Traceable channel hubs

Abstract

A computer generates a cryptographic puzzle and a puzzle tag based on a private verification key, a secret, and a public traceability key. The computer provides a first interaction request message comprising the cryptographic puzzle and the puzzle tag to a first device. The first device or a second device modifies the cryptographic puzzle to obtain a modified cryptographic puzzle, a random value, and a traceability token. The computer receives a second interaction request message comprising the modified cryptographic puzzle and the traceability token from the second device. The computer verifies the modified cryptographic puzzle. The computer solves the modified cryptographic puzzle to obtain a modified secret and provides a second interaction response message comprising a modified puzzle solution or indication thereof to the second device. The second device or the first device, modifies the modified secret using the random value to obtain the secret.

Description

PATENT Attorney Docket No.079900-1492496-9096WO01 Client Ref. No.9096WO01 TRACEABLE CHANNEL HUBS CROSS-REFERENCE TO RELATED APPLICATIONS

[0001] This application is a PCT application which claims priority to Greek Patent Application No.20240100383, filed May 21, 2024, which is herein incorporated by reference in its entirety for all purposes. BACKGROUND

[0002] Cryptocurrencies and blockchains have gained prominence as decentralized and publicly verifiable systems. Although blockchains differ in design principles, current blockchains share scalability issues, which has motivated a line of research in off-chain (also called layer 2) solutions. One off-chain solution is the use of interaction channels. An interaction channel between two users is created by an on-chain interaction that transfers an amount (e.g., an amount of cryptocurrency) from both users into a shared address, which is called the channel. Amounts held in a channel can only be used in an interaction authenticated by both channel counterparties. Therefore, channel users can interact with each other by exchanging authenticated transactions between them that redistribute the channel funds. A channel is closed by submitting the last authenticated transaction on-chain. Therefore, interaction channels permit many interactions between two users while requiring only two interactions on-chain, to open and close the channel.

[0003] An interaction channel is fundamentally limited to interactions between the two involved parties. To bypass this limitation, interaction channel hubs consider a star topology centered at a hub and permit interactions between any two users via this single intermediary.

[0004] However, having a single intermediary raises technical problems in terms of (i) security (e.g., the hub might steal data objects from users); (ii) unlinkability (e.g., the hub might link users to a particular interaction); (iii) value privacy (e.g., the hub might learn any interaction values); (iv) interoperability (e.g., the hub might need to run a different protocol to support different channels depending on the features provided by the underlying blockchain); (v) amount flexibility (e.g., the hub supports interactions of different types ). 79571371V.1

[0005] Embodiments of the disclosure address these problems and other problems individually and collectively. BRIEF SUMMARY

[0006] One embodiment is related to a method performed by a hub computer. The hubcomputer can generate a cryptographic puzzle (Z) and a puzzle tag ( ) based on a privateverification key (skV), a secret ( ), and a public traceability key (pkT). After generating thecryptographic puzzle (Z) and the puzzle tag ( ), the hub computer can provide a firstinteraction request message comprising the cryptographic puzzle (Z) and the puzzle tag ( ) toa first device. The first device or a second device, which is in communication with the first device, can modify the cryptographic puzzle (Z) to obtain a modified cryptographic puzzle(Z’), a random value (r), and a traceability token ( ) using the puzzle tag ( ), the publictraceability key (pkT), the cryptographic puzzle (Z), and a public verification key (pkV) that corresponds to the private verification key (skV). The hub computer can receive a second interaction request message comprising the modified cryptographic puzzle (Z’) and thetraceability token ( ) from the second device. After receiving the second interaction requestmessage, the hub computer can verify the modified cryptographic puzzle (Z’) using thetraceability token ( ), the public verification key (pkV), and the public traceability key (pkT).Responsive to the modified cryptographic puzzle (Z’) being verified, the hub computer cansolve the modified cryptographic puzzle (Z’) to obtain a modified secret ( ’). After solvingthe modified cryptographic puzzle (Z’), the hub computer can provide a second interaction response message comprising a modified puzzle solution or indication thereof to the seconddevice. The modified puzzle solution includes the modified secret ( ’). The second device orthe first device can then modify the modified secret ( ’) using the random value (r) to obtainthe secret ( ).

[0007] Another embodiment is related to a method performed by a second device. Thesecond device can receive a cryptographic puzzle (Z) and a puzzle tag ( ) from a first device.The cryptographic puzzle (Z) and the puzzle tag ( ) can be generated by a hub computer andprovided to the first device in a first interaction request message. The second device can modify the cryptographic puzzle (Z) to obtain a modified cryptographic puzzle (Z’), arandom value (r), and a traceability token ( ) using the puzzle tag ( ), the public traceabilitykey (pkT), the cryptographic puzzle (Z), and a public verification key (pkV). After modifying the cryptographic puzzle (Z), the second device can provide, to the hub computer, a second 79571371V.1interaction request message comprising the modified cryptographic puzzle (Z’) and thetraceability token ( ). The hub computer can verify the modified cryptographic puzzle (Z’)using the traceability token ( ), the public verification key (pkV), and the public traceabilitykey (pkT), and then solve the modified cryptographic puzzle (Z’) to obtain a modified secret( ’). The second device can then receive a second interaction response message comprising amodified puzzle solution or indication thereof. The modified puzzle solution includes themodified secret ( ’). After receiving the second interaction response message, the seconddevice can modify the modified secret ( ’) using the random value (r) to obtain the secret ( ).The second device can provide the secret ( ) to the first device in response to thecryptographic puzzle (Z).

[0008] Another embodiment is related to a method performed by a tracer computer. The tracer computer can generate a trace request message comprising a plurality of data identifiers that identify off-chain channels utilized by a hub computer. The tracer computer can provide the trace request message to the hub computer. The hub computer can obtains off-chain channel data based on the plurality of data identifiers. The tracer computer can receive a trace response message comprising the off-chain channel data from the hub computer. The trace response message includes a first cryptographic puzzle (Z), a firsttraceability token ( ), and a first secret ( ) from a first off-chain channel and a secondcryptographic puzzle (Z’), a second traceability token ( ’), and a second secret ( ’) from asecond off-chain channel. After receiving the trace response message, the tracer computer candetermine a ciphertext (c) and a proof ( ) from the first traceability token ( ). The tracercomputer can then decrypt the ciphertext (c) using a private traceability key ( ) to obtain arandom value (r). The tracer computer can modify the first secret ( ) to obtain a modified firstsecret ( ’). After obtaining the modified first secret ( ’), the tracer computer can determinewhether or not the modified first secret ( ’) matches and the second secret ( ’). If themodified first secret ( ’) matches and the second secret ( ’), the tracer computer candetermine that the first off-chain channel is associated with the second off-chain channel.

[0009] In some embodiments, based on determining that the first off-chain channel is associated with the second off-chain channel, the tracer computer can determine that a first device involved in the first off-chain channel is interacting with a second device involved in the second off-chain channel. 79571371V.1

[0010] Further details regarding embodiments of the disclosure can be found in the Detailed Description and the Figures. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] FIG.1 shows a block diagram of a traceable channel hub system according to embodiments.

[0012] FIG.2 shows a flow diagram of a method of processing an interaction according to embodiments.

[0013] FIG.3 shows a flow diagram of a tracing method according to embodiments.

[0014] FIG.4 shows a block diagram of components of a hub computer according to embodiments.

[0015] FIG.5 shows a block diagram of components of a user device computer according to embodiments.

[0016] FIG.6 shows a block diagram of components of a tracer computer according to embodiments.

[0017] FIG.7 shows a block diagram of components of a computer according to embodiments. TERMS

[0018] Prior to discussing embodiments of the disclosure, some terms can be described in further detail.

[0019] A “user” may include an individual. In some embodiments, a user may be associated with one or more personal accounts and / or mobile devices. The user may also be referred to as a client in some embodiments.

[0020] A “user device” may be a device that is operated by a user. Examples of user devices may include a mobile phone, a smart phone, a card, a personal digital assistant (PDA), a laptop computer, a desktop computer, a server computer, a thin-client device, a tablet PC, etc. The user device may include one or more processors capable of processing user input. The user device may also include one or more input sensors for receiving user input. As is known in the art, there are a variety of input sensors capable of detecting user input, such as accelerometers, cameras, microphones, etc. The user input obtained by the 79571371V.1input sensors may be from a variety of data input types, including, but not limited to, audio data, visual data, or biometric data. The user device may comprise any electronic device that may be operated by a user, which may also provide remote communication capabilities to a network. Examples of remote communication capabilities include using a mobile phone (wireless) network, wireless data network (e.g., 3G, 4G or similar networks), Wi-Fi, Wi-Max, or any other communication medium that may provide access to a network such as the Internet or a private network.

[0021] A “digital wallet” may include an electronic device or service that allows an individual to conduct electronic commerce transactions. A digital wallet may store user profile information, credentials, bank account information, one or more digital wallet identifiers and / or the like and can be used in a variety of transactions, such as, but not limited to, eCommerce transactions, social network transactions, money transfer / personal payment transactions, mobile commerce transactions, proximity payment transactions, gaming transactions, etc. A digital wallet may be designed to streamline the purchase and payment process. A digital wallet may allow the user to load one or more payment cards onto the digital wallet so as to make a payment without having to enter an account number or present a physical card. Digital wallets may also be used manage cryptocurrencies and execute cryptocurrency transactions, including, for example, receiving cryptocurrencies at a cryptocurrency address associated with the digital wallet holder or transmitting cryptocurrencies to other cryptocurrency addresses.

[0022] A "key pair" may include a pair of linked cryptographic keys. For example, a key pair can include a public key and a corresponding private key. As an example, in a key pair, a first key (e.g., a public key) may be used to encrypt a message, while a second key (e.g., a private key) may be used to decrypt the encrypted message. Additionally, a public key may be able to verify a digital signature generated with the corresponding private key. The public key may be distributed throughout a network in order to allow for verification of messages signed using the corresponding private key. Public and private keys may be in any suitable format, including those based on RSA or elliptic curve cryptography (ECC). In some embodiments, a public key of a public / private key pair may be a used as a service provider identifier that identifies a service provider. A public key can be a verification key.

[0023] A “digital signature” may include an electronic signature for a message. A digital signature may be a numeric data value, an alphanumeric data value, or any other type of data. 79571371V.1In some embodiments, a digital signature may be a unique data value generated from a message (or data packet) and a private key using a cryptographic algorithm. In some embodiments, a validation algorithm using a public key may be used to verify the signature. A digital signature may be used to demonstrate the veracity of the sender.

[0024] An “interaction” may include a reciprocal action or influence. An interaction can include a communication, contact, or exchange between parties, devices, and / or entities. Example interactions include a transaction between two parties and a data exchange between two devices. In some embodiments, an interaction can include a user requesting access to secure data, a secure webpage, a secure location, and the like. In other embodiments, an interaction can include a payment transaction in which two devices can interact to facilitate a payment.

[0025] “Interaction data” can include data related to and / or recorded during an interaction. In some embodiments, interaction data can be transaction data of the network data. Transaction data can comprise a plurality of data elements with data values.

[0026] An “amount” can include a quantity of something. An amount can include a total of a thing or things in number, size, value, or extent.

[0027] The term “verification” and its derivatives may refer to a process that utilizes information to determine whether an underlying subject is valid under a given set of circumstances. Verification may include any comparison of information to ensure some data or information is correct, valid, accurate, legitimate, and / or in good standing.

[0028] A "blockchain" can be a distributed database that maintains a continuously-growing list of records secured from tampering and revision. A blockchain may include a number of blocks of interaction records. Each block in the blockchain can contain also include a timestamp and a link to a previous block. Stated differently, interaction records in a blockchain may be stored as a series of "blocks," or permanent files that include a record of a number of interactions occurring over a given period of time. Blocks may be appended to a blockchain by an appropriate node after it completes the block and the block is validated. Each block can be associated with a block header. In embodiments of the invention, a blockchain may be distributed, and a copy of the blockchain may be maintained at each full node in a verification network. Any node within the verification network may subsequently use the blockchain to verify interactions. 79571371V.1

[0029] An “off-chain channel” or “interaction channel” may include a channel used to perform transactions or micro-transactions without broadcasting results to other devices. An example of an interaction channel can be a “state channel.” An off-chain channel can be performed without broadcasting results to a blockchain. An off-chain channel may be referred to as a “layer two channel.” Channels in the Lightning Network are examples of off- chain channels. In some implementations, an off-chain channel may be implemented utilizing a smart contract deployed on the blockchain. The participants on the off-chain channel can then perform transactions with one another without broadcasting to the blockchain. The off- chain channel can be closed by broadcasting “closing,” at which point the funds on the off- chain channel are distributed to the participants.

[0030] A “cryptographic puzzle” can refer to a cryptographic object (e.g., a cryptogram, cryptoquote, or cryptoquiz) that when solved can provide decoded data (e.g., a decoded message). A cryptographic puzzle can be designed to be difficult to solve without specific secret information, but relatively easy to verify once a solution is found. A cryptographic puzzle can be a verifiable linkable randomizable puzzle. A verifiable linkable randomizable puzzle can be a cryptographic primitive that enables commitment to a secret with respect to two secret keys, a verification key and a traceability key, such that (i) it can be verified that the commitment is issued by the owner of the verification key; and (ii) the verifiable linkable randomizable puzzle can be randomized to make it unlinkable to the original commitment for those without access to the traceability key, whereas it can be traced back to the original commitment using the traceability key.

[0031] A “data identifiers” can include values that identify particular data. A data identifier can identify a particular instance of something. A data identifier can identify off-chain channels, interactions, and / or computers involved in a traceable channel hub system.

[0032] A “processor” may include a device that processes something. In some embodiments, a processor can include any suitable data computation device or devices. A processor may comprise one or more microprocessors working together to accomplish a desired function. The processor may include a CPU comprising at least one high-speed data processor adequate to execute program components for executing user and / or system- generated requests. The CPU may be a microprocessor such as AMD's Athlon, Duron and / or Opteron; IBM and / or Motorola's PowerPC; IBM's and Sony's Cell processor; Intel's Celeron, Itanium, Pentium, Xeon, and / or XScale; and / or the like processor(s). 79571371V.1

[0033] A “memory” may be any suitable device or devices that can store electronic data. A suitable memory may comprise a non-transitory computer readable medium that stores instructions that can be executed by a processor to implement a desired method. Examples of memories may comprise one or more memory chips, disk drives, etc. Such memories may operate using any suitable electrical, optical, and / or magnetic mode of operation.

[0034] A “server computer” may include a powerful computer or cluster of computers. For example, the server computer can be a large mainframe, a minicomputer cluster, or a group of servers functioning as a unit. In one example, the server computer may be a database server coupled to a Web server. The server computer may comprise one or more computational apparatuses and may use any of a variety of computing structures, arrangements, and compilations for servicing the requests from one or more client computers. DETAILED DESCRIPTION

[0035] Cryptocurrencies and blockchains, while gaining popularity and seeing increased adoption in various forms, face a number of technical problems in terms of scalability and privacy. Payment channel hubs (also referred to as interaction channel hubs), have been proposed as a solution to both of these problems, pushing transactions off of a public ledger maintained by a blockchain network. Payment channel hubs have been improved over the last years by offering high degrees of anonymity, efficiency and interoperability. However, maintaining unlinkability while allowing some traceability to track illicit activities poses a technical problem.

[0036] Embodiments provide for new features for payment channel hubs that solve the technical problem of lack of traceability in cryptocurrency transactions while maintaining unlinkability, which were not considered in previous payment channel hubs constructions. Traceability allows for tracking (e.g., tracing) a transfer from one device to another device. Unlinkability prevents information about transfers from one device to another device to be leaked. Traceability and unlinkability guarantees appear to be opposing one another. Embodiments provide for a concept of selective traceability, which allows traceability for high-risk transfers between user devices in a payment channel, while preserving unlinkability for the rest of the transfers.

[0037] To solve the technical problem of lack of traceability, while maintaining unlinkability, embodiments introduce a new cryptographic primitive called verifiable linkable randomizable puzzles (VLRP). Verifiable linkable randomizable puzzles can enable 79571371V.1commitment to a secret with respect to two secret keys, a verification key and a traceability key, such that: 1) a device can verify that the commitment is issued by the owner of the verification key; and 2) the verifiable linkable randomizable puzzle can be randomized to make the verifiable linkable randomizable puzzle unlinkable to the original commitment for devices without access to the traceability key, whereas the verifiable linkable randomizable puzzle can be traced back to the original commitment using the traceability key.

[0038] Embodiments further provide for systems that include a payment channel hub computer built on verifiable linkable randomizable puzzles, which provides selective traceability guarantees. The auditable unlinkable payment channel hub system can include a tracer computer that flags high-risk transfers for traceability. Embodiments impose little overhead over existing constructions and yet provides traceability properties on top of the existing security, unlinkability, value privacy, interoperability, and amount flexibility. I. EXEMPLARY NETWORK ARCHITECTURE

[0039] Embodiments provide for traceable channel hub systems where a hub computer can communicate with a plurality of user devices to perform off-chain interactions. The off-chain interactions can involve amounts, such as cryptocurrency amounts, that are associated with blockchain networks. The hub computer can form an off-chain channel with each user device in the system. The hub computer and a user device can transfer amounts to one another dependent upon the solving of cryptographic puzzles.

[0040] FIG.1 shows a traceable channel hub system 100 according to embodiments of the disclosure. The traceable channel hub system 100 comprises a first user device 102, a first service provider computer 104, a first blockchain network 106, a hub computer 108, a second user device 110, a second service provider computer 112, a second blockchain network 114, and a tracer computer 116.

[0041] The hub computer 108 can be in operative communication with the first user device 102, the first service provider computer 104, the first blockchain network 106, the second user device 110, the second service provider computer 112, the second blockchain network 114, and the tracer computer 116. The first service provider computer 104 can be in operative communication with the first blockchain network 106 and the first user device 102. The second service provider computer 112 can be in operative communication with the second 79571371V.1blockchain network 114 and the second user device 110. The first user device 102 can be in operative communication with the second user device 110.

[0042] For simplicity of illustration, a certain number of components are shown in FIG.1. It is understood, however, that embodiments of the invention may include more than one of each component. In addition, some embodiments of the invention may include fewer than or greater than all of the components shown in FIG.1.

[0043] Messages between at least the devices included in the traceable channel hub system 100 in FIG.1 can be transmitted using a secure communications protocols such as, but not limited to, File Transfer Protocol (FTP); HyperText Transfer Protocol (HTTP); Secure Hypertext Transfer Protocol (HTTPS), SSL, ISO (e.g., ISO 8583) and / or the like. The communications network may include any one and / or the combination of the following: a direct interconnection; the Internet; a Local Area Network (LAN); a Metropolitan Area Network (MAN); an Operating Missions as Nodes on the Internet (OMNI); a secured custom connection; a Wide Area Network (WAN); a wireless network (e.g., employing protocols such as, but not limited to a Wireless Application Protocol (WAP), I-mode, and / or the like); and / or the like. The communications network can use any suitable communications protocol to generate one or more secure communication channels. A communications channel may, in some instances, comprise a secure communication channel, which may be established in any known manner, such as through the use of mutual authentication and a session key, and establishment of a Secure Socket Layer (SSL) session.

[0044] The first user device 102 may be operated by a first user. The first user device 102 can include a user device such as a phone, a tablet, a smartwatch, a desktop computer, a laptop computer, etc. The first user can utilize the first user device 102 to perform an interaction (e.g., a transaction, a data transfer, etc.) with the second user device 110 via the hub computer 108. The second user device 110 can be similar to the first user device 102. In some embodiments, the second user device 110 can include a resource provider device operated by a resource provider. In other cases, the second user device 110 can be operated by a second user that is not a resource provider.

[0045] The first service provider computer 104 may be operated by a first service provider. The first service provider computer 104 may provide access to a digital wallet to user devices. For example, the first service provider computer 104 may be a digital wallet application server and may communicate with digital wallet applications installed on user 79571371V.1devices. A digital wallet application stored on a user device can be utilized to manage cryptocurrencies and execute cryptocurrency transactions. For example, the digital wallet application can be utilized to process receiving cryptocurrencies at a cryptocurrency address associated with the digital wallet holder (e.g., a user of the user device) or transmitting cryptocurrencies to other cryptocurrency addresses. The second service provider computer 112 may be operated by a second service provider, and may be similar to the first service provider computer 104.

[0046] For example, the first user device 102 may install a digital wallet application, which is provided by the first service provider computer 104, on the first user device 102, which is used to obtain and utilize a digital currency account. After obtaining the digital currency account, the first user device 102 may communicate with the first blockchain network 106 via the first service provider computer 104. The first user device 102 can establish a first off- chain channel (e.g., using a channel contract) with the hub computer 108. The first off-chain channel can be associated with the first blockchain network 106. The first off-chain channel can facilitate the first user device 102 in communicating and performing interactions directly with the hub computer 108, without accessing the first blockchain network 106. For example, the first off-chain channel can allow the first user device 102 provide amounts to the hub computer 108.

[0047] A similar process can be performed between the second blockchain network 114, the second service provider computer 112, the second user device 110, and the hub computer 108 to establish a second off-chain channel between the second user device 110 and the hub computer 108. After the second off-chain channel is established between the second user device and the hub computer 108, the hub computer 108 may be in communication with the first user device 102 via the first off-chain channel and the second user device 110 via the second off-chain channel.

[0048] The first blockchain network 106 may operate a first blockchain of a first digital currency. The second blockchain network 114 may operate a second blockchain of a second digital currency. The first and second digital currencies may be the same or different. In some embodiments, the first blockchain network 106 may be operated and / or used by the first authority entity, and the second blockchain network 114 may be operated and / or used by the second authorizing entity. 79571371V.1

[0049] For example, the first blockchain network 106 can maintain a first blockchain for a first digital currency. The first user device 102 may store a digital wallet application that includes a cryptocurrency address associated with the first blockchain. The first service provider computer 104 can provide communications from the first user device 102 to the first blockchain network 106 to perform interactions using the first digital currency.

[0050] The hub computer 108 can be a computer or a server computer. The hub computer 108 can be a central hub in a hub and spoke system. The hub computer 108 can form off- chain channels with other devices. The hub computer 108 can form a plurality of off-chain channel with a plurality of user devices.

[0051] The hub computer 108 can form a first off-chain channel with the first user device 102. The hub computer 108 can form a second off-chain channel with the second user device 110. The off-chain channels can allow the hub computer 108 and a connected user device to perform interactions with one another off-chain (e.g., off of a blockchain). The off-chain channel can be a payment channel. For example, the first user device 102 can perform an interaction (e.g., a transfer of an amount) with the hub computer 108 when the first user device 102 and the hub computer are offline from the blockchain network(s) (e.g., not in communication with the first blockchain network 106 and / or the second blockchain network 114). For example, the first user device 102 and the hub computer 108 can perform a plurality of off-chain interactions (e.g., transfers of amounts) in the off-chain channel. At some point in time, the first user device 102 and the hub computer 108 can submit the outcome (e.g., the final state of) the off-chain channel to a blockchain network (e.g., the first blockchain network 106), such that the final transferred amounts in relation to the starting amounts are recorded in the blockchain maintained by the blockchain network.

[0052] In some embodiments, the hub computer 108 may be operated by a processing network, such as a payment processing network.

[0053] The tracer computer 116 can evaluate interactions performed between two devices even if the interactions are performed in an off-chain channel in a typically unlinkable manner. The tracer computer 116 can provide trace request messages to the hub computer 108. A trace request message can request the hub computer 108 to provide interaction related data from the off-chain channels between the hub computer 108 and external computers (e.g., user device, etc.). The trace request message can include a plurality of data identifiers that identify off-chain channels utilized by a hub computer. The trace request message can request 79571371V.1cryptographic puzzles and other data utilized by the external computers to perform an interaction.

[0054] The tracer computer 116 can utilize a private traceability key to decrypt information that can allow the tracer computer 116 to link and trace interactions between user devices. For example, the tracer computer 116 can link together a cryptographic puzzle obtained by the first user device 102 from the hub computer 108 with a modified cryptographic puzzle provided by the second user device 110 to the hub computer 108. Further details relating to tracing interactions across off-chain channels are described in further reference to FIG.3.

[0055] As an illustrative example of an interaction in the traceable channel hub system 100, the second user device 110 can transfer an amount to the first user device 102 via the hub computer 108, without the hub computer 108 identifying to which device the second user device 110 is transferring the amount.

[0056] The first user device 102 and the second user device 110 can establish a direct channel therebetween. The direct channel can be a TCP / IP based communication channel, a short-message service communication channel, or other communication channel that can provide messages between devices. The first user device 102 and the second user device 110 can communicate about transferring an amount to the first user device 102 from the second user device 110 via the hub computer 108. The first user device 102 and the second user device 110 can agree upon an amount to transfer.

[0057] The first user device 102 can utilize the first off-chain channel request an amount be transferred to the first user device 102 from the hub computer 108 dependent upon solving a cryptographic puzzle. The transfer can be dependent upon the first user device 102 providing a solution (e.g., a secret) of the cryptographic puzzle to the hub computer 108. The first user device 102 can obtain the cryptographic puzzle from the hub computer 108. The first user device 102 can provide the cryptographic puzzle to the second user device 110.

[0058] The second user device 110 can modify the cryptographic puzzle to obtain a modified cryptographic puzzle. The second user device 110 can provide the modified cryptographic puzzle to the hub computer 108 to transfer an amount from the second user device 110 to the hub computer 108 dependent upon solving the modified cryptographic puzzle. The hub computer 108 can solve the modified cryptographic puzzle and can provide the solution (e.g., a modified secret) to the second user device 110 to complete the transfer of the amount from the second user device 110 to the hub computer 108. 79571371V.1

[0059] The second user device 110 can determine the secret, which solves the cryptographic puzzle, based on the modified secret, which solves the modified cryptographic puzzle, by modifying the modified secret in a similar manner to modifying the cryptographic puzzle. Upon determining the secret, The second user device 110 can provide the secret to the first user device 102.

[0060] The first user device 102 can provide the secret to the hub computer 108 to complete the transfer of the amount from the hub computer 108 to the first user device 102.

[0061] Cryptographic puzzles and transfers in the off-chain channels are described in further detail herein. II. CRYPTOGRAPHIC PUZZLES

[0062] In generating a cryptographic puzzle (e.g., a verifiable linkable randomizablepuzzle) (Z), a computer can commit to a secret ( ) with respect to two cryptographic keypairs, a verification key pair and a traceability key pair. The verification key pair can include a private verification key and a public verification key. The traceability key pair can include a private traceability key and a public traceability key. The hub computer 108 can store the private verification key. The tracer computer 116 can store the private traceability key.

[0063] The hub computer 108, which is associated with and stores the private verification key of the verification key pair, can create valid cryptographic puzzles (Z). Cryptographic puzzles (Z) may only be created by a computer that has and utilizes a private verification key. For example, a hub computer, in a hub and spoke architectured network, can generate cryptographic puzzles. By having select computers be able to generate cryptographic puzzles, the overall security of the system is improved since malicious devices cannot generate cryptographic puzzles.

[0064] The cryptographic puzzle (Z) can be modified (e.g., randomized) with an amount of randomness that is indicated by a random value (r). Any device can modify the cryptographic puzzle (Z). Modification of the cryptographic puzzle (Z) can result in a new modifiedcryptographic puzzle (Z’) that commits to the result of a function ( , r) (e.g., commits to amodification of the secret ( ) using the random value (r) and a modification function ).

[0065] Using the public verification key it is possible to check that the modified cryptographic puzzle (Z’) has been correctly modified from a previous cryptographic puzzle 79571371V.1(Z) without leaking (e.g., exposing) the cryptographic puzzle (Z) itself. Such a property provides for unlinkability between a cryptographic puzzle (Z) and a modified cryptographic puzzle (Z’).

[0066] A cryptographic puzzle can provide selective traceability guarantees. Using the private traceability key it is possible to check whether or not the modified cryptographic puzzle (Z’) is modified from a cryptographic puzzle (Z), thus providing for select traceability between cryptographic puzzles and modified cryptographic puzzles. The tracer computer 116 can be able to identify linkages between cryptographic puzzles and modified cryptographic puzzles, while other devices in the system cannot link together cryptographic puzzles and modified cryptographic puzzles. The tracer computer 116 can utilize the private traceability key to identify related cryptographic puzzles. User devices can perform transfers to one another using the hub computer 108, as an intermediary, without the interaction of the tracer computer 116.

[0067] For example, the hub computer 108 can provide an amount (e.g., issue a payment) to the first user device 102 (e.g., a receiver device that receives an amount) conditioned on solving a cryptographic puzzle (Z). The first user device 102 can forward the cryptographic puzzle (Z) to the second user device 110 (e.g., a sender device that sends an amount).

[0068] Upon receiving the cryptographic puzzle (Z), the second user device 110 can modify the cryptographic puzzle (Z) into a modified cryptographic puzzle (Z’). The second user device 110 can then provide an amount (e.g., issue a payment) to the hub computer 108 conditioned on solving the modified cryptographic puzzle (Z’). The amount that is to be provided by the second user device 110 to the hub computer 108 can be the same as the amount that is to be provided by the hub computer 108 to the first user device 102.

[0069] The hub computer 108 can solve the modified puzzle (Z’) to determine a modifiedsecret ( ’). By solving the modified puzzle (Z’), the hub computer 108 can accept the amountfrom the second user device 110. After the hub computer 108 determines the modified secret( ’), the hub computer 108 can provide the modified secret ( ’) to the second user device 110.

[0070] The second user device 110 can modify (e.g., derandomize) the modified secret ( ’)to determine the secret ( ). The secret ( ) can be used to solve the cryptographic puzzle (Z).The second user device 110 can provide the secret ( ) to the first user device 102. The firstuser device 102 can provide the secret ( ) to the hub computer 108 to complete the transfer ofthe amount from the hub computer 108 to the first user device 102. 79571371V.1

[0071] Further details related to a verifiable linkable randomizable cryptographic puzzle and functions related thereto are illustrated in Table 1, below. A security parameter can bedenoted by 1 . The notation of can denote the output of a function when thefunction is a probabilistic polynomial time (PPT) algorithm and : can denotewhen the function is a deterministic polynomial time (DPT) algorithm.16 79571371V.1Table 1: Cryptographic Puzzles

[0072] Table 1 illustrates a plurality of methods that can be performed by devices in the traceable channel hub system 100 illustrated in FIG.1. Details of each method are described in the reference to Tables 2-10, below. A. Public Parameter and Trap Door Setup

[0073] Cryptographic puzzles, such as a verifiable linkable randomizable puzzle, can be generated, solved, modified, verified, and traced. For example, a cryptographic puzzle can be setup and generated using a method, a method, a method, and a method.

[0074] To initiate setup of the cryptographic puzzle (Z), the hub computer 108 can perform the method, as illustrated in Table 2, below. The hub computer 108 can utilize asecurity parameter 1 to generate public parameters and a trapdoor . To generate thegenerate public parameters and a trapdoor , the hub computer 108 can generate initialpublic parameters and an initial trapdoor using an initial puzzle generation. 1 method based on the security parameter 1 . The initial puzzle generationprocess can be similar to a puzzle generation process as described in Erkan Tairi, et.al. A2L: Anonymous atomic locks for 356 scalability in payment channel hubs, 2021 IEEE Symposium on Security and Privacy, pages 3571834–1851, IEEE Computer Society Press, May 2021. doi:10.1109 / SP40001.2021.00111, which is incorporated herein by reference.

[0075] After generating the initial public parameters and an initial trapdoor . The hub computer 108 can generate a common reference string . The common reference string can be generated using a common reference string generator method 1 basedon the security parameter 1 .

[0076] After generating the common reference string , the hub computer 108 can generate the public parameters using the initial public parameters and the common 79571371V.1reference string . For example, the hub computer 108 can include the common reference string into the initial public parameters to form the public parameters .

[0077] After forming the public parameters , the hub computer 108 can utilize the initial trapdoor as the trapdoor .

[0078] The public parameters can relate to public values for the interaction using the off-chain channel. For example, the public parameters can include a message that indicates to transfer an amount from one device to another device (e.g., from the hub computer 108 to the first user device 102). The trapdoor can be a value that can later be utilized to solve cryptographic puzzles (Z) that are generated by the hub computer 108 usingthe public parameters .Table 2: PSetup B. Cryptographic Key Setup

[0079] The hub computer 108 can generate a public verification key and a privateverification key using the 1 method based on the security parameter1 , as illustrated in Table 3, below. The hub computer 108 can generate a public key pand a private key using a digital signature cryptographic key generation method. 1 . The hub computer 108 can utilize the public key p as the public verificationkey . The hub computer 108 can utilize the private key as the private verification key .

[0080] The digital signature cryptographic key generation method . 1 can besecure under existential unforgeability under chosen-message attack (EUF-CMA). 79571371V.1

[0081] The public verification key can be made available to other devices in thesystem, while the private verification key remains private to the hub computer 108.Table 3: PVerifySetup

[0082] The tracer computer 116 can generate a public traceability key and a privatetraceability key using the 1 method based on the security parameter1, as illustrated in Table 4, below. The tracer computer 116 can generate an encryptionkey and a decryption key using a encryption cryptographic key generation method. 1 . The tracer computer 116 can utilize the encryption key as the publictraceability key . The tracer computer 116 can utilize the decryption key as the private verification key .

[0083] The encryption cryptographic key generation method . 1 can besecure under indistinguishability under chosen-plaintext attack (IND-CPA).

[0084] The public verification key can be made available to other devices in thesystem, while the private verification key remains private to the hub computer 108.79571371V.1C. Cryptographic Puzzle Generation

[0085] After the aforementioned methods are performed, the hub computer 108 can generate a cryptographic puzzle Z. For example, the hub computer 108 can generate the cryptographic puzzle Z for a first user device 102 when the first user device 102 requests to obtain an amount from the hub computer 108 via an off-line channel.

[0086] The hub computer 108 can generate the cryptographic puzzle Z and a cryptographicpuzzle tag using a generation method , , , as illustrated in Table 5, below.The cryptographic puzzle tag can identify the cryptographic puzzle Z.

[0087] The hub computer 108 can obtain the initial public parameters and the common reference string from the public parameters . After obtaining the initial publicparameters , the hub computer 108 can generate the cryptographic puzzle Z using a. , method. The hub computer 108 can generate the cryptographic puzzle Zbased on the initial public parameters and a secret . The secret can be a randomly generated value. The secret can be a solution to the generated cryptographic puzzle Z.

[0088] After generating the cryptographic puzzle Z, the hub computer 108 can sign the cryptographic puzzle Z using the private verification key to obtain a signature . The hubcomputer 108 can utilize the signature as the cryptographic puzzle tag .Table 5: PGen D. Solving a Cryptographic Puzzle with a Trapdoor

[0089] To solve a cryptographic puzzle Z, the hub computer 108 can utilize a cryptographicpuzzle solving method , , as illustrated in Table 6, below. The hub computer 10879571371V.1can utilize the trapdoor to solve the cryptographic puzzle Z to obtain the secret . The hub computer 108 can solve the cryptographic puzzle Z using a puzzle solving method. , as described in further detail in Erkan Tairi, et.al. A2L: Anonymousatomic locks for 356 scalability in payment channel hubs, 2021 IEEE Symposium on SecurityTable 6: PSolve E. Puzzle Tag Verification

[0090] The cryptographic puzzle Z can be associated with a cryptographic puzzle tag that can identify the cryptographic puzzle Z. Any computer (e.g., the hub computer 108, a user device, the tracer computer 116, etc.) can verify the cryptographic puzzle tag using a, , , method, as illustrated in Table 7, below.

[0091] A computer that is verifying the cryptographic puzzle tag can perform a digital signature verification function . , , to verify the cryptographic puzzle tagusing the public verification key , the cryptographic puzzle Z, and the cryptographic puzzle tag . For example, the computer can verify that the cryptographic puzzle Z was signed using the private verification key that corresponds to the public verification key , where the signature is equal to the cryptographic puzzle tag . The computer can determine a Boolean value that indicates whether or not the cryptographic puzzle tag is valid for the corresponding cryptographic puzzle Z.79571371V.1F. Cryptographic Puzzle Modification

[0092] A computer, such as the first user device 102 or the second user device 110, can modify a cryptographic puzzle Z. The computer can modify the cryptographic puzzle Z byrandomizing the cryptographic puzzle Z using a cryptographic puzzle randomization method, , , , , as illustrated in Table 8, below.

[0093] The computer can obtain the initial public parameters and the common reference string from the public parameters . The computer can perform a puzzlerandomization method . , using the initial public parameters and thecommon reference string to obtain a modified cryptographic puzzle and a random value . The random value can indicate information related to how the cryptographic puzzle is randomized into the modified cryptographic puzzle .

[0094] After determining the modified cryptographic puzzle and a random value , the computer can generate a ciphertext by encrypting the random value using the public traceability key .

[0095] The computer can then generate a proof . The proof can indicate that the ciphertext was correctly generated. The computer can generate the proof using a non-interactive zero knowledge proof method . , , , , . The computer cangenerate the proof based on the common reference string , a statement and a witness .

[0096] The statement can include the public traceability key , the public verification key , the modified cryptographic puzzle Z’, the ciphertext , and the initial publicparameters . The statement can be , , , , .

[0097] The witness can include the cryptographic puzzle Z, the random value , and thecryptographic puzzle tag . The witness can be , , .

[0098] After generating the proof , the computer can generate a traceability token that includes the proof and the ciphertext . The proof and the ciphertext can be utilized by the tracer computer 116 at a point later in time to obtain the random value from the ciphertext in order to trace transfers between off-chain channels.

[0099] As such, the computer can obtain a modified cryptographic puzzle , a random value , and a traceability token , where the random value indicates how the modified 79571371V.1cryptographic puzzle was created, and where the traceability token indicates that the modified cryptographic puzzle was created correctly and includes tracing information that is only accessible by the tracer computer 116.

[0100] In some embodiments, the cryptographic puzzle randomization method can include a plurality of random values that are encrypted to form the ciphertext c. Further, the ciphertext can be created based on the cryptographic puzzle Z. For example, two random values, including a first random value that can be associated with the computer and a second random value that can be associated with a tracer computer, can be generated. The ciphertext c can be formed from both random values. For example, the computer can encrypt the cryptographic puzzle Z using a computer public key (e.g., a computer encryption key ) and based on the first random value to form a first encrypted value. The computer can then encrypt the first encrypted value using a tracer computer public key (e.g., a tracer computer encryption key ) and based on the second random value to form the ciphertext c. A ciphertext c that is derived from a plurality of random values can be indicated .For example, the computer can perform:

[0101] Utilizing a plurality of random values can provide for the advantage of mitigating leakage to the tracer computer. To prevent leakage to the tracer computer, nested encryption in the puzzle-solving phase can be utilized. Instead of encrypting the cryptographic puzzle solely under the tracer computer’s key , the cryptographic puzzle can be first encrypted under the Hub computer’s key and then encrypted again using the tracer computer’s key ,resulting in , , . This can ensure that the tracer computercannot access the cryptographic puzzle without the hub computer’s collaboration. The auditing process remains unchanged: if a first user device is flagged, the tracer computer can remove the first encryption layer (e.g., using the PFlag method described in reference toTable 11), yielding , , which is forwarded to the hub computer. To maintainintegrity, the tracer computer can provide a proof of correct decryption. The hub computer can then link the first user device and the second user device for the flagged interactions, preserving unlinkability for all others (e.g., using the PAudit method described in reference toTable 12).23 79571371V.1Table 8: PRand G. Verification of Cryptographic Puzzle Modifications

[0102] A computer can verify whether or not a modified cryptographic puzzle has been modified from the cryptographic puzzle Z correctly. A computer can perform arandomization verification method , , , , , as illustrated in Table9, below.

[0103] Any computer can verify whether or not a modified cryptographic puzzle has been modified from the cryptographic puzzle Z correctly. For example, a hub computer 108 can verify the randomization of the modified cryptographic puzzle .

[0104] The computer can obtain the initial public parameters and the common reference string from the public parameters . The computer can also obtain the proof and the ciphertext from the traceability token .

[0105] The computer can verify the statement using the proof using a non-interactivezero knowledge proof verification process . , , . The computer can use theproof and the common reference string to verify the statement , which includes the public traceability key , the public verification key , the modified cryptographicpuzzle Z’, the ciphertext , and the initial public parameters . The statement can be, , , , . The computer can determine a Boolean value that indicates whetheror not the statement and the proof are valid. 79571371V.1Table 9: PVerifyRand H. Cross Off-Chain Interaction Tracing

[0106] The tracer computer 116 can determine whether or not a first cryptographic puzzle and a second cryptographic puzzle ’ are related to one another (e.g., the first cryptographic puzzle was modified to form the a second cryptographic puzzle ’). The tracer computer 116 can determine whether or not two cryptographic puzzles are related using a tracingmethod , , , , , , , as illustrated in Table 10, below.

[0107] The tracer computer 116 can obtain the public parameters , the first cryptographic puzzle , the second cryptographic puzzle ’, a first secret , a second secret and a traceability token from the hub computer 108. The first cryptographic puzzle Z and the first secret can be associated with a first off-chain channel established between the hub computer 108 and the first user device 102. The second cryptographic puzzle ’ and the second secret can be associated with a second off-chain channel established between the hub computer 108 and the second user device 110.

[0108] The tracer computer 116 can obtain the initial public parameters and the common reference string from the public parameters . The tracer computer 116 can also obtain the proof and the ciphertext from the traceability token .

[0109] The tracer computer 116 can decrypt the ciphertext using the private traceability key to obtain the random value . The tracer computer 116 can modify the first secret using the random value to obtain a verification secret?. The tracer computer 116 can compare the verification secret?to second secret . If the verification secret?and second secret match, then the first cryptographic puzzle was previously modified using the 79571371V.1random value to form the second cryptographic puzzle ’. The tracer computer 116 can determine that the first off-chain channel and the second off-chain channel are linked by the first cryptographic puzzle and the second cryptographic puzzle ’. As such, the tracer computer 116 can trace amount transfers through the hub computer 108, while other computers cannot trace amount transfers through the hub computer 108, including the hubcomputer 108 itself.Table 10: PTrace

[0110] In some embodiments, the tracer computer can perform a flag method as indicated in Table 11, below. The flag method (e.g., PFlag) can be a PPT algorithm that on input of a private auditability key (e.g., a private traceability key ) and a randomized cryptographic puzzle ’, outputs an attestation . When the tracer computer flags a user and / or user device as high-risk, the PFlag method can remove one encryption layer from ciphertext and generates a zero-knowledge proof for to ensure decryption integrity. PAudit, as illustrated in Table 12, which can be an alternate to PTrace, then allows the computer to extract the associated cryptographic puzzle by verifying the proof and decrypting .

[0111] The tracer computer can generate an intermediate ciphertext by decrypting the ciphertext using a tracer computer decryption key that corresponds to the tracer computer encryption key , which was utilized by the computer to encrypt the ciphertext during the cryptographic puzzle randomization method when a plurality of random values are utilized.

[0112] The tracer computer can then generate a witness w that is equal to the tracer computer decryption key . The tracer computer can utilize a non-interactive zero knowledge prove method to generate a flag proof . The tracer computer can determine 79571371V.1the flag proof based on the common reference string , a flag statement and the witness w. The flag statement can include the tracer computer encryption key , the ciphertext , and the intermediate ciphertext .

[0113] After generating the flag proof , the tracer computer can create the attestation .The attestation can include the intermediate ciphertext and the flag proof .Table 11: PFlag

[0114] In some embodiments, the hub computer can perform an alternate tracing method that is an alternate method to the PTrace method illustrated in Table 10, which is performed by the tracer computer. For example, the hub computer can perform a PAudit method illustrated in Table 12. The hub computer can perform PAudit when a plurality of random values were utilized to generate the ciphertext and the PFlag method was utilized.

[0115] The hub computer can obtain a traceability token for the interaction channel that is being audited (e.g., evaluated). The hub computer can obtain the ciphertext , which can be the ciphertext that is based on a plurality of random values, and a proof , which can be a proof formed during PRand based on the randomization of the cryptographic puzzle .

[0116] The hub computer can obtain the intermediate ciphertext and the flag proof from the attestation from the tracer computer upon request to evaluate a particular cryptographic puzzle.

[0117] The hub computer can then verify the flag proof using a non-interactive zero knowledge verification method. The hub computer can verify the flag proof based on 79571371V.1the common reference string , a flag statement and the flag proof , where the flag statement can include the ciphertext and the intermediate ciphertext . The non-interactive zero knowledge verification method can output a Boolean value that indicates whether or not the flag proof is valid.

[0118] If the flag proof is valid (e.g., 1), then the hub computer can decrypt the intermediate ciphertext ’ using the hub computer decryption key to obtain thecryptographic puzzle , which corresponds to the modified cryptographic puzzle ’.Table 12: PAudit III. OFF-CHAIN CHANNEL TRANSFERS

[0119] Computers can establish off-chain channels with the hub computer (e.g., hub computer 108) in a system with a hub and spoke model architecture. The hub computer can establish an off-chain channel with each computer. For example, the hub computer can establish a first off-chain channel with a first computer (e.g., the first service provider computer 104 or the first user device 102) and a second off-chain channel with a second computer (e.g., the second service provider computer 112 or the second user device 110).

[0120] Each computer may also establish a direct channel with another computer in the system. For example, the first computer can form a direct channel with the second computer. The direct channel can allow the first computer and the second computer to communicate outside of the off-chain channels directly with one another. The direct channel can be utilized for sending messages. For example, the first computer can provide information to the second 79571371V.1computer through the direct channel about an interaction in the off-chain channels established with the hub computer.

[0121] The creation of the off-chain channels between the hub computer and each of the first computer and the second computer, can allow the hub computer to perform off-chain interactions with the first computer and the second computer. The hub computer can perform off-chain interactions with the first computer and the second computer without knowing whether or not the first computer and the second computer are interacting with one another using the two different off-chain channels with the hub computer as an intermediary due to the direct channel.

[0122] FIG.2 shows a flowchart of a method of processing an interaction according to embodiments. The method illustrated in FIG.2 can be performed by a first computer 202 (e.g., the first service provider computer 104 or the first user device 102), a second computer 204 (e.g., the second service provider computer 112 or the second user device 110), and a hub computer 206 (e.g., hub computer 108).

[0123] The method illustrated in FIG.2 will be described in the context of the second computer 204 providing an amount to the first computer 202 via the hub computer 206. The transfer of the amount occurs in two transfers: 1) from the second computer 204 to the hub computer 206 and 2) from the hub computer 206 to the first computer 202. The amounts can be transferred via off-chain channels that are formed between the computers and the hub computer 206.

[0124] At step 210, the first computer 202 and the second computer 204 can establish a direct channel with one another. The direct channel can include a secure communication channel that allows messages to be provided between the first computer 202 and the second computer 204. The direct channel can be a TCP / IP based communication channel, a short- message service communication channel, or other communication channel that can provide messages between devices.

[0125] The first computer 202 and the second computer 204 can communicate using the direct channel. For example, the first computer 202 can generate an interaction request message that requests to interact with the second computer 204. The interaction request message can indicate that the first computer 202 is requesting to interact with the second computer 204 via the hub computer 206 and off-chain channels. The interaction request message can include a blockchain identifier that identifies a particular blockchain network 79571371V.1that the off-chain channels are to be associated with. The interaction request message can also include an indication of an amount that is to be added to the off-chain channel. The amount can be an amount of a cryptocurrency that is associated with the blockchain of the blockchain identifier.

[0126] At step 212, the first computer 202 can establish a first off-chain channel with the hub computer 206.

[0127] At step 214, the second computer 204 can establish a second off-chain channel with the hub computer 206.

[0128] At step 216, the first computer 202 can request a cryptographic puzzle Z that is related to a transfer of an amount (e.g., a transaction) from the hub computer 206 to the first computer 202 using the first off-chain channel that is established between the hub computer 206 and the first computer 202. If the cryptographic puzzle Z is solved and proof of the solution is provided to the hub computer 206, then the transfer of the amount can be recorded in the first off-chain channel.

[0129] At step 218, after receiving the request for the cryptographic puzzle Z, the hub computer 206 can generate a secret . The hub computer 206 can generate the secret from a solution space S. The secret can be a random value from the solution space S. The solution space S can include a plurality of potential secrets that can be utilized by the hub computer 206 to generate cryptographic puzzles. As an illustrative example, the secret can be a random value, such as, “856189168618946,” which can be generated using:.

[0130] At step 220, after generating the secret , the hub computer 206 can generate the cryptographic puzzle Z and a puzzle tag . The cryptographic puzzle Z can be a verifiable linkable randomizable puzzle. The puzzle tag can identify the cryptographic puzzle Z. The hub computer 206 can generate the cryptographic puzzle Z and the puzzle tag based on public parameters , a private verification key , and the secret .

[0131] The public parameters can include a first message that includes data related to the interaction between the hub computer 206 and the first computer 202. For example, the first message can include an amount to be transferred (e.g., $10) upon receiving the solved cryptographic puzzle or indication thereof (e.g., receiving the secret ).

[0132] The private verification key can be a private cryptographic key associated with the hub computer 206 and can correspond to a public verification key . The hub computer 79571371V.1206 can also have a public traceability key . The public traceability key can be previously provided by the tracer computer 116 to the hub computer 206.

[0133] The hub computer 206 can generate the cryptographic puzzle Z and a puzzle tag as described in reference to Table 5. For example, the hub computer 206 can perform a probabilistic polynomial time (PPT) algorithm based on the input of the public parameters pp, the private verification key , and the secret to determine the outputs of the cryptographic puzzle Z and the puzzle tag . The hub computer 206 can generate the puzzle tag , which can be a signature, by signing the cryptographic puzzle Z with the private verification key .The hub computer 206 can perform:, . , ,

[0134] At step 222, after generating the cryptographic puzzle Z and the puzzle tag , the hub computer 206 can generate a puzzle proof that indicates that the cryptographic puzzle Z was generated correctly and generated based on the public traceability key . The puzzle proof can be a non-interactive zero knowledge proof.

[0135] To generate the puzzle proof , the hub computer 206 can generate encrypt the secret using the public traceability key to obtain a ciphertext .

[0136] The hub computer 206 can utilize the secret and a generator to create an intermediate value . For example, the hub computer 206 can generate the intermediate value as follows:

[0137] The hub computer 206 can generate the puzzle proof based on the public traceability key , the intermediate value , the cryptographic puzzle Z, and the secret using a non-interactive zero knowledge proof process. For example, the hub computer 206can generate the puzzle proof by performing the following:. , , ,

[0138] At step 224, after generating the cryptographic puzzle Z and the puzzle proofthe hub computer 206 can generate a pre-signaturefor the first message .

[0139] The pre-signature can indicate be a partially signed message, generated off- chain, that can be completed by a specific recipient that possesses a secret value. A pre- 79571371V.1signature can be a digital signature that is not yet fully complete. In some cases, a pre- signature can be generated using a signer device’s cryptographic key and a partial message or context. A type of pre-signature is an adaptor signature. An adaptor signature can allow a signer device to generate a pre-signature and send it to a publisher device that holds a secret value (or can determine or otherwise obtain a secret value). The publisher device can then embed the secret into the pre-signature to create a complete, valid signature.

[0140] The hub computer 206 can generate the pre-signature using a hub computer private key that is associated with the first off-chain channel, the first message , and the intermediate value . For example, the hub computer 206 can generate the pre-signature by performing the following:

[0141] At step 226, the hub computer 206 can generate a first interaction request message. The first interaction request message can include a request to perform a first interaction between the first computer 202 and the hub computer 206. The first interaction can include the hub computer 206 providing an amount, as indicated by the first message . The first interaction request message can include the cryptographic puzzle Z, the puzzle tag , the puzzle proof , the intermediate value , and the pre-signature . The hub computer 206 can provide the first interaction request message to the first computer 202.

[0142] At step 228, after receiving the data generated by the hub computer 206 in response to the cryptographic puzzle Z request (at step 216), the first computer 202 can verify the puzzle tag . The first computer 202 can verify the puzzle tag using the public verification key , the cryptographic puzzle Z, the puzzle tag , and the public parameters pp, which can include the first message and the public traceability key . The first computer 202 can verify the puzzle tag as described in reference to Table 7.

[0143] At step 230, the first computer 202 can verify the puzzle proof using the public traceability key , the intermediate value , and the cryptographic puzzle Z. The first computer 202 can verify that the non-zero interactive proof of the puzzle proof is valid.For example, the first computer 202 can perform:79571371V.1

[0144] At step 232, after verifying that the puzzle proof is valid, the first computer 202 can perform a pre-verification process on the pre-signature . The first computer 202 can verify that the pre-signatureis valid using a hub computer public key , which corresponds to the hub computer private key for the first off-chain channel, the first message , and the intermediate value . For example, the first computer 202 canperform:

[0145] At this point, the first computer 202 can either modify the cryptographic puzzle Z to obtain a modified cryptographic puzzle ’ and provide the modified cryptographic puzzle ’ to the second computer 204, or can provide the cryptographic puzzle Z to the second computer 204 where the second computer modifies the cryptographic puzzle Z to obtain the modified cryptographic puzzle ’. Either the first computer 202 or the second computer 204 can modify the cryptographic puzzle Z.

[0146] For example, at step 234, after verifying the data received from the hub computer 206, the first computer 202 can provide the cryptographic puzzle Z and the puzzle tag to the second computer 204.

[0147] After receiving the cryptographic puzzle Z from the first computer 202, as an overview of the following steps, the second computer 204 can modify the cryptographic puzzle Z to obtain a modified cryptographic puzzle ’ and can request that the hub computer 206 solve the modified cryptographic puzzle ’ to obtain an amount transferred from the second computer 204 to the hub computer 206. Upon receiving the solution to the modified cryptographic puzzle ’, the second computer 204 can complete the transfer of the amount from the second computer 204 to the hub computer 206 via the second off-chain channel.

[0148] In particular, at step 236, after receiving the cryptographic puzzle Z from the first computer 202, the second computer 204 can modify the cryptographic puzzle Z. The second computer 204 can randomize the cryptographic puzzle Z to obtain a modified cryptographic puzzle ’. The second computer 204 can randomize the cryptographic puzzle Z based on the public parameters (which can be different from the public parameters of the first off-chain channel), the public verification key , the cryptographic puzzle Z, and the puzzle tag . By modifying the cryptographic puzzle Z, the second computer 204 can also obtain a traceability token and a random value r that indicates the randomness utilized to modify the 79571371V.1cryptographic puzzle Z. The second computer can modify the cryptographic puzzle Z asdescribed in reference to Table 8. For example, the second computer 204 can perform:, , . , , ,

[0149] At step 238, after modifying the cryptographic puzzle Z, the second computer 204 can generate a pre-signature for the interaction between the second computer 204 and the hub computer 206. The second computer 204 can generate the pre-signature based on a second computer private key , a second message , and a modified intermediate value ’.

[0150] The second messagecan include data related to the interaction between the hub computer 206 and the second computer 204. For example, the second message can include an amount to be transferred (e.g., $10) upon receiving the solved modified cryptographic puzzle or indication thereof (e.g., receiving the modified secret ’).

[0151] The second computer 204 can generate the modified intermediate value ’ using the intermediate value , a generator , the random value . For example, the second computer 204 can modify the intermediate value using the random value .

[0152] The second computer 204 generate the pre-signature by performing:. , ,

[0153] At step 240, after generating the pre-signature , the second computer 204 can generate a second interaction request message. The second interaction request message can include a request to perform a second interaction between the second computer 204 and the hub computer 206. The second interaction can include the second computer 204 providing an amount, as indicated by the second message . The second interaction request message can include the modified cryptographic puzzle ’, the traceability token , and the pre- signature. The second computer 204 can provide the second interaction request message to the hub computer 206.

[0154] At step 242, after receiving the modified cryptographic puzzle ’, the hub computer 206 can verify the modification of the cryptographic puzzle Z. The hub computer 206 can verify the modification of the cryptographic puzzle Z based on the public traceability key , the public verification key , the modified cryptographic puzzle ’, the traceability token , and the public parameters pp, where the public parameters (pp) include the second 79571371V.1message . The hub computer 206 can verify the modified cryptographic puzzle ’ as described in reference to Table 9.

[0155] At step 244, after verifying that the modified cryptographic puzzle ’ was formed correctly and formed using information that allows the tracer computer 116 to later trace the relationship between the cryptographic puzzle Z and the modified cryptographic puzzle ’, the hub computer 206 can solve the modified cryptographic puzzle ’. The hub computer 206 can solve the modified cryptographic puzzle ’ using a trapdoor that is configured to solve any VLRP cryptographic puzzle generated by the hub computer 206. By solving the modified cryptographic puzzle ’, the hub computer 206 can obtain a cryptographic puzzle solution that is a modified secret ’.

[0156] At step 246, after determining the modified secret ’ the hub computer 206 can adapt the pre-signature into a signature using the modified secret ’ to complete the signature. The hub computer 206 can obtain the signature using the cryptographic puzzle solution. For example, the hub computer 206 can perform:. ,

[0157] After generating the signature, the hub computer 206 can generate a second interaction response message. The second interaction response message can include a modified puzzle solution or indication thereof. For example, the second interaction response message can include the signature , which includes the modified secret ’. The hub computer 206 can provide the signature to the second computer 204 in the second interaction response message in response to the second interaction request message.

[0158] At step 248, after receiving the signature , the second computer 204 can extract the modified secret from the signature , the pre-signature , and the modified intermediate value ’. For example, the second computer 204 can perform:

[0159] At step 250, after obtaining the modified secret , the second computer 204 can obtain the secret using the modified secret and the random value that was utilized to modify the cryptographic puzzle Z. The second computer 204 can derandomize the modified secret to obtain the secret . For example, the second computer 204 can perform:79571371V.1

[0160] At such a point, the signature can indicate, in the second off-chain channel, that the second computer 204 has provided the amount to the hub computer 206 according to the second message that is associated with the signature .

[0161] At step 252, the second computer 204 can provide the secret , which solves the cryptographic puzzle Z, to the first computer 202.

[0162] At step 254, the first computer 202 can verify that the secret solves the cryptographic puzzle Z.

[0163] At step 256, after verifying the secret , the first computer 202 can generate a first interaction response message. The first interaction response message can be generated in response to the first interaction request message, which was generated at step 226. The first interaction response message can include a puzzle solution or indication thereof. For example, the first interaction response message can include the secret . The first computer 202 can provide the secret to the hub computer 206.

[0164] At step 258, after receiving the secret from the first computer 202, the hub computer 206 can verify that the secret solves the cryptographic puzzle Z.

[0165] At step 260, the hub computer 206 can generate a signaturefor the interaction between the hub computer 206 and the first computer 202. For example, the hub computer 206 can adapt the pre-signatureinto a signature using the secret to complete the signature. The hub computer 206 can obtain the signature using the cryptographic puzzlesolution. For example, the hub computer 206 can perform:. ,

[0166] The signature can indicate, in the first off-chain channel, that the hub computer 206 has provided the amount to the first computer 202 according to the first message that is associated with the signature .

[0167] As such, the amount of funds has been provided from the second computer 204 to the hub computer 206. The hub computer 206 has provided the same amount of funds to the first computer 202. However, the hub computer 206 does not know that these two different interactions are linked to one another. Yet, embodiments solve the technical problem of allowing unlinkability in such cases while allowing for select traceability by a tracer computer at a later point in time as further discussed in reference to FIG.3. 79571371V.1IV. TRANSFER TRACING

[0168] A first interaction between a first computer and a hub computer may not be generally linkable to a second interaction between a second computer and the hub computer even if the two interactions overall represent the second computer providing an amount to the first computer. However, a tracer computer can utilize cryptographic keys to obtain information that can allow the tracer computer to link the first interaction to the second interaction, while other devices without the cryptographic keys cannot link the first interaction to the second interaction.

[0169] FIG.3 shows a flowchart of a tracing method according to embodiments. The method illustrated in reference to FIG.3 describes a process in which a tracer computer 304 (e.g., the tracer computer 116) can request data from a hub computer 302 (e.g., the hub computer 108) to audit interactions across different off-chain channels. The method illustrated in reference to FIG.3 will be described in the context of the tracer computer 304 requesting data for a plurality of off-chain channels to identify a linkage between two different off-chain channels based on the cryptographic puzzle and modified cryptographic puzzle used. For example, the tracer computer 304 can be investigating fraud that is related to a first device of a first off-chain channel. The tracer computer 304 can determine whether or not the first off-chain channel is linked by interactions via the hub computer 302 to other off- chain channels.

[0170] At step 306, the tracer computer 304 can generate a trace request message that requests data related to off-chain channels associated with the hub computer 302. The trace request message can include information that identifies particular off-chain channels, interactions, and / or computers. The tracer computer 304 can generate, or otherwise obtain, one or more data identifiers that indicate particular off-chain channels, interactions, and / or computers involved in the traceable channel hub system. For example, the tracer computer 304 can obtain a data identifier that includes a user device identifier that indicates a device that has communicated with the hub computer 302. As another example, the tracer computer 304 can obtain a data identifier that indicates a particular off-chain channel formed between the hub computer 302 and another device. As another example, the tracer computer 304 can obtain a data identifier that indicates a particular date range (e.g., the past two days, ten days, etc.). 79571371V.1

[0171] At step 308, the tracer computer 304 can provide the trace request message to the hub computer 302.

[0172] At step 310, after receiving the trace request message, the hub computer 302 can obtain data related to the trace request message. For example, the hub computer 302 can obtain data related to interactions that occurred in the past two days. For example, the hub computer 302 can obtain data such as interaction data, messages, cryptographic puzzles, cryptographic puzzle solutions (e.g., secrets), traceability tokens, and signatures.

[0173] At step 312, the hub computer 302 can generate a trace response message comprising the requested data.

[0174] At step 314, the hub computer 302 can provide the trace response message to the tracer computer 304.

[0175] At step 316, the tracer computer 304 can initiate a process to determine whether or not two cryptographic puzzles from two different off-chain channel interactions are associated with one another by a randomization amount. By determining this, the tracer computer 304 can trace an interaction from the first computer 202 to the second computer 204. The tracer computer 304 can perform a trace process as described in reference to Table10. For example, the tracer computer 304 can perform:, , , , , ,

[0176] For example, at step 318, to determine whether or not two cryptographic puzzles are associated with one another, the tracer computer 304 can determine a ciphertext (c) and aproof ( ) from the traceability token ( ).

[0177] At step 320, after determining the ciphertext, the tracer computer 304 can decryptthe ciphertext (c) using a private traceability key ( ). This ciphertext was created duringthe modification (e.g., randomization) process of the cryptographic puzzle. The randomness (r) used to modify the cryptographic puzzle was encrypted using the tracer computer publickey ( ) (e.g., a public traceability key) to obtain the ciphertext (c). The tracer computer304 can obtain the randomness (r) by decrypting the ciphertext (c) with the privatetraceability key ( ) (e.g., a private traceability key).79571371V.1

[0178] At step 322, after determining the randomness (r), the tracer computer 304 canmodify the first secret ( ) of the first cryptographic puzzle (Z) using the randomness (r) toobtain a modified first secret (, r)).

[0179] At step 322, the tracer computer 304 can compare the modified first secret, r))to the second secret ( ) of the second cryptographic puzzle (Z’). For example, the tracercomputer 304 can determine whether or not the modified first secret ( ’) matches and thesecond secret ( ’).

[0180] At step 324, if the modified first secret ( ( , r)) matches the second secret ( ), thenthe first cryptographic puzzle (Z) and the second cryptographic puzzle (Z’) are linked to one another. The tracer computer 304 and determine that the first off-chain channel is associated with the second off-chain channel. The tracer computer 304 can trace the interaction from the first off-chain channel that involves the first cryptographic puzzle (Z) to the second off-chain channel that involves the second cryptographic puzzle (Z’). V. ADVANTAGES

[0181] Embodiments of the disclosure have a number of advantages. Embodiments provide for new features for payment channel hubs (PCH) that address the technical problem of traceability in cryptocurrency transactions, which were not considered in previous PCH constructions. Embodiments provide for selective traceability, which allows traceability for high-risk transfers while preserving unlinkability for the rest.

[0182] To solve this technical problem, embodiments provide for a cryptographic primitive called verifiable linkable randomizable puzzles (VLRP), which enables commitment to a secret. The verifiable linkable randomizable puzzles can allow for a verification that the commitment is issued by an owner of a verification key. The verifiable linkable randomizable puzzles can be modified (e.g., randomized) to make the verifiable linkable randomizable puzzles unlinkable to the original commitment for those without access to the traceability key. However, a tracer computer with access to the private traceability key can trace a modified verifiable linkable randomizable puzzle to the original verifiable linkable randomizable puzzle. 79571371V.1

[0183] Embodiments, when compared to current state-of-the-art systems, impose little overhead and yet provide traceability properties (e.g., auditability) on top of the existing security, unlinkability, value privacy, interoperability, and amount flexibility.

[0184] In embodiments, the tracer computer can focus on flagging senders, meaning the tracer computer can only deanonymize payments when a sender is identified as high-risk. However, the protocol cannot link all payments made to a flagged receiver. While this may appear limiting, the focus on senders still provides substantial fraudulent activity identification value. Typically, the sender initiates the illicit activity, making them the primary target for audits. Limiting the auditability scope to flagged senders helps maintain privacy for the majority of users while enabling fraudulent activity identification in critical situations. Given the protocol’s aim to balance privacy and auditability, this trade-off is acceptable and maintains the system’s integrity.

[0185] Embodiments further provide for minimum storage overhead for the hub computer. The hub computer an store all cryptographic puzzles generated for receivers and received from senders. While this introduces a storage overhead, the impact is minimal. Each cryptographic puzzle typically requires around 512 bytes, meaning even with a high volume of interactions, modern storage systems can easily accommodate the data. Additionally, this storage is essential to ensure auditability, which might be needed to identify fraudulent activity. The ability to audit interactions provides accountability without significantly increasing operational complexity. VI. COMPUTER SYSTEMS

[0186] Processing and methods described herein can be performed by computer systems. A. Hub Computer

[0187] FIG.4 shows a block diagram of a hub computer 400 according to embodiments. The exemplary hub computer 400 may comprise a processor 404. The processor 404 may be coupled to a memory 402, a network interface 406, and a computer readable medium 408. The computer readable medium 408 can comprise a blockchain module 408A, a smart contract module 408B, and a communication module 408C. 79571371V.1

[0188] The memory 402 can be used to store data and code. For example, the memory 402 can store a hub computer public key, a hub computer private key, smart contracts, etc. The memory 402 may be coupled to the processor 404 internally or externally (e.g., cloud based data storage), and may comprise any combination of volatile and / or non-volatile memory, such as RAM, DRAM, ROM, flash, or any other suitable memory device.

[0189] The computer readable medium 408 may comprise code, executable by the processor 404, for performing the following method. The hub computer 400 can generate acryptographic puzzle (Z) and a puzzle tag ( ) based on a private verification key (skV), asecret ( ), and a public traceability key (pkT). The hub computer 400 can provide a firstinteraction request message comprising the cryptographic puzzle (Z) and the puzzle tag ( ) toa first device. The first device or a second device, which is in communication with the first device, can modify the cryptographic puzzle (Z) to obtain a modified cryptographic puzzle(Z’), a random value (r), and a traceability token ( ) using the puzzle tag ( ), the publictraceability key (pkT), the cryptographic puzzle (Z), and a public verification key (pkV) that corresponds to the private verification key (skV). The hub computer 400 can receive a second interaction request message comprising the modified cryptographic puzzle (Z’) and thetraceability token ( ) from the second device. The hub computer 400 can verify the modifiedcryptographic puzzle (Z’) using the traceability token ( ), the public verification key (pkV),and the public traceability key (pkT). Responsive to the modified cryptographic puzzle (Z’) being verified, the hub computer 400 can solve the modified cryptographic puzzle (Z’) toobtain a modified secret ( ’). The hub computer 400 can provide a second interactionresponse message comprising a modified puzzle solution or indication thereof to the seconddevice. The modified puzzle solution can include the modified secret ( ’). The second deviceor the first device can modify the modified secret ( ’) using the random value (r) to obtain thesecret ( ).

[0190] The blockchain module 408A may comprise code or software, executable by the processor 404, for processing blockchain related data and communicating with blockchain networks. The blockchain module 408A, in conjunction with the processor 404, can utilize public / private key pairs used to communicate with a blockchain network. The blockchain module 408A, in conjunction with the processor 404, may establish communication channels, such as off-chain channels on blockchains. An off-chain channel can be governed by a channel contract. The blockchain module 408A, in conjunction with the processor 404, may transfer digital currencies on-chain and off-chain. In some embodiments, the blockchain 79571371V.1module 408A, in conjunction with the processor 404, may allow the hub computer 400 to facilitate cross-chain interactions. In some cases, the blockchain module 408A, in conjunction with the processor 404, can initiate the creation of a transaction entry in a block in a blockchain of a blockchain network.

[0191] The smart contract module 408B may comprise code or software, executable by the processor 404, for deploying and maintaining smart contracts. The smart contract module 408B, in conjunction with the processor 404, can deploy smart contracts to blockchains. The smart contract module 408B, in conjunction with the processor 404, can access stored smart contracts and deploy the smart contracts to a blockchain using the blockchain module 408A. The smart contract module 408B, in conjunction with the processor 404, can invoke functions and protocols of a smart contract that is deployed on a blockchain. Smart contracts can aid in utilizing off-chain channels.

[0192] The communication module 408C may comprise code or software, executable by the processor 404, for communicating with other devices. The communication module 408C, in conjunction with the processor 404, can generate messages, forward messages, reformat messages, and / or otherwise communicate with other devices.

[0193] The network interface 406 may include an interface that can allow the hub computer 400 to communicate with external computers. The network interface 406 may enable the hub computer 400 to communicate data to and from another device (e.g., service provider computers, blockchain networks, etc.). Some examples of the network interface 406 may include a modem, a physical network interface (such as an Ethernet card or other Network Interface Card (NIC)), a virtual network interface, a communications port, a Personal Computer Memory Card International Association (PCMCIA) slot and card, or the like. The wireless protocols enabled by the network interface 406 may include Wi-FiTM. Data transferred via the network interface 406 may be in the form of signals which may be electrical, electromagnetic, optical, or any other signal capable of being received by the external communications interface (collectively referred to as “electronic signals” or “electronic messages”). These electronic messages that may comprise data or instructions may be provided between the network interface 406 and other devices via a communications path or channel. As noted above, any suitable communication path or channel may be used such as, for instance, a wire or cable, fiber optics, a telephone line, a cellular link, a radio frequency (RF) link, a WAN or LAN network, the Internet, or any other suitable medium. 79571371V.1B. User Device

[0194] FIG.5 shows a block diagram of a user device 500 according to embodiments. The exemplary user device 500 may comprise a processor 504. The processor 504 may be coupled to a memory 502, a network interface 506, and a computer readable medium 508. The computer readable medium 508 can comprise a blockchain module 508A, a digital wallet module 508B, and a communication module 508C.

[0195] The memory 502 can be used to store data and code and may be similar to the memory 402 as described herein. For example, the memory 502 can store verification keys, private keys, smart contracts, communication data, etc.

[0196] The computer readable medium 508 may comprise code, executable by the processor 504, for performing the following method. The user device 500 can receive acryptographic puzzle (Z) and a puzzle tag ( ) from a first device, wherein the cryptographicpuzzle (Z) and the puzzle tag ( ) are generated by a hub computer and provided to the firstdevice in a first interaction request message. The user device 500 can modify the cryptographic puzzle (Z) to obtain a modified cryptographic puzzle (Z’), a random value (r),and a traceability token ( ) using the puzzle tag ( ), the public traceability key (pkT), thecryptographic puzzle (Z), and a public verification key (pkV). The user device 500 can provide, to the hub computer, a second interaction request message comprising the modifiedcryptographic puzzle (Z’) and the traceability token ( ). The hub computer can verify themodified cryptographic puzzle (Z’) using the traceability token ( ), the public verificationkey (pkV), and the public traceability key (pkT), and solves the modified cryptographic puzzle(Z’) to obtain a modified secret ( ’). The user device 500 can receive a second interactionresponse message comprising a modified puzzle solution or indication thereof. The modifiedpuzzle solution can include the modified secret ( ’). The user device 500 can modify themodified secret ( ’) using the random value (r) to obtain the secret ( ). The user device 500can provide the secret ( ) to the first device in response to the cryptographic puzzle (Z).

[0197] The blockchain module 508A may comprise code or software, executable by the processor 504, for processing blockchain related data and communicating with blockchain networks. The blockchain module 508A, in conjunction with the processor 504, can utilize public / private key pairs used to communicate with a blockchain network. The blockchain module 508A, in conjunction with the processor 504, can allow the a user associated with a user account maintained by the user device 500 to interact using amounts included in the user 79571371V.1account. The blockchain module 508A, in conjunction with the processor 504, may transfer digital currencies on-chain and off-chain.

[0198] The digital wallet module 508B may comprise code or software, executable by the processor 504, for maintaining a digital wallet application. The digital wallet module 508B, in conjunction with the processor 504, can maintain passwords, payment methods, cryptocurrencies, and / or any other data for the user device 500. The digital wallet module 508B, in conjunction with the processor 504, can store user profile information, payment information, bank account information, one or more digital wallet identifiers and / or the like and can be used in a variety of transactions, such as but not limited to eCommerce, social networks, money transfer / personal payments, mobile commerce, proximity payments, gaming, off-chain channels, and / or the like for retail purchases, digital goods purchases, utility payments, purchasing games or gaming credits from gaming websites, transferring funds between users, and / or the like. The digital wallet module 508B, in conjunction with the processor 504, can allow a user of the user device 500 to load one or more payment cards onto the digital wallet so as to make a payment without having to enter an account number or present a physical card. The digital wallet module 508B, in conjunction with the processor 504, can allow a user of the user device 500 to maintain or manage one or more cryptocurrencies associated with one or more blockchain networks.

[0199] The communication module 508C may comprise code or software, executable by the processor 504, for communicating with other devices. The communication module 508C, in conjunction with the processor 504, can generate messages, forward messages, reformat messages, and / or otherwise communicate with other devices.

[0200] The network interface 506 may be similar to the network interface 406 and will not be repeated here. Tracer Computer

[0201] FIG.6 shows a block diagram of a tracer computer 600 according to embodiments. The exemplary tracer computer 600 may comprise a processor 604. The processor 604 may be coupled to a memory 602, a network interface 606, and a computer readable medium 608. The computer readable medium 608 can comprise a trace module 608A and a communication79571371V.1

[0202] The memory 602 can be used to store data and code and may be similar to the memory 402 as described herein. For example, the memory 602 can store verification keys, private keys, smart contracts, etc.

[0203] The computer readable medium 608 may comprise code, executable by the processor 604, for performing the following method. The tracer computer 600 can generate a trace request message comprising a plurality of data identifiers that identify off-chain channels utilized by a hub computer. The tracer computer 600 can provide the trace request message to the hub computer. The hub computer obtains off-chain channel data based on the plurality of data identifiers. The tracer computer 600 can receive a trace response message comprising the off-chain channel data from the hub computer. The trace response messagecan include a first cryptographic puzzle (Z), a first traceability token ( ), and a first secret ( )from a first off-chain channel and a second cryptographic puzzle (Z’), a second traceabilitytoken ( ’), and a second secret ( ’) from a second off-chain channel. The tracer computer 600can determine a ciphertext (c) and a proof ( ) from the first traceability token ( ). The tracercomputer 600 can decrypt the ciphertext (c) using a private traceability key ( ) to obtain arandom value (r). The tracer computer 600 can modify the first secret ( ) to obtain a modifiedfirst secret ( ’). The tracer computer 600 can determine whether or not the modified firstsecret ( ’) matches and the second secret ( ’). If the modified first secret ( ’) matches and thesecond secret ( ’), the tracer computer 600 can determine that the first off-chain channel isassociated with the second off-chain channel.

[0204] The trace module 608A may comprise code or software, executable by the processor 604, for tracing interactions across off-chain channels. The trace module 608A, in conjunction with the processor 604, can determine whether or not two off-chain channels are linked to one another. The trace module 608A, in conjunction with the processor 604, can obtain a first cryptographic puzzle and a first secret from a first off-chain channel and a second cryptographic puzzle and a second secret from a second off-chain channel as well as a traceability token.

[0205] The trace module 608A, in conjunction with the processor 604, can obtain initial public parameters and a common reference string from public parameters. The trace module 608A, in conjunction with the processor 604, can obtain a proof and a ciphertext from a traceability token. The trace module 608A, in conjunction with the processor 604, can decrypt the ciphertext using the private traceability key to obtain the random value. The trace 79571371V.1module 608A, in conjunction with the processor 604, can modify the first secret using the random value to obtain a verification secret. The trace module 608A, in conjunction with the processor 604, can compare the verification secret to second secret. If the verification secret and second secret match, then the first cryptographic puzzle was previously modified using the random value to form the second cryptographic puzzle. The trace module 608A, in conjunction with the processor 604, can determine that the first off-chain channel and the second off-chain channel are linked by the first cryptographic puzzle and the second cryptographic puzzle.

[0206] The communication module 608B may comprise code or software, executable by the processor 604, for communicating with other devices. The communication module 608B, in conjunction with the processor 604, can generate messages, forward messages, reformat messages, and / or otherwise communicate with other devices.

[0207] The network interface 606 may be similar to the network interface 406 and will not be repeated here. D. Exemplary Computer System and Subsystems

[0208] Any of the computer systems mentioned herein may utilize any suitable number of subsystems. Examples of such subsystems are shown in FIG.7 in computer system 700. In some embodiments, a computer system includes a single computer apparatus, where the subsystems can be the components of the computer apparatus. In other embodiments, a computer system can include multiple computer apparatuses, each being a subsystem, with internal components. A computer system can include desktop and laptop computers, tablets, mobile phones and other mobile devices.

[0209] The subsystems shown in FIG.7 are interconnected via a system bus 724. Additional subsystems such as a printer 708, keyboard 716, storage device(s) 718, monitor 722 (e.g., a display screen, such as an LED), which is coupled to display adapter 712, and others are shown. Peripherals and input / output (I / O) devices, which couple to I / O controller 702, can be connected to the computer system by any number of means known in the art such as input / output (I / O) port 714 (e.g., USB, FireWire®). For example, I / O port 714 or external interface 720 (e.g., Ethernet, Wi-Fi, etc.) can be used to connect computer system 700 to a wide area network such as the Internet, a mouse input device, or a scanner. The interconnection via system bus 724 allows the central processor 706 to communicate with 79571371V.1each subsystem and to control the execution of a plurality of instructions from system memory 704 or the storage device(s) 718 (e.g., a fixed disk, such as a hard drive, or optical disk), as well as the exchange of information between subsystems. The system memory 704 and / or the storage device(s) 718 may embody a computer readable medium. Another subsystem is a data collection device 710, such as a camera, microphone, accelerometer, and the like. Any of the data mentioned herein can be output from one component to another component and can be output to the user.

[0210] A computer system can include a plurality of the same components or subsystems, for example, connected together by external interface 720, by an internal interface, or via removable storage devices that can be connected and removed from one component to another component. In some embodiments, computer systems, subsystem, or apparatuses can communicate over a network. In such instances, one computer can be considered a client and another computer a server, where each can be part of a same computer system. A client and a server can each include multiple systems, subsystems, or components. In various embodiments, methods may involve various numbers of clients and / or servers, including at least 10, 20, 50, 100, 200, 500, 1,000, or 10,000 devices. Methods can include various numbers of communication messages between devices, including at least 100, 200, 500, 1,000, 10,000, 50,000, 100,000, 500,00, or one million communication messages. Such communications can involve at least 1 MB, 10 MB, 100 MB, 1 GB, 10 GB, or 100 GB of data.

[0211] Although the steps in the flowcharts and process flows described above are illustrated or described in a specific order, it is understood that embodiments of the invention may include methods that have the steps in different orders. In addition, steps may be omitted or added and may still be within embodiments of the invention.

[0212] Aspects of embodiments can be implemented in the form of control logic using hardware circuitry (e.g., an application specific integrated circuit or field programmable gate array) and / or using computer software stored in a memory with a generally programmable processor in a modular or integrated manner, and thus a processor can include memory storing software instructions that configure hardware circuitry, as well as an FPGA with configuration instructions or an ASIC. As used herein, a processor can include a single-core processor, multi-core processor on a same integrated chip, or multiple processing units on a single circuit board or networked, as well as dedicated hardware. Based on the disclosure and 79571371V.1teachings provided herein, a person of ordinary skill in the art will know and appreciate other ways and / or methods to implement embodiments of the present disclosure using hardware and a combination of hardware and software.

[0213] Any of the software components or functions described in this application may be implemented as software code to be executed by a processor using any suitable computer language such as, for example, Java, C, C++, C#, Objective-C, Swift, or scripting language such as Perl or Python using, for example, conventional or object-oriented techniques. The software code may be stored as a series of instructions or commands on a computer readable medium for storage and / or transmission. A suitable non-transitory computer readable medium can include random access memory (RAM), a read only memory (ROM), a magnetic medium such as a hard-drive or a floppy disk, or an optical medium such as a compact disk (CD) or DVD (digital versatile disk) or Blu-ray disk, flash memory, and the like. The computer readable medium may be any combination of such devices. In addition, the order of operations may be re-arranged. A process can be terminated when its operations are completed but could have additional steps not included in a figure. A process may correspond to a method, a function, a procedure, a subroutine, a subprogram, etc. When a process corresponds to a function, its termination may correspond to a return of the function to the calling function or the main function.

[0214] Such programs may also be encoded and transmitted using carrier signals adapted for transmission via wired, optical, and / or wireless networks conforming to a variety of protocols, including the Internet. As such, a computer readable medium may be created using a data signal encoded with such programs. Computer readable media encoded with the program code may be packaged with a compatible device (e.g., as firmware) or provided separately from other devices (e.g., via Internet download). Any such computer readable medium may reside on or within a single computer product (e.g., a hard drive, a CD, or an entire computer system), and may be present on or within different computer products within a system or network. A computer system may include a monitor, printer, or other suitable display for providing any of the results mentioned herein to a user.

[0215] Any of the methods described herein may be totally or partially performed with a computer system including one or more processors, which can be configured to perform the steps. Any operations performed with a processor may be performed in real-time. The term “real-time” may refer to computing operations or processes that are completed within a 79571371V.1certain time constraint. As examples, a time constraint may be 30 seconds, 1 minute, 10 minutes, 30 minutes, 1 hour, 4 hours, 1 day, or 7 days. Thus, embodiments can be directed to computer systems configured to perform the steps of any of the methods described herein, potentially with different components performing a respective step or a respective group of steps. Although presented as numbered steps, steps of methods herein can be performed at a same time or at different times or in a different order. Additionally, portions of these steps may be used with portions of other steps from other methods. Also, all or portions of a step may be optional. Additionally, any of the steps of any of the methods can be performed with modules, units, circuits, or other means of a system for performing these steps.

[0216] The specific details of particular embodiments may be combined in any suitable manner without departing from the spirit and scope of embodiments of the disclosure. However, other embodiments of the disclosure may be directed to specific embodiments relating to each individual aspect, or specific combinations of these individual aspects.

[0217] The above description of example embodiments of the present disclosure has been presented for the purposes of illustration and description. It is not intended to be exhaustive or to limit the disclosure to the precise form described, and many modifications and variations are possible in light of the teaching above.

[0218] A recitation of "a", "an" or "the" is intended to mean "one or more" unless specifically indicated to the contrary. The use of “or” is intended to mean an “inclusive or,” and not an “exclusive or” unless specifically indicated to the contrary. Reference to a “first” component does not necessarily require that a second component be provided. Moreover, reference to a “first” or a “second” component does not limit the referenced component to a particular location unless expressly stated. The term “based on” is intended to mean “based at least in part on.”

[0219] The claims may be drafted to exclude any element which may be optional. As such, this statement is intended to serve as antecedent basis for use of such exclusive terminology as “solely”, “only”, and the like in connection with the recitation of claim elements, or the use of a “negative” limitation.

[0220] All patents, patent applications, publications, and descriptions mentioned herein are incorporated by reference in their entirety for all purposes. None is admitted as prior art. Where a conflict exists between the instant application and a reference provided herein, the instant application shall dominate. 79571371V.1

Claims

WHAT IS CLAIMED IS:

1. A method comprising: generating, by a hub computer, a cryptographic puzzle (Z) and a puzzle tag ( )based on a private verification key (skV), a secret ( ), and a public traceability key (pkT);providing, by the hub computer, a first interaction request message comprisingthe cryptographic puzzle (Z) and the puzzle tag ( ) to a first device, wherein the first deviceor a second device, which is in communication with the first device, modifies the cryptographic puzzle (Z) to obtain a modified cryptographic puzzle (Z’), a random value (r),and a traceability token ( ) using the puzzle tag ( ), the public traceability key (pkT), thecryptographic puzzle (Z), and a public verification key (pkV) that corresponds to the private verification key (skV); receiving, by the hub computer, a second interaction request messagecomprising the modified cryptographic puzzle (Z’) and the traceability token ( ) from thesecond device; verifying, by the hub computer, the modified cryptographic puzzle (Z’) usingthe traceability token ( ), the public verification key (pkV), and the public traceability key(pkT); responsive to the modified cryptographic puzzle (Z’) being verified, solving,by the hub computer, the modified cryptographic puzzle (Z’) to obtain a modified secret ( ’);and providing, by the hub computer, a second interaction response message comprising a modified puzzle solution or indication thereof to the second device, wherein themodified puzzle solution includes the modified secret ( ’), wherein the second device or thefirst device, modifies the modified secret ( ’) using the random value (r) to obtain the secret( ).

2. The method of claim 1, wherein the cryptographic puzzle is a verifiable linkable randomizable puzzle.

3. The method of claim 1, further comprising: generating, by the hub computer, the secret ( ).

4. The method of claim 1, further comprising: 79571371V.1generating, by the hub computer, a proof ( ) based on the secret ( ) and anpublic traceability key ( ), wherein the proof ( ) is a non-interactive zero knowledgeproof that indicates a relationship between the secret ( ) and the cryptographic puzzle (Z).

5. The method of claim 1, wherein the first interaction request messagefurther comprises a first pre-signature ( ), wherein the method further comprises:generating, by the hub computer, the first pre-signature ( ) using a hubcomputer private key ( ), a first message ( ), and a value (Y) derived from the secret( ), wherein the first message ( ) indicates an amount to transfer from the hub computerto the first device over a first off-chain channel dependent upon a solution to the cryptographic puzzle (Z) to release the transfer.

6. The method of claim 5, wherein the second interaction requestmessage further comprises a second pre-signature (, wherein the second pre-signature( ) is created by the second device using a second device private key ( ), a secondmessage , and a second value (Y’) derived from the random value (r), wherein thesecond message ( ) indicates an amount to transfer from the second device to the hubcomputer over a second off-chain channel dependent upon a solution to the modified cryptographic puzzle (Z’) to release the transfer.

7. The method of claim 6, wherein after providing the second interaction response message, the method further comprises: receiving, by the hub computer from the first device, a first interaction response message comprising a puzzle solution or indication thereof, wherein the puzzlesolution includes the secret ( ).

8. The method of claim 7, wherein the puzzle solution or indicationthereof in the first interaction response message comprises a first signature ( ) created bythe first device based on the first pre-signature (and the secret ( ), and wherein themodified puzzle solution or indication thereof in the second interaction response messagecomprises a second signature ( ), wherein the method further comprises:creating, by the hub computer, the second signature ( ) on the second pre-signature ( ) and the modified secret ( ’).79571371V.

19. The method of claim 1, wherein the traceability token ( ) includes aciphertext (c) that is the random value (r) encrypted with the public traceability key (pkT).

10. The method of claim 1, further comprising: receiving, by the hub computer from a tracer computer, a trace request message comprising a request for interaction data; generating, by the hub computer, a trace response message comprising a plurality of cryptographic puzzles including the cryptographic puzzle (Z) and the modifiedcryptographic puzzle (Z’), a plurality of secrets including the secret ( ) and the modifiedsecret ( ’), and a plurality of traceability tokens including the traceability token ( ); andproviding, by the hub computer, the trace response message to the tracer computer.

11. The method of claim 10, wherein the tracer computer determines aciphertext (c) from the traceability token ( ), decrypts the ciphertext (c) using a privatetraceability key (skT) to obtain the random value (r), modifies the secret ( ) using the randomvalue (r) to obtain a result, and compares the result to the modified secret ( ’).

12. The method of claim 1, wherein first device is a first user device, and wherein the second device is a second user device.

13. A method comprising: receiving, by a second device, a cryptographic puzzle (Z) and a puzzle tag ( )from a first device, wherein the cryptographic puzzle (Z) and the puzzle tag ( ) are generatedby a hub computer and provided to the first device in a first interaction request message; modifying, by the second device, the cryptographic puzzle (Z) to obtain amodified cryptographic puzzle (Z’), a random value (r), and a traceability token ( ) using thepuzzle tag ( ), a public traceability key (pkT), the cryptographic puzzle (Z), and a publicverification key (pkV); providing, by the second device to the hub computer, a second interaction request message comprising the modified cryptographic puzzle (Z’) and the traceability token( ), wherein the hub computer verifies the modified cryptographic puzzle (Z’) using thetraceability token ( ), the public verification key (pkV), and the public traceability key (pkT),and solves the modified cryptographic puzzle (Z’) to obtain a modified secret ( ’);79571371V.1receiving, by the second device, a second interaction response message comprising a modified puzzle solution or indication thereof, wherein the modified puzzlesolution includes the modified secret ( ’);modifying, by the second device, the modified secret ( ’) using the randomvalue (r) to obtain the secret ( ); andproviding, by the second device, the secret ( ) to the first device in response tothe cryptographic puzzle (Z).

14. The method of claim 13, wherein the secret ( ) is a solution to thecryptographic puzzle (Z).

15. The method of claim 13 further comprising: generating, by the second device, the second interaction request messagecomprising the modified cryptographic puzzle (Z’) and the traceability token ( ).

16. The method of claim 13, wherein the first interaction request messagefurther comprises a first pre-signature ( ), wherein the hub computer generates the firstpre-signature ( ) using a hub computer private key ( ), a first message ( ), and avalue (Y) derived from the secret ( ), wherein the first message ( ) indicates an amount totransfer from the hub computer to the first device over a first off-chain channel dependent upon a solution to the cryptographic puzzle (Z) to release the transfer, wherein the secondinteraction request message further comprises a second pre-signature ( ), wherein themethod further comprises: generating, by the second device, the second pre-signature () using asecond device private key ( ), a second message ( ), and a second value (Y’) derivedfrom the random value (r), wherein the second message ( ) indicates an amount totransfer from the second device to the hub computer over a second off-chain channel dependent upon a solution to the modified cryptographic puzzle (Z’) to release the transfer, wherein the modified puzzle solution or indication thereof in the second interaction responsemessage comprises a second signature ( ), wherein the hub computer generates the secondsignature ( ) on the second pre-signature ( ) and the modified secret ( ’); andextracting, by the second device, the modified secret ( ’) from the secondsignature ( ) to obtain the secret ( ).

17. A method comprising: 79571371V.1generating, by a tracer computer, a trace request message comprising a plurality of data identifiers that identify off-chain channels utilized by a hub computer; providing, by the tracer computer, the trace request message to the hub computer, wherein the hub computer obtains off-chain channel data related to an off-chain channel based on the plurality of data identifiers; receiving, by the tracer computer, a trace response message comprising the off-chain channel data from the hub computer, wherein the trace response message includes afirst cryptographic puzzle (Z), a first traceability token ( ), and a first secret ( ) from a firstoff-chain channel and a second cryptographic puzzle (Z’), a second traceability token ( ’),and a second secret ( ’) from a second off-chain channel;determining, by the tracer computer, a ciphertext (c) and a proof ( ) from thefirst traceability token ( );decrypting, by the tracer computer, the ciphertext (c) using a privatetraceability key ( ) to obtain a random value (r);modifying, by the tracer computer, the first secret ( ) to obtain a modified firstsecret ( ’);determining, by the tracer computer, whether or not the modified first secret( ’) matches and the second secret ( ’); andif the modified first secret ( ’) matches and the second secret ( ’), determining,by the tracer computer, that the first off-chain channel is associated with the second off-chain channel.

18. The method of claim 17, wherein the first traceability token ( )includes the ciphertext (c) that is the random value (r) encrypted with a public traceability key (pkT).

19. The method of claim 17 further comprising: based on determining that the first off-chain channel is associated with the second off-chain channel, determining, by the tracer computer, that a first device involved in the first off-chain channel is interacting with a second device involved in the second off-chain channel.

20. A computer product comprising a computer readable medium storing a plurality of instructions that, when executed, cause a computer system to perform the method of any one of claims 1-19. 79571371V.

121. A system comprising: the computer product of claim 20; and one or more processors for executing instructions stored on the computer readable medium. 79571371V.1

Images