An operating system for blockchain IoT devices

Abstract

To provide an operating system for blockchain IoT devices.SOLUTION: In an operating system 100 for blockchain IoT devices, a control agent 103 has an IP address and a public-private key cryptographic key pair associated with the IoT device. A BID control system 104 of an auto-feeder IoT device is a control component implemented by a software, monitors the state of a blockchain network, and / or transmits a blockchain transaction to the blockchain network.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention generally relates to distributed ledger (blockchain) technology. The present invention may be any blockchain-related technology, including (but not limited to) Bitcoin blockchain. Aspects of the present invention also relate to the Internet of Things (IoT). The present invention may be suitable for controlling IoT devices. [Background technology]

[0002] The term "blockchain" is used herein to include all forms of electronic, computer-based, distributed ledgers. These include consensus-based blockchain and transaction chain technologies, permissioned and unpermissioned ledgers, shared ledgers, side chains and alt chains, and variations thereof. The most widely known application of blockchain technology is the Bitcoin ledger, although other blockchain implementations have been proposed and developed. Although Bitcoin is referred to herein for convenience and illustrative purposes, it should be noted that the present invention is not limited to use with the Bitcoin blockchain, and alternative blockchain implementations and protocols are within the scope of the present invention. The term "user" may refer to a human or computer-based resource.

[0003] A blockchain is a peer-to-peer electronic ledger implemented as a computer-based decentralized distributed system composed of blocks. Blocks are in turn composed of transactions. Each transaction is a data structure that encodes the transfer of control of digital assets between participants in the blockchain system and contains at least one input and at least one output. Each block contains a hash of the previous block, and blocks are chained together to create a permanent, immutable record of all transactions written to the blockchain since its inception. Transactions contain small programs, known as scripts, embedded in their inputs and outputs. Scripts specify how and by whom the output of a transaction can be accessed. On the Bitcoin platform, these scripts are written using a scripting language based on the stack.

[0004] In order for a transaction to be written to the blockchain, it must be "validated". Network nodes (miners) perform work to ensure that each transaction is valid, and invalid transactions are rejected by the network. Software clients installed on nodes perform this validation work on unspent transactions (UTXOs) by running their own lock and unlock scripts. A transaction is valid if the execution of the lock and unlock scripts evaluates to true. Many commands in the scripting language return a Boolean value (e.g., OP-EQUAL). This makes it possible to build conditionals into blockchain transactions.

[0005] Blockchain technology is most widely known for its use in implementing cryptocurrencies. However, more recently, digital entrepreneurs have begun to explore the use of both the cryptocurrency security system on which Bitcoin is based, and the data that can be stored on the blockchain, to implement new systems. The present invention relates to one such new and novel use of blockchain technology.

[0006] In particular, the present invention relates to the use of blockchain to implement a simple yet efficient and powerful mechanism for generating a wide and diverse range of computer-implemented systems, which may include control units and control systems that automate and control processes and / or direct the operation of equipment.

[0007] Such devices may include IoT devices. IoT devices are equipped with electronic circuitry, software, sensors, network connectivity capabilities, etc., enabling them to communicate with other devices and systems, often via wireless means, and to perform desired tasks. In some instances, IoT devices may be very small and include only limited processing and storage capabilities. This presents a problem when the software required for the device's tasks is large and complex. Furthermore, the software and hardware required to provide IoT connectivity and intelligence is provided only in or within the device itself, making it more difficult and expensive to install, maintain, update, etc. Furthermore, recent excitement about the potential of IoT has been tempered by concerns about security.

[0008] A prior disclosure, “ADEPT: An IoT Practitioner Perspective” from January 2015, discloses techniques for integrating blockchain technology into IoT devices. At the time of filing, it was retrieved from [https: / / ia902601.us.archive.org / 4 / items / pdfy-esMcC00dKmdo53- / IBM%20ADEPT%20Practictioner%20Perspective%20-%20Pre%20Publication%20Draft%20-%207%20Jan%202015.pdf]. This disclosure (hereinafter “ADEPT”) describes a washing machine that is contract-managed and communicates with a retailer via blockchain to purchase refills when a “low detergent” condition is met.

[0009] However, while ADEPT discloses how an IoT system operates relative to a blockchain, it does not address the issue of how such a system might be deployed, configured, or technologically impacted with a blockchain. In other words, ADEPT describes how software on an IoT device might autonomously interact with a blockchain, but does not discuss or disclose how to get the software on a device in the first place, or even how to secondarily modify the operation of the device during use / operation / deployment.

[0010] It would therefore be advantageous to have an operating system that is generic (i.e., not device specific) but small enough to be loaded onto any device while retaining strong cybersecurity. Desirably, such an operating system would provide dynamic functionality of the device, rather than fixed functionality. In other words, it would be a significant technical advantage to be able to change the configuration, settings and functionality of the device in an easy, efficient and dynamic way. Such a technical solution is not solved by prior art such as ADEPT. A further advantage over known prior art is the ability to enable easy, secure and robust control functions, including the possibility to process payments for services provided by the device. The present invention solves these and other objectives by interfacing the IoT with a blockchain protocol, such as the Bitcoin protocol.

[0011] Thus, in accordance with the present invention there is provided a system and method as defined in the accompanying claims. Summary of the Invention [Problem to be solved by the invention]

[0012] The present invention may provide computer-implemented systems and methods. The present invention may be described as a control method since it controls, directs, and / or influences the activity of one or more devices. The present invention may be described as an operating system. The present invention may be implemented in software.

[0013] The present invention may comprise an operating system that coordinates, controls, and / or influences the activity of at least one device. The operating system may be general purpose in the sense that it is independent of the device it controls.

[0014] The invention may be implemented using a blockchain platform with which an operating system ("control component") is configured to interact. The blockchain may be the Bitcoin blockchain. In a preferred embodiment, the device is an Internet of Things (IoT) device.

[0015] The present invention may provide a computer-implemented control system for controlling an apparatus, the system comprising an apparatus configured for wireless communication with a network and having an IP address and a public-private cryptographic key pair associated with the apparatus, a software-implemented control component configured to monitor a state of a blockchain network and / or to transmit blockchain transactions to the blockchain network, and / or a set of instructions configured for execution by the control component to control the functionality of the apparatus.

[0016] The control component may be configured to access the instruction set from a memory location that is separate from the device, or "ex-device."

[0017] The control component may be configured to receive an input signal from an input source, which may be a further device and / or a computer-based resource or agent, which may be substantially as described below.

[0018] The instruction set may be stored in a distributed hash table (DHT) and accessed for download and installation by the control component from the DHT. The advantage of this is that it provides the ability to change the instructions (and therefore the functionality of the device).

[0019] The location of the DHT may be indicated or provided using metadata provided in the blockchain transaction. The advantage of this is that the location of the instruction is immutably recorded in the blockchain, thus providing a permanent and tamper-resistant record, and the location is verifiable by any party with access to the blockchain, thus improving security and verification.

[0020] The instruction set may be accessed by the control component using a lookup key that is associated with a cryptographic key pair.

[0021] The control component may be located on or within the device, or the control component may be located at a location external to the device and configured to wirelessly communicate with the device.

[0022] The control component may be configured to perform cryptographic calculations, access its associated private / public key pair, have an associated Bitcoin or other blockchain related address, operate the device via an API, and perform secret sharing protocol operations, which may be substantially in accordance with the secret sharing protocol as described below.

[0023] The control component may be configured to affect or control activity of the device based on detection of a valid blockchain transaction.

[0024] The present invention may provide a system and / or method substantially as described below.

[0025] The invention may provide a computer-implemented control method configured to control a device or devices, the method may comprise the steps of providing a device configured to (wirelessly) communicate with a network and having an IP address and a public-private cryptographic key pair associated with the device, providing a software-implemented control component configured to monitor a state of a blockchain network and / or to send blockchain transactions to the blockchain network, and providing a set of instructions configured for execution by the control component to control the functionality of the device.

[0026] The control component may be configured to access the instruction set from a memory location separate from the device. The control component may be configured to receive an input signal from an input source, which may be a further device and / or a computer-based resource or agent.

[0027] The instruction set may be stored in a distributed hash table (DHT) and accessed for download and installation by the control component from the DHT.

[0028] The location of the DHT may be indicated or provided using metadata provided in a blockchain transaction, and the instruction set may be accessed by the control component using a lookup key associated with a cryptographic key pair.

[0029] The control component may be located on or within the device, or the control component may be located at a location external to the device and configured to wirelessly communicate with the device.

[0030] The control component may be configured to perform cryptographic calculations, access its associated private / public key pair, have an associated Bitcoin or other blockchain related address, operate devices via APIs, and perform secret sharing protocol operations.

[0031] The control component may be configured to affect or control activity of the device based on detection of a valid blockchain transaction.

[0032] Any feature described with respect to one embodiment or aspect of the invention may apply to any other feature or embodiment of the invention, for example any feature mentioned in relation to a system may apply to a method and vice versa.

[0033] These and other aspects of the invention will be apparent from and will be taught with reference to the embodiments described hereinafter, by way of example only, and with reference to the accompanying drawings, in which: [Brief description of the drawings]

[0034] [Figure 1] 1 illustrates a system configured in accordance with an embodiment of the present invention and for an illustrative use case. [Diagram 2] 2 shows a truth table for the control system of FIG. 1. [Diagram 3] 2 shows the steps of processing an unlock transaction for the example of FIG. 1. [Figure 4] We present techniques that can be used to share secrets and generate public or private keys. [Diagram 5] We present techniques that can be used to share secrets and generate public or private keys. [Figure 6] We present techniques that can be used to share secrets and generate public or private keys. [Figure 7] We present techniques that can be used to share secrets and generate public or private keys. [Figure 8] We present techniques that can be used to share secrets and generate public or private keys. [Figure 9]Figures 9-11 show one implementation in which the locking script of a blockchain transaction is used to implement the functionality of a logic gate. Figure 9 shows an overview of the technique in which two Boolean inputs A and B are evaluated within the locking script of a first transaction to produce a Boolean output X. [Figure 10] 1 illustrates an outline of a technique for implementing a logic gate using first and second blockchain transactions. [Figure 11] 1 illustrates how a blockchain transaction's locking script is used to implement the functionality of a logic gate. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0035] The present invention offers the following advantages in particular: The present invention provides an operating system that is intentionally "thin" (small in terms of memory and / or processing requirements) and therefore can be implemented in any IoT device. Because device-specific functionality is not hard-coded within the device, rather than loaded from a secure repository such as a Distributed Hash Table (DHT), it can be easily "upgraded." This is a significant technical improvement over prior art that does not allow for dynamic configuration. · It can be controlled and managed by an autonomous computing agent (or software that resides on or outside the IoT device). When interfacing with the blockchain, for example the Bitcoin platform, it allows for the integration of payment processing functions. Based on blockchain cryptography, similar to Bitcoin ECC, it provides robust security.

[0036] A Blockchain IOT Device (BIT) is a computing agent configured to execute predefined instructions that are securely stored off-BID and accessed by cryptographic keys. "Off-BID" means that the instructions are not provided within the BID itself, but are stored elsewhere and accessed as and when needed. These instructions are selected and configured to perform a selected task or tasks. When executed, the instructions can control and affect the operation of the IoT device. In a preferred embodiment, the BID resides on the IoT itself, meaning that the BID is installed in a memory located within or on the IoT device. However, in other embodiments, the BID may be off-BID and have an Internet connection to the device.

[0037] An IoT device has its own encryption keys (and IP address) and can therefore securely communicate and interact with other devices or DHTs etc. Its "operating system" is a simple general-purpose system, with some built-in functionality for (at least but not limited to) the following: ·Cryptographic calculation, Reading instructions from an external source (such as DHT), Performing simple actions, like a toggle switch (i.e., as on a physical IoT device).

[0038] Thus, IoT devices or their associated BIDs do not contain their own built-in instructions and do not "know" what they do or how to do it. The BID only contains a mechanism to securely retrieve instructions from elsewhere. The BID can only perform a simple set of operations (the following are for illustration only and not limitation): Access to your own master private and public key pair, as well as your own (derivable) BTC address. The ability to send data to and receive data from an IP address. · Secret sharing protocol computations (described below). In a preferred embodiment, these are implemented in machine code. · Search and interpret blockchain events. · Actuation and control of the attached physical device (through a standard API which is basically just a set of switches).

[0039] BID incoming and outgoing communications are encrypted using a security mechanism described below. This allows keys to be generated using a shared secret. This allows: (i) Greater security from "hacking". (ii) A simple generic software upgrade protocol. (iii) Apparatus agnosticism.

[0040] The present invention therefore provides a general purpose operating system that can be used in any IoT device: the device itself is not programmed, all programs are stored separately and loaded into the device at configuration time (or, in some embodiments, at run time).

[0041] <Examples of use of the present invention> The following illustrative example relates to the use of an embodiment of the present invention for the control of an auto-feeder IoT device. This is provided for illustrative purposes only, as an example of how an implementation of the present invention may be used.

[0042] 1, the system 100 includes first and second client devices, numbered as 102a and 102b, respectively, and a BID control system 104 operative to receive input from and transmit information to the first and second client devices 102a, 102b. In this exemplary use case, the first and second client devices 102a, 102b are radio frequency identification devices (RFID) detectable by the BID control system 104. The control system 104 is operative to use the blockchain and to transmit output to the blockchain.

[0043] How the control system 104 works is explained using an example of two dogs named Archimedes (A) and Bertrand (B) by Carol. The two dogs are left alone in the backyard all day and both get along well with each other if they do not eat at the same time. Eating at the same time makes them aggressive and fight each other for some reason. Both A and B have identifiable RFID collars, namely a first RFID collar 102a and a second RFID collar 102b, that can be detected by an Internet Of Things (IoT) device 101. The IoT device is an auto-feeder that distributes a specified amount of food to be consumed by one dog. In other words, the BID control system 104 controls the operation of the IoT feeding device.

[0044] In this example, the BID 104 is a software resource or component provided on the IoT autofeeder and interfaces with the feeder to control the functionality of the feeder.

[0045] The BID starts its life by downloading and installing its instructions from the DHT. It does not need to do this again until these instructions are changed. This may be, for example, when the BID needs to be upgraded, or when the operation of the BID should be completely changed, for example when the BID's instruction set can be changed to detect more than two RFID signals.

[0046] The control agent uses the values ​​sent by the BID to generate blockchain transactions and shares a new secret with the BID after each iteration, as described further below.

[0047] The functionality of the BID control system 104 is implemented using blockchain transactions that are locked using the following lock script:

[0048] OP_HASH160 <unlockingscripthash>OP_EQUAL Transactions are generated to provide an instruction set (via metadata that links to a distributed hash table (DHT)) for controlling IoT auto-feeder devices, and may contain instructions to established computational resources as described below. Rather than storing the instructions within the transaction itself, the metadata may contain pointers or references to where the instructions can be accessed. Thus, the instructions may be kept "off-block".

[0049] Not only does the blockchain provide a mechanism for controlling activity, it also records information about events that have taken place. For example, the blockchain provides the ability to count the number of feedings, what time the feedings occurred, which dogs ate, if the maximum food allotment was distributed, etc. The blockchain also provides cryptographic security.

[0050] An important function of the transaction is to ensure that food is dispensed only if one dog is present in the feeder at a time. Therefore, some condition needs to be built into the transaction's script. This is achieved by the truth table shown in Figure 2, and by the XOR function, see Figures 9-11. If neither A nor B is present in the feeder, no food is dispensed. If A is present in the feeder but B is not, distribute food. If B is present in the feeder but A is not, distribute food. If both A and B are present in the feeder, no food will be dispensed.

[0051] When A or B is present at the feeder, an RFID signal is sent from the respective client device, i.e. the first RFID collar 102a or the second RFID collar 102b, to the auto-feeder's control system 104 to unlock the dog's secure current puzzle solution (which is securely replaced by a new puzzle solution after each iteration). Alternatively, if A or B is not present at the feeder, a random number is sent from the respective RFID collar to the feeder. In other words, a dog is "present at the feeder" meaning that its RFID collar is within the detectable range of the feeder. In this case, the associated puzzle is unlocked for transmission. If not present, the default value is a random number.

[0052] As is conventionally known, a puzzle solution is data that, when hashed, results in a value that matches when compared to a stored value in a (Bitcoin) script. Briefly, the process is as follows: A secret value (the "solution") is hashed and stored in the lock script for later comparison. To unlock the lock script, the secret is presented to the script by the unlocker (Redeem). The presented value is hashed and then compared to the stored hash. If the comparison determines that they are equal, the result of the comparison is "true". In effect, the stored value is a DOUBLE-hash of the secret, and the presented value is a SINGLE-hash of the secret. This allows secrets of any length to be shortened to a standard, manageable size (i.e. always 160 bits long) as input to the script.

[0053] The Auto Feeder BID executes its instructions retrieved from the DHT using a lookup key associated with the BID's key / pair. The Control Agent manages the data flow to / from the BID (i.e. data related to RFID signals but not related to the BID's instruction set). Thus, the Auto Feeder BID monitors its state. The Auto Feeder BID stores two secret values ​​(S1 and S2) received from a separate Control Agent 103, which may be a suitably programmed computational resource configured to oversee the feeding process. The secret values ​​S1 and S2 are used conditionally when the dog's RFID collar is detected within range. Based on its instructions retrieved from the appropriate DHT, upon detecting an RFID within range (along with other conditions related to time of day, number of previous feedings, other restrictions, etc.), it sends a signal to the Generic Agent acting as its Control Agent (described below). The signal includes: If Archimedes' RFID is detected, S1 (=Puzzle A solution); otherwise, a random number. If Bertrand's RFID is detected, S2 (=Puzzle B solution); otherwise, a random number.

[0054] The Auto Feeder BID then does the following: · The Autofeeder checks for a valid transaction on the network (which may or may not have been published on a block, but must be a valid transaction). This transaction is generated and broadcast by the control agent. If the transaction passes the embedded XOR test, it is valid. If it does not, it is invalid and will not be propagated beyond the first hop on the network. Thus, it will not be detected by the BID. Alternatively, if the BID is the first hop and therefore the transaction is detected, then part of the BID's function (with respect to any other node) will validate the transaction. Thus, it can detect if the transaction is valid before taking any resulting action. A valid transaction also ensures that the necessary, i.e. information about the feeding event, is stored and recorded in the blockchain. If the answer above is true, the BID executes its conditional command. In this example, the BID dispenses some food. · It receives a transmission from the control agent 103, allowing it to share two secrets (S1 and S2 as described below) and internally updates these secret values ​​in preparation for the next iteration.

[0055] The locking script for a Bitcoin transaction is given by: OP_HASH160 <puzzle-a>OP_EQUALOP_SWAP OP_HASH160 <puzzle-b>OP_EQUAL OP_NUMEQUALOP_NOTOP_VERIFY OP_1metadata1PubK-CarolOP_2OP_CHECKMULTSIG Here, Puzzle A is the equivalent result of OP_HASH160 (Puzzle A solution). Puzzle B is the equivalent result of OP_HASH160 (Puzzle B solution). Metadata1 contains references to the encoded instructions stored in the DHT. PubK-Carol is Carol's public key.

[0056] Note that the programming of the agent may be hard-coded, or it may read its instructions from the DHT.

[0057] The encoded instructions may be stored and accessed according to the procedures described below that reference the transactions from the blockchain transaction using metadata.

[0058] Carol's public key may be kept securely or may be regenerated using the processes described below.

[0059] To unlock the blockchain transactions for the above explanation, the following script is needed: Sig-CarolPuzzle-B-solutionPuzzle-A-Solution <unlockingscript> Please refer to FIG. 3 for an explanation of the following steps.

[0060] In step S300, the control system 104 operates to hash the submitted puzzle A solution and compare it to the stored version of puzzle A retrieved from storage (this version is a hash of the solution). The stored version of puzzle A may be stored in storage local to the control system 104, or in any other suitable storage medium. If they are equal, then top of stack=1. If they are different, then top of stack=0.

[0061] In step S302, the top of the stack is then swapped with the second item in the stack, which is the puzzle B solution. This is hashed and compared to the stored version of puzzle B read from storage, again pushing a 1 or 0 to the top of the stack, similar to the result from S300. The stored version of puzzle B may be stored in storage local to control system 104, or in any other suitable storage medium.

[0062] Here, the top two stack items are either 0 or 1. In step S304, OP_NUMEQUAL returns 1 if the numbers are equal, otherwise it returns 0. This is the exact opposite of the XOR truth table.

[0063] In step S306, OP_NOT flips the top item on the stack to generate the desired XOR result.

[0064] In step S308, OP_VERIFY checks whether the item at the top of the stack is 1, and if not, i.e., the XOR operation fails, the transaction is immediately marked as invalid since more than one input from the first and second client devices returned a matching puzzle solution. As a result, no food is dispensed from the IoT dispenser since there is more than one dog in the IoT dispenser. Thus, the output of the control system 104 is controlled by the execution of the underlying Bitcoin transaction.

[0065] If OP_VERIFY returns 1, processing in the control system 104 returns to the multisig of the script, where the presence of Carol's signature is checked in step S310.

[0066] The stack operations performed by the control system 104 when analyzing the unlock script are shown below: First, the control system 104 hashes the unlock script using OP_EQUAL to compare the hash with the hash of the unlock script. After this, the unlock script is executed.

[0067] [Table 1-1] [Table 1-2] <Generate a key using the shared secret> Keys may be kept securely or regenerated, and in the case of private keys that may be used to derive public keys, the private keys may be stored in fragments.

[0068] A user, say Alice or Bob, may hold one part of their private key, a service provider may hold a second part, and a third part may be held at a remote secure site. The private key may be reconstructed using any two of the three parts, or, more generally, the private key may be reconstructed using any m of the n parts.

[0069] If the private key is reconfigurable, it can be used to regenerate the public key at the point of use, and the private and public keys can again be discarded after use.

[0070] The separation of the private keys may be achieved using Shamir's Secret Sharing Scheme: a private-public key pair can be deterministically derived from a master key using the following method: This method allows secret values ​​to be shared by participants without transmitting them.

[0071] The system may generate participants' public keys using the subkey generation method described below.

[0072] 4 shows a system 1 including a first node 3 in communication with a second node 7 via a communications network 5. The first node 3 has an associated first processing device 23, and the second node 5 has an associated second processing device 27. The first and second nodes 3, 7 may include electronic devices such as computers, phones, tablet computers, mobile communications devices, computer servers, etc. In one example, the first node 3 may be a client (user) device and the second node 7 may be a server. The server may be a server of a digital wallet provider.

[0073] The first node 3 uses the first node master private key (V 1C ) and the first node master public key (P 1C ) The second node (7) is associated with a first asymmetric crypto pair having a second node master private key (V 1S ) and the second node master public key (P 1S ) In other words, the first and second nodes each possess an individual public-private key pair.

[0074] The first and second asymmetric cryptographic pairs of each first and second node 3, 7 may be generated during a registration process, such as registering a wallet. The public key of each node may be publicly shared across the communications network 5.

[0075] To determine a common secret (SC) in both the first node 3 and the second node 7, the nodes 3, 7 perform the steps of methods 300, 400 respectively, without communicating a secret key over the communications network 5.

[0076] The method 300 performed by the first node 3 includes obtaining at least the first node master private key (V 1C ) and the Generator Value (GV), the first node 2nd private key (V 2C The method 300 includes determining 330 a generator value (M) based on a message (M) shared between the first node and the second node, which may include sharing the message over the communication network 5, as described in more detail below. The method 300 includes determining 330 a generator value (M) based on a message (M) shared between the first node and the second node, which may include sharing the message over the communication network 5, as described in more detail below. 1S ) and the Generator Value (GV), the second node 2S The method 300 further includes determining 370 the first node second private key (V 2C ) and the second node second public key (P 2S ) to determine 380 a common secret (CS).

[0077] Importantly, the same common secret (CS) can also be determined at the second node 7 by the method 400. The method 400 determines the first node master public key (P 1C ) and the Generator Value (GV), the first node derives a second public key (P 2C ). The method 400 includes a step 430 of determining the second node master private key (V 1S ) and the Generator Value (GV), the second node 2S The method 400 further includes determining 470 a second node second private key (V 2S ) and the first node second public key (P 2C ) to determine 480 a common secret (CS).

[0078] The communications network 5 may include a local area network, a wide area network, a cellular network, a wireless communications network, the Internet, etc. In these networks, data may be transmitted over communications media such as electrical wires, optical fibers, or radio waves and may be susceptible to eavesdropping, such as by an eavesdropper 11. The methods 300, 400 enable the first node 3 and the second node 7 to both independently determine the common secret without transmitting the common secret over the communications network 5.

[0079] Thus, one advantage is that the common secret (CS) can be determined securely and independently by each node, without the need to transmit the private key over a potentially insecure communications network 5. The common secret may also be used as (or as the basis for) the private key.

[0080] The methods 300, 400 may include additional steps. See Fig. 8. The method 300 includes, at the first node 3, transmitting a message (M) and a first node second private key (V 2C ) to generate a signed message (SM1). The method 300 may further include a step 360 of transmitting the first signed message (SM1) to the second node 7 via the communication network. Meanwhile, the second node 7 may perform a step 440 of receiving the first signed message (SM1). The method 400 may further include a step 440 of transmitting the first signed message (SM2) to the second node 7 via the communication network. 2C ) and a step 460 of authenticating the first node 3 based on the result of the step of verifying the first signed message (SM1). Advantageously, this enables the second node 7 to authenticate that the intended first node (where the first signed message was generated) is the first node 3. This is because only the first node 3 knows the first node master private key (V 1C ), therefore, only the first node 3 has access to the first node second private key (V 2C ) can be determined. It should be appreciated that similarly, a second signed message (SM2) can be generated at the second node 7 and sent to the first node 3. Thus, as in a peer-to-peer scenario, the first node 3 can authenticate the second node 7.

[0081] The sharing of a message (M) between the first node and the second node may be accomplished in various ways. In one example, a message may be generated at the first node 3 and then transmitted to the second node 7 over the communication network 5. Alternatively, a message may be generated at the second node 7 and then transmitted to the first node 3 over the communication network 5. In some examples, the message (M) may be public and therefore transmitted over the insecure network 5. One or more messages (M) may be stored in a data store 13, 17, 19. One skilled in the art will appreciate that the sharing of a message may be accomplished in various ways.

[0082] Advantageously, a record that allows recreation of the common secret (CS) can be kept without the record itself having to be stored in secret or transmitted securely.

[0083] <How to register 100, 200> An example of a registration method 100, 200 will now be described with reference to Figure 6, where the method 100 is performed by a first node 3 and the method 200 is performed by a second node 7. This includes establishing first and second asymmetric cryptographic pairs for the first node 3 and the second node 7, respectively.

[0084] An asymmetric cryptopair includes an associated private key and a public key, such as those used in public key cryptography, in this example, the asymmetric cryptopair is generated using the properties of Elliptic Curve Cryptography (ECC) and elliptic curve arithmetic.

[0085] In the methods 100, 200, this involves a first node and a second node agreeing 110, 210 on a common ECC system and using a base point (G) (Note: the base point may be referred to as a common generator, but the term "base point" is used to avoid confusion with the generator value GV). In one example, the common ECC system may be based on secp256K1, which is the ECC system used by Bitcoin. The base point (G) may be selected, randomly generated, or assigned.

[0086] Considering now the first node 3, the method 100 includes resolving 110 the common ECC system and base point (G). This may include receiving the common ECC system and base point from the second node 7 or the third node 9. Alternatively, a user interface 15 is associated with the first node 3, which allows a user to selectively provide the common ECC system and / or base point (G). In yet another alternative, one or both of the common ECC system and / or base point (G) may be randomly selected by the first node 3. The first node 3 may send a notification to the second node 7 over the communication network 5 indicating the use of the common ECC system with the base point (G), which may then resolve 210 by sending a notification indicating an acknowledgment to the use of the common ECC system and base point (G).

[0087] The method 100 includes a step of: 1C ) and the first node master public key (P 1C ), based at least in part on random integers within a specified range of tolerances in the common ECC system, 1C ), which generates the first node master private key (V 1C ) and the base point (G) based on the elliptic curve point multiplication, the first node master public key (P 1C ) P 1C =V 1C ×G (formula 1) Thus, the first asymmetric crypto-pair comprises: V 1C : The first node master private key, which is kept secret by the first node. P 1C : The first node master public key that will be made public.

[0088] The first node 3 uses the first node master private key (V 1C ) and the first node master public key (P 1C ) may be stored in a first data store 13 associated with the first node 3. For security purposes, the first node master private key (V 1C ) may be stored in a secure part of the first data store 13 to ensure that the key remains secret.

[0089] The method 100 includes, as shown in FIG. 6, generating a first node master public key (P 1C ) to the second node 7 via the communication network 5. The second node 7 transmits the first node master public key (P 1C ) is received 220, the first node master public key (P 1C ) may be stored 230 in a second data store 17 associated with the second node 7.

[0090] Similar to the first node 3, the method 200 of the second node 7 includes the step of determining the second node master private key (V 1S ) and the second node master public key (P 1S ) and generating 240 a second asymmetric cryptopair having a second node master private key (V 1S ) is also a random integer within the allowed range. The second node master public key (P 1S ) is determined by the following formula: P 1S =V 1S ×G (formula 2) Thus, the second asymmetric crypto-pair comprises: V 1S : The second node master private key, which is kept secret by the second node. P 1S : The second node master public key, which will be made publicly available.

[0091] The second node 7 may store the second asymmetric cryptographic pair in the second data store 17. The method 200 may further include storing the second node master public key (P 1S ) to the first node 3. The first node 3 also transmits the second node master public key (P 1S ) Receive 140, store 150.

[0092] It should be appreciated that in some alternatives, each public master key may be received and stored in a third data store 19 associated with a third node 9 (such as a trusted third party). This may include a third party acting as a public directory, such as a certification authority. Thus, in some examples, the first node master public key (P 1C ) may be requested and received by the second node 7 only when a common secret (CS) is requested, and vice versa.

[0093] The registration step only needs to occur once as an initial setup.

[0094] <Session start and determination of shared secret by first node 3> One example of determining the common secret (CS) is described herein with reference to Figure 7. The common secret (CS) may be used for a particular session, time, transaction, or other purpose between the first node 3 and the second node 7, and it may not be desirable or secure to use the same common secret (CS) and therefore the common secret (CS) may be changed between different sessions, times, transactions, etc.

[0095] The following is provided for illustration of the above mentioned secure transmission techniques.

[0096] [Generate message (M) 310] In this example, the method 300 performed by the first node 3 includes a step 310 of generating a message (M). The message (M) may be random, pseudorandom, or user defined. In one example, the message (M) is based on Unix time or a nonce (as well as any value). For example, the message (M) may be given as: Message (M) = Unix time + nonce (Equation 3) In some examples, the message (M) is arbitrary. However, it should be understood that the message (M) may have optional values ​​(such as Unix time, etc.) that may be useful in some applications.

[0097] The method 300 includes a step 315 of sending the message (M) to the second node 7 via the communication network 3. Since the message (M) does not contain information about the private key, the message (M) may be sent over an insecure network.

[0098] [320 Determine Generator Value (GV)] The method 300 further includes determining 320 a Generator Value (GV) based on the message (M). In this example, this includes determining a cryptographic hash of the message. An example of a cryptographic hash algorithm includes SHA-256 to generate a 256-bit Generator Value (GV), i.e. GV = SHA-256(M) (Equation 4) It should be understood that other hash algorithms may be used. This may include other hash algorithms in the Secure Hash Algorithm (SHA) family. Some specific examples include instances in the SHA-3 subset, including SHA3-224, SHA3-256, SHA3-384, SHA3-512, SHAKE128, and SHAKE256. Other hash algorithms may include algorithms in the RACE Integrity Primitives Evaluation Message Digest (RIPEMD) family. A specific example may include RIPEMD-160. Other hash functions may include families based on the Zemor-Tillich hash function and the Knapsack hash function.

[0099] [First node determines second private key 330] The method 300 then determines the second node master private key (V 1C ) and the generator value (GV), the first node second private key (V 2C This involves determining 330 the first node master private key (V 1C ) and a generator value (GV). V 2C =V 1C +GV (formula 5) Therefore, the first node's second private key (V 2C ) is not a random value, but is instead deterministically derived from the first node master private key. The corresponding public key in the cryptographic pair, i.e., the first node second public key (P 2C ) have the following relationship: P 2C =V 2C ×G (Formula 6) From equation 5 to equation 6, V 2C Substituting, we get the following equation: P 2C =(V 1C +GV)×G(Formula 7) Here, the “+” operator represents elliptic curve point addition. Elliptic curve cryptography algebra is distributive, and Equation 7 can be expressed as follows: P 2C =V 1C ×G+GV×G (Formula 8) Finally, (Equation 1) is substituted into (Equation 7) to obtain the following equation: P 2C =P 1C +GV×G (Formula 9.1) P 2C =P 1C + SHA-256(M) × G (Equation 9.2) Therefore, the corresponding first node second public key (P 2C ) is the first node master public key (P 1C ) and derivable given knowledge of the message (M). As described in more detail below with respect to method 400, the second node 7 may receive the first node second public key (P 2C With such knowledge, it is possible to independently determine

[0100] [Generate 350 a first signed message (SM1) based on the message and the first node's second private key] The method 300 includes receiving a message (M) and a determined first node second private key (V 2C ) to generate 350 a first signed message (SM1). The step of generating a signed message includes applying a digital signature algorithm to digitally sign the message (M). In one example, this includes applying a first node second private key (V) to the message in an Elliptic Curve Digital Signature Algorithm (ECDSA) to obtain the first signed message (SM1). 2C Examples of ECDSA include those based on ECC systems having secp256k1, secp256r1, secp384r1, se3cp521r1.

[0101] The first signed message (SM1) is sent to the second node 7 using the corresponding first node second public key (P 2C ) This verification of the first signed message (SM1) may be used by the second node 7 to authenticate the first node 3, which is discussed below in method 400.

[0102] [Second node determines second public key 370'] The first node 3 then transmits the second node second public key (P 2S ) may be determined 370. As described above, the second node second public key (P 2S ) contains at least the second node master public key (P 1S ) and a generator value (GV). In this example, the public key is determined as a private key by elliptic curve point multiplication with the base point (G) 370, so that the second node's second public key (P 2S ) can be expressed similarly to Equation 6 as follows: P 2S =V 2S ×G (Formula 10.1) P 2S =P 1S +GV×G (Formula 10.2) The mathematical proof of Equation 10.2 is as follows: 2C ) is the same as that described above to derive equation 9.1 for . It should be understood that the first node 3 can determine 370 the second node second public key independently of the second node 7.

[0103] [380 Determine the common secret at the first node 3] The first node 3 then transmits the first node second private key (V 2C ) and the second node second public key (P 2S ) a common secret (CS) may be determined 380 by the first node 3 according to the following formula: S=V 2C ×P 2S (Formula 11) <Method 400 performed in second node 7> A corresponding method 400 performed in the second node 7 will now be described. It should be understood that some of these steps are similar to the steps performed by the first node 3 described above.

[0104] The method 400 includes a step 410 of receiving a message (M) from the first node 3 via the communications network 5. This may include the message (M) sent by the first node 3 in step 315. The second node 7 then determines 420 a generator value (GV) based on the message (M). The step 420 of determining a generator value (GV) by the second node 7 is similar to the step 320 performed by the first node 3 described above. In this example, the second node 7 performs this determining step 420 independent of the first node 3.

[0105] The next step is to generate the first node master public key (P 1C ) and the generator value (GV), the first node second public key (P 2C In this example, the public key is determined as a private key by elliptic curve point multiplication with the base point (G) 430′, so that the first node second public key (P 2C ) can be expressed similarly to Equation 9 as follows: P 2C =V 2C ×G (Equation 12.1) P 2C =P 1C +GV×G (Formula 12.2) The mathematical proofs of Equations 12.1 and 12.2 are the same as those given above for Equations 10.1 and 10.2.

[0106] [Second node 7 authenticates first node 3] The method 400 may include steps performed by the second node 7 to authenticate the unconfirmed first node 3 as the first node 3. As mentioned above, this includes step 440 of receiving the first signed message (SM1) from the first node 3. The second node 7 then receives the first node second public key (P 2C ) may verify 450 the signature of the first signed message (SM1).

[0107] The verification of the digital signature may be performed according to the Elliptic Curve Digital Signature Algorithm (ECDSA) described above. Importantly, the first node's second private key (V 2C The first signed message (SM1) signed by V 2C and P 2C form a cryptographic pair, the corresponding first node second public key (P 2C ) should be correctly verified. These keys are generated by the first node master private key (V 1C ) and the first node master public key (P 1C ), verification of the first signed message (SM1) can be used as a basis for authenticating that the unconfirmed first node sending the first signed message (SM1) is the same first node 3 being registered. Therefore, the second node 7 may further perform a step (460) of authenticating the first node 3 based on the result of the step of verifying the first signed message (450).

[0108] [Second node 7 determines the shared secret] The method 400 includes a step of: 1S ) and the generator value (GV), the second node second private key (V 2S ) in a manner similar to step 330 performed by the first node 3. 2S ) is calculated by the following formula: 1S ) and a generator value (GV). V 2S =V 1S +GV (Equation 13.1) V 2S =V 1S +SHA-256(M) (Formula 13.2) The second node 7 then derives the second node second private key (V 2S ) and the first node second public key (P 2C ) based on which a common secret (CS) may be determined480. S=V 2S ×P 2C (Formula 14) [Certification of the common secret (CS) determined by the first node 3 and the second node 7] The common secret (CS) determined by the first node 3 is the same as the common secret (CS) determined at the second node 7. A mathematical proof that Equation 11 and Equation 14 provide the same common secret (CS) is now described.

[0109] Given the common secret (CS) determined by the first node 3, Equation 10.1 can be substituted into Equation 11 as follows: S=V 2C ×P 2S (Formula 11) S=V 2C ×(V 2S ×G) S=(V 2C ×V 2S ) × G (Equation 15) Given the common secret (CS) determined by the second node 7, Equation 12.1 can be substituted into Equation 14 as follows: S=V 2S ×P 2C (Formula 14) S=V 2S ×(V 2C ×G) S=(V 2S ×V 2C ) × G (Equation 16) Since ECC algebra is commutative, Equation 15 and Equation 16 are equivalent: S=(V 2C ×V 2S )×G=(V 2S ×V 2C ) × G (Equation 17) [Common Secret (CS) and Private Key] The common secret (CS) can now be used as a private key or as the basis for a private key in a symmetric key algorithm for secure communication between the first node 3 and the second node 7 .

[0110] The shared secret (CS) is the elliptic curve point (x S ,y S ), which may be converted to a standard key format using a standard publicly known operation agreed upon by nodes 3 and 7. For example, x S The value is AES 256 It may be a 256-bit integer that can be used as a cryptographic key, which can be further converted to a 160-bit integer using RIPEMD160 for any application that requires a 160-bit key length.

[0111] The common secret (CS) may be determined as needed. Importantly, the first node 3 does not need to store the common secret (CS) since it can be re-determined based on the message (M). In some examples, the message (M) used may be stored in a data store 13, 17, 19 (or other data store) that does not have the same level of security as required for a master private key. In some examples, the message (M) may be publicly available.

[0112] However, depending on some applications, the shared secret (CS) may be the first node master private key (V 1C ), the common secret (CS) may be stored in a first data store (X) associated with the first node.

[0113] Advantageously, this technique can be used to determine multiple common secrets, which may correspond to multiple secure private keys, based on a single master key crypto-pair.

[0114] <Hierarchical structure of generator values ​​(keys)> For example, a series of successive generator values ​​(GV) may be determined, where each successive GV may be determined based on the previous generator value (GV). For example, instead of repeating steps 310-370, 410-470 to generate successive private keys, previously used generator values ​​(GV) may be repeatedly rehashed by both parties to establish a hierarchy of generator values ​​by prior agreement between the nodes. In fact, a generator value based on a hash of a message (M) may become a next-generation message (M) for a next-generation generator value (GV). Doing this allows for successive generation of shared secrets to be calculated, without the need for further protocol-established transmissions, in particular the transmission of multiple messages each time a common secret is generated. The next-generation common secret (CS') may be calculated as follows:

[0115] First, both the first node 3 and the second node 7 independently determine the next generation generator value (GV'), which is similar to steps 320 and 420, but adapted according to the following equation: M' = SHA-256(M) (Equation 18) GV' = SHA-256(M') (Equation 19.1) GV' = SHA-256(SHA-256(M)) (Equation 19.2) The first node 3 then generates the next-generation second node second public key (P 2S ') and the first node second private key (V 2C ') may be determined similarly to steps 370 and 330 above, but adapted according to the following formula: P 2S '=P 1S +GV'×G (Formula 20.1) V 2C '=V 1C +GV' (Equation 20.2) The second node 7 then generates the next-generation first node second public key (P 2C ') and the second node second private key (V 2S ') may be determined similarly to steps 430 and 470 above, but adapted according to the following formula: P 2C '=P 1C +GV'×G (Equation 21.1) V 2S '=V 1S +GV' (Equation 21.2) The first node 3 and the second node 7 may then each determine a next generation common secret (CS'). In particular, the first node 3 determines the next generation common secret (CS') according to the following formula: CS'=V 2C '×P 2S '(Formula 22) The second node 7 determines a next-generation common secret (CS') according to the following formula. CS'=V 2S '×P 2C '(Formula 23) Further generations (CS'', CS''', etc.) can be calculated in the same way to generate the chain hierarchy. This technique requires that both the first node 3 and the second node 7 keep track of the original message (M) or the originally calculated Generator Value (GV), and which node it relates to. As this is publicly known information, there are no security issues with possessing this information. Therefore, this information may be kept in a "hash table" (linking hash values ​​to public keys) and freely distributed across the network 5 (e.g. using Torrent). Furthermore, if any individual shared secret (CS) in the hierarchy has not been solved before, it can be solved by solving the private key V. 1C , V 1S remains secure, it does not affect the security of any other shared secrets in the hierarchy.

[0116] <Key tree structure> Similar to the chain (linear) hierarchical structure described above, hierarchical structures in the form of trees can be created. According to the tree structure, various keys for different purposes such as authentication keys, encryption keys, signature keys, payment keys, etc. can be determined. These keys are then all linked to a single securely maintained master key. This is illustrated in FIG. 12, which shows a tree structure 901 with various different keys. Each of these can be used to generate secrets that are shared with another party. Branching trees can be achieved in several ways, three of which are described below.

[0117] (i) Master Key Spawning In the chain hierarchy, each new "link" (public / private key pair) is generated by adding the multiplied rehashed message to the original master key. For example (for clarity, only the private key of the first node 3 is shown): V 2C =V 1C +SHA-256(M) (Equation 24) V 2C '=V 1C +SHA-256(SHA-256(M))(Formula 25) V 2C ''=V 1C +SHA-256(SHA-256(SHA-256(M)))(Eq. 26) etc.

[0118] To generate a branch, any key can be used as a submaster key. For example, V 2C ' is generated by adding hashes to the submaster key (V 3C ) can be used.

[0119] V 3C =V 2C '+SHA-256(M)(Formula 27) Submaster Key (V 3C ) is itself a next-generation key (V 3C '), for example:

[0120] V 3C '=V 2C '+SHA-256(SHA-256(M))(Formula 28) It uses the master key spawning method shown in FIG.

[0121] (ii) Logical Association In this method, all the nodes (public / private key pairs) in the tree are generated as a chain (or in any other way) and the logical relationships between the nodes in the tree are maintained by a table where each node in the tree is simply related to its parent node in the tree using a pointer, which can then be used to determine the associated public / private key pair in order to determine the common secret (CS) for the session.

[0122] (iii) Message diversity A new public / private key pair can be generated by introducing a new message at any point in the chain or tree. The message itself may be arbitrary or may convey some meaning or function (e.g., it may relate to a "real" bank account number, etc.). It may be desirable for such a new message for forming the new public / private key pair to be kept secure.

[0123] <encoding scheme> The metadata of a transaction may be used to access instructions stored in a document outside the block. This document is sometimes called a "contract." The metadata used to reference a transaction can be formatted in a variety of ways; however, a suitable encoding scheme is described here.

[0124] A transaction is transferable if the rights it defines are vested in the holder or owner of the transaction. An example of a non-transferable transaction is a participant-named transaction, i.e., the rights are vest in a specific named entity rather than in the holder of the transaction. Only transferable transactions are discussed in this coding scheme.

[0125] A token represents a particular transaction that details or defines the rights conferred by the transaction. In accordance with the present invention, a token is a representation of a transaction in the form of a Bitcoin transaction.

[0126] This coding method uses metadata having three parameters or data items. This data can indicate: i) the amount of shares available under the transaction (which may be referred to herein as "NumShares"); ii) the amount of transmission units to be transferred from the sender to at least one receiver (this is sometimes called "ShareVal"); iii) A factor for calculating the value of the amount of transfer units (this is sometimes called the "pegging rate").

[0127] The advantage of this encoding scheme is that it can be used to encapsulate or represent a transaction as a token on the blockchain using only the three parameters mentioned above. In fact, a transaction can be specified using a minimum of these three data items. Since this encoding scheme can be used for any kind of transferable transaction, a common algorithm can be devised and applied. Further details of these metadata items are provided below.

[0128] A divisible token is one in which the value on a transaction output can be divided into smaller amounts that are allocated across multiple tokens (i.e. across multiple transactions). A typical example is a tokenized fiat currency. A divisible transaction is defined as a transaction that specifies a non-zero pegging rate. In a divisible transaction, the tokenized value transferred in the transaction output is tied to the underlying bitcoin (BTC) value by a pegging rate. That is, the transaction specifies the holder's rights in terms of a pegging rate. In a non-divisible token, there is no pegging rate and the transaction specifies the holder's rights in terms of a fixed value (e.g., a bearer bond that says "this transaction can be redeemed for exactly $1000" or a voucher that says "this transaction is redeemable for 1 haircut"). In a non-divisible transaction, the underlying transaction BTC value is unrelated to the transaction value.

[0129] The expression "underlying BTC value" refers to the amount of Bitcoin (BTC) that is attached to a transaction output. In the Bitcoin protocol, each transaction output must have a non-zero BTC amount to be considered valid. In practice, the BTC amount must be greater than a set minimum value ("dust"), currently set at 546 satoshis at the time of writing. One Bitcoin is defined to be equal to 100 million satoshis. Since Bitcoin transactions are used herein only as a means to facilitate the exchange of ownership, the actual underlying BTC amount is arbitrary. The true value is in the transaction specifications. In theory, all tokens can be transferred by dust.

[0130] In accordance with the encoding scheme of the present invention, specifically for divisible tokens, the underlying BTC value has the following meaning: it carries a relationship to the transaction value through the pegging rate. The pegging rate is itself arbitrary and is chosen to keep the underlying BTC amount small. The reason for using a pegging rate rather than simply each underlying token transaction with dust is that the protocol of the present invention provides visibility. When a token is split into several smaller transaction outputs, there is no need to adjust the original transaction. Rather, the transaction value of each fractional token is simply calculated based on the pegging rate and the fractionalized amount of the underlying BTC value.

[0131] Limited tokens are tokens whose total issuance value is fixed (or "limited") by a fixed non-zero number of shares defined by a quantity called NumShares. Thus, no further shares can be issued under a limited transaction. For example, a transaction for co-ownership of a racehorse may be limited to 100% of the racehorse (e.g., 100 shares at 1% each, or 10 shares at 10% each, etc.). An unlimited transaction means that the issuer can undertake further issuance of shares, for example by adding the required amount of fiat currency to their Reserve Account. NumShares must be explicitly stated in all transactions. Limited transactions must have NumShares>0. An unlimited transaction is indicated by setting NumShares=0.

[0132] A typical example is a monetary reserve (similar to a gold reserve) where the total value held in a reserve account matches the total value of the promissory notes (i.e., outstanding tokens) in existence. This concept extends beyond monetary reserves to inventory stocks. For example, an issuer of licensed printed t-shirt tokens may start with a stock of 10,000 t-shirts and issue divisible tokens representing these 10,000 t-shirts (where each share = 1 t-shirt). The original token can be subdivided, and each subdivided token is redeemable for a number of t-shirts according to the underlying BTC value of the transaction output, as determined by the pegged rate. However, if demand increases, the issuer may decide to issue more shares (i.e., increase the number of shares in circulation by another 10,000). In such a case, it is the issuer's obligation to hold another 10,000 t-shirts in the issuer's reserve account (i.e., inventory warehouse) to undertake further issuances. Therefore, the total number of t-shirts in inventory at any one time is the total number of unredeemed shares (where inventory acts as a "reserve account").

[0133] The pegged rate only applies to divisible transactions, where the value of the shares (represented by a quantity called ShareVal) is fixed to the underlying BTC amount. For example, a transaction may specify that the issuer promises to redeem tokens at a rate of $10,000 per underlying BTC. This may mean that a transaction with a tokenized underlying output value of (for example) 15,400 satoshis is redeemable for $1.54. A value of 0 for the pegged rate indicates that the transaction is non-divisible (i.e., only the whole can be transferred, like a bearer bond). When the pegged rate is set to 0 (implying a non-divisible token), the underlying BTC value is unrelated to the transaction value and can be set to any amount. Typically, in this case, it is desirable to keep the underlying BTC amount as small as possible (i.e., set it to dust) to minimize operational costs.

[0134] NumShares is the total (fixed) number of shares available under the (limited) deal. In limited deals, NumShares must be a whole number greater than zero. In non-limited deals, NumShares is not fixed since more shares can be issued at any time (if they can be subscribed). This is indicated by setting the value to 0.

[0135] A share is defined as the transfer unit and ShareVal is the value of that unit. For example, in fiat currency, the transfer unit may be set to 1 cent. Or, for example, the transfer unit may be set to 50 cents, in which case transfers can only be performed in 50 cent "lots". ShareVal can also be expressed as a percentage. For example, if a breeder wants to sell a racehorse for 10 equal shares, set ShareVal=0, which is 10%. ShareVal must be greater than 0 and must be defined in the transaction.

[0136] TotalIssuance represents the total value of shares issued. This value is only relevant for capped deals. For non-capped deals, the issue is not fixed and more shares may be issued. When shares are expressed as a percentage, by definition we set TotalIssuance=0 to 100%.

[0137] In a limited transaction, NumShares, ShareVal, and TotalIssuance are related as follows: NumShares×ShareVal=TotalIssuance A value of 0 for TotalIssuance means that it is an unlimited transaction. An example of an unlimited transaction is a fiat currency (so TotalIssuance is set to 0). Examples of limited transactions are (i) a limited edition commemorative coin (1000 are minted, 1 share = 1 coin), where TotalIssuance = 1000 x 1 = 1000 coins, and (ii) tickets for seats in a venue, where TotalIssuance = total number of seats available.

[0138] Distribution is defined as the total value of unspent tokens (i.e., determined by transactions in UTXO (unspent transaction output)). The complete set of all unspent transactions is kept in a list available to all Bitcoin nodes. For example, if an issuer initially issues $10,000 in fiat currency tokens and over time redeems $5500 worth of tokens, then Distribution = $4500 (the value of unredeemed tokens). This value should be adjusted to the balance of the relevant reserve account.

[0139] Illustrative Examples of Computational Resources ("Agents") Suitable for Use with Embodiments of the Present Invention The present invention can utilize appropriately configured computational resources (herein "agents") to perform automated aspects of the desired processing. An example of a suitable and preferred agent is provided below, although other implementations may be used.

[0140] An agent may work in conjunction with the blockchain, using the blockchain as a non-erasable tape in a Turing machine implementation. This agent runs in parallel with the blockchain network and oversees and handles the execution of (loop) processes. The loop processes are designed to perform a given task, such as automating the processing or control of a device or system. This parallel resource can monitor the state of the blockchain and cause transactions to be written to the blockchain. In a sense, this utilizes the blockchain as a non-erasable tape of a Turing machine, with the following definition and characteristics: 1. The blockchain acts as the tape of a Turing machine. Each transaction in the blockchain represents a cell on the tape. This cell can contain symbols from a finite alphabet. 2. The tape head can read information from blocks that have already been written on the blockchain. 3. Tape heads can write new blocks containing many transactions to the end of the blockchain, however they cannot write to blocks that already exist, thus making the blockchain tape non-erasable. 4. It can be stored as part of a multi-signature pay-to-script-hash (P2SH) transaction for each transaction.

[0141] An important function of an agent is to act as an automated entity that monitors the current state of the blockchain. It can further receive signals or inputs from any off-block source. Depending on the blockchain state and / or the inputs received, the agent may perform certain actions. The agent decides which actions should be performed. These may or may not include actions in the "real world" (i.e., off-block) and / or actions on the blockchain (such as generating and broadcasting new transactions). The actions taken by the agent may be triggered by the blockchain state. The agent may further decide on the next set of transactions to be broadcast to the Bitcoin network and later written to the blockchain.

[0142] The actions of the agents execute in parallel and simultaneously against the blockchain (e.g., Bitcoin) network. In a sense, this stores the functionality of the blockchain (e.g., Bitcoin) script. This continuous monitoring enforces a "loop" control flow construct that makes the combined agent and blockchain system Turing Complete.

[0143] A Turing machine contains two stacks: · Data Stack: This is represented by the blockchain as described above. Control Stack: This is represented by an agent function. It stores information related to repeated control flow functions.

[0144] Separating the control stack from the data stack provides the advantage of preventing infinite loops from occurring in Bitcoin core and mitigating denial of service attacks.

[0145] The Agent manages and executes subroutines that can be looped using any type of loop construct (e.g., FOR-NEXT, REPEATUNTIL, etc.). The illustrative embodiment described herein includes a process that uses an example of a "repeat" construct. The user may specify an index (i) and a limit (J), which represent the current iteration number (which typically counts starting from 0) and the total number of iterations of the repeat loop, respectively.

[0146] For each iteration, 1. The index is increased by 1. As for the termination condition, when the index reaches the limit, the iteration stops. 2. A block of code containing an “if condition then action” (ICTA) statement is executed. The action can be any action on or off the blockchain. 3. A cryptographic hash of this subroutine is calculated, which can be stored as part of the transaction on the blockchain. The hash is unique for each code, allowing for verification of which code was used.

[0147] The loop body contains code blocks, each of which contains an "if condition then action" (ICTA) statement that monitors the current state of the blockchain for transactions that match: Start or trigger conditions (e.g. when a certain date is reached), the iteration condition (i.e. the metadata or hash associated with the previous iteration), The stopping condition (i.e. the last iteration of the loop).

[0148] The ICTA statement allows the agent to decide about the next transaction based on the current state of the blockchain. Generating the next transaction involves broadcasting the transaction to the Bitcoin network and writing the new transaction to the blockchain, which acts as a record that this iteration has been executed. Once the transaction is written to the blockchain, the manager will then know that the previous iteration has been executed and written to the blockchain, and will execute the next iteration. The latter continues until an iteration loop exists, when the index (i) reaches a limit (J) specified in the code block.

[0149] Each transaction is stored in the blockchain in a reusable way. In the Bitcoin implementation, each signature in a transaction is tagged with a SIGHASH flag. This flag can take different values. Each of these values ​​indicates whether other parts of the transaction can be modified without the involvement of the owner of this signature. Reusable transactions have the SIGHASH flag "SigHash_AnyoneCanPay" in one of the transaction inputs. This allows anyone to contribute to the inputs of the transaction. This parameter allows the agent's ICTA function to be executed and repeated multiple times with different inputs. The use of this function can be restricted to authorized parties, for example by cloning the reuse transaction.

[0150] The "If condition" portion of the ICTA code block can monitor any kind of condition. This is similar to other programming languages ​​(e.g., C, C++, Java) and is not limited to information stored in the blockchain. For example, it could monitor the date and time (i.e., when a certain date and time is reached), or monitor the weather (i.e., when the temperature is below 10°C and it is raining), or monitor the conditions of a transaction or credit (i.e., when company A buys company B).

[0151] The "Then action" portion of an ICTA code block can perform a number of actions. The invention is not limited with respect to the number or type of actions that can be taken. Actions are not limited to transactions on the blockchain, but transactions, including metadata related to the action, may be written to the blockchain.

[0152] The metadata can be in any form, however, in one embodiment, the metadata may store a hyperlink to a file containing more data or instructions related to the action, the metadata may store both a hyperlink to a hash table containing more data or instructions related to the action, and a hash of the action that acts as a lookup key into the hash table.

[0153] The agent's control stack can be implemented in a number of ways, specialized for each user's needs. For example, the control stack's iteration loop can be based on any Turing-complete language. One possible choice of language is a language based on a Forth-style stack. The advantage of using this language is that it keeps the control stack consistent in programming style with the well-known and widely used Bitcoin script.

[0154] <Using the Bitcoin Script Alternate Stack as a data storage space> Bitcoin scripts contain commands, also called opcodes, that allow users to move data into an alternate-style stack known as an "altstack."

[0155] The opcodes are as follows: · OP_TOALTSTACK, which moves data from the top of the primary stack to the top of the altstack. OP_FROMALTSTACK, which moves data from the top of the altstack to the top of the primary stack.

[0156] This allows data from intermediate computation steps to be stored in the altstack, similar to the "memory" function that allows a calculator to store data. In one embodiment, the altstack is used to configure Bitcoin scripts to solve small computational tasks and return results to the calculator.

[0157] <Use the code register to manage agents> The agent also manages a registry of all the code it owns and executes. This registry is structured like a lookup table or dictionary that maps specific keys to specific values. The key and value pair is represented by the hash of the code block (H1) and the IPv6 address where the code is stored, respectively. To retrieve a code block with key H1, the lookup table is used to retrieve the associated value (which is the location where the code is stored) and retrieve the source code accordingly. The implementation of the code registry may vary.

[0158] <Agent code transaction metadata and respawn loop> The information needed to respawn a loop of agents for a particular iteration is stored as metadata in the transaction recorded on the blockchain.

[0159] Thus, a transaction on the blockchain stores or provides access to information about a given iteration of a loop running on an agent, which may include the values ​​of any variables associated with the loop, such as the index i, and any other required information, such as values ​​of parameters used within a code block or location related data where further required information can be accessed.

[0160] The metadata itself is stored as part of a multi-signature pay-to-script-hash (P2SH) script within the transaction. The metadata recorded with the transaction also gives the ability to record an audit trail of how the code has been executed in the past.

[0161] There are several ways that an agent can repeatedly respawn a loop code block on each iteration. The code block may be hard-coded into the agent itself, or may be stored in a private or publicly available file, or may be stored as an entry on a private or public hash table file, or a combination of these. The code block may be fixed to a hard-coded variable, or may contain fixed but portable parameters. The parameters may be single values ​​in any data format, or may be small chunks of code, or a combination thereof. The parameters may be populated by reading them directly from metadata in the transaction (e.g., a Bitcoin transaction), or from an external source such as an internal database, or a private / public file, or a hash table, or any combination of these. A pointer to the external source of the parameter value may be stored in the metadata in the transaction.

[0162] The following steps provide an example of how an agent can respawn a repeating loop code block on the i-th iteration. In this example, the code registry is a hash table, whereby the hash value acts as a lookup key for the table and is stored in metadata on the transaction. 1. An agent monitors the blockchain for transactions that contain hashes of code blocks that match entries in the code registry. 2. The agent finds the transaction that contains the corresponding hash (H1). 3. The agent reads "Metadata-CodeHash", gets the CodeHash field to get H1, and uses H1 to read the code (C1). If RIPEMD-160(SHA256(C1)) equals H1, the code has not changed and it is safe to proceed to the next step. 4. The agent reads the "Metadata-CodeHash" which stores the index i and respawns the code at the ith iteration. In other words, the loop is "reloaded" at the appropriate iteration. 5. The user’s signature is included in the P2SH command to verify the origin of the metadata. 6. The Agent reads the Metadata-OutputHash and Metadata-OutputPointer to retrieve the output of the previous step if these data are needed for this iteration of the loop.

[0163] It should be noted that the above-described embodiments do not limit the present invention, and that those skilled in the art can devise numerous alternative embodiments without departing from the scope of the present invention, which is defined by the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claims. The word "comprising" or "comprises" and the like does not exclude the presence of elements or steps other than those listed in any claim and the specification as a whole. In this specification, "comprises" means "includes" or "consists of", and "comprising" means "including" or "including of". The singular reference of an element does not exclude the presence of a plurality of such elements and vice versa. The invention can be implemented by means of hardware comprising several distinct elements, or by means of a suitably programmed computer. In a device claim enumerating several means, these several means may be implemented by one and the same hardware element. The fact that certain quantities are recited in mutually different dependent claims does not indicate that a combination of these quantities cannot be used to advantage. [Explanation of symbols]

[0164] 101 Auto Feeder IoT Device 102 Clients 103 Control Agent 104 BID Control System< / unlockingscript> < / unlockingscripthash>

Claims

1. 1. A computer implemented control system, comprising: a first device configured for communication with a network, the first device having an IP address and a public-private cryptographic key pair associated with the first device; a software implemented control component configured to monitor a state of a blockchain network and / or transmit blockchain transactions to the blockchain network; one or more client devices configured to send input signals to the control component, the input signals configured to affect control of the first device; a set of instructions configured for execution by the control component to control functionality of the first device, the set of instructions being stored in a repository stored in a location separate from the first device, the set of instructions being accessed for download and installation from the repository by the control component, the location of the repository being indicated or provided using metadata provided in a blockchain transaction; and A system including:

2. The system of claim 1 , wherein the one or more client devices are radio frequency identification devices (RFID).

3. 3. The system of claim 1 or 2, wherein the first device is controlled based on the proximity of the one or more client devices to the first device.

4. i) the repository is a distributed hash table (DHT); ii) the instruction set is read to regulate, control and / or affect operation of the first device; and / or The system of any one of claims 1 to 3, wherein iii) the first device is an IoT device.

5. the software implemented control component having a public-private cryptographic key pair associated with the associated blockchain associated address; The system of any preceding claim, wherein the control component is configured to access the set of instructions from the repository using a look-up key related to the public-private cryptographic key pair associated with the control component.

6. A system as described in any one of claims 1 to 5, wherein the control component is provided on or within the first device, or the control component is provided in a separate location from the first device and configured for wireless communication with the first device.

7. The system of any preceding claim, wherein the control component is configured to control or affect operation of the first device based on detection of a valid blockchain transaction.

8. 1. A computer-implemented control method, comprising: providing a first device configured for communication with a network, the first device having an IP address and a public-private cryptographic key pair associated with the first device; providing a software implemented control component configured to monitor a state of a blockchain network and / or to transmit blockchain transactions to said blockchain network; providing one or more client devices configured to send input signals to the control component, the input signals configured to affect control of the first device; providing a set of instructions configured for execution by the control component to control functionality of the first device; Including, i) the control component is configured to access the set of instructions from a repository stored in a location separate from the first device; ii) the instruction set is stored in the repository and is accessible for download and installation from the repository by the control component; iii) the location of the repository is indicated or provided using metadata provided in a blockchain transaction.

9. The method of claim 8 , wherein the one or more client devices are radio frequency identification devices (RFID).

10. 10. The method of claim 8 or 9, wherein the first device is controlled based on the proximity of the one or more client devices to the first device.

11. i) the repository is a distributed hash table (DHT); ii) the instruction set is read to regulate, control and / or affect operation of the first device; and / or The method according to any of claims 8 to 10, wherein iii) the first device is an IoT device.

12. the software implemented control component having a public-private cryptographic key pair associated with the associated blockchain associated address; 10. The method of claim 9, wherein the control component is configured to access the instruction set from the repository using a lookup key associated with the public-private cryptographic key pair associated with the control component.

13. A method according to any one of claims 8 to 10, wherein the control component is provided on or within the first device, or the control component is provided at a separate location from the first device and configured for wireless communication with the first device.

14. The control component Perform cryptographic calculations; Access to your associated private / public key pair, Have an associated Bitcoin or other blockchain related address; Interacting with the first device via an API; performing secret sharing protocol operations; The method according to any one of claims 8 to 12.

15. The method of any of claims 8 to 13, wherein the control component is configured to control or affect operation of the first device based on detection of a valid blockchain transaction.

Images