Computer-implemented system and method for transferring access to digital resources

Abstract

To provide a computer-implemented method for transferring access to, or control of, a resource.SOLUTION: A method comprises the steps of: providing a blockchain transaction redeemable to transfer control of a resource by providing a data item (S1) to a first blockchain transaction, the data item being determinable only by a controller of both a revealable value (s) and a secret value (k0); and providing the revealable value to a controller of the secret value to enable the controller to determine the data item. The method may be carried out using a Bitcoin blockchain, or using a combination of different blockchains.SELECTED DRAWING: Figure 3

Description

[Technical Field]

[0001] The present disclosure relates generally to the secure transfer of access to or control of resources, and in particular to the atomic transfer of such access or control via cryptographic keys transmitted using one or more blockchain transactions. The present disclosure is particularly suitable for use within, but not limited to, any variant of the Bitcoin protocol. [Background technology]

[0002] Herein, we use the term "blockchain" to encompass all forms of electronic, computer-based, distributed ledgers. These include consensus-based blockchain and transaction chain technologies, permissioned and permissionless ledgers, shared ledgers, and variations thereof. While other blockchain implementations have been proposed and developed, the most widely known application of blockchain technology is the Bitcoin ledger. Bitcoin may be referenced herein for convenience and illustrative purposes, but it should be noted that this disclosure is not limited to use with the Bitcoin blockchain, and alternative blockchain implementations and protocols are encompassed within the scope of this disclosure. The term "user" here may refer to a human or a processor-based resource.

[0003] A blockchain is a peer-to-peer electronic ledger implemented as a computer-based, decentralized, distributed system, composed of blocks, which in turn are composed of transactions. Each transaction is a data structure that encodes the transfer of control of digital assets between participants in the blockchain system and contains at least one input and at least one output. Each block contains a hash of the previous block, and these blocks are strung together to create a permanent, immutable record of all transactions written to the blockchain since its origin. Transactions contain small programs known as scripts. Scripts embed their inputs and outputs and specify how and by whom the transaction's outputs are accessible. In the Bitcoin platform, these scripts are written using a stack-based scripting language.

[0004] For a transaction to be written to the blockchain, it must be validated. Network nodes (miners) perform the work to ensure that invalid transactions are rejected by the network and that each transaction is valid. A software client installed on the node performs this validation work on unspent transactions (UTXOs) by executing the UTXO's lock and unlock scripts. If the execution of the lock and unlock scripts evaluates to TRUE, the transaction is valid and the transaction is written to the blockchain. Therefore, for a transaction to be written to the blockchain, it must (i) be validated by the first node that receives it, and if the transaction is valid, the node relays the transaction to other nodes in the network; (ii) be added to a new block constructed by miners; or (iii) be mined, i.e., added to the public ledger of past transactions.

[0005] While blockchain technology is most widely known for its use in implementing cryptocurrencies, digital entrepreneurs are beginning to explore the use of both the cryptographic security system on which Bitcoin is based and the data that can be stored on the blockchain to implement new systems. It would be highly advantageous if blockchain could be used to automate tasks and processes that are not limited to the cryptocurrency field. Such solutions could take advantage of the benefits of blockchains (e.g., permanence, tamper-resistance of event records, decentralized processing, etc.) while further diversifying their uses.

[0006] One area of ​​current research is the use of blockchain-based computer programs for the implementation of "smart contracts." These are computer programs designed to automate the execution of the terms of machine-readable contracts or agreements. Unlike traditional contracts, which are written in natural language, smart contracts are machine-executable programs that contain rules that can process inputs to produce outcomes, which in turn cause actions to be performed that depend on the outcomes.

[0007] Another area of ​​blockchain-related interest is the use of "tokens" (or "colored coins") to represent and transfer real-world entities via the blockchain. Potentially confidential or secret items can be represented by tokens that have no discernible meaning or value. Thus, tokens act as identifiers that allow real-world items to be referenced from the blockchain.

[0008] The concept of atomic swaps has already been discussed in the cryptocurrency community. An exchange between parties is atomic, meaning that all participants either receive their desired resource (e.g., cryptocurrency tokens or coins) or do nothing. At the time of writing, Wikipedia describes atomic swaps as "a proposed feature in cryptocurrencies that allows the exchange of one cryptocurrency for another without the need for a trusted third party." Traditional cryptocurrencies require a trusted third party, such as a cryptocurrency exchange, to execute cryptocurrency swaps, preventing one party from sending currency without receiving it back. Atomic swap systems use hash-time-locked smart contracts. As a result, parties must supply the currency to be swapped within a specified time, or the transaction will be canceled. This preserves atomicity in that either the swap occurs or the currency is not swapped. https: / / en.wikipedia.org / wiki / Atomic_swap

[0009] Thus, while many security breaches or "hacks" have been carried out on cryptocurrency exchanges such as Mount Gox, atomic swaps offer increased security for transfers made on the blockchain, as removing the need for a trusted third party removes the risk of exploitation and malicious intervention. Summary of the Invention

[0010] It is therefore desirable to provide a cryptographic method for exchanging resources atomically with the immutability and trustlessness provided by blockchain technology, which would improve security for exchanges conducted over blockchain-implemented networks.

[0011] Such an improved solution is devised here.

[0012] Thus, in accordance with the present disclosure, there is provided a method as defined in the accompanying claims.

[0013] The present disclosure may provide a computer-implemented method. The method may be described as a method for transferring control of a resource. The method controls the transfer of resources across or through a blockchain network. Additionally or alternatively, the method may be described as a secure transfer method. Additionally or alternatively, the method may be described as a security method for controlling when and / or by whom a controlled resource is accessible. The resource may be a resource stored on or a reference from a blockchain, such as a portion of cryptocurrency or a tokenized item / asset / entity.

[0014] The method comprises: providing a first blockchain transaction redeemable to enable access to a first resource by providing at least a data item in the first blockchain transaction, the data item being determinable only by a control of both a disclosable value and a private value; providing said disclosable value to a control unit of said secret value so that said control unit can determine said data item; In the context of this disclosure, "enabling access" may include, but is not limited to, transferring control of a resource, such as an amount of cryptocurrency, or enabling access to a document, an online resource, or a security access code.

[0015] The method enables secure transfer of access to or control of resources using one or more blockchains without requiring the protocols of those blockchains to share one or more common hash functions, thereby providing the advantage of increasing the number of blockchains across which transfers can be performed. Thus, the security and efficiency of such transfers of control or access are preserved while increasing the versatility of the transfer. The method also enables transfers across incompatible network / blockchain protocols.

[0016] The data item may include a first private key of a first cryptographic key pair.

[0017] The first blockchain transaction may further require the provision of a second private key of a second cryptographic key pair in order to be redeemable, the second cryptographic key pair being associated with the intended recipient of the first resource.

[0018] This provides the advantage of increasing the security of the method by preventing any actor with unwanted knowledge of the first private key from redeeming the first transaction.

[0019] The first private key may be a deterministic private key of a deterministic cryptographic key pair, the deterministic public key of which is derived using a first public key of the first cryptographic key pair and a second public key of the second cryptographic key pair.

[0020] This further improves the security of the method by providing a level of obfuscation so that unwanted disclosure of the first cryptographic key does not compromise the first transaction, while preserving the intended recipient's ability to redeem the first transaction.

[0021] The step of providing the disclosable value to the control unit includes: providing a second blockchain transaction redeemable to enable access to a second resource by providing at least the data item to the second blockchain transaction, wherein redemption of the second blockchain transaction causes the controller to provide the disclosable value; and redeeming the second blockchain transaction.

[0022] This allows atomic swaps of resource access or control to be performed without requiring the use of a hash function, thereby providing a mechanism for secure simultaneous digital exchanges to be performed without the restriction on blockchain protocols sharing a common hash function.

[0023] Redeeming the above-mentioned blockchain transaction may include calculating a cryptographic signature corresponding to the data item and comparing a value stored in the transaction to at least a portion of the calculated signature.

[0024] This allows important parts of the cryptographic algorithms to be performed off-block, thereby providing the necessary tasks for maintaining a level of cryptographic security from the blockchain, with the associated benefits of reducing the size of the first transaction (and therefore reducing storage requirements) and improving the efficiency of the method.

[0025] The secret value may be an ephemeral key used in the digital signature process.

[0026] The present disclosure also provides a system including a processor and a memory including executable instructions that, upon execution by the processor, cause the system to perform any embodiment of the computer-implemented method described herein.

[0027] The present disclosure also provides a non-transitory computer-readable storage medium having stored thereon executable instructions that, when executed by a processor of a computer system, cause the computer system to perform at least one of the computer-implemented methods described herein.

[0028] These and other aspects of the present disclosure will be apparent from and will be taught with reference to the embodiments described herein, which are described below, by way of example only, and with reference to the accompanying drawings, in which: [Brief explanation of the drawings]

[0029] [Figure 1] 1 shows a table of prior art Distinguished Encoding Rules. [Figure 2] 1 shows a table containing scripts for extracting parts of a signature. [Figure 3] 1 shows a flowchart including steps of an embodiment of the present disclosure. [Figure 4] 1 shows a flowchart including steps of an embodiment of the present disclosure. [Figure 5] 1 shows a flowchart including steps of an embodiment of the present disclosure. [Figure 6] FIG. 1 is a schematic diagram illustrating a computing environment in which various embodiments may be implemented. DETAILED DESCRIPTION OF THE INVENTION

[0030] A standard hash function, such as SHA-256, takes a data structure X and generates a 256-bit number H(X)∈Z. 256 This is a one-way deterministic function. X → H(X) In the context of cryptography, hash functions can be used to generate hash puzzles, which are functions that are TRUE if and only if a pre-image X is provided as an input to the function.<Solve H(X)> That is, <x><Solve H(X)>=TURE For SHA-256, such a function is given in the Bitcoin script by: <Solve H(X)> =OP_HASH256<H(X)> OP_EQUALVERIFY A hash puzzle may be used in a script, such as a Redeem script, of a blockchain transaction to ensure that if the transaction is redeemed, the preimage X must be disclosed in the Redeem script input and therefore visible on the blockchain.

[0031] [Table 1]

[0032] [Table 1] Under the ECDSA protocol, a signature for a private key S1 and a message hash H(m) is generated in the following way (note that the message hash is known to everyone, but the private key is known only to the person signing the message):

[0033] The first step is to generate a random number k∈Z known as an ephemeral key. * n From this value, r is derived, which is the x coordinate of the ephemeral key multiplied by the generator point. r=R x , (R x ,R y )=k·G The value r forms one half of the signature. The other half, s, is defined by: s=k -1 (H(m)+S1*r) mod n The combination (r, s) = Sig P1 is an ECDSA signature.

[0034] One important feature of ECDSA is that, once the ephemeral key k is known, the private key can be calculated as follows: S1=r -1 (s*kH(m)) mod n The signature (r, s) data structure contains the integer values ​​of r and s concatenated with some additional encoded data.

[0035] According to the Distinguished Encoding Rules (DER) [S. Blake-Wilson, D. Brown, P. Lambert, Use of Elliptic Curve Cryptography (ECC) Algorithms in Cryptographic Message Syntax (CMS), Network Working Group (2002); https: / / tools.ietf.org / html / rfc3278], a specific encoding of the ECDSA signature (r, s) data structure is given by the table shown in Figure 1 (note that dummy r and s data values ​​are used).

[0036] Referring to Figure 1, the last byte representing the signature type is not the standard DER encoding, but is used in Bitcoin signature encoding. The fourth byte of the signature represents the length r, which is 32 bytes if the leading bit of the binary representation of r is 0, and 33 bytes if the leading bit is 1. In this case, an extra zero-valued byte is added to the byte sequence. Bytes 5 through 36 or 37 of the signature represent the value or r itself.

[0037] The method for generating the private key puzzle is described below.

[0038] The private key puzzle is a function in the Redeem script that evaluates to TRUE when provided with inputs that allow the private key S1 to be computed for a given public key P1.

[0039] Puzzles of this type allow the algebraic properties of Elliptic Curve Cryptography (ECC) public / private key pairs to be exploited in implementing resource access and control: if two public keys are summed, the corresponding private key is the sum of the individual private keys. P1+P2=(S1+S2) G Compare this to a hash function, where when the hash sum of two values ​​is calculated, the corresponding preimage is usually not the sum of the individual preimages. H(X1+X2)≠H(X1)+H(X2) Although hash functions exist where the sum of the hash values ​​of the individual preimages equals the hash value of the sum of the preimages (known as harmonic hash functions), these are usually impractical to implement. Furthermore, public / private key pairs allow for data encryption / decryption and message signing using the Elliptic Curve Digital Signature Algorithm (ECDSA).

[0040] Examples of private key puzzles for performing atomic swaps are described below. These examples enable users of the methods disclosed herein to perform inter-chain swaps on blockchains that do not share a common hash function. Examples include transferring control of or access to resources controlled by public / private key pairs.

[0041] Throughout this application, the secret key puzzles are formulated in terms of ECC key pairs and the ECDSA protocol. However, this disclosure is not limited to these standards. For example, the methods are also applicable to Schnorr signatures, RSA key pairs with the DSA protocol.

[0042] As mentioned above, the private key puzzle is<Solve P1> and the corresponding private key <s1>Evaluates to TRUE if it affects: <s1><Solve P1>=TURE Such a function does not currently exist.<Solve P1> Including S1 in the transaction Redeem script ensures that, in order to redeem the transaction, any input provided to the Redeem script must include the corresponding private key S1. This means that S1 is publicly exposed on the blockchain. However, at least if the Redeem script is a Redeem script for a blockchain transaction on the Bitcoin blockchain, such a function may require a prohibitively large number of operators, which would prevent the transaction from being constructed and spent. This issue is discussed in more detail below.

[0043] Suppose there exists an operator OP_ECMULT that performs elliptic curve point multiplication, such that a point on an elliptic curve, say a generator G, is a positive integer, say S1∈Z * n means multiplying by , which means: <s1> <g>OP_ECMULT= <p1> In this case, the private key puzzle is given by:

[0044] <Solve P1> = <s1> <g>OP_ECMULT <p1>OP_EQUALVERIFY However, currently no such elliptic curve operators exist in the Bitcoin script.

[0045] After restoring some opcodes previously deprecated in the Bitcoin fork in May 2018, such as OP_MOD, we now technically have all the operators necessary to perform elliptic curve multiplication in Bitcoin script, i.e., to compose OP_ECMULT with other operators. However, there are practical reasons why this is not possible.

[0046] Such a function would require a minimum of 256 iterations, each involving several lines of complex arithmetic. Most notably, each iteration would require applying the extended Euclidean algorithm to take the modular inverse. The size of this required script would therefore far exceed the limit of 201 opcodes or 10KB.

[0047] In contrast, the method presented below uses only a few lines of opcodes.

[0048] Disclosed below are embodiments of methods for generating and utilizing private key puzzles, including those in which the private key is calculated off-block. In embodiments, the private key itself is not exposed in the input of the Redeem script; rather, components of the signature are exposed.

[0049] The key concept requires that the unlock script contains a signature that is associated with a particular ephemeral key. The corresponding private key can then be calculated from the signature by anyone who knows the ephemeral key.

[0050] The embodiments described with reference to Bitcoin script do not use any non-standard script operations.

[0051] function<Solve P1,r0> is constructed, where P1 is a public key and r0 is derived from a specific ephemeral key k0. This function<Sig P1,r0> <p1>Evaluates to TRUE if and only if it operates on<Sig P1,r0> denotes the signature of P1 using a particular ephemeral key k0. Since a signature with a known ephemeral key exposes the corresponding private key,<Sig P1,r0> If k is made public, the private key can be computed by anyone who knows k.

[0052] Referring to Figure 2, a Bitcoin script for extracting the r portion of the signature is disclosed. According to the DER encoding of the signature described above, to extract the r portion, it is necessary to split the signature at byte 5, up to byte 36 or byte 37. This depends on the value of byte 4. This is achieved by the Bitcoin script: OP_3 OP_SPRIT OP_NIP OP_1 OP_SPRIT SOP_SWAP OP_SPLIT OP_DROP Consider public key P1. As discussed above, a method is disclosed for generating a lock script such that the corresponding unlock script exposes sufficient information to the control of the ephemeral key to determine private key P1.

[0053] The method involves forcing the unlock script to include a signature of P1 using an ephemeral key, denoted k0. The corresponding private key, denoted S1, can be computed from the signature by anyone who knows the ephemeral key. Users of the method agree on the value of k0 to be used. Users may communicate this value to each other using any known, suitable secure method.

[0054] As mentioned above, an ECDSA signature consists of two components: Sig P1 = (r, s), where r is directly related to and computable from the ephemeral key k0.

[0055] r=R corresponding to the ephemeral key k0 x The value of is calculated (off-block) via the following formula: (R x ,R y )=k0·G A Redeem script is then generated that requires as input the signature of P1 using the ephemeral key k0.

[0056] [Table 2]

[0057] [Table 2] An example of a Redeem script compatible with the Bitcoin blockchain is given below.

[0058] [Table 3]

[0059] [Table 3] Here is the key puzzle script<Solve P1,r0> = [Table 4]

[0060] [Table 4] In the table above, the first line places the public key P1 into the alt-stack and duplicates the signature. The second line checks that the correct ephemeral key was used. The third line reads the public key from the alt-stack and checks that the signature is valid. The Bitcoin scripts used above, i.e., OP_DUP, OP_TOALTSTACK, and OP_FROMALTSTACK, are not strict requirements and can be omitted if, for example, input variables are duplicated and reordered.

[0061] Note that there are alternative ways to formulate the private key puzzle within the Bitcoin script. In particular, instead of OP_SPLIT, OP_CAT can be used. In this case, the input to the Redeem script is a partial signature containing only the s component (which can be computed using a predetermined ephemeral key k0 and a private key S1). The Redeem script can then concatenate a predetermined value of r with the partial signature to generate the complete signature (r, s). This signature can have the desired r by construction. Thus, the standard checksig operation remains.

[0062] An atomic swap refers to two transactions: one from Alice to Bob and one from Bob to Alice. An atomic swap ensures that either both transactions are redeemable or neither is redeemable. The mechanism that allows this to happen is a hash puzzle within the Redeem script. Benefits of atomic swaps include: Cryptocurrencies on different blockchains can be exchanged. For example, Alice may send BCH to Bob and receive BTC from Bob. Colored coins or other forms of tokens on the same blockchain may be exchanged.

[0063] Note that currently, atomic exchanges across different blockchains require both blockchains to share a common hash function in their scripting languages. An advantage of the present disclosure is that blockchains no longer require a common hash function, thereby enabling the transfer of control of or access to resources across diverse blockchains. Furthermore, atomic exchanges based on digital signatures allow for verification that the digital signature is consistent with the corresponding public key, thereby improving the security of the exchange.

[0064] Known methods are described below to provide a context for the subsequent description of embodiments of the present disclosure.

[0065] P A and P B Let denote the ECDSA public keys of Alice and Bob, respectively. 1. Alice has a secret A0∈Z known only to herself. * n (n is the degree of the elliptic curve generator G). 2. Alice transfers the funds locked by the Redeem script to Bob. <CheckSig P B ><Solve H(A0)> At this stage, Bob does not know the preimage of H(A0), so he cannot spend the funds. 3. Bob transfers the funds locked by the Redeem script to Alice. <CheckSig P A ><Solve H(A0)> 4. Now that Alice knows A0, she can spend the funds. This reveals A0 on the blockchain as an input to Alice's Redeem script.

[0066] Bob knows A0 and can use his funds.

[0067] The private key puzzles of the present disclosure described above may be used to perform atomic swaps between users of one or more blockchains without the requirement of a shared hash function. Methods for performing such atomic swaps are described below.

[0068] Instead of using hash puzzles, atomic swaps use the private key puzzles described above, which preserves all the functionality of known atomic swaps while allowing for advantageous versatility, including: Atomic swaps across blockchains that do not share a common hash function. · An atomic exchange of control over or access to a resource controlled by a public / private key pair.

[0069] As mentioned above, when using private key puzzles rather than hash puzzles, when Alice redeems a transaction, instead of disclosing a pre-image of the hash, she becomes able to determine the private key of a known public key. This contrast is shown in the table below.

[0070] [Table 5]

[0071] [Table 5] An embodiment of the present disclosure will now be described with reference to FIG. 3 in terms of the following method steps. 1. (110) Alice chooses an ephemeral key k0 and sends it to Bob over a suitable secure channel. Alternatively, Alice and Bob may have agreed on k0. 2. (120) Alice has a secret key S1∈Z known only to herself. * n She calculates the corresponding public key P1 = S1 G. 3. (130) Alice creates a transaction TxA with a Redeem script. <CheckSig P B ><Solve P1,r0> P B is Bob's public key,<Solve P1,r0> is the private key puzzle mentioned above. At this stage, Bob cannot redeem the transaction because he does not know the private key corresponding to public key P1, i.e., S1. Alice submits TxA to the blockchain. 4. (140) Bob creates a transaction TxB with a Redeem script. <CheckSig P A ><Solve P1,r0> where P A is Alice's public key. Bob submits TxB to the blockchain. 5. (150) Now that Alice knows S1, she can redeem TxB. As input to TxB's Redeem script, Alice must provide a signature of P1 using a specific ephemeral key k0. Redeeming TxB by submitting a Redeem transaction to the blockchain that presents TxB with the unlock script does not necessarily reveal the value of s. This disclosure of s allows Bob to calculate the private key S1, provided he already knows the value of the ephemeral key k0. (160) There may or may not be a time constraint on the redemption of TxA and TxB using a time lock function. The time lock function is configured to allow Alice and Bob to return TxA and TxB to Alice and Bob after a certain time has passed by submitting the appropriate refund transactions to the blockchain. 6. (170) If Alice redeems TxB, (180) Bob can calculate S1 and redeem Tx1 by providing the signature corresponding to S1 via the unlock script of the (190) Redeem transaction.

[0072] Because this method does not rely on hash puzzles, it can be used to perform atomic swaps across blockchains that do not share a common hash function within the scripting language. All that is required is that the scripting language include sufficient functionality to generate private key puzzles, which is not a very restrictive set of requirements.

[0073] Referring to FIG. 4, in a further embodiment, Alice and Bob each have their own ephemeral key k A and k B and their own private key X A and X B They exchange their ephemeral keys in a similar manner to how they communicated the ephemeral key k0 in the asynchronous embodiment described above. Alice and Bob then select the signature component, i.e., point k A · r, the x component of G A and point k B · r, the x component of G B You can calculate it as follows: X A and X B The remaining signature components of the signature calculated using A and s B Therefore, Sig X A =(r A ,s A ) and Sig X B =(r B ,s B ) k A and k B may or may not be the same in this embodiment, i.e., a common k0 may be used instead.

[0074] This embodiment is carried out according to the following steps. 1. (210A, 210B) Alice and Bob create their own ephemeral keys k A and k B and communicate them with each other. 2. (220A) Alice has a private key X known only to herself. A ∈Z * n She selects the corresponding public key Y A =X A Calculate G. 3. (230) Alice creates a transaction Tx1A with a Redeem script. <CheckSig P B > <Solve Y A ,Y B ,r A ,r B > P B is Bob's public key and his private key X A ,X B Requires you to provide a signature corresponding to <Solve Y A ,Y B ,r A ,r B > is a private key puzzle. At this stage, Bob has the public key Y A The private key corresponding to X A Since Bob does not know the transaction, he cannot redeem the transaction. 4. (220B) Bob has a private key X known only to himself. B ∈Z * n He selects the corresponding public key Y B =X B Calculate G. 5. (240) Bob creates transaction Tx1B with a Redeem script. <CheckSig P A > <Solve Y A ,Y B ,r A ,r B > where P A is Alice's public key.

[0075] Note that the key puzzle portion of the Tx1A and Tx1B scripts is identical. <Solve Y A ,Y B ,r A ,r B > is the private key X A ,X B The signature corresponding to A ,s A ) and (r B ,s B ) is required.

[0076] (250) At this point, Alice is X B Alice does not know B Similarly, Bob cannot calculate X because he does not know A or s A Therefore, neither Alice nor Bob has sufficient information to redeem Tx1A or Tx1B. Both Alice and Bob have their respective signature components s A / s B or private key X A / X B By communicating with each other, they will act honestly. Alternatively, only one of them will act honestly, or neither of them will act honestly. Therefore, one of the following outcomes can occur:

[0077] 6A.1) Alice gives Bob A or X A and Bob sends s B or X B (i.e., both parties behave honestly). (295) Thus, both Alice and Bob have sufficient information to provide signatures for the Redeem scripts of transactions Tx1A and Tx1B that solve the key puzzle therein. Tx1A and Tx1B can therefore be redeemed by Bob and Alice, respectively, by submitting payment transactions that present Tx1A and Tx1B with their respective unlock scripts.

[0078] 6B.2) Bob A or X A By sending the correct s, only Alice will behave honestly, and Bob will not send the correct s B or X B Assume that Bob behaves dishonestly by not sending X or by not sending anything at all. (270) Bob then uses X to solve the key puzzle contained in the Redeem script of Tx1A. A Once Bob submits a Redeem transaction to the blockchain that includes an unlock script configured to redeem Tx1A, the signature (r B ,s B ) is made publicly available. (280) This allows Alice to B Because she knows the key X B The value s that allows us to calculate B Alice then finds out X and therefore has enough information to redeem Tx1B. (290) Alice then finds X to solve the key puzzle contained in the Redeem script for Tx1B. B Submit a Redeem transaction providing the signature in the unlock script that corresponds to

[0079] 6C.3) Neither Alice nor Bob has given the other A / s B or X A / X B (260) In this case, transactions Tx1A and TX1B remain unredeemable until such time as the timelock (if active) expires. The timelock allows control of the transaction to be returned to their respective owners, who submit the appropriate Redeem transaction to the blockchain.

[0080] The symmetric construction of transactions as described in the above embodiment allows for atomic swaps to be performed using transactions constructed from key puzzles, which allows both transactions Tx1A and Tx1B to transfer access to and control of their respective resources to other parties simultaneously, rather than requiring parties to wait for a block to be mined to reveal the necessary information in order to redeem transactions that depend on it.

[0081] An embodiment of the present disclosure that allows for the atomic exchange of access to or control of one or more resources will be described with reference to FIG.

[0082] In this embodiment, Alice controls access to a resource with an ECC public / private key pair. This resource may be funds in one cryptocurrency, may be funded with multiple cryptocurrencies, or may be access to a web app, a rental car, or a cryptographic document, or control of an Internet of Things smart device such as a webcam or door lock. Below, we present a method for Bob to gain access to this resource from Alice using the Bitcoin protocol. This exchange is atomic: Alice redeems the BCH she received from Bob, and Bob gains access to or control of the resource, or nothing happens.

[0083] As an example, consider the case where Bob transfers funds in BCH to Alice, and Alice transfers funds in BCH, Ethereum (ETH), and DASH to Bob.

[0084] This method ensures that the information required by the control part of the ephemeral key to compute the private key that controls the resource is exposed when the atomic swap is complete, eliminating the need for trust when a party grants access to a controlled resource.

[0085] The method includes the following steps. 1. (310) Alice selects an ephemeral key k0 and communicates it to Bob. 2. (320) Alice has a secret key S1∈Z known only to herself. * n She selects a public key P1 = S1 G. This public key controls access to resources and is publicly broadcast.

[0086] (In this example, the resources are BCH, ETH, and DASH funds locked under public key P1.) 3. (325) Alice obtains Bob's public key P B Using this, the deterministic public key P'=P1+P B =P1+S B · Calculate G, and (330) access to the resource is determined by the private key S'=S of the public key P'. B +S1's owner to retrieve it. For example, this could be accomplished by generating a transaction Tx' that sends an amount of cryptocurrency to address P', or by encrypting a document with public key P' and broadcasting the document on an open forum. (In this example, Alice generates BCH, ETH, and DASH transactions to a common address, each locked with the common public key P'.) 4. (340) Bob submits transaction TxB, which is locked in the Redeem script. <CheckSig P A ><Solve P1,r0> 5. (370) Now that Alice knows S1, she can redeem TxB. In this example, this is done on the BCH blockchain. As mentioned above, this allows Bob to calculate S1 from the information provided in Alice's input to the Redeem script. (360) There may or may not be a time constraint on the redemption of Tx' and TxB using a time lock function. The time lock function is configured to allow Tx' and TxB to be returned to Alice and Bob after a certain time has passed. 6. (370) Alice redeems transaction TxB by submitting a Redeem transaction providing a signature corresponding to S1 in the unlock script and disclosing the s portion of the signature to Bob. 7. (380) Bob now calculates S1, and therefore (385) P's private key S'=S B +S1, which gives Bob access to the resources controlled by P'. (In this example, Bob can now spend the BCH, ETH, and DASH funds locked under public key P'.) Even if private key S1 is publicly exposed on the blockchain or otherwise, only Bob can access or control the resource locked in P' because the resource is locked by the combination of S1 and Bob's private key. In this sense, S1 acts as a deterministic key.

[0087] In this example, we can see that it is no longer necessary that the cryptocurrency Bob is purchasing contains specific operations in those scripting languages. All that is required is that Bob spends on a cryptocurrency collection of BCH, and that the transaction is controlled using ECDSA signatures.

[0088] To avoid Bob's resources being locked forever by Alice, a time-locked refund can be introduced into the method: a BCH transaction from Alice to Bob that returns the resources to Bob after a specific relative time has passed, e.g., 24 hours, since Bob's initial transaction to Alice.

[0089] Similarly, Alice may return access to the resources she controls to herself after a certain amount of time has passed. In the multi-cryptocurrency example, this could also be a refund transaction, similar to Bob's.

[0090] It may not be necessary or practical for Alice to return control of the resource to herself if the swap has not completed after a certain amount of time has passed. For example, if the resource is an encrypted document to which Bob has been granted access, there is no harm in Alice keeping the document encrypted with key P' indefinitely.

[0091] Referring to FIG. 6 , an illustrative simplified block diagram of a computing device 2600 is provided that may be used to implement at least one embodiment of the present disclosure. In various embodiments, the computing device 2600 may be used to implement any of the illustrated systems described above. For example, the computing device 2600 may be configured for use as a data server, a web server, a portable computing device, a personal computer, or any electronic computing device. As shown in FIG. 6 , the computing device 2600 may include one or more processors with one or more levels of cache memory and memory controller (collectively labeled 2602), which may be configured to communicate with a storage subsystem 2606 that includes a main memory 2608 and a permanent storage device 2610. The main memory 2608 may include a dynamic random access memory (DRAM) 2618 and a read-only memory (ROM) 2620, as shown. The storage subsystem 2606 and the cache memory 2602 may be used for storage of information such as details associated with transactions and blocks as described in this disclosure. The processor 2602 may be utilized to provide the steps or functions of any embodiment as described in this disclosure.

[0092] The processor 2602 may also communicate with one or more user interface input devices 2612 , one or more user interface output devices 2614 , and a network interface subsystem 2616 .

[0093] The bus subsystem 2604 may provide a mechanism that allows the various components and subsystems of the computing device 2600 to communicate with each other as intended. Although the bus subsystem 2604 is shown schematically as a single bus, alternative embodiments of the bus subsystem may utilize multiple buses.

[0094] The network interface subsystem 2616 may provide an interface to other computing devices and networks. In some embodiments, the network interface subsystem 2616 may act as an interface to receive data from and send data to other systems on the computing device 2600. For example, the network interface subsystem 2616 may allow a data technician to connect the device to a network so that the data technician can send data to and receive data from the device without having to be in a remote location, such as a data center.

[0095] User interface input device(s) 2612 may include one or more user input devices, such as a keyboard, a pointing device such as an integrated mouse, trackball, touchpad, or graphics tablet, a scanner, a barcode scanner, a touchscreen integrated into a display, a voice recognition system, an audio input device such as a microphone, and other types of input devices. In general, use of the term "input device" is intended to encompass all possible types of devices and mechanisms for inputting information into computing device 2600.

[0096] The one or more user interface output devices 2614 may include a display subsystem, a printer, or a non-visual display such as an audio output device. The display subsystem may include a cathode ray tube (CRT), a liquid crystal display (LCD), a light emitting diode (LED) display, or a flat-panel device such as a projection or other display device. In general, use of the term "output device" is intended to include all possible types of devices and mechanisms for outputting information from computing device 2600. The one or more user interface output devices 2614 may be used, for example, to present a user interface and facilitate user interaction with applications that perform the processes and transformations described herein, when such interaction is appropriate.

[0097] The storage subsystem 2606 may provide a computer-readable storage medium that stores the basic programming and data structures that provide the functionality of at least one embodiment of the present disclosure. Applications (e.g., programs, code modules, instructions), which, when executed by one or more processors, provide the functionality of one or more embodiments of the present disclosure, may be stored in the storage subsystem 2606. These application modules or instructions may be executed by one or more processors 2602. The storage subsystem 2606 also provides a repository for storing data used in accordance with the present disclosure. For example, the main memory 2608 and the cache memory 2602 may provide volatile storage for programs and data. The permanent storage device 2610 may provide permanent (non-volatile) storage of programs and data and may include a magnetic hard disk drive, one or more floppy disk drives associated with removable media, one or more optical drives (e.g., CD-ROM, DVD, or Blue-Ray) associated with removable media, and other similar storage media. Such programs and data may include programs for performing the steps of one or more embodiments described in this disclosure and data associated with the transactions and blocks described in this disclosure.

[0098] Computing device 2600 may be of various types, including a portable computing device, a tablet computer, a workstation, or any other device described below. Additionally, computing device 2600 may include another device connectable to computing device 2600 through one or more ports (e.g., USB, headphone jack, optical connector, etc.). A device that may be connected to computing device 2600 may include multiple ports configured to receive fiber optic connectors. Thus, the device may be configured to convert optical signals into electrical signals that are transmitted to computing device 2600 through the ports connecting the device for processing. Due to the ever-changing nature of computers and networks, the description of computing device 2600 shown in FIG. 6 is intended only as a specific example for purposes of describing a preferred embodiment of the device. Many other configurations are possible, having more or fewer components than the system shown in FIG. 6.

[0099] It should be noted that the above-described embodiments illustrate, rather than limit, the present disclosure, and that those skilled in the art can devise many alternative embodiments without departing from the scope of the present disclosure, which is defined by the appended claims. In the claims, any reference signs between parentheses are not intended to limit the claim. The words "comprising" and "comprises", and the like, do not exclude the presence of elements or steps other than those listed in any claim or the specification as a whole. In this specification, "comprising" means "having or consisting of," and "comprises" means "including or consisting of." A singular reference of an element does not exclude a plural reference of such element, and vice versa. The present disclosure can be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In a device claim enumerating several means, several of these means may be embodied by one and the same item of hardware. The mere fact that certain means are recited in mutually different dependent claims does not indicate that a combination of these means cannot be used to advantage. < / g> < / s1> < / g> < / s1> < / x>

Claims

1. 1. A computer-implemented method, performed by a first computing device and a second computing device, wherein both the first computing device and the second computing device know a secret value, the method comprising: providing, by the first computing device, a first blockchain transaction redeemable to enable access to a first resource by providing the first blockchain transaction with at least a signature corresponding to a data item, the data item being determinable only by a control of both a disclosable value and the secret value; providing, by the second computing device, a second blockchain transaction redeemable to enable access to a second resource by providing at least a signature corresponding to the data item in the second blockchain transaction, wherein redemption of the second blockchain transaction causes the second computing device to provide the disclosable value; redeeming, by the first computing device, the second blockchain transaction; A method comprising:

2. The method of claim 1 , wherein the data item comprises a first private key of a first cryptographic key pair.

3. 3. The method of claim 2, wherein the first blockchain transaction, to be redeemable, further requires providing a signature corresponding to a second private key of a second cryptographic key pair, the second cryptographic key pair being associated with an intended recipient of the first resource.

4. 2. The method of claim 1 , wherein the data item includes a deterministic private key of a deterministic cryptographic key pair, the deterministic public key of the pair being derived using a first public key of a first cryptographic key pair and a second public key of a second cryptographic key pair.

5. 5. The method of claim 1, wherein redeeming a blockchain transaction of any of claims 1 to 4 comprises calculating a cryptographic signature corresponding to the data item and comparing a value stored in the transaction with at least a portion of the calculated signature.

6. 1. A system comprising: a processor; a memory containing executable instructions that, when executed by the processor, cause the system to perform the method of any one of claims 1 to 5; A system including:

7. A non-transitory computer-readable storage medium having stored thereon executable instructions that, when executed by a processor of a computer system, cause the computer system to perform at least one of the methods of any one of claims 1 to 5.

Images