction.

[0033] When a given party 103, for example Alice, wants to submit a new transaction 152j to be included in the blockchain 150, she formulates the new transaction (using a wallet function in her client application 105) according to the relevant transaction protocol. She then sends the transaction 152 from the client application 105 to one of one or more transfer nodes 104F to which she is connected. For example, this may be the transfer node 104F that is closest or best connected to Alice's computer 102. When any given node 104 receives the new transaction 152j, it processes it according to the node protocol and its respective role. This includes first checking whether the newly received transaction 152j meets certain conditions to be "valid", an example of which will be described in more detail shortly. In some transaction protocols, the conditions for validation are configurable per transaction by a script included in the transaction 152. Alternatively, the conditions may simply be a built-in feature of the node protocol, or may be defined by a combination of the script and the node protocol.

[0034] Provided that the newly received transaction 152j passes the tests to be considered valid (i.e., is "validated"), any storage node 104S that receives the transaction 152j adds the newly validated transaction 152 to a pool 154 in the copy of the blockchain 150 that it maintains. Additionally, any transfer node 104F that receives the transaction 152j propagates the validated transaction 152 to one or more other nodes 104 in the P2P network 106. Because each transfer node 104F applies the same protocol, this means that, assuming the transaction 152j is valid, it will soon be propagated throughout the P2P network 106.

[0035] Once in the pool 154 in the copy of the blockchain 150 maintained on one or more storage nodes 104, the miner nodes 104M start competing to solve the proof-of-work puzzle of the latest version of the pool 154 that contains the new transaction 152 (other miners 104M are still trying to solve the puzzle based on their old view of the pool 154, but whoever gets there first defines where the next new block 151 ends and the new pool 154 begins, and eventually, someone solves the puzzle for the part of the pool 154 that contains Alice's transaction 152j). Once the proof-of-work has been done for the pool 154 that contains the new transaction 152j, it becomes an immutable part of one of the blocks 151 in the blockchain 150. Because each transaction 152 contains a pointer back to the previous transaction, the order of the transactions is also immutably recorded.

[0036] Figure 2 shows an example of a transaction protocol. This is an example of a UTXO-based protocol. A transaction 152 (abbreviated as "Tx") is the basic data structure of the blockchain 150 (each block 151 contains one or more transactions 152). The following is described with reference to an output-based protocol or a "UTXO"-based protocol. However, this is not limited to all possible implementations.

[0037] In the UTXO-based model, each transaction ("Tx") 152 comprises a data structure that includes one or more inputs 202 and one or more outputs 203. Each output 203 may include an unspent transaction output (UTXO), which can be used as a source of input 202 for another new transaction (unless the UTXO has already been redeemed). The UTXO specifies an aggregate amount of digital assets (a store of value). It may also include, among other information, the transaction ID of the transaction from which it came. The transaction data structure may also include a header 201, which may include indicators of the sizes of the input fields 202 and output fields 203. The header 201 may also include the ID of the transaction. In an embodiment, the transaction ID is a hash of the transaction data (excluding the transaction ID itself) and is stored in the header 201 of the raw transaction 152 submitted to the miner 104M.

[0038] Suppose Alice 103a wants to create a transaction 152j that transfers the amount of digital assets in question to Bob 103b. In FIG. 2, Alice's new transaction 152j is labeled "Tx1". It in turn takes the amount of digital assets locked to Alice in the output 203 of the previous transaction 152i and transfers at least a portion of this to Bob. The previous transaction 152i is labeled "Tx0" in FIG. 2, where Tx0 and Tx1 are merely arbitrary labels. These do not necessarily mean that Tx0 is the first transaction in the blockchain 151 or that Tx1 is the immediate next transaction in the pool 154. Tx1 can point back to any previous (i.e., antecedent) transaction that still has unpaid outputs 203 locked to Alice.

[0039] The preceding transaction Tx0 may already be validated and included in the blockchain 150 when Alice creates her new transaction Tx1, or at least when she sends it to the network 106. It may already be included in one of the blocks 151 at that point, or it may still be waiting in the pool 154, in which case it will be included. Alternatively, Tx0 and Tx1 may be created and sent to the network 102 together, or Tx0 may even be sent after Tx1 if the node protocol allows for buffering of "orphan" transactions. The terms "preceding" and "subsequent," as used herein in the context of a sequence of transactions, refer to the order of transactions in a sequence defined by transaction pointers specified in the transactions (such as which transaction pointers point back to other transactions). They may be equivalently referred to as “predecessor” and “successor,” “antecedent” and “descent,” “parent” and “child,” etc. This does not necessarily imply the order in which they are generated, transmitted to the network 106, or arrive at any given node 104. Nevertheless, a successor transaction (a successor transaction or “child”) that points to a predecessor transaction (a predecessor transaction or “parent”) is not validated until and unless the parent transaction is validated. A child that arrives at a node 104 before its parent is considered an orphan. It may be discarded, or it may be discarded or buffered for a period of time to wait for its parent, depending on the node protocol and / or minor actions.

[0040] One of the one or more outputs 203 of the prior transaction Tx0 includes a particular UTXO, labeled herein as UTXO0. Each UTXO includes a value specifying the aggregate amount of the digital asset represented by the UTXO, and a locking script that defines the conditions that must be satisfied by an unlocking script in the input 202 of the subsequent transaction for the subsequent transaction to be validated, and therefore for the UTXO to be successfully redeemed. Typically, the locking script locks the aggregate amount to a particular party (the beneficiary of the transaction in which it is included). That is, the locking script defines the unlocking conditions, and typically includes a condition that the unlocking script in the input of the subsequent transaction includes a cryptographic signature of the party to whom the prior transaction is locked.

[0041] A locking script (aka scriptPubKey) is a piece of code written in a domain-specific language recognized by the node protocol. A specific example of such a language is called “Script” (capital S). A locking script specifies the information needed to pay the transaction output 203, e.g., the requirements of Alice’s signature. An unlocking script appears in the transaction’s output. An unlocking script (aka scriptSig) is a piece of code written in a domain-specific language that provides the information needed to satisfy the criteria of the locking script. For example, it may include Bob’s signature. An unlocking script appears in the transaction’s input 202.

[0042] In the illustrated example, UTXO0 of output 203 of Tx0 is A ], which means that for UTXO0 to be redeemed (or more precisely, for a subsequent transaction that attempts to redeem UTXO0 to be valid), Alice’s signature Sig P A [Checksig P A] is the public key P from Alice’s public-private key pair. A The input 202 of Tx1 includes a pointer that points back to Tx1 (e.g., using its transaction ID, TxID0, which in an embodiment is a hash of the entire transaction Tx0). The input 202 of Tx1 includes an index that identifies UTXO0 within Tx0, to identify it among any other possible outputs of Tx0. The input 202 of Tx1 also includes an unlocking script that includes Alice's cryptographic signature, created by applying Alice's private key from her key pair to a predetermined portion of the data. <Sig P A > (sometimes called a “message” in cryptography). The data (or “message”) that Alice needs to sign in order to provide a valid signature is defined by the locking script, the node protocol, or a combination of these.

[0043] When a new transaction Tx1 arrives at node 104, the node applies the node protocol, which involves running the locking script and the unlocking script together to check whether the unlocking script satisfies the conditions defined in the locking script (where the conditions may include one or more criteria). In an embodiment, this involves concatenating the two scripts. <Sig P A > <P A >||[Checksig P A ]

[0044] where "||" denotes concatenation, "<...>" means to put the data on a stack, and "[...]" is a function that is composed in the unlocking script (a stack-based language in this example). Similarly, the scripts may be executed one after the other on a common stack rather than concatenating the scripts. In either case, when executed together, the scripts authenticate that the locking script on the input of Tx1 contains Alice's signature signing the expected portion of the data, as included in the locking script on the output of Tx0, using Alice's public key PA. To perform this authentication, the expected portion of the data itself (the "message") must also be included in the Tx0 sequence. In an embodiment, the signed data includes the entirety of Tx0 (so a separate element needs to be included specifying the signed portion of the data in the clear, since that is already inherently present).

[0045] The details of authentication with public-private cryptography will be well known to those skilled in the art. Essentially, if Alice signs a message by encrypting it using her private key, then given Alice's public key and the message in the clear, another entity, such as node 104, can authenticate that the encrypted version of the message must have been signed by Alice. Signing typically involves hashing the message, signing the hash, and tagging this as the signature on a clear version of the message, thus allowing any holder of the public key to authenticate the signature.

[0046] If the unlocking script of Tx1 satisfies one or more conditions specified in the locking script of Tx0 (as shown in the example, Alice's signature is provided in Tx1 and is authenticated), the node 104 considers Tx1 valid. For a mining node 104M, this means it is added to the transaction pool 154 awaiting proof of work. For a transfer node 104F, it transfers the transaction Tx1 to one or more other nodes 104 in the network 106, so that it is propagated throughout the network. Once Tx1 is verified and included in the blockchain 150, it defines Tx0 to UTXO0 as a payment. Note that Tx1 is only valid if it pays an unpaid transaction output 203. If it tries to pay an output that has already been paid by another transaction 152, Tx1 is invalid even if all other conditions are met. Therefore, node 104 also needs to check whether the UTXO referenced in the prior transaction Tx0 has already been spent (already formed a valid input to another valid transaction). This is one of the reasons why it is important for blockchain 150 to impose a defined order on transactions 152. Indeed, a given node 104 could maintain a separate database marking UTXOs 203 that transactions 152 have been spent, but ultimately, what defines whether a UTXO has been spent is whether it has already formed a valid input to another valid transaction in blockchain 150.

[0047] Note that the UTXO-based transaction model requires that a given UTXO must be spent in its entirety; it is not possible to “leave behind” a fraction of the total amount defined in the UTXO while another fraction is paid. However, the total amount of a UTXO can be split into multiple outputs of subsequent transactions. For example, the total amount defined in UTXO0 in Tx0 can be split into multiple UTXOs in Tx1. Thus, if Alice does not want to give Bob the entire total amount defined in UTXO0, she can use the remaining amount to give herself change or pay another party in the second output of Tx1.

[0048] In practice, Alice usually also needs to include a fee for the winning miners, because today the reward of the generation transaction alone is typically not enough to incentivize mining. If Alice does not include a fee for the miners, Tx0 will likely be rejected by the miner's nodes 104M, and thus, although technically valid, it will still not be propagated and included in the blockchain 150 (the miner protocol does not force the miners to accept the transaction 152 if they do not want to). In some protocols, the mining reward does not need its own separate output 203 (i.e., it does not need a separate UTXO). Instead, the difference between all the totals indicated by the inputs 202 and all the totals specified in the outputs 203 of a given transaction 152 is automatically given to the winning miners 104. For example, suppose a pointer to UTXO0 is the only input to Tx1, and Tx1 has only one output UTXO1. If the aggregate amount of digital assets specified in UTXO0 is greater than the aggregate amount specified in UTXO1, the difference automatically goes to the winning miner 104M. Alternatively or additionally, however, it is not necessarily excluded that a miner reward may be explicitly specified in a unique one of the UTXOs 203 of transaction 152.

[0049] Also note that if all of the aggregates specified in all of the outputs 203 of a given transaction 152 are greater than all of the aggregates specified in all of its inputs 202, this is another basis for invalidity in most transaction models. Thus, such a transaction will not be propagated or mined into a block 151.

[0050] Alice and Bob's digital assets consist of unpaid UTXOs locked in any transaction 152 anywhere in the blockchain 150. Thus, typically, the assets of a given party 103 are distributed across UTXOs of various transactions 152 throughout the blockchain 150. No single number is stored anywhere in the blockchain 150 that defines the entire balance of a given party 103. It is the role of the wallet function in the client application 105 to collate together the values ​​of all the various UTXOs locked for each party and not yet paid in another onward transaction. This can be done by querying the copy of the blockchain 150 stored on any storage node 104S, e.g., the storage node 104S that is closest to or best connected to each party's computer device 102.

[0051] Note that script code is often expressed diagrammatically (i.e., not in a precise language). For example, [Checksig P A ], [Checksig P A]=OP_DUP OP_HASH160<H(Pa)> OP_EQUALVERIFY may be written to mean OP_CHECKSIG. The "OP_..." refers to a specific opcode in the scripting language. OP_CHECKSIG (also called "Checksig") is a Script opcode that takes two inputs (a signature and a public key) and verifies the validity of the signature using the Elliptic Curve Digital Signature Algorithm (ECDSA). At runtime, any occurrences of the signature ("sig") are removed from the script, but additional requirements remain in the transaction, such as a hash puzzle, that are verified by the "sig" input. As another example, OP_RETURN is a scripting language opcode to generate a non-spendable output of a transaction, which can store metadata in the transaction, and thereby immutably record the metadata in the blockchain 150. For example, the metadata can include a document that is desired to be stored in the blockchain.

[0052] signature P A is a digital signature. In an embodiment, it is based on ECDSA using the elliptic curve secp256K1. A digital signature signs a specific piece of data. In an embodiment, for a given transaction, the signature signs some of the transaction inputs and all or some of the transaction outputs. The specific pieces of outputs to sign depend on the SIGHASH flag, which is a 4-byte code included at the end of the signature that selects which outputs are signed (and therefore fixed at the time of signing).

[0053] A locking script is sometimes referred to as a "scriptPubKey", referring to the fact that each transaction contains the public key of the party being locked. An unlocking script is sometimes referred to as a "scriptSig", referring to the fact that it provides a corresponding signature. However, more generally, it is not required in all applications of blockchain 150 that the conditions under which a UTXO is redeemed include authenticating a signature. More generally, the scripting language may be used to define any one or more conditions. Thus, the more general terms "locking script" and "unlocking script" are preferred.

[0054] Digital Asset Allocation FIG. 3 illustrates an example system 300 for allocating (i.e., paying) an amount of digital assets using a blockchain transaction. The system 300 includes one or more recipients 301 and an allocating party ("allocator") 302. There may be any number of recipients ("recipients") 301, as indicated by labels 1 through N in FIG. 3. Each party operates a respective computing device. For example, referring to FIG. 1, one or more recipients 301 may play the role of Alice 103a or Bob 103b and operate respective computing devices 102a, 102b. Each arrow in FIG. 3 represents a transfer of an amount of digital assets using a blockchain transaction 152.

[0055] System 300 may also include an issuing party ("issuer") 303 that operates each computer device. In some embodiments, issuer 303 and allocator 302 are the same party. Alternatively, issuer 303 and allocator 302 may be different parties.

[0056] The allocator 302 and / or the issuer 303 may take the form of one or more physical server units, or a server including an entire data center. Alternatively, the allocator and / or the issuer may take the form of a user terminal or a group of user terminals networked together. That is, the allocator and / or the issuer may be an individual user or a group of users, such as an organization, e.g., a company, an academic institution, a charity, etc. In general, the allocator and / or the issuer includes a computing device. The computing device includes a processing device, including one or more processors, e.g., one or more central processing units (CPUs), accelerator processors, application specific processors, and / or field programmable gate arrays (FPGAs). The computing device also includes a memory, i.e., a computer readable storage device in the form of a non-transitory computer readable medium or media. The memory may include one or more memory units using one or more memory media. The memory medium may be, for example, a magnetic medium such as a hard disk, an electronic medium such as a solid state drive (SSD), flash memory, or EEPROM, and / or an optical medium such as an optical disk drive. The allocator's memory stores software configured to run on a processing unit of the node computing device to perform its respective role. It will be understood that any action attributed to the allocator and / or issuer herein may be performed by software running on a respective processing unit of the allocator's or issuer's computing device. The allocator and / or issuer may communicate with the recipients 301 (e.g., Alice and Bob) via, for example, the Internet 101.

[0057] Each party is associated with the blockchain 150 via a unique public key. The public key may be an elliptic curve cryptography public key. As shown in FIG. 3, each recipient 301 has its own ownership public key P Oi and the allocator 302 allocates the public key P AiFor example, a first recipient (recipient i=1) has a first ownership public key P O1 and the second recipient (recipient i=2) owns the second ownership public key P O2 Thus, the Nth recipient (i=N) owns the Nth ownership public key P ON It will be understood that the first, second, ..., Nth etc. are simply labels used to distinguish between different recipients and their proprietary public keys. In an example where system 300 includes issuer 303, issuer 303 owns an issuing public key P I Each public key forms part of a public / private key pair, where the public key is generated based on the private key. Typically, the private key is kept secret and is not shared or published with others.

[0058] One or more of the public keys may be a certified public key. A certified public key is associated with a public key certificate issued by a certification authority. This certificate is a digital certificate that can be used to prove ownership of an associated public key. This certificate can be used to prove that the certification authority that issues the certificate attests to the ownership of the public key.

[0059] The allocator 302 has access to an allocation (i.e., a store) of digital assets. Digital assets can represent a mapping to real-world assets. For example, a particular amount of digital assets can represent a particular amount of real-world assets. As an example, digital assets can represent ownership of a house, artwork, patents, etc., and the allocator can be responsible for transferring or assigning (partial) ownership of the assets. For example, the allocator may wish to transfer 50% ownership of an asset to a first recipient and 50% ownership of the asset to another recipient. Digital assets can be digital tokens. That is, an allocation of digital assets can be multiple tokens. Each token can be pegged to an amount of real-world assets. Tokens can represent, for example, a vote, a period of electrical energy, a ticket to an event, etc. For example, an allocator may be responsible for allocating (i.e., distributing) tokens to recipients 301. The recipients may then redeem the tokens, for example, for entry to a music festival. As another example, tokens may enable access to a subscription service (e.g., a media streaming service). Each token may represent a period of access to the service (e.g., one month). The allocating party may allocate recipients a set number of tokens (e.g., 12 tokens for a one-year subscription) that may be paid for to access the service.

[0060] Optionally, the issuer 303 can issue an allocation of the digital asset to the allocator 302. That is, the issuer can generate one or more blockchain transactions that together transfer the allocation of the digital asset from the issuer to the allocator. Specifically, the blockchain transaction transfers ownership of the digital asset to the blockchain address of the issuer (e.g., the issuing public key P I or PI , the address based on the allocator's public key P A As one example, an issuer can entrust an allocator to distribute large amounts of digital assets to recipients, thus freeing the issuer from generating and sending a (large) number of blockchain transactions. In this example, the issuer transfers the allocator's allocation address (e.g., public key P A or P A The issuer only needs to transfer their allocation of digital assets to the peer-to-peer (P2PKH) blockchain, which means that the issuer only needs to carry out a single transaction.

[0061] As explained in detail above, the output of a blockchain transaction locks an amount of digital assets to a particular public key. The corresponding private key is required to access (e.g., transfer, use, spend) the amount of digital assets locked to the public key. Thus, in this example, only the allocator 302 has the right to allocate P A and the paired private key S A The allotment of digital assets can be accessed by using P. Initially, the allotment of digital assets is held (i.e., locked) under a first-allocation public key and a first-allocation private key pair. As described below, the allocator can make several payment allocations. Each payment allocation (i.e., each iteration of the allocation of the aggregate amount of digital assets) may include a different public and private key pair. For example, the first iteration may be P A (1) and S A (1) can be used, and the second iteration is P A (2) and S A (2) Then, the Nth iteration is P A (n) and S A (n) For simplicity, P A (1) The notation P is used to represent A is used.

[0062] The Allocator 302 is required to transfer an allocated aggregate amount of digital assets to a set of Recipients 301. The set may include a single Recipient or multiple Recipients. Each Recipient has a respective ownership public key P Oi A unique proprietary private key S paired with Oi The allocator possesses a public ownership key P corresponding to the recipient who will receive the aggregate digital asset allocation. Oi The ownership public key P Oi There are several ways to obtain the set of . For example, each recipient can obtain an individual ownership public key P Oi may be registered (i.e., made available) with the allocator and / or issuer 303. Public key registration is described below. Note that, as described below, the respective amounts transferred to the recipient may or may not be equal.

[0063] Note that the allocator 302 could simply transfer the amount of digital assets to the recipient's ownership public key. However, if the recipient's ownership private key were compromised, all future payments to the recipient would be compromised. However, if the recipient's payment private key were compromised, only the payment would be compromised. The new payment public / private key pair would be P Oi and is used as the next payment address. Oi is considered as the recipient's identifier, while P Pi is a redeemable voucher / token (i.e. redeemable for real-world assets). Periodic payments are made using the ownership key P as an authenticated access point. Oi Using P Pi The address is searched based on the Pi Since P can be updated with each payment, its compromise is limited to theft (i.e., P Pi The result can only be the total amount of digital assets transferred to the address based on the iteration of P.Oi Compromise of your account is tantamount to a breach of identity and potential loss of all future payments.

[0064] Instead, the allocator 302 allocates each ownership public key P Oi For each, the corresponding payment public key P Pi For a given recipient 301, generate their payment public key P Pi is at least the recipient's ownership public key P Oi and the allocator's public key P Ai For example, for the first round of allocation, the first recipient's payment public key is generated using at least the first recipient's ownership public key P Oi and the allocator's first allocation public key P A The use of both the recipient's ownership public key and the allocator's public key creates a link between the two parties.

[0065] When multiple cycles of allocating payments are instituted, the first set of payment public keys is the allocator's first public key P A Subsequent allocation iterations generate a second, different allocation public key P A (2) The generation of the different allocator public keys is described below.

[0066] The allocator 302 acts as a payment address for each recipient, or allocates a payment public key P that is used to generate payment addresses. Pi Controls the payment key P Pi The set of addresses allows any party (e.g., issuer 303, recipient 301, regulator, etc.) to verify a payment address and, for example, the aggregate amount of digital assets transferred to a payment address at any point in time.

[0067] First, the payment public key P PiOnce the set of , is generated, the allocator 302 can generate one or more blockchain transactions to transfer payments for the digital asset store to the intended recipients, whereby the transactions allocate each of the aggregate amounts of the digital assets to the public key P A ) from the allocator's address (based on the recipient's payment public key P Pi , based on the digital assets of the recipient. The payment may be transferred in a single transaction; that is, a single transaction may have multiple outputs, whereby each output transfers a share of the digital assets to a different payment address (i.e., a different recipient). Alternatively, the payment may be transferred using one or more transactions. For example, each transaction may transfer a share of the digital assets to a single, different payment address (i.e., a different recipient).

[0068] The allocator 302 can send the transaction to the blockchain network 106, i.e., to one or more nodes 104 connected to the blockchain. If the transaction is deemed valid by satisfying the conditions of the blockchain protocol (described above), the transaction is committed to the blockchain 150 and acts as an immutable public record of the allocated amounts.

[0069] Once a transaction is committed to the blockchain, the sum of digital assets can be accessed under certain conditions. One of these conditions is that the payment public key P Pi The corresponding payment private key S Pi In other words, a share of the digital asset is provided in a transaction that seeks to access a sum of digital assets using a first public payment key P P1 A first payment private key S from the first public key-private key pair when transferred to the payment address based on PiEach recipient 301 is required to transfer their share to another blockchain address. To access their share of the digital asset, each recipient 301 must provide their public payment key P Pi The corresponding payment private key S Pi This means that the allocator’s private key S A knowledge is required.

[0070] The allocator 302 allocates a private key S on the blockchain, for example in a (certainly) unspendable output of a blockchain transaction. A For example, S A may be included in the OP_RETURN output of the transaction. The OP_RETURN opcode marks the transaction output as invalid, ensuring that a later transaction input cannot spend that output. Alternatively, the allocator may disclose the private key S to the recipient 301, for example, by publishing it on a website and / or by sending it via other secure communication means, e.g., encrypted email. A It is possible to publish off-chain.

[0071] Below, we consider a payment public key P for use by the allocator 302 and the recipient 301. Pi We describe one technique for generating a public payment key P Pi is the ownership private key S as follows: Oi Along with the assigned private key S A can be derived from P Pi =S Pi G=(S Oi +S A )·G P Pi =P A +S Oi G P Pi =P A +P Oi

[0072] The use of public key appending here creates a link between the two addresses, and therefore the two parties (the allocator 302 and the recipient 301), without the need for further communication. Pi =P A +P Oi ) means that the allocator allocates digital assets to the address P Oi Across the entire set of A to individual outputs. An example transaction 400 is shown in FIG.

[0073] As shown, transaction 400 includes the allocation of the allocator’s public key P A The figure includes an input 401 for transferring an allocation of digital assets from a recipient 302, and a number of outputs. In this example, there are N outputs. Each output transfers a respective sum 402 of digital assets to a respective payment public key 403 belonging to a respective recipient 302. It will be understood that Figure 4 is a representation of a transaction. In effect, the input of the transaction includes an unlocking script, and each output of the transaction includes a locking script.

[0074] The allocator 302 allocates the aggregate amount of digital assets using blockchain transactions, along with the public payment key P Pi The allocator then allocates the set of P Pi To compute the sums of the two, we use the OP_RETURN declaration or other methods to retrieve the assigned private key S on the chain. A may be made public.

[0075] To access (i.e., pay) their amounts of digital assets, the recipient 301 needs to be able to determine the payment address to which those amounts have been transferred. The payment address is stored in the recipient's ownership public key P Oi (And only the recipient has the corresponding private key S Oi), and the allocator's public key P A Recall that the payee is generated based on its public payment key P Pi and a payment address (e.g., P2PKH). In addition, the recipient can calculate the payment public key P Pi A payment private key S paired with Pi The recipient must be able to determine the ownership private key S Oi and the allocator's private key S A Therefore, the recipient can use the above equation, i.e., S Pi =S Oi +S A , using the payment private key S Pi can be generated.

[0076] For successive allocations, the public key P A must be updated. The corresponding private key S must be updated so that for n allocations there are n allocation public and private key pairs. A The corresponding private key S A (1) With public key P A (1) After the first allocation (n=1) to A (2) The updated public key P A (2) When allocating the aggregate amount of digital assets for the second allocation, the allocator generates a second set of payment public keys P as before, except that updated public keys are used. Pi (2) That is, P Pi (2) =P Oi +P A (2) , or in general, P Pi (n) =P Oi +P A (n)The allocator can then generate one or more transactions that transfer the second allocation amount to the recipient's updated payment address, which can be the updated public key itself or a hash of the updated public key.

[0077] The public keys can be updated in several ways. In some examples, the public keys are updated randomly. In other examples, the following hybrid scheme is used: A (n) is a randomly (or otherwise) generated public key P An and the sum of the previous list of public keys,

number

[0078] In this example, the updated assigned public key is equal to a newly (e.g., randomly) generated key plus the sum of all of the previous public keys. This public key structure creates an audit trail of payments, linking each updated public key to the previous one. In this way, a chain of payments is created. The new public key is not generated purely from the previous one, as this would increase the attack surface (i.e., if the old public key is compromised, an attacker could generate all future addresses as well).

[0079] Optionally, each recipient 301 may share their ownership public key P Oi For example, the (certified) ownership public key P Pimay be updated using a deterministic component derived from a shared secret (shared between the recipient and the allocator 302), as described in WO2017 / 145016. A summary of the technology described in WO2017 / 145016 is as follows. 1. Alice creates a message and hashes it. 2. Alice uses the hashed message to create a second private-public key pair via the appending of ECC. 3. Alice sends the hashed message to the allocator, signed with her second private key. 4. The allocator verifies Alice's signature. 5. The allocator uses the hash message to create a second private-public key pair via Elliptic Curve Cryptography (ECC) addition. 6. Alice and the allocator can now mutually compute the second public key. 7. Alice and the allocator multiply their respective second public keys by each other’s second private keys to derive a shared secret (commutative law). 8. Hashing a message (and hashing the hash of the hashed message, etc.) allows the creation of a hierarchy of shared secrets, where only the original message needs to be known.

[0080] Note that in some examples, the allocator can perform actions attributed to Alice, and the recipient can perform actions attributed to the allocator.

[0081] A sequence of ownership public keys P Oi (1) , P Oi (2) , ..., P Oi (n) can be generated using the method described above. Oi (2can be used by the recipient and the allocator for the second cycle of allocations. Each allocation can use an updated ownership public key, and the nth cycle uses the nth updated ownership public key P Oi (n) This enhances the security of transactions through periodic key updates, while also providing an initial (certified) ownership public key P Oi It also holds a reference to

[0082] The allocator performs sequential allocations using P Pi (n) =P Oi (n) +P An The updated ownership public key may be used.

[0083] In some instances, each recipient may not receive an equal share of the digital asset store; that is, some recipients may receive a larger share than others. Each ownership public key P Oi is the weighting (percentage) of the digital asset allocation D i The allocator ensures that the correct proportion of allocations is assigned to each public payment key P Pi The relative weighting of each share D to ensure that i ΣD i Note that = 100%.

[0084] The allocator 302 also allocates a set of active ownership public keys.

number

[0085] As described above, Alice can register her ownership public key on the blockchain, which allows the allocating party to obtain her ownership public key. Figures 5a and 5b show an example transaction for registering Alice's ownership public key. As shown in Figure 5a, transaction 500 is sent from Alice to the issuer. That is, transaction 500 includes an input having an unlocking script 501 that includes Alice's signature and Alice's public key. This allows Alice to pay the output of a previous blockchain transaction sent to Alice. Transaction 500 includes an output having a locking script 502 configured to transfer a certain amount of the input to the issuer (e.g., a pay-to-public-key-hash to the issuer's public key). This serves as a shareholder payment from Alice to the issuer. Note that this shareholder payment may be performed outside of the block, for example, using a bank transfer, etc. The input includes a value 503 equal to v+w. where this value is the payment for the total share, and w is a representative value representing the weighting Di linked to Alice. Note that the value w is arbitrary.

[0086] FIG. 5b illustrates an example of a transaction 504 that includes Alice's ownership public key. The transaction 504 is sent from an issuer to Alice. That is, the transaction 504 includes an input having an unlocking script that includes the issuer's signature and the issuer's public key. The transaction 504 includes two outputs. The first output includes Alice's ownership public key in a non-spendable transaction output 506, e.g., an OP_RETURN output. This registers Alice's ownership public key on the blockchain 150. The second output 507 includes a pay-to-public key hash for Alice. This allows Alice to revoke (or invalidate) her ownership public key, e.g., transfer her share to a different party. Alternatively, the second output 507 may include a pay-to-public key hash for the issuer. This would allow the issuer to revoke Alice's ownership public key. As another alternative, the second output 507 may require n-of-m signatures to pay the output value 508. For example, the second output 507 may involve one or both of Alice's and the issuer's public keys.

[0087] Active Ownership Public Key P Oi and / or weighting D i One way to maintain the list of recipients' ownership public keys P will now be described with reference to Figures 5a and 5b. Oi At the time of registering the public key P I together with the recipient's ownership public key P Oi For example, the digital asset may be a native token. A representative amount indicates active ownership (i.e., entitlement) to an amount of the digital asset. In some examples, an ownership public key P OiDuring registration, a multi-signature transaction is set up by either the issuer or the recipient, so that both parties validate the transaction, thereby determining the weighting (e.g., percentage) of the amount allocated to the recipient, D. i Agree to.

[0088] Representative totals with relative weighting D i The proportion of tokens that are mapped to the digital asset may be at the discretion of the issuer 303. For example, if the recipient 301 receives 25% of the allocation of the digital asset, then the representative amount may be 25 units of tokens mapped to the digital asset. The representative amount may be calculated by dividing the total amount by the recipient's ownership public key P Oi Such a transaction is illustrated in Figure 5a. In this example, the recipient (e.g., Alice) transmits the sum v via the first output to the issuer's public key P I This serves as a payment for an amount of digital assets. In the example transaction of Figure 5b, the issuer transfers a representative amount w, representing a share of D1=w% of the digital assets, to Alice’s ownership public key P Oi This transaction transfers Alice's public ownership key P Oi to weighting D1.

[0089] If the output 507 to Alice is not redeemed (i.e., paid), the output of the transaction is classified as an unspent transaction output (UTXO). The set of UTXOs across the entire blockchain can be easily queried; that is, the UTXO set acts like a universal memory for the blockchain. Public ownership key P O1 All active owners of P appear in the UTXO set. Thus, the allocator uses the ownership public key P to determine to whom to transfer digital asset payments, along with the amount of digital assets to transfer. Oi(e.g., certified ownership public key) and their respective weightings D1.

[0090] A recipient 301 (e.g., Alice) can decide to transfer their allocation back to the issuer 303. To do this, Alice can generate a transaction to transfer a representative sum w back to the issuer, using Alice's ownership public key P O1 has the effect that P no longer appears in the UTXO set. Alternatively, Alice can use a blockchain transaction to create a new recipient's ownership public key P O2 A party may choose to transfer (e.g., trade) their ownership to another party. The transaction may be a multisig transaction requiring the signature of the issuer. Transfers in this manner may only occur if approved by the issuer.

[0091] Register the ownership public key and create the active ownership public key P Oi and weighting D i Another method for maintaining the list will now be described with reference to FIG.

[0092] The method uses a public ownership key P Oi For example, during the initial registration process, the issuer 303 may register Alice's ownership public key P O1 In this sense, the ownership public key can declare a total weight D1 denoted by i The output may be non-spendable, for example because it contains an opcode that causes the output (locking) script to fail when executed. In some such cases, the OP_RETURN output is tagged with the ownership public key P OiWhenever a is registered or revoked, it may be included in a transaction with an authorized identifier (e.g., a 4-byte prefix). The identifier may be certified by the issuer or a trusted third party. The output may be generated by the recipient or by the issuer.

[0093] An example transaction is shown in Figure 6. Transaction 600 includes an input 601 that transfers an amount x (the transaction fee) from Alice's public key, and an output 602. Output 602 is a non-spendable transaction output. Output 602 also includes an authorized identifier 603, Alice's ownership public key P O1 , and Alice's weighting D1.

[0094] The allocator 302 can identify transactions with a particular identifier, e.g., a particular prefix. For example, the allocator can keep a list of ownership public keys, which can then be updated by identifying transactions with particular authorized identifiers. Active ownership public keys can be represented by a particular identifier (e.g., prefix), which the allocator can check when an allocation is scheduled. Any ownership public keys that are revoked from this list can be represented by a different identifier (e.g., prefix) that was assigned to a previous owner through an OP_RETURN transaction at the time of revocation (e.g., when trading shares).

[0095] It has been assumed above that the allocator 302 is a trusted third party. In an alternative scenario, or as an additional security measure, a shared allocation secret key S A , P ATo protect the allocation of digital assets associated with each payment, they can be stored in an enclave in a trusted execution environment, e.g., Software Guard Extensions (SGX). All automated code defined in the allocator software also ensures that payments are securely stored in the allocator’s public key P. Pi Until it is assigned to A It may also be executed in a trusted execution environment to avoid compromising the

[0096] In summary, public keys can be used to indicate ownership of digital assets. During registration, each holder registers their individual ownership public key with, for example, the issuer or assigning party. The total number of public keys issued is equal to the total number of owners. The use of public, for example Elliptic Curve Cryptography (ECC) keys to indicate ownership of assets can be used for one or more of the following applications: · Safety features -ECC public keys are provably secure. Ownership of shares can be proven through digital signatures. Thus, using the underlying cryptosystem to indicate share ownership provides a smaller code base and reduces the attack surface. · Regulation -Enables regulatory compliance by capturing customer information submitted at the time of issuance of the public key. Public keys can be authenticated using a Certificate Authority. · Trackable Share -The organization / regulator and the holders themselves can identify the complete list of holders in the list of allocated shares using a set of unique public keys. This ensures transparency for both parties (e.g. company and shareholders) without revealing personal information or the identity of the holders.

[0097] The following describes examples using the above embodiments: Payment allocations can be used for distributed payments, coupons on bonds and treasury instruments, unit trust allocations, dispersing insolvency allocations, partnership allocations, and equitable distributions, monthly wage payments, loan repayments, and royalty payments, e.g., to artists from sales profits, among others.

[0098] A specific use case will now be described: An issuer (e.g., a company) Kangaroo Ltd uses a trusted third party to provide a token protocol on a blockchain. The protocol uses a request-response mechanism to generate smart contracts. Kangaroo Ltd wants to distribute shares in digital assets to shareholders. Below is a step-by-step outline of the procedure followed by the participants according to the embodiment described above. Below is listed the names of the parties involved in the exemplary allocation scheme, their roles, and all public-private key pairs they possess. · Alice -Shareholder-P O1 , P O1 · Bob -Publisher (e.g. Kangaroo)-P1 · Carol -Allocator-P A · Token Service (TS) -Smart Contract Provider -Smart Contract Address

[0099] To register ownership of shares in digital assets, 1. Alice sends a transaction to the smart contract address requesting a 1% share of Kangaroo Inc’s digital assets. 2. Bob sees Alice's shareholder request and accepts her request. 3. Alice transfers the amount of digital assets to Bob for the share. 4. Bob obtains Alice's own share ownership public key P O1 , then sends an OP_RETURN statement declaring the value of Alice's share that belongs to

[0100] To allocate shares of digital assets, 1. At the time the shares are to be allocated, Kangaroo will allocate the Digital Assets to A Transfer to. 2. Carol P A It retrieves the funds in and references the list of active ownership public keys in each OP_RETURN statement. Carol can obtain this information from a TS authenticated by Bob. 3. Carol is a Oi A set of public keys P Pi =P Oi +P A We assign a share to each paying public key defined by 4. Carol includes her private key S in the OP_RETURN transaction. A is issued on-chain. 5. Alice is now P Pi =P Oi +P A and the quarterly dividend payment can be obtained.

[0101] It will be understood that the above embodiments have been described by way of example only. More generally, there may be provided a method, apparatus or program according to any one or more of the following statements:

[0102] Statement 1: A computer-implemented method for generating at least one transaction associated with a blockchain, the at least one transaction for distributing an allocation of digital assets from an Allocating Party to one or more Recipients, the Allocating Party being associated with an allocation public key linked to the allocation, and each Recipient being associated with a respective ownership public key, the method comprising the steps of obtaining, for each of the one or more Recipients, (i) an ownership public key associated with a Recipient user, and (ii) a respective payment public key based on the allocation public key; and generating the at least one transaction, the at least one transaction including one or more output scripts, each output script configured to transfer a respective amount of the allocation to a respective payment address, the respective payment address being based on the respective payment public key.

[0103] For example, the payment address may be a payment public key. Alternatively, the payment address may be a P2PKH, i.e. a hash of a payment public key.

[0104] Statement 2: The method of Statement 1, comprising the step of causing the at least one transaction to be included in the blockchain.

[0105] For example, the above may include causing at least one transaction to be transmitted to one or more nodes of a blockchain network for inclusion in the blockchain.

[0106] Statement 3: The method of statement 2, wherein the assigned public key is paired with an assigned private key, and the method includes making the assigned private key available to the one or more recipients.

[0107] For example, the assigned private key may be published on-chain within the transaction (e.g., using a private key puzzle in a non-spendable transaction output or a payable output). Alternatively, the private key may be published off-chain and sent to the recipient, e.g., using a side channel.

[0108] Statement 4: A method of any of statements 1-3, wherein each ownership public key is associated with a respective weighting, and the method includes a step of obtaining, for each recipient, a respective weighting associated with the ownership public key, and each aggregate amount of the allocation transferred to a recipient is based on the obtained respective weighting.

[0109] Statement 5: Any of the methods of statements 1-4, wherein the blockchain includes a plurality of unpaid transaction outputs, each unpaid transaction output being linked to a respective unpayable transaction output including the ownership public key of a respective recipient, and the step of obtaining the respective ownership public keys includes a step of obtaining the respective ownership public keys from the unpaid transaction output linked to the respective unpaid transaction output.

[0110] Statement 6: The method of Statement 5 dependent on Statement 4, wherein each unpaid transaction output includes a respective representation of the weighting, and wherein obtaining the respective weighting includes, for each recipient, obtaining a respective weighting based on a respective representation in the unpaid transaction output linked to the respective unpaid transaction output including the recipient's ownership public key.

[0111] For example, the weighting may be obtained by scanning a number of unpaid transaction outputs for unpaid transaction outputs linked with registered ownership public keys.

[0112] Statement 7: The method of statement 6, wherein each representation of the weighting is a representative aggregate of the digital assets.

[0113] Statement 8: Any of the methods of statements 5-7, the method including a step of determining whether each of the one or more recipients' ownership public keys is an active ownership public key based on whether the respective ownership public key is linked to an unpaid transaction output, and the step of generating respective payment keys includes only generating respective payment keys for the active ownership public keys.

[0114] Statement 9: Any of the methods of statements 1-8, wherein the blockchain includes a plurality of transactions having non-payable transaction outputs, each non-payable transaction output including a respective recipient's ownership public key, and the step of obtaining the respective ownership public key includes obtaining the respective ownership public key from each non-payable transaction output.

[0115] Statement 10: The method of Statement 9 depending at least on Statement 4, wherein each non-spendable transaction output includes a representation of a weighting associated with the respective ownership public key, and wherein obtaining the respective weighting includes determining, for each recipient, the respective weighting based on the representation in the respective non-spendable transaction output.

[0116] STATEMENT 11: The method of STATEMENT 9 or STATEMENT 10, the method including identifying each non-payable transaction output based on a predetermined identifier included in the at least one non-payable transaction output.

[0117] Statement 12: The method of statement 11, comprising: for each recipient user, determining whether a respective ownership public key is an active ownership public key based on whether at least one non-payable transaction output including the respective ownership public key includes the predetermined identifier; and wherein generating a respective payment key comprises only generating a respective payment key for the active ownership public key.

[0118] Statement 13: Any of the methods of statements 4-12, the method including maintaining a record of the respective weightings of each recipient user and / or maintaining a record of the active ownership public keys.

[0119] Statement 14: The method of any of statements 1-13, wherein the at least one transaction is a single transaction, and the single transaction includes the one or more output scripts.

[0120] Statement 15: The method of any of statements 1-14, wherein one or more payment addresses are escrow payment addresses and the method includes a step of withholding a private key assignment from at least one of the one or more recipients until at least one condition is satisfied by the at least one recipient.

[0121] Statement 16: Any of the method of Statements 1-15, the method including the steps of generating an updated allocation public key; and for each of the one or more recipients, generating (iii) an ownership public key associated with the recipient, and (iv) an updated respective payment public key based on the updated allocation public key; and generating at least one transaction, the at least one transaction including one or more output scripts, each output script configured to transfer a respective amount of the allocation to a respective updated payment address of a respective recipient, the respective updated payment address being based on the respective updated payment public key.

[0122] Statement 17: The method of statement 16, the method including publishing an updated assigned private key that is paired with the updated assigned public key.

[0123] STATEMENT 18: Any of the methods of STATEMENTS 1-17, wherein the allocation is transferred from an issuing public key associated with an issuer to an allocation address based on the allocation public key using a transaction on the blockchain.

[0124] Statement 19: The method of statement 3 or any subsequent statement depending thereon, wherein the assigned private key is stored in a trusted execution environment and is accessible only by the assigning party after causing the at least one transaction to be included in the blockchain.

[0125] Statement 20: A computing device of the assigning party, comprising a memory including one or more memory units, and a processing device including one or more processing units, the memory storing code configured to be executed on the processing device, the code being configured, when executed on the processing device, to perform the method of any of statements 1-19.

[0126] Statement 21: A computer program embodied in a computer readable storage device configured to perform the method of any of statements 1-19 when executed on the allocating party's computing equipment.

[0127] Statement 22: A computer-implemented method for accessing an aggregate amount of digital assets, the aggregate amount of digital assets being transferred from an assignment public key of an assigning party to a payment address of a recipient using a transaction associated with a blockchain, the recipient being associated with an ownership public key, the method comprising: bringing about a first transaction including the ownership public key contained within the blockchain; obtaining an assignment private key paired with the assignment public key; and determining a payment address based on a payment public key, the payment public key being generated based on the ownership public key and the assignment public key; and using the assignment private key to determine a payment private key paired with the payment public key.

[0128] Statement 23: The method of statement 22, the method comprising generating a second transaction, the second transaction transferring the amount of digital assets from the payment address to a different address on the blockchain.

[0129] Statement 24: The method of statement 22 or statement 23, wherein the blockchain includes a third transaction having an unpaid transaction output, the unpaid transaction output including an amount of the digital assets linked to the ownership public key, and the method includes generating a fourth transaction transferring the amount of the digital assets linked to the ownership public key to a public key of a different party on the blockchain.

[0130] Statement 25: The method of statement 24, wherein the different parties are either (i) different recipients associated with different ownership public keys, or (ii) an issuer, and the allocation is transferred from an issuing public key associated with the issuer to the allocation public key of the allocating party using a transaction on the blockchain.

[0131] Statement 26: The recipient's computing equipment includes a memory including one or more memory units and a processing device including one or more processing units, the memory storing code configured to be executed on the processing device, the code being configured, when executed on the processing device, to perform any of the methods of statements 22-25.

[0132] Statement 27: A computer program embodied in a computer readable storage device configured to perform the method of any of statements 22-25 when executed on the allocating party's computing equipment.

[0133] According to aspects disclosed herein, a method may be provided that includes actions of a recipient, an allocating party, and an issuing party.

[0134] According to aspects disclosed herein, a system may be provided that includes computer devices of a recipient, an allocating party, and an issuing party.

[0135] Other variations or implementations of the disclosed technology may become apparent to those of ordinary skill in the art once the disclosure is set forth herein. The scope of the present disclosure is not limited by the described embodiments, but only by the appended claims.

Claims

1. 1. A computer-implemented method for generating at least one transaction associated with a blockchain, comprising: the at least one transaction is for distributing an aggregate amount related to an allocation of digital assets from an Allocating Party to one or more Recipients; the assigning party is associated with an assignment public key that is linked to the assignment; Each recipient is associated with a respective ownership public key, and The method comprises: obtaining a respective ownership public key of each of the one or more recipients; generating, for each of the one or more recipients, a respective payment public key based on (i) an ownership public key associated with the recipient user, and (ii) the assignment public key; generating the at least one transaction, the at least one transaction including one or more output scripts, each output script configured to transfer a respective amount associated with the allocation to a respective payment address, the respective payment addresses being based on the respective payment public key; A method comprising:

2. The method comprises: causing said at least one transaction to be included in said blockchain; The method of claim 1 , comprising:

3. The assigned public key is paired with an assigned private key; and The method comprises: making the assigned private key available to the one or more recipients; The method of claim 2 , comprising:

4. Each ownership public key is associated with a respective weighting, and The method comprises: obtaining, for each recipient, a respective weighting associated with an ownership public key, the respective amount of the allocation transferred to the recipient being based on the respective weighting; The method according to any one of claims 1 to 3, comprising:

5. the blockchain includes a plurality of unpaid transaction outputs; each unpaid transaction output is linked to a respective unpayable transaction output that includes the ownership public key of the respective recipient; and The step of obtaining each of the ownership public keys comprises: obtaining from each unpaid transaction output linked with said respective ownership public key; The method according to any one of claims 1 to 4, comprising:

6. each unpaid transaction output includes a respective representation of said weightings; and The step of obtaining the respective weights comprises: obtaining, for each Recipient, a respective weighting based on a respective representation in the unpaid transaction output linked with a respective unpaid transaction output that includes the Recipient's ownership public key; The method of claim 4 , comprising:

7. each representation of said weighting being a representative aggregate of said digital assets; The method according to claim 6.

8. The method comprises: determining whether the ownership public key of each of the one or more recipients is an active ownership public key based on whether the respective ownership public key is linked to an unpaid transaction output; the step of generating each disbursement key only includes generating each disbursement key for an active ownership public key; 8. The method according to any one of claims 5 to 7.

9. The blockchain includes a plurality of transactions having non-spendable transaction outputs, each non-spendable transaction output including a respective recipient's ownership public key; and the step of obtaining the respective ownership public keys comprises obtaining the respective ownership public keys from the respective non-spendable transaction outputs.

9. The method according to any one of claims 1 to 8.

10. Each non-spendable transaction output includes a representation of a weight associated with said respective ownership public key; and and obtaining the respective weightings includes determining, for each recipient, the respective weightings based on a representation in a respective non-spendable transaction output. The method according to claim 9 when dependent on claim 4.

11. The method comprises: identifying each non-payable transaction output based on a predetermined identifier included in the at least one non-payable transaction output; 11. The method according to claim 9 or 10.

12. determining, for each recipient user, whether a respective ownership public key is an active ownership public key based on whether at least one non-payable transaction output including the respective ownership public key includes the predetermined identifier; and the step of generating each disbursement key only includes generating each disbursement key for an active ownership public key; The method of claim 11.

13. The method comprises: (i) maintaining a record of said respective weightings for each recipient user; and / or (ii) determining whether each ownership public key of the one or more recipients is an active ownership public key based on whether the respective ownership public key is linked to an unpaid transaction output, wherein generating respective payment keys includes only generating respective payment keys for active ownership public keys; and maintaining a record of the active ownership public keys; The method of claim 4 , comprising:

14. the at least one transaction is a single transaction; the single transaction includes the one or more output scripts; 14. The method according to any one of claims 1 to 13.

15. One or more of the payment addresses is an escrow payment address, and The method comprises: withholding a private key assignment from at least one of said one or more recipients until at least one condition is satisfied by said at least one recipient; 15. The method of claim 1 , comprising:

16. The method comprises: generating an updated assigned public key; generating, for each of the one or more recipients, (iii) an ownership public key associated with the recipient, and (iv) an updated respective payment public key based on the updated assignment public key; generating at least one transaction; the at least one transaction includes one or more output scripts; each output script configured to transfer a respective amount of said allocation to a respective updated payment address of a respective recipient; the respective updated payment addresses being based on the respective updated payment public keys. Steps and 16. The method of claim 1 , comprising:

17. The method comprises: publishing an updated assigned private key paired with the updated assigned public key; 17. The method of claim 16, comprising:

18. the allocation is transferred from an issuing public key associated with an issuer to an allocation address based on the allocation public key using a transaction on the blockchain; 18. The method of any one of claims 1 to 17.

19. The assigned private key is stored in a trusted execution environment; and the assigned private key is accessible only by the assigning party after causing the at least one transaction to be included in the blockchain; The method according to claim 3.

20. a computer device of the allocating party, a memory including one or more memory units; a processing device including one or more processing units; the memory stores code configured to be executed on the processing unit; The code is configured, when executed on the processing device, to perform the method of any one of claims 1 to 19. Computer equipment.

21. 1. A computer program embodied in a computer readable storage device, comprising: configured to carry out the method according to any one of claims 1 to 19 when executed on a computing device of the allocating party; Computer program.

22. 1. A computer-implemented method for accessing an aggregate amount of digital assets, comprising: the amount of digital assets being transferred from the allocating party's assigned public key to the recipient's payment address using transactions associated with a blockchain; The recipient is associated with a public ownership key; The method comprises: providing a first transaction including the ownership public key contained within the blockchain; obtaining an assigned private key paired with the assigned public key; determining a payment address based on a payment public key, the payment public key being generated based on the ownership public key and the assignment public key; determining a payment private key paired with the payment public key using the assigned private key; A method comprising:

23. The method comprises: generating a second transaction, the second transaction transferring the amount of digital assets from the payment address to a different address on the blockchain; 23. The method of claim 22.

24. the blockchain includes a third transaction having an unpaid transaction output; the unpaid transaction output includes an amount of the digital asset linked to the ownership public key; and The method comprises: generating a fourth transaction to transfer the amount of the digital assets linked to the ownership public key to a public key of a different party to the blockchain; 24. The method of claim 22 or 23.

25. the different parties are either (i) different recipients associated with different ownership public keys, or (ii) issuers; the digital asset amount is transferred from an issuing public key associated with the issuer to the assigned public key of the assigning party using a transaction on the blockchain; 25. The method of claim 24.

26. a recipient's computing device, a memory including one or more memory units; a processing device including one or more processing units; the memory stores code configured to be executed on the processing unit; The code is configured, when executed on the processing device, to perform the method of any one of claims 22 to 25. Computer equipment.

27. 1. A computer program embodied in a computer readable storage device, comprising: configured to perform the method of any one of claims 22 to 25 when executed on the recipient's computing device; Computer program.

Images