Improved system and method for storing, generating and validating tokens used to control access to resources - Patent Application 20070122999

Abstract

To provide an improved system and method for storage, generation and verification of tokens used for controlling access to resources.SOLUTION: A method installed on a computer is provided. The method includes: (i) a step which provides a verification data item of a unidirectional function chain of a data item; (ii) a step which presents access block chain transaction including a data item of the chain to a block chain (such as a bit coin block chain); (iii) a step which applies to the data item the unidirectional function to give output; (iv) a step which compares the output of the step (iii) with the verification item to conclude; and (v) a step which (a) assigns the output as a further verification data item for verifying the further data item of the chain and (b) approves an access to a resource associated with the data item on the basis of the conclusion at the step (iv).SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates generally to secure and efficient solutions for controlling the transfer of and access to digital resources, and more particularly to the transfer, storage, communication, generation, and verification of electronic / digital tokens that act as access keys. The present invention is particularly well-suited for use with blockchains, such as, but not limited to, the Bitchain blockchain. [Background technology]

[0002] In this document, the term "blockchain" is used to encompass all forms of electronic, computer-based, and distributed ledgers. These include consensus-based blockchain and transaction chain technologies, public and private ledgers, permissioned and permissionless ledgers, shared ledgers, and variations thereof. While the most widely known application of blockchain technology is the Bitcoin ledger, other blockchain implementations have been proposed and developed. For convenience and illustrative purposes, this document may refer to Bitcoin. However, it should be noted that the present invention is not limited to use with the Bitcoin blockchain, and alternative blockchain implementations and protocols are within the scope of this document. The term "user" herein may refer to a human or processor-based resource. The term "Bitcoin" is also used herein to encompass all versions and variations of protocols / platforms derived from or based on the Bitcoin protocol / platform.

[0003] A blockchain is a peer-to-peer electronic ledger implemented as a decentralized, computer-based system composed of blocks, which are made up of transactions. Each transaction is a data structure that encodes the transfer of control of digital assets between participants in the blockchain system and contains at least one input and at least one output. Each block contains a hash of the previous block, thereby chaining blocks together to create a permanent, immutable record of all transactions written to the blockchain since its inception. Transactions contain small programs, known as scripts, embedded in their inputs and outputs that specify who can access the transaction's outputs and how. In the Bitcoin platform, these scripts are written using a stack-based scripting language.

[0004] For a transaction to be written to the blockchain, it must be "validated." Network nodes (miners) perform work to ensure each transaction is valid; invalid transactions are rejected by the network. A software client installed on the node performs this validation work on unspent transactions (UTXOs) by executing their lock and unlock scripts. If the execution of the lock and unlock scripts evaluates to true, the transaction is valid and is written to the blockchain. Thus, for a transaction to be written to the blockchain, it must i) be validated by the first node that receives it. If the transaction is validated, the node relays it to other nodes in the network. The transaction must ii) be added to a new block constructed by miners and iii) be mined, i.e., added to the public ledger of past transactions.

[0005] While blockchain technology is most widely known for its use in implementing cryptocurrencies, digital entrepreneurs are beginning to consider implementing new systems using both the cryptographic security system that Bitcoin is based on and the data that can be stored on the blockchain. It would be highly advantageous if blockchain could be used for automated tasks and processes that are not limited to the cryptocurrency realm. Such solutions would be able to take advantage of the benefits of blockchain (e.g., permanent, immutable records of events, distributed processing, etc.) while being more diverse in their applications. Summary of the Invention [Problem to be solved by the invention]

[0006] One area of ​​current research is the use of tokens to represent and transfer resources or control over them, or allow access to those resources, via the blockchain. The resources associated with a token can be electronic or physical, virtual or real-world. Potentially sensitive or confidential resources can be represented by tokens that have no discernible meaning or value. In this way, tokens act as identifiers that allow real-world resources to be referenced from the blockchain.

[0007] It is desirable to provide a secure and efficient manner of communicating, storing, generating, and / or transferring tokens from one user to another while minimizing the use of computing resources. Such an improved solution has now been devised. [Means for solving the problem]

[0008] Thus, according to the present invention there is provided a method as defined in the accompanying claims.

[0009] According to the present invention, there may be provided a computer-implemented access or control method comprising the following steps. (i) providing a verification data item for a first one-way function chain of data items; (ii) submitting an access blockchain transaction to the blockchain that includes the data item with the first chain of the data item; (iii) applying said one-way function to the data item to provide an output; (iv) comparing the output of step (iii) with the validation items to provide a conclusion; (v) Based on the consequences of step (iv): (a) assigning said data item as a further verification data item for verifying a further data item of the first chain; (b) authorizing access to resources associated with said data items;

[0010] Steps (i) and / or (ii) may be performed by a first party. Steps (iii) through (v) may be performed by a second party. The term "user" may be used interchangeably with "party" herein. The terms "party" and "user" are intended to include human users, computing resources, clients, servers, and / or network nodes.

[0011] Applying a one-way function, such as a cryptographic hash function, to a data item results in a further data item. Subsequent application of the one-way function to the further data item results in a still further data item. In this way, a chain of data items may be generated, where members of the chain of data items are deterministically linked to each other through the application of the one-way function. Such a chain may be referred to as a one-way function chain of data items. A verification data item may be a data item that is a member of the one-way function chain and is used for verification purposes, and is described in more detail below.

[0012] The comparison in step (iv) may include applying at least one test or criterion. The test or criterion may include evaluating whether the output matches or is identical to the verification item. The test may include evaluating based on a threshold. The one-way function may be a hash function.

[0013] Such methods improve security and reliability by providing a check on the origin of each data item, improve efficiency by reducing the amount of storage space and memory required for verification purposes, and improve security and reduce the likelihood of errors by reducing the amount of data communicated.

[0014] The method may further comprise repeating steps (ii) to (v) with said further validation data item and further data item.

[0015] This provides the advantage of recording events on the blockchain, making the record public and immutable. Thus, the blockchain can serve as a communication medium or mechanism for transmitting or transferring data items from one user to another. The second user can access the data items from the blockchain. Thus, direct communication between the first and second users is avoided or minimized. This is advantageous because such communication could be subject to interception by unauthorized parties. The present invention provides a solution for cases where users may not know or trust each other. This provides improved security and an improved communication solution for the transfer of tokens. Furthermore, the public and immutable nature of the blockchain can be used to verify the event(s) that occurred and the data item(s) submitted by the first user.

[0016] The method may further comprise the steps of: (vi) providing a validation data item of a second one-way function chain of data items; (v) submitting an exchange blockchain transaction to the blockchain that is unlockable upon providing at least one validation item of the first chain and said validation data item of the second chain, where such unlocking causes the at least one data item of the second chain to be associated with the resource. This provides a secure and recorded method of transferring between users the ability to access at least one resource associated with each at least one data item.

[0017] The method may further include unlocking the exchange blockchain transaction and repeating steps (ii) through (v) with the data item of the second chain and the validation data item of the second chain. This provides the advantage of allowing new users to securely access at least one resource.

[0018] The method may further include submitting a return blockchain transaction to the blockchain configured to return control of the inputs of the exchange blockchain transaction after a lock time has elapsed. This provides the advantage of preventing dishonest users from locking up exchange blockchain transaction inputs indefinitely, thereby increasing the versatility of the method and providing a more secure method.

[0019] The method may further comprise storing an initial data item of the one-way function chain, from which at least one data item of the one-way function chain is computable. This provides the advantage of further reducing storage requirements and correspondingly improving the efficiency of the method.

[0020] Step (v) may further comprise deleting the validation data item. This provides the advantage of further reducing storage requirements and correspondingly improving the efficiency of the method.

[0021] An access blockchain transaction may include information that identifies the resource. For example, a blockchain transaction may include a URL or its hash that points to an off-chain data repository that contains information about the resource. The URL may be stored in the transaction's metadata. This provides the advantage that information about resources can be communicated securely.

[0022] At least one data item may be stored in the access blockchain transaction in the form of a cryptographic (public) key. This provides the advantages of reducing transaction size, enabling the use of standard transactions rather than custom transactions, increasing privacy, and allowing users of the method to run the method on multiple different blockchains implementing different protocols.

[0023] At least one of the public keys may be generated using a predetermined public key and a data item of a one-way function chain. This provides a simple and secure way to allow public keys to be derived, and offers the advantage of reducing storage requirements.

[0024] The method may include providing a public key chain, each public key in the public key chain corresponding to a respective data item in the one-way function chain. This links public keys in a chain that can be verified, which provides the advantage of increased security.

[0025] The present invention also provides a computer-implemented method comprising the steps of: (viii) providing a validation data item for a one-way function chain of data items; (ix) providing certain data items of said chain; (x) applying said one-way function to said data items to provide an output; (xi) comparing the output of step (x) with the validation items to provide a conclusion; (xii) based on the outcome of step (xi): (a) assigning said data item as a further verification data item for verifying further data items in said chain; (b) authorizing access to resources associated with said data item.

[0026] The comparison of step (x) may include application of at least one test or criterion. The test may include evaluation of whether the output matches or is identical to the verification item. The test may include evaluation based on a threshold. The one-way function may be a hash function.

[0027] This method may provide a way to allow access to resources to be provided in a publicly verifiable, secure, and computationally efficient manner. Embodiments of the present invention may be referred to as security and / or access control methods.

[0028] The present invention provides a system comprising: processor and; a memory containing executable instructions that, upon execution by a processor, cause the system to perform any embodiment of the computer-implemented method described herein; Also provided is a system having:

[0029] The present invention also provides a non-transitory computer-readable storage medium having stored thereon executable instructions that, when executed by a processor of a computer system, cause the computer system to perform at least an embodiment of the computer-implemented method described herein.

[0030] These and other aspects of the invention will be apparent from and elucidated with reference to the embodiments described hereinafter, which embodiments of the invention will now be described, by way of example only, with reference to the accompanying drawings, in which: [Brief explanation of the drawings]

[0031] [Figure 1] 1 is a flowchart showing the steps for generating and activating a token. [Figure 2] 10 is a flow chart illustrating steps for exchanging control of a token. [Figure 3]1 is a flowchart illustrating steps for activating a token using a public key. DETAILED DESCRIPTION OF THE INVENTION

[0032] The present invention allows for efficient generation and storage of tokens using cryptographically secure one-way function chains such as hash chains. This method has the advantages of performance, storage, scalability, and reliability. Tokens can be securely sold to other users. Tokens can be provably linked to public keys, thereby providing a private, secure, and universal way to activate and verify tokens.

[0033] A token is a data structure or data item that ensures trusted communication between one or more distinct parties over a network. For example, a token can be used to represent the transfer of control of a resource from one party to another and / or to access the controlled resource, such as a good or service. For example, by activating a token, a customer can be authorized to access resources such as computing or electronic resources, a hotel room, a hire car or toll road; goods such as prescription drugs, consumer products, or items in a supply chain; and services such as a session on a website or computer application. The token itself may be used as a key to unlock these resources or may point to an external state containing further information about the resource, such as a distributed hash table (DHT).

[0034] Tokens are typically represented as 256-bit numbers, and once activated, may have time restrictions (e.g., a token may grant access to a secure data repository for 24 hours) and may have a finite number of uses (e.g., once a token is activated and 24 hours have passed, access to the secure data repository is revoked until a new, different token is issued and activated).

[0035] The party wishing to activate a token is referred to as the "client," and the party wishing to verify that the token has been activated is referred to as the "server." [Table 1]

[0036] A client activates a token by providing it to a server. This can be done by publicly disclosing the token on the blockchain. This is accomplished by completing a transaction that records the token's value in transaction data or metadata that the server can verify. Note that the output of this transaction does not need to be spent.

[0037] The amount of tokens required can scale linearly with the amount of events requiring their usage. For example, if a user requests access to a secure data repository a certain number of times, the same number of tokens may be generated. A known method for creating multiple tokens for future use is for each token to be generated separately, for example, randomly. All tokens are then stored in a database by both the client and the server.

[0038] However, in the present invention, only one token needs to be stored by each of the client and server at a time. This is achieved by implementing the rule that each token is related to the previous token through the successive application of a cryptographically secure one-way function, such as a hash function. For example, token t i The rules are: t i =H(t i-1 ) (1) According to the token i-1 where H is a hash function such as SHA-256.

[0039] Token t i-1 To activate t i-1 A transaction containing t is submitted to the blockchain. i-1 is the token t before it. i is the solution to the hash puzzle of i-1 Publicly revealing the provably links each token in the chain.

[0040] Advantages of the present invention include: The client and server only need to remember one token at any given time, which saves memory. If a token is a 256-bit number and Alice wants to use n tokens, she saves (n-1)*256 bits of space using this method compared to storing each token individually in the database. Only small amounts of data need to be communicated between the client and server, which improves performance, security, and reliability. Tokens are calculated rather than stored, preventing accidental loss of tokens through destruction or data corruption. An inspectable record of tokens is available because each token is provably linked to the previous token through the solution to a hash puzzle.

[0041] Referring to Figure 1, we now describe a method (100) by which a client (Alice) activates a sequence of tokens that can be verified by a server (Bob). The tokens are generated by Alice using a hash chain. The following steps are performed:

[0042] 1. Alice and Bob agree on the number n of resources that require token activation to access (105).

[0043] 2. Alice generates 110 a 256-bit number t0. This can be accomplished by hashing some input data, or it can be a random number. The value t0 will be the last token Alice uses. Alice hashes this number n times to get t n =H n (t0) Calculate where t n is a validation data item, not a token. Alice n to Bob (115).

[0044] Alice remembers t0 and no other values. Alice uses rule (1) to generate n tokens t n-1 Use this value to calculate t1,t0,…,t1,t0, which generates an access chain or hash chain of tokens that satisfies: t n-1 =H(t n-2 ) t n-2 =H(t n-3 ) … t1=H(t0) Also, t n =H(t n-1 )

[0045] The first token Alice uses is t n-1 The last token to be used is t0. n is used for validation purposes only and is not a token in itself.

[0046] 3. Bob is t n (120) and does not remember other values. Bob stores t0, t1, ..., t n-1 Note that it is not possible to calculate

[0047] 4. Alice receives the first token t n-1 =H n-1 She activates it by calculating (125) the value of (t0) and generating (130) a transaction that includes that token. The token may be stored, for example, in transaction metadata or in a lock or unlock script. It may also be stored in the public key of the recipient's address itself; more details on this are discussed in connection with further embodiments of the invention below. Alice submits the transaction to the blockchain, which reveals the token (135).

[0048] 5. Bob can now see and read the revealed token, t n =H(t n-1 ) verifies that Alice activated the correct token (140) by checking that t n-1 Remember t n Delete t n-1 becomes the next validation data item in the sequence.

[0049] 6. Alice is t n-2 Activate another token by repeating step 4 with t. Bob validates this token by repeating step 5, but checking t n-1 =H(t n-2 ) This process is repeated iteratively (160) until n tokens have been activated and verified (165).

[0050] A method 200 for transferring the ability to access a resource is described with reference to FIG.

[0051] Alice receives m tokens of her tokens. n-1 ,…,t n-m has already activated t and Charlie needs nm tokens t to fulfill one or more conditions. n-m-1 Suppose Charlie wants to gain control of t0, t1, t2, t3, t4, t5, t6, t7, t8, t9, t10, t11, t12, t13, t14, t15, t16, t17, t18, t19, t20, t21, t22, t23, t24, t25, t26, t27, t28, t29, t2A, t2B, t2D, t2E, t2E, t2F, t2G, t2H ...

[0052] Alice and Charlie agree that Alice will transfer her remaining tokens to Charlie (205). Alice then sends Charlie the hash of the next unused token, H(t m-n-1 ) to send.

[0053] Charlie creates a new token s0. Then Charlie executes the rule s m-n-1 =H(s m-n-2 ) s m-n-2 =H(s m-n-3 ) … s1=H(s0) A sequence of nm tokens using s m-n-1 ,...,s0 is generated (210).

[0054] Charlie also lists the validation data items used for validation purposes: m-n =H(s m-n-1 ) is also calculated. Charlie is s m-n to Alice (215).

[0055] Charlie submits 220 a transaction to the blockchain that meets the one or more conditions, where the unlock script for this transaction is LockingScript=CheckSigH(P A ) AND SolveH(t n-m-1) AND SolveH(s n-m ) where P A is Alice's public key. This address can be a Pay To Public Key Hash (P2PKH) address or a Pay To Script Hash (P2SH) address controlled by Alice.

[0056] Now, Alice notifies the server, Bob, that she has transferred the token to Charlie. Alice then sends the next token, t m-n-1 and validation data items s m-n Bob does this by informing Alice (225) that Alice has the current verification item t m-n =H(t m-n-1 ) that Bob can verify. m-n-1 This is because only Alice knows the value of

[0057] If Alice is dishonest and does not give this information to the server, Bob, once she spends the transaction from Charlie (230), this information will be publicly disclosed on the blockchain anyway, because the transaction unlock script UnlockingScript=[s m-n ][t n-m-1 ][SigP A ][P A ] Because it has the shape of

[0058] If the hash is identical to the current verification item (240), Bob transfers control of the token to Charlie (245) and selects t as the next verification data item. n-m-1 s n-m (250) Otherwise, Bob does not transfer control of the token to Charlie (260).

[0059] Now Bob is s m-n =H(s m-n-1 ) by checking Charlie's first token s m-n-1 can be validated (255). Therefore, Charlie can prove to Bob that he received the token from Alice.

[0060] It is also possible to include a time-locked refund of the transaction from Charlie to Alice, so that Alice cannot indefinitely lock the input of a transaction submitted by Charlie.

[0061] Tokens in the access chain described above can be provably linked to public / private keys. Note that this method of linking public / private keys to tokens does not require the tokens to be linked through a one-way function or hash chain as described above, and will work if each token is created individually without any connection to previous tokens. However, the benefits of using a token access chain are transferred to the linked keys, which then form the access chain, forming a verifiable sequence of public / private keys that are provably linked to each other through the one-way function of the access chain.

[0062] One application for this is for Alice to activate her token by making a transaction to these public key addresses, and Bob can verify that the token is activated by observing the public key addresses themselves.

[0063] This helps keep transaction sizes as small as possible and improves privacy, as only standard transactions are required, rather than custom transactions related to token schemes. It is also a universal method for any public / private key system valid on any blockchain protocol or platform.

[0064] Referring now to FIG. 3, a method is described in which a client, Alice, activates (300) a sequence of tokens that can be verified by a server, Bob.

[0065] Let P0 represent Alice's public key and S0 represent Alice's private key. In an elliptic curve digital signature algorithm (ECDSA) system, public / private key pairs are related by P0 = S0 · G, where G is the generating point of the elliptic curve. However, any equivalent public / private key system may be used to perform the steps of the method.

[0066] Agree on the number of tokens (305), generate tokens from an initial value t0 (310), and verify the chain data item t n After sending (315) to Bob, Alice shares her public key P0 with Bob (320), who stores it as a verification data item (325).

[0067] First token t n-1 (330) Alice uses it as a derived public key P1=(S0+t n-1 )·G=P0+t n-1 G Used to create (335).

[0068] Only Alice n-1 Only Alice can create this public key because she knows P1. Public key P1 can be provably linked to the first token in Alice's access chain.

[0069] Alice can use this public key as the address to which she can send a transaction to activate her first token. She generates a blockchain transaction (340) addressed to this public key and submits it to the blockchain (345), thereby publicly disclosing her public key.

[0070] After that, Alice n-1 to Bob (350). Bob then sends P1 = P0 + t n-1 By verifying (355) that the transaction was made to G, the token t n-1 The public key revealed by the submitted transaction is the public key P0 and the token t n-1 If the result is identical to that computed by Bob using (360), then Bob grants Alice access to the resource (370). Otherwise, Bob denies access (365).

[0071] This process can be repeated iteratively (375): if the final token has not yet been activated, Bob stores the revealed public key as the next verification data item (380) and the process continues; otherwise, the process ends (385).

[0072] The method creates n public keys, each provably uniquely linked to a token in the access chain, as follows: P1=P0+t n-1 G P2=P1+t n-2 G … P n =P n-1 +t0·G

[0073] This process relies on the token taking a value in the same group as the private key, which in the case of the Bitcoin scep256k1 protocol is Z n *where n is the order of the elliptic curve generator G. This number is 2 256 If the token is not in this group, it can be run through a hash function such as SHA-256, modulo n. If any of the tokens are 0 after this process, Alice needs to start again and choose a different seed token t0.

[0074] The above-described embodiments illustrate rather than limit the present invention, and it should be noted that those skilled in the art will be able to design many alternative embodiments without departing from the scope of the present invention as defined by the appended claims. In the claims, reference signs placed between parentheses shall not be construed as limiting the claims. The use of words such as "comprises" and "having" does not exclude the presence of elements or steps other than those listed in any claim or the specification as a whole. As used herein, "comprises" means "comprises or consists of," and "having" means "comprises or consists of." The singular reference of an element does not exclude the plural reference of such elements, and vice versa. The present invention can be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In a device claim enumerating several means, several of these means may be embodied by one and the same item of hardware. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to advantage.

Claims

1. 1. A computer-implemented method performed among a first computing resource, a second computing resource, and a third computing resource, the method comprising: (i) generating, at the first computing resource, a first one-way function chain of data items; (ii) transmitting by the first computing resource to the second computing resource a verification data item of the first one-way function chain of data items; (iii) submitting an access blockchain transaction to a blockchain by the first computing resource, the access blockchain transaction including a data item of the first chain, the data item being stored in the access blockchain transaction in the form of a public key; (iv) receiving, by the first computing resource, access to a resource associated with the data item based on an outcome at the second computing resource of a comparison between the data item and the verification data item; (v) providing, by a third computing resource, a verification data item of a second one-way function chain of the data item; (vi) submitting, by the third computing resource, an exchange blockchain transaction unlockable upon providing at least one validation item of the first chain and the validation data item of the second chain to the blockchain, where such unlocking causes at least one data item of the second chain to be associated with the resource; Including, method.

2. 1. A computer-implemented method performed among a first computing resource, a second computing resource, and a third computing resource, comprising: (i) receiving, at the second computing resource, a verification data item of a first one-way function chain of data items transmitted by the first computing resource; (ii) obtaining, by the second computing resource, an access blockchain transaction submitted by the first computing resource to a blockchain network, the access blockchain transaction including a data item of the first chain, the data item being stored in the access blockchain transaction in the form of a public key; (iii) applying, by the second computing resource, the one-way function to the data item to provide an output; (iv) comparing, by the second computing resource, the outcome of step (iii) with the verification item to produce an outcome; (v) based on the outcome of step (iv): (a) assigning the output as a further verification data item for verifying further data items of the first chain; (b) authorizing access by the second computing resource to a resource associated with the data item; (vi) providing, by a third computing resource, a verification data item of a second one-way function chain of the data item; (vii) submitting, by the third computing resource, an exchange blockchain transaction unlockable upon providing at least one validation item of the first chain and the validation data item of the second chain to a blockchain, where such unlocking causes at least one data item of the second chain to be associated with the resource; method.

3. 3. The method of claim 1 or 2, wherein step (iv) comprises the application of at least one test or criterion.

4. The method of claim 3 , wherein the test or criteria includes an assessment of whether the output matches or is identical to the validation item.

5. The method of claim 3 or 4, wherein the test comprises a threshold-based assessment.

6. 3. The method of claim 2, further comprising repeating steps (ii) through (v) with the further verification data item and the further data item.

7. 7. The method of claim 1, further comprising: unlocking the exchange blockchain transaction; and repeating steps (ii) to (v) with the data item of the second chain and the validation data item of the second chain.

8. 10. The method of claim 7, further comprising submitting a return blockchain transaction to a blockchain configured to return control of the inputs of the exchange blockchain transaction after a lock time has elapsed.

9. 9. The method according to claim 1, further comprising the step of storing an initial data item of a chain of one-way functions, from which at least one data item of the chain of one-way functions can be calculated.

10. The method of claim 1 , further comprising deleting the validation data item.

11. 11. The method of claim 1, wherein the access blockchain transaction includes information identifying the resource.

12. 12. The method according to claim 1, wherein at least one of the public keys is generated using a predetermined public key and a data item of a one-way function chain.

13. 13. A method according to any one of claims 1 to 12, comprising providing a public key chain, each public key in the public key chain corresponding to a respective data item of a one-way function chain.

14. 1. A system comprising: a processor; a memory containing executable instructions that, upon execution by the processor, cause the system to perform a computer-implemented method according to any one of claims 1 to 13; A system having:

15. A non-transitory computer-readable storage medium having stored thereon executable instructions that, when executed by a processor of a computer system, cause the computer system to perform at least the computer-implemented method of any one of claims 1 to 13.

Images