System and method for ensuring correct execution of computer programs using a mediator computer system

Abstract

To provide systems and methods capable of ensuring correct execution of computer programs in a distributed computing environment.SOLUTION: In a distributed system, a first computer system is configured to: require computationally verifiable assurances of the authenticity and integrity of computations performed by a second computer system; and delegate execution of a program to the second computer system, where a protocol to make the execution of the program safer is employed to constrain the second computer system to perform correct execution of the program. The protocol may include mitigation and correction routines that mitigate and / or correct incorrect execution of the program, and the protocol may utilize a blockchain network such as a Bitcoin-based blockchain network.SELECTED DRAWING: Figure 4

Description

[Technical Field]

[0001] The present invention relates generally to ensuring the correct execution of computer programs in a distributed computing environment, and more particularly to a protocol for ensuring the correct execution of a program where a first computing entity delegates the execution of the program to a second computing entity. The present invention is particularly suited, but not limited to, for use in blockchain networks. [Background technology]

[0002] In this document, the term "blockchain" may refer to any of several types of electronic, computer-based distributed ledgers. These include consensus-based blockchain and transaction chain technologies, permissioned and unpermissioned ledgers, shared ledgers, and variations thereof. The most widely known application of blockchain technology is the Bitcoin® ledger, although other blockchain implementations have been proposed and developed. For convenience and illustrative purposes, Bitcoin may be referenced as one useful application of the technology described in this disclosure, but Bitcoin is only one of many applications to which the technology described in this disclosure may be applied. However, it should be noted that the present invention is not limited to use with the Bitcoin blockchain, and alternative blockchain implementations and protocols, including non-commercial applications, are also within the scope of the present invention.

[0003] A blockchain is a peer-to-peer electronic ledger, implemented as a computer-based, decentralized, distributed system composed of blocks, which in turn may consist of transactions and other information. In some examples, a "blockchain transaction" refers to an input message that encodes a structured collection of field values ​​containing data and a set of conditions, the fulfillment of which is a prerequisite for the set of fields to be written to the blockchain data structure. For example, in Bitcoin, each transaction is a data structure that encodes the transfer of control of a digital asset between participants in the blockchain system and includes at least one input and at least one output. In some embodiments, a "digital asset" refers to binary data associated with rights to use. Examples of digital assets include Bitcoin, Ether, and Litecoin. In some implementations, the transfer of control of a digital asset can be accomplished by reassociating at least a portion of the digital asset from a first entity to a second entity. Each block in a blockchain may include a hash of the previous block, thereby chaining blocks together to create a permanent, immutable record of all transactions written to the blockchain since its inception. Transactions contain small programs known as scripts embedded in their inputs and outputs that specify how and who can access the transaction's outputs. In the Bitcoin platform, these scripts are written using a stack-based scripting language.

[0004] For a transaction to be written to the blockchain, it must be "validated." Network nodes (mining nodes) perform the work to ensure each transaction is valid; invalid transactions are rejected by the network. Nodes can have different standards for validity than other nodes. Because validity in the blockchain is consensus-based, a transaction is considered valid if a majority of nodes agree that the transaction is valid. A software client installed on a node performs this validation work for transactions that reference unspent transaction outputs (UTXOs), in part by executing UTXO locking and unlocking scripts. A transaction is validated by a node if the execution of the locking and unlocking scripts evaluates to TRUE and other validation conditions, if applicable, are met. Validated transactions are propagated to other network nodes, and mining nodes can then choose to include the transaction in the blockchain. Therefore, for a transaction to be written to the blockchain, it must be i) verified by the first node that receives it, which relays it to other nodes in the network if the transaction is verified; ii) added to a new block constructed by mining nodes; or iii) mined, i.e., added to the public ledger of past transactions.

[0005] While blockchain technology is most widely known for its use in implementing cryptocurrencies, digital entrepreneurs are beginning to explore the use of both the cryptographic security system upon which Bitcoin is based and the data that can be stored on the blockchain to realize new systems. It would be highly advantageous if blockchain could be used for automated tasks and processes that are not limited to the cryptocurrency realm. Such solutions would be more versatile in their application while also being able to take advantage of the benefits of blockchain (e.g., a permanent, tamper-proof record of events, distributed processing, etc.).

[0006] This disclosure describes technical aspects of one or more blockchain-based computer programs. A blockchain-based computer program may be a machine-readable and executable program recorded in a blockchain transaction. A blockchain-based computer program may include rules that can process inputs to generate results, which can then cause actions to be performed depending on these results. One area of ​​current research is the use of blockchain-based computer programs for the implementation of "smart contracts." Unlike traditional contracts that are written in natural language, smart contracts may be computer programs designed to automate the execution of the terms of a machine-readable agreement or agreement.

[0007] Another area of ​​blockchain-related interest is the use of "tokens" (or "colored coins") to represent and transfer real-world entities via the blockchain. Potentially sensitive or secret items can be represented by tokens that have no discernible meaning or value. Tokens thus act as identifiers that allow real-world items to be referenced on the blockchain. Summary of the Invention

[0008] It would therefore be desirable to provide a method and system that improves blockchain technology in one or more of these aspects. Such an improved solution has now been devised. Thus, according to the present invention, there is provided a method as defined in the appended claims.

[0009] According to the present invention, there may be provided a computer-implemented method for a node in a blockchain network, the computer-implemented method including encrypting a secret value under a public key associated with a mediator computer system, providing the encrypted secret value to a worker computer system, the encrypted secret value being usable by the worker computer system and the mediator computer system to collectively execute a first program, making a second program available on a blockchain data structure, the execution of the second program having an input, determining that the blockchain data structure reflects a proof of correct execution of the second program and the input value, the input value being the input, the execution of the second program to generate the proof being based at least in part on using the input value as input to the second program, and, in response to determining that the input value is valid, providing the secret value to the worker computer system, the worker computer system being able to execute the first program using at least the secret value.

[0010] Preferably, the method may include generating a cryptographic hash output based at least in part on the secret value; generating attestation that the encrypted value and the cryptographic hash output are both determined at least in part on the secret value; and providing the cryptographic hash output and the attestation to a worker computer system, the worker computer system operable to use the attestation to determine whether the encrypted secret value and the cryptographic hash output are based at least in part on the same value.

[0011] The proof may be a zero-knowledge proof, and the correctness of the zero-knowledge proof may be computationally verifiable by a worker computer system. Computational verification may include the use of cryptographic operations to provide guarantees of integrity and / or authenticity.

[0012] Preferably, the input value may be a first input value, and the method may include the steps of: calculating a second input value based at least in part on the first input value in response to a determination that the first input value is erroneous; providing the second input value to a worker computer system; and providing the secret value to the worker computer system in response to a determination that the worker computer system has executed a third program using the second input value.

[0013] Preferably, the step of calculating the second input value may include the step of calculating a weighted Hamming distance.

[0014] Preferably, the method may include obtaining second evidence, the second evidence including a set of communications between the worker computer system and the data source, the set of communications usable to determine whether an input value is valid, the second evidence being digitally signed by the data source; verifying authenticity of the second evidence using at least one public key associated with the data source; and determining whether the input is valid based at least in part on the set of communications.

[0015] In some cases, making the second program available on the blockchain data structure includes mining blockchain transactions against the blockchain data structure, the blockchain transactions including information usable to determine the second program and a lock script. The lock script can encumber a movement of a digital asset, and collectively executing the lock script and the corresponding lock script removes the encumbrance on the movement of the digital asset, and collectively executing the lock script and the corresponding unlock script includes verifying that at least two digital signatures belong to a set of digital signatures. The set of digital signatures may include a first digital signature associated with a computing entity that performs the computer-implemented method described herein, a second digital signature associated with a worker computer system, and a third digital signature associated with a mediator computer system. Verification of at least half of the signatures in the set of digital signatures may be performed as part of collectively executing the lock script and the unlock script to remove the encumbrance.

[0016] Execution of the first program may transfer control of the digital asset to a worker computer system.

[0017] Preferably, the method may further include, in response to determining that the worker computer system failed to execute the third program using the second input values ​​within the time threshold, making a fourth program available to the blockchain data structure, the fourth program usable to gain control of the digital asset.

[0018] The time threshold may encode the earliest time that a blockchain transaction that includes part of the fourth program can be mined into the blockchain data structure.

[0019] Preferably, the method may include generating a digital signature and encoding the digital signature into an unlock script, the unlock script may further encode a purported digital signature associated with the worker computer system, the fourth application including the lock script and the unlock script, and execution of the fourth program by one or more nodes of a blockchain network associated with the blockchain data structure includes determining that both the digital signature and the purported digital signature are valid.

[0020] The first application may include a lock script and an unlock script, where the unlock script encodes a purported secret value and a purported digital signature associated with the worker computer system. Execution of the first application by one or more nodes of a blockchain network associated with the blockchain data structure may include determining that the purported secret value and the purported digital signature are both valid.

[0021] The lock script may include the cryptographic hash output. Determining that the purported secret is valid may include calculating the output of a cryptographic hash algorithm using the purported secret value and determining that the output and the cryptographic hash output match.

[0022] It is further desirable to provide a system including a processor and a memory containing executable instructions that, upon execution by the processor, cause the system to perform any of the claimed methods.

[0023] It is further desirable to provide a non-transitory computer-readable storage medium having stored thereon executable instructions that, upon execution by one or more processors of a computer system, cause the computer system to perform at least any of the claimed methods.

[0024] Additionally or alternatively, the present invention may provide improved blockchain programming tools or assistance, which may provide improved, efficient, and optimized configurations that facilitate or enable distributed, verifiable computation. [Brief explanation of the drawings]

[0025] These and other aspects of the invention will be apparent from and elucidated with reference to the embodiment(s) described hereinafter. One embodiment of the present invention will now be described, by way of example only, with reference to the accompanying drawings, in which: [Figure 1] 1 illustrates an environment for verifying correct execution of a program, according to at least one embodiment. [Figure 2] 1 illustrates a computing environment that may be utilized to implement a protocol, according to various embodiments. [Figure 3] 1 shows a diagram of an environment suitable for performing verifiable computations. [Figure 4] 1 shows a diagram of an environment in which protocols may be implemented to enforce correct execution of programs in a distributed computing environment. [Figure 5] 1 illustrates an example of a transaction record according to a blockchain-based protocol for enforcing correct program execution in a distributed computing environment. [Figure 6]FIG. 10 is a diagram illustrating a process for requesting execution of a program according to a protocol. [Figure 7] FIG. 10 is an exemplary diagram of a process for verifying correct execution of a program according to a protocol. [Figure 8] FIG. 10 is an exemplary diagram of a process for satisfying a request for program execution according to a protocol. [Figure 9] FIG. 10 is an example diagram of a process for executing a correction routine according to a protocol. [Figure 10] FIG. 10 is an exemplary diagram of a process for arbitrating a dispute according to a protocol. [Figure 11] 1 illustrates a computing device that can be used to implement at least one embodiment of the present disclosure. DETAILED DESCRIPTION OF THE INVENTION

[0026] In various embodiments, the systems and methods described herein are utilized to ensure the correct execution of computer programs in a distributed computing environment in which multiple entities may control nodes of the distributed computing environment. In such a distributed environment, it can be difficult for a computing entity to delegate the execution of a task to another entity, at least because the two entities lack a trust relationship that provides the delegating entity with assurance that the executing entity actually performed the task and performed the task correctly. Protocols according to the present disclosure can be utilized to provide cryptographically verifiable assurance of the correct execution of a program, where a first computing entity delegates the execution of the program to a second computing entity. Thus, the use of such protocols can be utilized to improve the efficiency of a computing system (e.g., a distributed computing environment) by more efficiently utilizing available computing resources across the system to execute the program while providing cryptographically verifiable assurance that the program executed correctly.

[0027] 1 illustrates an environment in which the systems and methods described herein may be utilized to enforce and / or ensure the correct execution of a program. In some embodiments, a first computer system (e.g., client 102) delegates execution of a program 108 to a second computer system (e.g., prover 104). The prover 104 may execute the program and provide a proof of correct execution 110 to the client 102 that attests that the prover 104 executed the program correctly (e.g., using correct values ​​for inputs, which may be received from an additional computer system). In some cases, a third computer system (e.g., mediator 106) may be utilized to determine whether the prover executed the program 108 correctly according to a protocol. The techniques described herein may be implemented in a distributed computing environment and utilized in connection with a blockchain network.

[0028] The client 102 may refer to a computer system that delegates the execution of a computational task to the prover 104, which may be a different computer system. The prover 104 may, generally speaking, be any suitable computer system capable of executing a computational task, which may be encoded in any suitable format, such as a program 108. The client 102 may select the prover 104 from among multiple computer systems capable of executing a program. The prover 104 may also be a computer system over which the client 102 has no control and which, generally speaking, is not required to have a trust relationship with the client 102; the client 102 does not require any further assurance, outside of the protocols described herein, that the prover 104 will perform an action in a particular way (e.g., execute a program according to a set of inputs specified by the client 102).

[0029] Program 108 may refer to a computational task and may be generated using the techniques described in connection with FIG. 2. Program 108 may be, for example, a quadratic program Q as described in connection with FIG. 2. Generally speaking, program 108 may have one or more inputs that, in conjunction with a set of instructions, are used to determine one or more outputs. The inputs and / or outputs may be utilized to generate proof of correct execution 110, which is a proof generated by prover 104 that is computationally verifiable evidence that the inputs and / or outputs have the correct values. In one embodiment, the proof is a zero-knowledge proof.

[0030] The mediator 106 may be a computer system that has and / or establishes a trust relationship with the client 102 and / or the verifier 104. In this context, a trust relationship may refer to the mediator being determined by the client 102 and / or the verifier 104 to be an appropriate entity to mediate disputes that may arise between the client 102 and the verifier 104. For example, a trust relationship may refer to a willingness to grant the mediator the ability to implement one or more correction programs in collaboration with either one of the clients or the verifier.

[0031] In some embodiments, the protocol enables the execution and verification of a program through blockchain transactions. As described in further detail herein, a zero-knowledge protocol may have a set of stages, including, but not limited to, a creation stage, a computation stage, and a verification stage. During the creation stage, calculation of public parameters that can be used to generate and verify a zero-knowledge proof is performed. During the execution stage, the program may be executed based on one or more inputs, which may include data obtained from sources external to the blockchain, such as a trusted authority, a website, etc. The prover may obtain data from an external data source as part of the execution of the program. During the verification stage, the inputs may represent one or more parameters of a verification function executed according to the zero-knowledge proof verification. In some cases, it is desirable to have a protocol that ensures that the inputs used to execute a program are correct. In other words, it may be desirable to constrain the prover to behave correctly and provide accurate inputs when executing the program.

[0032] 2 illustrates a computing environment 200 that may be utilized to implement a protocol according to various embodiments. The protocol may be implemented using blockchain technology to store proofs of correctness and combine a "correct-by-construction" cryptographic approach with smart contracts. In one embodiment, the publicly verifiable computation scheme includes three phases: a setup phase, a computation phase, and a verification phase.

[0033] The setup phase may be performed as part of a process of outsourcing the execution of a computational task. A client, as referred to below, may refer to an entity such as a customer or client computer system that delegates the execution of a computational task to a prover, and a prover may be a different computer system. A client may delegate the execution of a computational task for a variety of reasons, generally speaking, including, but not limited to, limited computing resources, a lack of computing resources, financial costs associated with utilizing the client computer system to perform a task, energy costs associated with utilizing the client computer system to perform a task (e.g., a mobile device or laptop that relies on a battery for power may utilize a prover to perform a computationally intensive task, thereby conserving power and extending the use of the battery-powered device), etc.

[0034] In one embodiment, the setup phase involves a client, customer, employee of an organization, or any other suitable entity writing a contract in a formal language with precise semantics. The contract may be written in a high-level programming language such as C or Java. Generally speaking, the contract may be expressed in any language or syntax that can be converted or translated into a format that can be manipulated by a computer system. In one embodiment, a domain-specific language may provide type safety for limited purposes, and limited expressivity may be utilized. The generated source code may be a precise description of the contract.

[0035] The compiler 202 may be any hardware, software, or combination thereof, including executable code that, when executed by one or more processors of a computer system, causes the system to take source code 206 as input and generate a circuit. The compiler 202 may refer to a computer program that executes or performs instructions based on instructions compiled into a machine-readable format, such as binary code. While the compiler 202 is illustrated, it should be noted that interpreters, assemblers, and other suitable software and / or hardware components may be utilized to convert source code into a circuit. In one embodiment, the circuit is an arithmetic circuit comprising wires that carry values ​​from a field F and connect to logic and / or arithmetic gates. In one embodiment, the circuit C is used by the system to generate a quadratic program Q 208, which includes a set of polynomials that provide a complete description of the original circuit C.

[0036] In one embodiment, the compiler 202 can recognize a substantial subset of a programming language, such as C or Java, including, but not limited to, preprocessor directives, static initializers, global and local functions, block-scoped variables, arrays, data structures, pointers, function calls, functional operators (e.g., functors), conditionals and loops, and arithmetic and bitwise Boolean operators. In one embodiment, the compiler 202 does not support the entire set of commands from a programming language standard (which may in some cases be intended to prevent certain types of algorithms from being executed in smart contracts, such as disallowing recursive algorithms). In one embodiment, the compiler extends the representation of the source code to an arithmetic gate language to generate arithmetic circuits. Circuit implementations have previously been considered by Campanelli, M. et al. (2017) in "ZERO-Knowledge Contingent Payments Revisited: Attacks and Payments for Services" and by Tillich, S. and Smart, B. in "Circuits of Basic Functions Suitable For MPC and FHE." The arithmetic circuitry may be utilized by compiler 202 or any other suitable hardware, software, or combination thereof (e.g., software modules not shown in FIG. 2) to construct a quadratic arithmetic problem (QAP). The quadratic program, according to one embodiment, is compiled into a set of cryptographic routines for the client (e.g., key generation and verification) and the prover (e.g., computation and proof generation).

[0037] In one embodiment, the key generator 204 is hardware, software, or a combination thereof that includes executable code that, when executed by one or more processors of a computer system, causes the system to generate evaluation and verification keys that form a quadratic program. The approach of encoding computations as quadratic programs is considered in "Quadratic Span Programs and Succinct NIZKs without PCPs" by Gennaro, R. et al. (2013). In one embodiment, a quadratic arithmetic problem (QAP) Q encodes a circuit C over a field F and solves a set of m+1 polynomials, i.e., V={v k (x)},W={w k (x)},Y={y k (x)} where 0≦k≦m. A target polynomial t(x) is further defined. Given a function f that takes n elements of F as input and outputs n' elements, for N=n+n', Q is a function of {c1,...,c N}∈F N is a valid assignment of the input and output groups of f, and t(x) divides p(x), i.e.,

number

[0038] In one embodiment, the construction of a QAP for an arithmetic circuit involves multiplying an arbitrary root r for each multiplication gate g in the circuit. g ∈F and define the target polynomial as

number

number

[0039] The output of a gate is equal to the product of its inputs. A divisibility check is done by checking p(r g ) = 0 for each gate g and root r of t(x). g The QAP is decomposed into separate checks of deg(t(x)), one for each gate. The addition gates and multiplication-by-constant gates do not contribute to the size or degree of the QAP.

[0040] In one embodiment, the QAP is defined over a field Fp, where p is a large prime number. In one embodiment, a QAP over Fp is desired to efficiently compute any function that can be expressed in terms of addition and multiplication modulo p. An arithmetic split gate is a gate over the field [0, 2 k-1 ] into k binary output wires. Boolean functions can therefore be expressed using arithmetic gates. For example, NAND(a,b)=1-ab. Each embedded Boolean gate costs only one multiplication. Furthermore, new gates such as split can be defined standalone and composed with other gates. k-1 ] is known to be an input a∈F pGiven, the split gate is Σ k 2 i-1 a i = a and each a i The binary digits a1,...,a of a such that is either 0 or 1 k It outputs k wires that hold

[0041] Finally, the public parameters used by all provers and verifiers are generated by the system as part of the setup phase. K and the verification key V K Note that is derived using a secret value selected by the client. The key generator 204 utilizes a Quadratic Arithmetic Program (QAP) in conjunction with the key generation algorithm to derive the evaluation key E K 210 and verification key V K 212 may be generated.

[0042] In one embodiment, the execution of the computational task involves the prover calculating a function on input 216 (i.e., evaluating f(x)). In one embodiment, the prover is any suitable computer system to which a client can delegate a computational task. In one embodiment, input 216 includes information that is evidence of the prover's identity, such as a digital signature generated using a private key associated with the prover. In one embodiment, the prover is a computer system to which a client agrees to transfer digital assets in exchange for successfully completing the computational task. In one embodiment, the client provides the prover with input x and evaluation key EK, and the prover uses evaluation module 214 against a computation routine to calculate output y (i.e., y=f(x), where the input is x and the function is f) and generates proof of correctness 218 using evaluation key 210. In one embodiment, the evaluation module is hardware and / or software that includes instructions that, when executed by one or more processors of the computer system, cause the computer system to evaluate the values ​​of the internal circuit wires of QAP 208 and generate the QAP's output y.

[0043] In one embodiment, each polynomial v in the quadratic program k (x)∈F is an element g in the bilinear group vk(s) where s is a secret value chosen by the client, g is a group generator, and F is the field of discrete logarithms of g. In one embodiment, for a given input, the prover evaluates the circuit to find the coefficient c of the quadratic program. i Therefore, the prover obtains the values ​​of the output and internal circuit wires corresponding to v(s)=Σ k∈{m} c k ·v k Evaluate (s) and v(s) Calculate w(s) and y(s), and then calculate h(x)=p(x) / t(x)=Σ d h i x i Calculate h in the evaluation key i and g s(i) Using the term g h(s) In one embodiment, the proof of correctness 218 can be calculated as (g v(s) ,g w(s) ,g y(s) ,g h(s) ), and the verifier uses a bilinear map to check that p(s) = h(s) · t(s). In one embodiment, the proof π is stored on the blockchain network 222 for later use or can be verified by multiple parties without requiring the prover to interact with each of them separately. In one embodiment, circuit-stored evaluation of the proof of correctness can be performed to unlock resources (e.g., digital assets) that are blocked by the transaction's locking script.

[0044] 2 includes blockchain nodes implemented as peer-to-peer distributed electronic devices, each executing instances of software and / or hardware that perform operations according to a blockchain protocol agreed upon at least in part among the node's operators. In some examples, a "node" refers to a peer-to-peer electronic device distributed across the blockchain network. One example of a blockchain protocol is the Bitcoin protocol.

[0045] In one embodiment, at least some of the nodes are mining nodes that perform complex computations, such as solving cryptographic problems. Mining nodes that solve cryptographic problems create new blocks for the blockchain and broadcast the new blocks to the other nodes. The other nodes validate the mining node's work and, upon validation, accept the block into the blockchain (e.g., by adding it to the blockchain's distributed ledger). In some examples, a block is a group of transactions, often marked with a timestamp and a "fingerprint" (e.g., a hash) of the previous block. In this way, each block can become linked to the previous block, creating a "chain" that links the blocks in the blockchain. In embodiments, valid blocks are added to the blockchain by consensus of the nodes. Also, in some examples, the blockchain includes a list of attested blocks.

[0046] In one embodiment, the proof π is broadcast to the blockchain network 222, and a verifier 220 is used to verify the proof. In one embodiment, the verifier 220 is any suitable computing entity, such as a node on the blockchain. Additionally, in some cases, an evaluation key E K and verification key V KNote that the same computing entity that generates the proof also verifies the proof. In one embodiment, a node in the blockchain generates a verification key V K and the proof π to prove the transaction that transfers control of the digital asset, and therefore prove the contract if the verification is successful. One requirement of the protocol is that the prover must have a verification key V K Therefore, in this protocol, the common reference string (CRS) is provided by the client, or at least by the evaluation key E. K and verification key V K In one embodiment, the public verification key V K can be used by any computing entity to verify a computation.

[0047] Generally speaking, a client can use standard transactions (e.g., standard transactions defined in a Bitcoin-based blockchain network) such as P2PK (pay-to-public-key) and P2PKH (pay-to-public-key-hash) to pay a counterparty or prover. For example, in one embodiment, a client converts a P2PK lock script into an arithmetic circuit and broadcasts a transaction including a puzzle derived from the circuit. The counterparty or prover receives the circuit, provides appropriate inputs (e.g., information evidencing the prover's identity, such as a secret shared between the client and prover or a digital signature generated using the prover's private key), and executes the circuit to generate a proof of correctness π. In one embodiment, the proof is used to unlock a digital asset; further, information identifying the counterparty or prover (e.g., a public key and / or digital signature associated with the counterparty or prover) may not be recorded on the blockchain in an unobfuscated format.

[0048] In one embodiment, the verification key and corresponding proof are generated according to the techniques described above and / or below. K and proof π, i.e.,

number

[0049] Verification key V K , proof π, and (a1, a2,..., a N ), t(x) divides p(x), so (x N+1 ,...,x m )=f(x0,...,x N To verify that α is true, the verifier proceeds as follows: First, it checks all three α terms.

number

number

number

number

number

[0050] Thus, given the notation from the above sections and examples described in this disclosure, validation, according to one embodiment, involves a set of paired checks of the following elements:

number

[0051] FIG. 3 illustrates a diagram 300 for coordinating the execution of a verifiable computation. A client 302, a prover 304, and a verifier 306 may be nodes in a blockchain network. The client 302 may be any suitable computer system and may include executable code that, when executed by one or more processors of the computer system, causes the computer system to receive a smart contract 308. In one embodiment, the smart contract 308 is encoded in a high-level programming language as source code, such as C, C++, or Java. In one embodiment, software such as a compiler, interpreter, and / or assembler may be utilized to transform the smart contract 308 into an arithmetic circuit 310, which is a set of arithmetic circuits that are based on a set of variables.

number

[0052] In one embodiment, client 302 provides arithmetic circuit 310 to prover 304, which obtains input 312 to the circuit. The source of the input data may be data stored on the blockchain or obtained externally as a result of interacting with a specific data feed specified for arithmetic circuit 310. The input data may be obtained from a data feed, such as a data provider 320 and / or a trusted entity 322, via a network 318, such as a local network, an internal network, a public network such as the Internet, a wide area network, a wireless network, a mobile network, a satellite network, or a distributed computing system with multiple network nodes. In some cases, input 312 may be data, such as data about real-world states and events. Circuit 310 may be used to generate quadratic program Q, which includes a set of polynomials that provide a complete description of the original circuit. In either case, prover 304 may execute circuit C or quadratic program Q on input 312 to generate one or more output intermediate outputs and one final output. In some embodiments, the prover is expected to obtain as output a valid transcript of {C, x, y}, which is an assignment of values ​​to the circuit wires such that the value assigned to the input wire is that of x, the intermediate values ​​correspond to the correct operation of each gate in C, and the value assigned to the output wire is y. If the asserted output is incorrect (i.e., y ≠ P(x)), then there is no valid transcript of {C, x, y}. In one embodiment, the prover is expected to provide a subset of the values ​​of the circuit wires, and the selected subset of the values ​​of the circuit wires is not known a priori to the prover.

[0053] In one embodiment, the prover 304 obtains external data from the data provider 320 in the following manner: The prover 304 and the data provider 320 establish a cryptographically secured communications session; The prover 304 makes a request over the cryptographically secured communications session; The data provider provides data in response to the request; The prover receives the data and, in response to receiving the data, requests proof of communications between the parties; The data provider provides a cryptographically verifiable proof-of-communications between the prover and the data provider during the cryptographically secured communications session. Communications The prover 304 calculates and digitally signs the evidence with the data provider's private key. The prover receives the proof of communication. Generally speaking, a proof of communication is cryptographically verifiable evidence that one or more communications occurred between a client and a server (e.g., between the prover 304 and the data provider 320). In one embodiment, the evidence can be used to verify the content of the communication between the client and the server, although it should be noted that in some cases, portions of the communication may be redacted (e.g., information whose disclosure is subject to legal restrictions), such as by replacing the redacted information with obfuscated information (e.g., information in encrypted or hashed format), or replaced with a predetermined default value. In one embodiment, the evidence is determined at least in part based on the root value of the Merkle tree. In one embodiment, the evidence (e.g., the proof of communication) is digitally signed using a cryptographic private key accessible to the data provider 320. An entity such as a certificate authority may issue a digital certificate certifying that a cryptographic public key corresponds to the private key. For the purposes of this disclosure, a proof of communication will be represented by the notation π Communications Although it is commonly referred to using Prover, or more simply as π. The techniques for obtaining data from data provider 320 and / or for verifying the integrity and / or authenticity of data obtained from data provider 320 may be performed in accordance with the techniques described in UK Patent Application No. 1720946.1.

[0054] In one embodiment, the trusted entity 322 or trusted authority may be an entity, such as a computing system, that is expected to have access to the input data (e.g., now or in the future). The public key of the data feed may be embedded in the locking script, which constrains the signatures and messages in the unlocking script to have a mathematical relationship to the key rather than a fixed value. In this way, the lock is configured so that any modification of the data is detected and corrective action, such as mitigation and / or invalidation, can be taken. Pending data may be used to lock the digital asset and may be data that is not yet known to the locking node when the locking script is configured. This data may be data that has not yet been established (e.g., data that is expected to be created in the future but has not yet been created) or data that is known to another node but not yet available to the locking node. However, the data is data that is expected to be available (now or in the future) from the trusted entity 322. The locking script may include a public key for a determined data source (e.g., a trusted entity 322) and instructions that cause a verifying node executing the locking script to verify the source of the data provided in the locking script by a) generating a modified public key based on the public key for the determined data source and based on data defined in the unlocking script, and b) evaluating the signature in the unlocking script based on the modified public key. Techniques for utilizing a trusted entity 322 according to various techniques described herein may be according to those described in connection with UK Patent Application No. 1705749.8.

[0055] In an embodiment, the output y, the values ​​of the internal circuit wires (or a subset thereof), and the evaluation key E K is used to generate a proof of correctness 316. The proof π can be stored on the blockchain and verified by multiple parties without requiring the prover 304 to interact with multiple parties separately. In this way, the verifier 306 receives the public verification key V K and proof π can be used to verify the broadcasted transaction, thereby verifying the contract. In some cases, the client 302 may recover any digital assets impeded by the broadcasted transaction if the verification fails. In some cases, the verifier 306 and the client 302 are the same computer system.

[0056] In one embodiment, Figure 4 shows a diagram 400 of a protocol for securing program execution, where input data of a program (e.g., a smart contract) is attested. In one embodiment, the protocol provides automatic compensation for potential damage caused by erroneous execution of the program. Client 402, Prover 404, and Mediator 406 may follow protocols described elsewhere in this disclosure.

[0057] As discussed elsewhere, a client, such as client 402 shown in Figure 4, may refer to a computer system controlled by an entity, where the client computer system and / or client entity is a party to a contract. For example, client 402 may be associated with an entity that places an order to purchase a token in exchange for a digital asset, such as Bitcoin, which is then transferred to the token's issuer or owner. The token may be a smart contract.

[0058] A prover 404 may be a computer system that monitors a network for transactions that embed or reference programs such as smart contracts, as described elsewhere. For example, a prover 404 may be a node in a blockchain network. A prover may also be referred to as a worker or a worker computer system.

[0059] The mediator 406 may be a mediator computer system that has and / or establishes a trust relationship with the client 402 and / or the prover 404. In this context, a trust relationship may refer to the mediator being determined by the client 402 and / or the prover 404 to be an appropriate entity to mediate disputes that may arise between the client 402 and the prover 404. For example, a trust relationship may refer to a willingness to cooperate with either the client or the prover to grant the mediator the ability to unlock digital assets associated with the execution of a smart contract. For example, a mediator may be used to provide automatic compensation for damages that may result from the erroneous execution of a program (e.g., a smart contract).

[0060] The client 402 can determine a secret value, which can be randomly or pseudo-randomly generated. The secret value may refer to a value that should not be provided in clear to the prover 404 until the client 402 determines that the security deposit posted by the prover 404 is acceptable for return. Note that in some cases, the security deposit serves as an incentive for the prover 404 to follow a protocol regarding the correct execution of the program. The prover 404 risks losing control of assets immobilized by the security deposit transaction if the protocol is not followed. Thus, the client 402 may reveal the secret value to the prover 404 in response to the client 402 determining that the prover 404 has fulfilled all of the prover's responsibilities according to the protocol.

[0061] After determining the secret value, the client 402 may encrypt the secret value, thereby generating an encrypted secret. The secret value may be encrypted using a public key associated with the mediator 406 to generate a ciphertext. In one embodiment, the mediator 406 is jointly selected by the client 402 and the prover 404. In one embodiment, the mediator 406 is a node in the blockchain network described in connection with FIG. 1. In one embodiment, the secret value is encrypted under a symmetric key known to both the client 402 and the mediator 406. The client 402 may compute a hash output using the secret value as input to a cryptographic hash algorithm, such as the SHA-256 cryptographic hash algorithm. Additionally, the client 402 may generate a proof that the ciphertext and the hash output both encode the same secret value. In one embodiment, the proof is a zero-knowledge proof. The client 402 may send the ciphertext, the hash output, and the proof to the prover 404 as part of the protocol.

[0062] A prover 404 can post a margin deposit transaction to the blockchain network, which blocks the movement of the prover's 404's digital assets and is used to ensure the prover 404 follows the protocol. If the prover 404 does not follow the protocol, the prover 404 risks losing the assets blocked by the margin deposit transaction. In one embodiment, a margin deposit transaction is created by the prover 404 and redeems a previous transaction of value D bitcoins and can be redeemed in two ways: first, by publishing the prover's 404's private value and digital signature (called a recover deposit transaction), or second, by the generation of digital signatures for the same transaction by both the client 402 and the prover 404 (called a compensation transaction). A margin deposit transaction can reference a previous transaction with a UTXO of D bitcoins (or other suitable digital assets) belonging to the prover 404. A margin deposit transaction may include one or more inputs, such as a digital signature of the attester 404. The type and / or amount of digital assets blocked by a margin transaction may be mutually agreed upon by the client 402 and the attester 404 or may be specified by the client 402 and may be selected based at least in part on the maximum damage that could be caused by running a program using erroneous input data.

[0063] In one embodiment, client 402 and a counterparty agree on terms for the execution of a program (e.g., a smart contract). The counterparty can create a lock transaction, one of whose outputs is locked by the program (e.g., a smart contract script), and send it to client 402. The counterparty is sometimes referred to as the issuer of the program (e.g., a smart contract). Note that at this point, the lock transaction is not yet valid because the value of the input does not equal the value of the output of the lock transaction. When client 402 receives the lock transaction, client 402 adds the input to the lock transaction and unlocks a UTXO controlled by client 402 to transfer to the issuer the agreed-upon digital asset, as well as an output bearing the fee payable to prover 404 for the execution of the program (e.g., a smart contract), and a multi-signature unlock script that unlocks the fee when two of the following three signatures are provided: a signature from client 402, a signature from prover 404, and a signature from mediator 406. In response to detecting that the prover 404 has posted the margin deposit transaction, the client 402 can broadcast the lock transaction to the blockchain network.

[0064] The prover 404 can collect external data and compute the zero-knowledge proof required for contract execution. Collecting external data may involve notarizing communications with the data source. One approach to notarizing communications is considered by Hajjeh and M. Badra in "TLS Sign," which defines a new subprotocol called TLSSignOnOff, in which the client (which may be a different entity than the client described in the context of zero-knowledge protocols) and server inform their peers when they start or stop sending signed data. After the stop message, the server collects a hash of the conversation and signs it. Various other approaches for notarizing record data of cryptographically secured communication sessions (e.g., storing a record of the session and signing the conversation with a cryptographically verifiable proof of the authenticity and / or integrity of the recorded conversation) can be used, such as those described by R. Housley and M. Brown, "Transport Layer Security (TLS) Evidence Extensions," and by H. Ritzdorf, K. Wust, A. Gervais, G. Felley, and S. Capkun, "TLS-N: Non-repudiation over TLS Enabling Ubiquitous Content Signing for Disintermediation," which define an evidence window that begins when the client makes a request; when one of the parties closes the evidence window, hashes of the messages and a timestamp of the evidence's creation are signed by the server, optionally concealing the confidential record. Techniques for gathering external data may follow those described in Gathering external data or may utilize trusted data sources in connection with UK Patent Application No. 1705749.8. The prover 404 can broadcast the unlock transaction to the blockchain network.

[0065] After the prover 404 broadcasts the unlock transaction, a verifier computer system can perform a verification process to determine whether the proof of correct execution is valid. In some embodiments, the verifier is a computing entity distinct from the client 402, but need not be, and the client may perform the verification process. In one embodiment, the verification process includes both verifying the validity of the proof of correct execution (e.g., that an output was generated from the circuit based at least in part on one or more inputs to the circuit) and also verifying that the data inputs to the circuit by the prover 404 were correct inputs. For example, the verification may include checking whether the values ​​of the inputs to the program are expected values ​​based on a notarized exchange from a trusted data source that provides external data (e.g., flight information for which the parties are insured against delays, weather data for a financial derivatives contract that uses a weather data feed instead of a price index for crop insurance).

[0066] If the client 402 (or, more generally, any suitable system performing a verification process) determines that the input data is incorrect, the prover 404 can calculate a loss d that reflects the difference between a first output generated based on the correct input values ​​and a second output generated based on the incorrect input values ​​broadcast by the prover 404 in the unlock transaction. For example, a smart contract (e.g., a program) may insure a party against the delay of a particular flight, and execution of the program may include determining whether a particular flight was delayed using external data, such as flight information for a particular commercial flight on a particular day. If the flight is delayed, the party to the program may receive a transfer of assets (e.g., a smart contract providing travel insurance against delays). Various extensions, modifications, and alternative embodiments are also contemplated herein. For example, the transfer of assets may be based, at least in part, on additional criteria, such as that the delay is due to a specific reason (e.g., weather-related delay / cancellation), that the delay be for at least a certain duration (e.g., only delays greater than three hours are insured), and that the transfer vary depending on the duration of the delay (e.g., longer delays are insured for a larger amount). As a second example, if the input to the program corresponds to an exchange rate between currencies, the damage d may measure the difference in the amount that the client 402 should receive based on the correct currency exchange rate (e.g., based on a rate encoded in a communication session notarized by a trusted source) and the currency exchange rate that the prover 404 used to execute the program. In one embodiment, the prover 404 delegates the calculation of the damage d to another computer system, such as a different worker than the prover 404 shown in FIG. 4. Note that in some cases, the system may require the prover 404 to calculate the damage. In one embodiment, a zero-knowledge proof of the damage amount may be generated to provide evidence of the damage amount, which may correspond to the output of a different circuit (e.g., a program).

[0067] Once the system (e.g., client 402) calculates or otherwise determines (e.g., by receiving the results of the calculation from another prover) the damage value, the system can make the calculated damage value available to the prover 404. In one embodiment, the calculated damage value and a zero-knowledge proof of the validity of the damage value are made available to the prover 404 by broadcasting the damage value and / or the proof to the blockchain network, which may allow other nodes in the blockchain to determine whether the damage value is correct. In one embodiment, the damage value and / or the proof are made available to the prover 404 external to the blockchain. For example, the system can send a message to the prover 404 in any suitable manner, where the message includes the damage value and / or the proof. In some embodiments, the system provides the damage to the prover 404 if and only if the damage value is non-zero.

[0068] In some embodiments, the prover 404 receives or otherwise obtains the damage value. If the damage value is zero, the prover 404 may proceed in the same or similar manner as if no damage value had been received. For example, the prover 404 may receive a message indicating that the damage associated with the execution of a particular program (e.g., a smart contract) is zero and determine that a compensation routine does not need to be executed. In one embodiment, the prover 404 waits for the client 402 to provide a secret value. The secret value may be usable to redeem a digital asset that was blocked by the blockchain transaction. For example, the blockchain transaction may include a lock script and an unlock script that, when executed collectively, verify that the correct secret value was provided in the unlock script and unblock the digital asset.

[0069] However, if the prover 404 receives a damage value that is non-zero, the prover 404 may perform one or more actions according to the protocol. In one embodiment, the prover 404 receives the damage value and a corresponding zero-knowledge proof for the damage value. The prover 404 may verify the proof. If the proof is verified, the prover 404 may make a decision as to whether the prover 404 agrees with the value of the damage value it received. In one embodiment, the prover 404 performs any suitable set of actions to determine the damage value, such as by running a program that calculates the damage, delegating execution of the program to another computing entity (e.g., the prover 404 thereby becomes a client for execution of the program by a different prover), etc.

[0070] If the damage value determined by the prover 404 matches the damage value provided to the prover 404, the prover 404 determines that the damage value is correct and may perform one or more steps that result in the transfer of control of assets equal to the damage value d to the client 402 as compensation. In one embodiment, the prover 404 broadcasts a transaction to the blockchain network that includes the transfer of control of assets equal to the damage value d to an address associated with the client 402. However, if the prover 404 determines a different value for the damage (or the zero-knowledge proof does not verify), the prover 404 may provide a time-stamped transcript of the conversation to the mediator 406. The mediator can use the transcript to determine whether the damage value calculated by the client 402 or the prover 404 is correct.

[0071] The prover 404 may receive the secret value at various times and from various entities. For example, the secret value may be provided to the prover 404 by the client 402 upon verifying proof of correct work that the prover 404 correctly executed a program (e.g., a smart contract) and that one or more inputs used to generate the program's output match expected values ​​based on data external to the blockchain (e.g., data whose correctness and / or value cannot be computationally verified using only data stored in the blockchain network). The client 402 may provide the secret value to the prover 404 upon calculating a damage value d and receiving a transfer of digital assets as compensation from the prover 404 in that amount. The prover 404 may receive the secret value from the mediator 406 in response to the mediator determining that the damage value d provided by the client 402 to the prover 404 was incorrect, that a transfer of digital assets equal to the damage value d′ has been made to the client 402, or a combination thereof.

[0072] Upon receiving the secret value, the prover 404 can generate a blockchain transaction to recover the digital asset blocked by the margin deposit. The prover 404 may generate a blockchain transaction that includes an unlock script that encodes the secret value and the prover's 404 digital signature. The corresponding lock script that blocks the digital asset can include instructions to verify that the unlock script encoded the correct secret value by comparing a hash of the secret value to the output value encoded in the lock script, and further to verify the digital signature of the lock script using a public key associated with the prover 404. Thus, the lock script and unlock script can collectively form a program that, when executed, transfers control of the digital asset blocked by the lock script of the margin deposit transaction. In some embodiments, the blockchain transaction to recover the digital asset is executed when the escrow recovery transaction is executed for a period t wIn one embodiment, this restriction is encoded in the lock script. In some embodiments, the restriction is not programmatically encoded, but is limited to a time limit such that the block must be broadcast (e.g., mined) to the blockchain network within time t w A different transaction (e.g., a compensation transaction) may then be enforced on behalf of the client 402 by allowing the client 402 to claim the digital assets that were blocked by the margin transaction.

[0073] For example, in one embodiment, client 402 determines that input values ​​used by prover 404 to execute a program (e.g., a smart contract) are not expected input values ​​based on information obtained from a trusted source (e.g., via a notarized communication session) and sends a message to prover 404 indicating a calculated damage value d. If prover 404 does not transfer digital assets corresponding to at least the compensation value of d, client 402 may wait until time t to post a blockchain transaction to claim the digital assets in the margin deposit. w The compensation transaction may encode the digital signatures of both the client 402 and the prover 404, and the compensation transaction may wait until time t w The compensation transaction may be time-locked so that it cannot be mined against the blockchain network before the start of the protocol. The compensation transaction may include an unlock script that allows the client 402 to control the digital assets that were blocked by the margin deposit transaction. In one embodiment, the body of the compensation transaction is signed by the prover at the start of the communication, which may be at or before the start of the protocol.

[0074] FIG. 5 illustrates an example of a transaction record generated by a first client computer system operated by Bob and a second client computer system operated by Alice. Bob may be referred to as the token issuer, and Alice may be referred to as the client. Diagram 500 illustrates the creation of a lock transaction for the execution of a program (e.g., a smart contract). The lock transaction 502 may direct the transfer of digital assets to a cryptocurrency wallet or address accessible by Bob in exchange for the smart contract. In the illustrated example, Alice uses a pay-to-public-key-hash by specifying a hash of a public key associated with a private key controlled by Bob. In other examples, Alice may transfer digital assets to Bob using a pay-to-public-key or pay-to-script-hash opcode. Using the first client computer system, Bob prepares a lock transaction 502 for a provided contract, which has two inputs and two outputs. In the illustrated example, Bob generates a first input 504 having a value of x, which may have a value of several satoshis, and a first output 508 including metadata describing the terms of the contract. The first output 508 may have a value of zero (OP_RETURN). In the illustrated example, Bob generates a second input 506, also having a value of x or several satoshis, and a second output 510 having a value of y and a pay-to-public-key-hash ("P2PKH") indicating the digital asset that Alice must transfer. The lock transaction 502 can be sent from a first client computer system operated by Bob to a second client computer system operated by Alice.

[0075] In one embodiment, at least some of the nodes act as attesting nodes that attest transactions as described in this disclosure. In some examples, a transaction includes data providing proof of ownership of a digital asset (e.g., bitcoin) and conditions for accepting or transferring ownership / control of the digital asset. In some examples, an "unlocking transaction" refers to a blockchain transaction that reassociates (e.g., transfers ownership or control of) at least a portion of a digital asset represented by an unspent transaction output (UTXO) of a previous transaction to an entity associated with a blockchain address. In some examples, a "previous transaction" refers to a blockchain transaction that includes the UTXO referenced by the unlocking transaction. In some embodiments, a transaction includes a "locking script" that prevents the transaction from proceeding with conditions that must be met before ownership / control can be transferred ("unlocked").

[0076] Lock transaction 502 is modified by Alice using a second client computer system. In the example shown in FIG. 5, the resulting modified lock transaction 512 includes three inputs and an output. The first input 514 is unchanged and includes a value of x (number of satoshis). The first output 520 is unchanged and holds metadata describing the terms of the contract. The second input 516 is unchanged and has a value of x (number of satoshis). Similar to lock transaction 502, the second output 522 holds a value of y (corresponding to the digital asset over which Alice must transfer control) and a P2PKH. Using the second client computer system, Alice adds a third input 518 and a third output 524. The third input 518 has a value of y+z, which corresponds to the digital asset over which Alice transfers control for the contract and a fee to the worker. The third output 524 has a value of z, which corresponds to the fee to the worker. Multi-party signature functionality may be utilized in a scheme where a client sends resources (e.g., digital assets) for contract execution to two of three multisig addresses, one with a key controlled by each of the transacting parties (e.g., the client and the prover) and one controlled by the mediator. To do so, a client (e.g., Alice) creates a multisig address for the private keys of the client, the prover, and the mediator. In one embodiment, the lock transaction is time-locked, and Alice locks the transaction within a time window t w Allows you to recover your resources (e.g., digital assets) at a later time.

[0077] The mediator may be the mediator computer system described above in connection with FIG. 4. If there is a dispute (e.g., Alice disagrees with the input values ​​used by the prover in executing the program), the mediator can collaborate with either the client or the prover, as appropriate, to redeem the funds. For example, if the client does not follow the established protocol, the mediator can collaborate with the prover to force the prover to transfer the blocked digital asset under a third output (e.g., fee value z). Conversely, if the prover does not follow the protocol, the mediator can collaborate with the client because two out of three signatures are sufficient to redeem the escrowed funds. Note that rather than including a publicly associated, long-lasting address for the mediator, for additional privacy, the parties can use blinded addresses. To convince the mediator of the correctness of the data, the parties can present a transcript containing a proof-of-communication. In some cases, a blinded address for the mediator is used to conceal the scheme. However, if the goal of the protocol is to provide transparency (e.g., allow nodes in the blockchain network to verify transactions), non-blind addresses may be utilized in one embodiment.

[0078] In some cases, the protocol is secure, which may refer to the mediator's inability to unilaterally redeem escrowed funds. In some cases, the protocol is optimistic, which may refer to the assumption that the mediator will willingly mediate disputes. In some embodiments, the protocol requires the mediator to provide a fourth input having a value M corresponding to the escrow alongside the transacting parties, and the mediator can recover the escrow value M if and only if the escrow transaction that prevents the movement of the worker fee is redeemed. In this way, the possibility of the mediator causing a denial of service attack by refusing to mediate a dispute is mitigated because the mediator cannot reclaim the escrow value until the worker fee is redeemed.

[0079] FIG. 6 shows a flowchart 600 of a process according to the protocol described in this disclosure. The flowchart may be implemented according to embodiments described elsewhere in this disclosure, such as in FIGS. 1, 4, and 12. The process may be implemented by the same system that implements the process described in connection with FIG. 7. The process may be implemented by a client described elsewhere in this disclosure, or by any other suitable computing entity. A suitable system (e.g., the client described in connection with FIG. 4) includes one or more processors and memory containing executable instructions that, when executed, cause the one or more processors to perform at least a portion of the process described in connection with FIG. 6.

[0080] As part of the process, the system can select appropriate provers and mediators (602). In one embodiment, a client issues a request through a program execution platform requesting execution of a program (e.g., a smart contract). The request can include metrics for the program (e.g., information about the program's computational complexity or expected execution time, a fee corresponding to the digital asset the client is willing to transfer control of for the program's execution, etc.). One or more prospective provers on the platform can provide a response to the request indicating the prospective prover's willingness to execute the program. In one embodiment, the platform includes a feedback system, where prospective provers have ratings associated with their past performance on the platform. For example, a prover may receive a positive rating for successfully fulfilling past requests and a negative rating for failing to fulfill or incorrectly fulfilling past requests. The rating can include additional information, such as how often the prospective prover used incorrect input data, broadcast a corrected transaction, or was involved in a dispute resolved by a mediator. In one embodiment, the client selects a verifier based at least in part on a rating associated with the prospective verifier (eg, the verifier has the highest rating of all responding verifiers).

[0081] In one embodiment, the client determines a secret value x (604). The secret value may refer to a value that the client does not reveal to the prover until the client determines that the prover executed the program (e.g., a smart contract) and verifies that the program executed correctly. Verifying the correct execution of the program may include determining whether correct input data was used to control the execution of the program.

[0082] The system obtains a public key associated with the mediator computer system and encrypts (606) the secret value under the mediator's public key, thereby generating the encrypted secret value Enc Mediator The system can generate 606 an output y=H(x) using the secret value as input to a cryptographic hash algorithm, such as the SHA-256 cryptographic hash algorithm. Generally speaking, a pre-image resistant function, such as a one-way function, may be used instead of a cryptographic hash function as described in this context. The system can generate 606 an output y=H(x) using the secret value as input to a cryptographic hash algorithm, such as the SHA-256 cryptographic hash algorithm. Mediator A zero-knowledge proof that (x) and the output y encode the same secret may further be generated (608). The zero-knowledge proof may be computationally verifiable by a computing entity that does not have access to the shared value (e.g., a computer system that does not have access to the secret value x can still verify Enc Mediator (It can be computationally verified that (x) and the output y are generated from the same values).

[0083] After generating the aforementioned data, the system may send the encrypted secret value, the hash output, and the zero-knowledge proof to the prover 610. This information may be made available to the prover in any suitable manner, such as by providing the information across multiple data packets, by storing the data in a location accessible to the prover and providing a reference to that location (e.g., a uniform resource identifier), or the like.

[0084] The client can make 612 a program available to the prover. The program can refer to a program the client requests the prover to execute. The program can be a smart contract whose execution depends on input data that can be obtained from the blockchain network or from an off-chain data source, such as that described in connection with FIG. 3. In one embodiment, the client makes the program available to the prover by broadcasting a funding transaction that encodes a reference to the program, the funding transaction following, for example, that described in connection with FIG. 5. The funding transaction and / or the program can be broadcast by the client in response to detecting that the prover has broadcast a margin deposit transaction to the blockchain network. The prover can execute the program according to the processes described in connection with FIGS. 8 and 9.

[0085] FIG. 7 shows a flowchart 700 of a process according to the protocol described in this disclosure. The flowchart may be implemented according to embodiments described elsewhere in this disclosure, such as in FIGS. 1, 4, and 12. The process may be implemented by the same system that implements the process described in connection with FIG. 6. The process may be implemented by a client described elsewhere in this disclosure, or by any other suitable computing entity. A suitable system (e.g., the client described in connection with FIG. 4) includes one or more processors and memory containing executable instructions that, when executed, cause the one or more processors to perform at least a portion of the process described in connection with FIG. 7.

[0086] The system may detect 702 an indicator that the program has executed (e.g., as described in FIG. 6). In some embodiments, the prover broadcasts an unlock transaction indicating the execution of the program. The indicator may include a proof of correctness, or proof of correct execution of the program. The indicator may further include a proof of communication between the prover and the data provider. The execution of the program may be controlled by one or more inputs, the values ​​of which may be determined based on data external to the blockchain network.

[0087] Upon detecting the indicator, the system may verify (704) the execution of the program. In some cases, the system delegates the verification step to another computer system, such as the verifier computer system described in connection with FIG. 3. Verifying the execution of the program may include verifying that the program ran to completion and generated an output, verifying the validity of a proof of correctness generated by the prover, verifying that inputs to the program have correct values, etc. If the system determines that the program (e.g., a smart contract) executed correctly and validly, the system may make (712) a secret value x available to the prover. Generally speaking, the system may make the secret value x available to the prover once it determines that the prover performed various steps (e.g., correct execution of the program) according to the protocol. The secret value x may be used by the prover to recover digital assets that were blocked by the margin transaction. In some cases, the client and the prover collaboratively generate a multi-party signature that unlocks digital assets to the prover as a fee for running the program.

[0088] If the system determines that the program did not execute correctly, the system can determine that the incorrect execution was due to the use of incorrect input values. For example, the inputs to the program may differ from the expected input values ​​obtained from a data feed as described above in connection with FIG. 3. The system can determine (706) a correction value, which may be based on the difference between the actual input values ​​used to execute the program and the expected input values ​​obtained from the data feed. In one embodiment, the correction value is calculated using a weighted Hamming distance, i.e.,

number

[0089] After sending the correction value to the prover, the system can determine (710) whether a correction transaction was detected. A correction transaction may refer to a transaction broadcast by the prover to the blockchain network that is an acknowledgement that the program executed incorrectly, and may be a correction for the erroneous execution of the program. For example, in some cases, the correction transaction includes a transfer of digital assets equivalent to the difference between what the system would have received under correct execution of the program and what the system received under the actual erroneous execution of the program.

[0090] If a corrected transaction is detected, the system may provide or otherwise make available (712) the secret value x to the prover. wIf not subsequently detected, a different transaction (e.g., a compensation transaction) may be broadcast by the client to claim the digital assets blocked by the margin deposit transaction on behalf of the client.

[0091] FIG. 8 shows a flowchart 800 of a process according to the protocol described in this disclosure. The flowchart may be implemented according to embodiments described elsewhere in this disclosure, such as in FIGS. 1, 4, and 12. The process may be implemented by the same system that implements the process described in connection with FIG. 9. The process may be implemented by a prover described elsewhere in this disclosure, or by any other suitable computing entity. A suitable system (e.g., the prover described in connection with FIG. 4) includes one or more processors and a memory containing executable instructions that, when executed, cause the one or more processors to perform at least a portion of the process described in connection with FIG. 8.

[0092] The prover may receive or otherwise obtain (802) the encrypted value, the hash output, and a zero-knowledge proof that the encrypted value and the hash output are derived from the same value. The prover may receive this data directly from the client (e.g., via a message sent by the client to the prover) or indirectly (e.g., by the client broadcasting the data to the blockchain network, storing the data in a data store and providing a link to that location). The prover may verify (804) the zero-knowledge proof.

[0093] The prover may obtain (806) a program to execute. A reference to the program may be encoded in the funding transaction as described elsewhere in this disclosure. Additionally, the system may determine (808) input data for the execution of the program. For example, the input data may be data obtained directly from the blockchain network or from a data feed through the network, as described in connection with FIG. 3. In one embodiment, the prover executes (810) the program (e.g., a smart contract) according to the input data. Upon completing the execution of the program, the system may generate (812) an output of the program execution and further a proof of correctness. The output and proof may be made available (814) to a verifier computer system in an unlock transaction. The verifier computer system may be any suitable computer system that performs a verification process, such as the client described in connection with FIG. 4.

[0094] FIG. 9 shows a flowchart 900 of a process according to the protocol described in this disclosure. The flowchart may be implemented according to embodiments described elsewhere in this disclosure, such as in FIGS. 1, 4, and 12. The process may be implemented by the same system that implements the process described in connection with FIG. 8. The process may be implemented by a prover described elsewhere in this disclosure, or by any other suitable computing entity. A suitable system (e.g., the prover described in connection with FIG. 4) includes one or more processors and a memory containing executable instructions that, when executed, cause the one or more processors to perform at least a portion of the process described in connection with FIG. 9.

[0095] The prover may determine 902 whether a correction value has been received. According to the protocol, the prover may wait a predetermined period of time for a correction value to be received, and if none is received within the period of time, may implicitly determine that no correction value was received and / or that the correction value is zero and that no correction transaction is required. The correction value may be received from the client in response to the client or any suitable verifier determining erroneous execution of the program by the prover.

[0096] If the prover determines that a correction value was not received and / or that the correction value is zero, the prover then receives (910) a secret value. The secret value may be usable to generate and / or execute an unlock script that, when executed collectively with the lock script of the margin transaction deposit, allows the prover to recover the digital assets that were blocked by the margin transaction. The secret value may further be used to redeem worker fees for the funding transaction. Note that if the client refuses to provide the secret value to the prover (i.e., the client violates the protocol constraints), the prover may obtain the secret value from the mediator.

[0097] If the prover receives the correction value, the prover can determine (904) whether the correction value was calculated correctly. The prover can obtain a zero-knowledge proof of the calculation of the correction value and use this proof to determine whether the calculation was calculated correctly or incorrectly, and / or perform a separate calculation. In some cases, the prover always accepts the client's correction value as having been calculated correctly. If the system determines that the correction value was calculated correctly and that its value is correct, the prover can generate (914) a correction transaction based at least in part on the correction value. For example, the correction transaction can be a transaction that is mined against the blockchain and transfers digital assets equal to the amount of the correction value. The system can then wait (910) to receive the secret value in the manner described above.

[0098] However, if the prover disagrees with the provided correction value, the system can determine (906) a different correction value (e.g., based on a separate calculation). The prover can provide (908) the mediator with the encrypted secret value and a transcript that can be used to mediate a dispute between the prover and the client regarding which correction value is correct. The transcript may include information such as the correction value and the corresponding zero-knowledge proof calculated by the prover and / or the client, one or more input values ​​used to generate the correction value, and / or proof of communication. The mediator can determine that the different correction value calculated by the prover is correct, decrypt the encrypted secret value, and provide the secret value to the prover.

[0099] In some cases, the method for calculating the damage value is agreed upon between the client and the prover early in the protocol, for example, when the client selects the prover to perform the calculation. In one embodiment, the client may send the prospective prover as part of its request both the program to be executed and a formula used to calculate the damage caused by incorrect execution of the program. In one embodiment, the prover has knowledge of the formula for calculating the damage value before deciding whether to agree to run the program. In some cases, the mediator receives the formula from the client, the prover, or both, and this formula may be digitally signed by either or both parties. The protocol may require the mediator to receive the same formula from both the client and the prover and terminate the protocol if the formulas are different.

[0100] FIG. 10 shows a flowchart 1000 of a process according to the protocol described in this disclosure. The flowchart may be implemented according to embodiments described elsewhere in this disclosure, such as in FIGS. 1, 4, and 12. The process may be implemented by a mediator computer system described elsewhere in this disclosure, or by any other suitable computing entity. A suitable system (e.g., a prover described in connection with FIG. 4) includes one or more processors and a memory containing executable instructions that, when executed, cause the one or more processors to perform at least a portion of the process described in connection with FIG. 10. In one embodiment, a mediator, also referred to as a mediator computer system, is utilized by a client and / or prover of the protocol to resolve disputes. Disputes may arise between a client and a prover when one or both parties fail to adhere to the protocol, for example, by failing to perform a step or by failing to perform a step correctly.

[0101] In one embodiment, the prover initiates a dispute with a mediator, and the mediator receives an encrypted secret value and a transcript from the prover (1002). The encrypted secret value may be encrypted under the mediator's public key, and the mediator has access to the corresponding private key. The transcript may contain information usable to adjudicate the dispute. For example, the transcript may include a zero-knowledge proof that is probative of a particular state and / or value. The mediator may verify the transcript in any suitable manner, such as by verifying the correctness of the proof. The mediator may delegate some or all steps of the verification process to another computing system, such as a node in a blockchain network. If the mediator agrees with the prover (e.g., the correctness of the proof that is probative of the state or value asserted by the prover), the mediator may decrypt the encrypted secret value (1006) and provide the secret value to the prover. Additionally, the mediator, in collaboration with the prover, can generate 1008 one or more multi-party signatures that can be used to execute one or more programs, such as a program that can be used to redeem worker fees for lock transactions. However, if the mediator instead agrees with the client, the mediator, in collaboration with the client, can generate 1012 one or more multi-party signatures that can be used to execute various programs, such as a program that claims digital assets posted by the prover (e.g., as a penalty for failing to adhere to the protocol) and / or a program that collects worker fees for lock transactions.

[0102] In a similar manner, a client can initiate a dispute resolution routine with a mediator by providing the mediator with an encrypted secret value and a transcript. The transcript may include information such as zero-knowledge proofs. The mediator receives the encrypted secret value and the transcript (1010) and can adjudicate the dispute by applying the techniques described above.

[0103] FIG. 11 is an exemplary simplified block diagram of a computing device 1100 that may be used to implement at least one embodiment of the present disclosure. In various embodiments, the computing device 1100 may be used to implement any of the systems illustrated and described above. For example, the computing device 1100 may be configured for use as a data server, a web server, a portable computing device, a personal computer, or any electronic computing device. As shown in FIG. 11 , the computing device 1100, in embodiments, may include one or more processors 1102 configured to communicate with and operatively coupled to multiple peripheral subsystems via a bus subsystem 1104. In some embodiments, these peripheral subsystems include a storage subsystem 1106, including a memory subsystem 1108 and a file / disk storage subsystem 1110, one or more user interface input devices 1112, one or more user interface output devices 1114, and a network interface subsystem 1116. Such storage subsystems 1106 may be used for temporary or long-term storage of information.

[0104] In some embodiments, the bus subsystem 1104 provides a mechanism that allows the various components and subsystems of the computing device 1100 to communicate with each other as intended. While the bus subsystem 1104 is shown schematically as a single bus, alternative embodiments of the bus subsystem utilize multiple buses. In some embodiments, the network interface subsystem 1116 provides an interface to other computing devices and networks. The network interface subsystem 1116, in some embodiments, serves as an interface for receiving data from other systems and transmitting data from the computing device 1100 to other systems. In some embodiments, the bus subsystem 1104 is utilized to communicate data such as details, search terms, etc.

[0105] In some embodiments, the user interface input devices 1112 include one or more user input devices, such as a keyboard; a pointing device, such as an integrated mouse, trackball, touchpad, or graphics tablet; a scanner; a barcode scanner; a touchscreen integrated into a display; an audio input device, such as a voice recognition system or a microphone; and other types of input devices. In general, use of the term “input device” is intended to include all possible types of devices and mechanisms for inputting information into the computing device 1100. In some embodiments, the one or more user interface output devices 1114 include a display subsystem, a printer, or a non-visual display, such as an audio output device. In some embodiments, the display subsystem includes a flat-panel device, such as a cathode ray tube (CRT), a liquid crystal display (LCD), a light-emitting diode (LED) display, or a projection or other display device. In general, use of the term “output device” is intended to include all possible types of devices and mechanisms for outputting information from the computing device 1100. One or more user interface output devices 1114 may be used, for example, to present a user interface and facilitate user interaction with applications that perform the described processes and variations thereof, when such interaction may be appropriate.

[0106] In some embodiments, storage subsystem 1106 provides a computer-readable storage medium that stores basic programming and data constructs that provide the functionality of at least one embodiment of the present disclosure. Applications (programs, code modules, instructions), which in some embodiments when executed by one or more processors, provide the functionality of one or more embodiments of the present disclosure, and in some embodiments are stored in storage subsystem 1106. These application modules or instructions can be executed by one or more processors 1102. In various embodiments, storage subsystem 1106 further provides a repository for storing data used in accordance with the present disclosure. In some embodiments, storage subsystem 1106 includes memory subsystem 1108 and file / disk storage subsystem 1110.

[0107] In embodiments, memory subsystem 1108 includes multiple memories, such as a main random access memory (RAM) 1118 for storing instructions and data during program execution and / or a read-only memory (ROM) 1120 capable of storing fixed instructions. In some embodiments, file / disk storage subsystem 1110 provides non-transitory, persistent (non-volatile) storage for program and data files and may include a hard disk drive, a floppy disk drive with associated removable media, a compact disk read-only memory (CD-ROM) drive, an optical drive, a removable media cartridge, or other similar storage media.

[0108] In some embodiments, computing device 1100 includes at least one local clock 1124. Local clock 1124, in some embodiments, is a counter that represents the number of ticks that have occurred since a particular start date and, in some embodiments, is integrally located within computing device 1100. In various embodiments, local clock 1124 is used to synchronize data transfers within the processor and included subsystems for computing device 1100 at particular clock pulses, and may also be used to coordinate synchronous operations between computing device 1100 and other systems in a data center. In another embodiment, the local clock is a timer with a programmable interval.

[0109] Computing device 1100 can be any of a variety of types, including a portable computing device, a tablet computer, a workstation, or any other device described below. Additionally, computing device 1100, in some embodiments, can include another device that can connect to computing device 1100 through one or more ports (e.g., USB, headphone jack, Lightning connector, etc.). In embodiments, such a device includes a port configured to accept an optical fiber connector. Thus, in some embodiments, the device is configured to convert optical signals into electrical signals that are transmitted through the port connecting the device to computing device 1100 for processing. Due to the ever-changing nature of computers and networks, the description of computing device 1100 shown in FIG. 11 is intended only as a specific example for purposes of illustrating a preferred embodiment of the device. Many other configurations are possible, having more or fewer components than the system shown in FIG. 11 .

[0110] Accordingly, the specification and drawings are to be interpreted in an illustrative rather than a restrictive sense. However, it will be apparent that various modifications and changes can be made thereto without departing from the scope of the invention as set forth in the appended claims. Likewise, other variations are within the scope of this disclosure. Thus, while the disclosed techniques are susceptible to various modifications and alternative constructions, certain illustrative embodiments thereof have been shown in the drawings and have been described above in detail. It is to be understood, however, that there is no intention to limit the invention to the particular forms or configurations disclosed, but on the contrary, the intention is to cover all modifications, alternative constructions, and equivalents falling within the scope of the invention as defined by the appended claims.

[0111] Use of the terms "a," "an," "the," and similar referents in the context of describing embodiments of the disclosure (particularly in the context of the claims below) should be construed to cover both the singular and the plural unless otherwise indicated or clearly contradicted by context. The terms "comprise," "have," "include," and "comprise" should be construed as open-ended (i.e., meaning "including but not limited to") unless otherwise noted. The term "connected," when referring to an unmodified physical connection, should be construed as being partially or wholly contained within, attached to, or joined together, even if there is something intervening. Recitation of ranges of values ​​in this disclosure is merely intended to serve as a shorthand method of referring individually to each separate value falling within the range, unless otherwise indicated, and each separate value is incorporated herein as if it were individually set forth. Use of the term "set" (e.g., "set of items") or "subset" should be construed as a non-empty collection containing one or more members, unless otherwise stated or contradicted by context. Further, unless otherwise stated or contradicted by context, the term "subset" of a corresponding set does not necessarily indicate a proper subset of the corresponding set, although a subset and a corresponding set may be equivalent.

[0112] Conjunctive language, such as phrases of the form "at least one of A, B, and C" or "at least one of A, B, and C," unless specifically indicated otherwise or clearly contradicted by context, is understood in the context of otherwise common usage to indicate that an item, term, etc. may be either A or B or C, or any non-empty subset of the set A, B, and C. For example, in the illustrative example of a set having three members, the conjunctive phrases "at least one of A, B, and C" and "at least one of A, B, and C" refer to any of the following sets: {A}, {B}, {C}, {A, B}, {A, C}, {B, C}, {A, B, C}. Thus, such conjunctive language is generally not intended to imply that a particular embodiment requires that at least one of A, at least one of B, and at least one of C each be present.

[0113] The actions of the processes described can be performed in any suitable order unless otherwise indicated or otherwise clearly contradicted by context. The processes described (or variations and / or combinations thereof) can be performed under the control of one or more computer systems configured with executable instructions, implemented in hardware, or a combination thereof as code (e.g., executable instructions, one or more computer programs, or one or more applications) that collectively execute on one or more processors. In some embodiments, the code can be stored on a computer-readable storage medium, for example, in the form of a computer program including a plurality of instructions executable by one or more processors. In some embodiments, the computer-readable storage medium is non-transitory.

[0114] Any or all examples provided, or the use of exemplary language (e.g., "such as"), are intended merely to better clarify embodiments of the invention and do not impose limitations on the scope of the invention unless otherwise claimed. No language in the specification should be construed as indicating any non-claimed element as essential to the practice of the invention.

[0115] Embodiments of the present disclosure have been described, including the best mode known to the inventors for carrying out the invention. Variations of these embodiments will become apparent to those skilled in the art upon reading the foregoing description. The inventors anticipate that skilled artisans will adopt such variations as appropriate, and the inventors intend for the embodiments of the present disclosure to be practiced otherwise than as specifically described. Accordingly, the scope of the present disclosure includes all modifications and equivalents of the subject matter recited in this specification and the appended claims as permitted by applicable law. Moreover, any combination of the above-described elements in all possible variations thereof is encompassed within the scope of the present disclosure unless otherwise indicated or otherwise clearly contradicted by context.

[0116] All references, including cited publications, patent applications, and patents, are herein incorporated by reference to the same extent as if each reference was individually and specifically indicated to be incorporated by reference and set forth in its entirety.

[0117] The above-described embodiments illustrate rather than limit the invention, and it should be noted that those skilled in the art can design many alternative embodiments without departing from the scope of the invention as defined by the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the scope of the claim. The words "comprises" and "comprises", and the like, do not exclude the presence of elements or steps other than those listed in any claim or the specification as a whole. In this specification, "comprises" means "comprises or consists of", and "comprising" means "includes or consists of". The singular reference of an element does not exclude the plural reference of such elements, and vice versa. The invention can be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In a device claim enumerating several means, several of these means can be embodied by one and the same item of hardware. The mere fact that certain means are recited in mutually different dependent claims does not indicate that a combination of these means cannot be used to advantage.

Claims

1. 1. A computer-implemented method comprising: In the client computer system: encrypting the secret value under a public key associated with the mediator computer system; providing the encrypted secret value to a worker computer system, the encrypted secret value usable by the worker computer system and the mediator computer system to collectively execute a first program; making a second program available in a blockchain data structure, execution of the second program having an input; In the worker computer system, obtaining the encrypted secret value; obtaining the second program for execution; determining input values ​​for execution of said second program; executing the second program according to the input values ​​to generate an output and a proof of correct execution; making the output and the proof available in a blockchain data structure; In the mediator computer system, receiving the encrypted secret value and a transcript from one of the client computer system and the worker computer system, the transcript containing information usable to adjudicate a dispute between the client computer system and the worker computer system; verifying the transcript; determining whether the dispute between the client computer system and the worker computer system is valid; when the dispute is determined to be valid, decrypting the encrypted secret value and transmitting the decrypted secret value to the one of the client computer system and the worker computer system that initiated the dispute; A method comprising:

2. In the client computer system, generating a cryptographic hash output based at least in part on the secret value; generating evidence that the encrypted value and the cryptographic hash output are both determined at least in part based on the secret value; providing the cryptographic hash output and the evidence to the worker computer system; In the worker computer system, using the evidence to determine whether the encrypted secret value and the cryptographic hash output are based at least in part on the same value; The method of claim 1 further comprising:

3. 3. The method of claim 2, wherein the evidence is a zero-knowledge proof, the correctness of the zero-knowledge proof being computationally verifiable by the worker computer system.

4. The input value is a first input value, and the method includes, at the client computer system, in response to determining that the first input value is erroneous: calculating a second input value based at least in part on the first input value; providing the second input value to the worker computer system; providing the secret value to the worker computer system in response to determining that the worker computer system executed a third program using the second input value; The method of any one of claims 1 to 3, further comprising:

5. The method of claim 4 , wherein calculating the second input value comprises calculating a Hamming distance.

6. In the client computer system, obtaining second evidence, the second evidence including a set of communications between the worker computer system and a data source, the set of communications usable to determine whether the input value is valid, the second evidence being digitally signed by the data source; verifying the authenticity of the second evidence using at least a public key associated with the data source; determining whether the input is valid based at least in part on the set of communications; The method of any one of claims 1 to 5, further comprising:

7. Making the second program available on the blockchain data structure includes causing the client computer system to mine blockchain transactions against the blockchain data structure, the blockchain transactions comprising: information usable to determine the second program; and A lock script that blocks movement of a digital asset, and collective execution of the lock script and the unlock script releases the block on movement of the digital asset, and collective execution of the lock script and the unlock script unifies two digital signatures. a digital signature associated with a computing entity that performs the computer-implemented method; a digital signature associated with the worker computer system; and a digital signature associated with the mediator computer system; a lock script, the lock script including verifying that the lock script is of a set of digital signatures including 7. The method of claim 1, comprising:

8. The method of claim 1 , wherein execution of the first program transfers control of a digital asset to the worker computer system.

9. In the client computer system, making available a fourth program to the blockchain data structure in response to determining that the worker computer system failed to execute the third program using the second input values ​​within a time threshold, the fourth program being usable to gain control of a digital asset. The method of claim 4 further comprising:

10. 10. The method of claim 9, wherein the time threshold encodes the earliest time a blockchain transaction including a portion of the fourth program can be mined against the blockchain data structure.

11. In the client computer system, generating a digital signature; encoding the digital signature into an unlock script, the unlock script further encoding a purported digital signature associated with the worker computer system; the fourth program including a lock script and the unlock script; and execution of the fourth program by one or more nodes of a blockchain network associated with the blockchain data structure includes determining that both the digital signature and the purported digital signature are valid; 11. The method of claim 9 or 10, further comprising:

12. the first program includes a lock script and an unlock script, the unlock script encoding a purported secret value and a purported digital signature associated with the worker computer system; execution of the first program by one or more nodes of a blockchain network associated with the blockchain data structure includes determining that the purported secret value and the purported digital signature are both valid. The method of claim 2.

13. The lock script includes the cryptographic hash output, and determining that the purported secret value is valid comprises: calculating an output of a cryptographic hash algorithm using said purported secret value; determining that the output and the cryptographic hash output match; 13. The method of claim 12, comprising:

14. A network including client computer systems and worker computer systems, each system comprising: a processor; a memory containing executable instructions; A network wherein the executable instructions, upon execution by each processor, cause each system to perform the computer-implemented method of any one of claims 1 to 13.

Images