Nec Corporation

Srdjan Capkun

Ghassan Karame

Claudio Soriente

Hubert Ritzdorf

Sinisa Matetic

Takayuki Sasaki

Adrian Perrig

Kari Kostiainen

Ramya Jayaram Masti

Jason Lee

Damian Gruber

Karl Wuest

Sven Gnap

Moritz Schneider

A blockchain payment involves a transfer of funds from an account of a user to a collateral account of a service provider. The service provider receives a payment intent from the user including a payment index, a random payment ID, and an address of the collateral account. The service provider replaces the address by a commitment and provides the modified payment intent to a majority of statekeepers of a blockchain, receives payment approvals from the statekeepers, each payment approval including the modified payment intent signed with a private key of a respective statekeeper, evaluates the received payment approvals, aggregates successfully evaluated payment approvals, and transmits the aggregation result to the user. The service provider receives a final transaction created by the user after having verified the aggregation result, verifies that the user correctly constructed the final transaction, and accepts the payment in case of successful verification of the final transaction.

Fast blockchain payment method and system

A method for storing a data file (DF) on a storage entity (SE) includes receiving, by a proxy (PE) and from a computing entity (CE), a plurality of hash values corresponding to a plurality of blocks of the DF. The PE may check whether the plurality of blocks of the DF are stored in the SE based on the plurality of hash values. Based on determining that at least a subset of the plurality of blocks of the DF are not being stored in the SE, the PE may compute a secret associated with an encryption key. The PE may transmit, to the CE, the secret. The PE may receive, from the CE, information including storage locations of the subset of the plurality of blocks within the SE and one or more hash values, of the plurality of hash values, associated with the subset of the plurality of blocks.

Method for storing a data file

A full blockchain node for preserving privacy of a lightweight blockchain client in a blockchain network includes at least one computer device having an operating system. A trusted execution environment is installed on the at least one computer device such that code is executable by the trusted execution environment in isolation from the operating system. The trusted execution environment is configured to communicate with the lightweight blockchain client for performing blockchain transactions in a blockchain network.

Method and system of preserving privacy for usage of lightweight blockchain clients

A method of preserving privacy for usage of a lightweight blockchain client in a blockchain network includes using, in a full blockchain node of the blockchain network, a trusted execution environment (TEE). A secure communication is established between the lightweight blockchain client and the TEE. The TEE receives a request from the lightweight blockchain client for at least one transaction or address of the lightweight blockchain client. The TEE obtains unspent transaction output (UTXO) information with respect to the request from the lightweight blockchain client from a UTXO database by oblivious database access using an oblivious RAM (ORAM) protocol.

A method for storing a data file, 'DF' on a storage entity, 'SE' includes a computing entity, &#x2018;CE&#x2019;, chunking the DF into a number of blocks using a one-way-function and a chunking key. The CE may compute a hash value for each of the blocks. One or more proxies, &#x2018;PE&#x2019;, may check whether the blocks are already stored, resulting in a first number of already stored blocks and a second number of blocks not being stored. The CE may encrypt the blocks not being stored using an encryption key, transmit the encrypted blocks to the SE for storing, and inform the PE about the hash value of each of the transmitted blocks and corresponding storage location information of the transmitted blocks.

A method of preserving privacy for usage of a lightweight blockchain client in a blockchain network includes using, in a full blockchain node of the blockchain network, a secure software guard extensions (SGX) enclave. A request is received from the lightweight blockchain client for a setup of a secure network connection. A client unique ID is received from the lightweight blockchain client, and is acknowledged following a successful attestation by the lightweight blockchain client. A request is received from the lightweight blockchain client for transaction(s)/address(es) of the lightweight blockchain client. The SGX enclave loads and searches unspent transaction outputs (UTXO) from a memory of the full blockchain node and sends a response to the request from the lightweight blockchain client for the transaction(s)/address(es) based on a match from the searching the UTXO. The secure communication is then terminated with the lightweight blockchain client.

A method for controlling access to a shared resource for a plurality of collaborative users includes securely providing, on a storage and device entity, the shared resource. The shared resource is created by a resource owner entity. The method further includes specifying access control rules for the shared resource, translating the access control rules into a smart contract, including the smart contract into a blockchain, and if a second user requests access to the shared resource, performing access decisions for the shared resource by evaluating the smart contract with regard to the access control rules.

Method for controlling access to a shared resource

A communication apparatus comprising: a plurality of communication processes, each performing communication process on a flow associated thereto; a plurality of network interfaces, each of the network interfaces adapted to be connected to a network; a dispatcher that receives a packet from the network interface and dispatches the packet to an associated communication process, based on a dispatch rule that defines association of a flow to a communication process to which the flow is dispatched; and a control unit that performs control to roll back each of the communication processes using saved image thereof.

Communication apparatus, system, method, and non-transitory medium

A communication apparatus comprising a plurality of communication processes, each of the communication processes configured to be executed in an environment allocated thereto and isolated from each of one or more environments arranged for remaining one or more processes, each of the communication processes performing communication processing on a flow associated thereto, a network interface connected to a network; a dispatcher that dispatches a packet to the communication process based on a dispatch rule that defines association of a flow with a communication process.

Communication apparatus, system, method, and non-transitory medium for securing network communication

A method for encrypting data based on all-or-nothing encryption includes: providing, by an encryption system, data to be encrypted and an encryption key; dividing, by the encryption system, the data into an odd number of blocks, wherein each of the blocks has the same size; encrypting, by the encryption system, the blocks with the encryption key to obtain an intermediate ciphertext c' comprising intermediate ciphertext blocks c&#x2032;, . . . , c&#x2032;, wherein c0&#x2032; corresponds to a random seed and c&#x2032;, . . . , c&#x2032; corresponds to the encrypted blocks; and obtaining, by the encryption system, a final ciphertext c using the intermediate ciphertext c&#x2032;. An intermediate overall ciphertext t is obtained based on XOR'ing the intermediate ciphertext blocks c&#x2032;, . . . , c&#x2032;; and obtaining a plurality of final ciphertext blocks c1, . . . cN by XOR'ing respective intermediate ciphertext blocks c&#x2032;, . . . , c&#x2032; with the intermediate overall ciphertext t.

Method and system for encrypting data

A method for encrypting data based on all-or-nothing encryption. Data to be encrypted and an encryption key are provided. The data is divided into an odd number of blocks, wherein each of the odd number of blocks has the same size. The blocks are encrypted with the encryption key to obtain an intermediate ciphertext that includes the encrypted blocks. The intermediate ciphertext is linearly transformed based on additive contravalence operations to obtain a final ciphertext.

A method for enforcing access control policies on data owned by a plurality of users includes evaluating the access control policies of users, applying a collusion resistant sharing scheme for generating key shares of an encryption key and delegating the key shares to one or more designated users based on a result of the evaluation. The data is securely dispersed by applying an encryption scheme on all parts of the data to be encrypted to produce encrypted data shares. The encryption scheme is provided such that for decryption of the encrypted data, the encryption key and at least a predetermined number of data shares are provided. Each data share is delegated to one or more designated users, and the data shares and the key shares are distributed to the respective designated users.

Growing community of inventors

Zurich, Switzerland

Srdjan Capkun