International Business Machines Corporation

Timothy Olson

Petr Novotny

Nitin Gaur

Jeronimo Irazabal

Venkatraman Ramakrishna

Described are techniques for generating and employing decentralized asset identifiers for cross-blockchain network asset transfers, the techniques including registering a decentralized asset identifier to an asset with a local asset identifier, where the decentralized asset identifier is immutable. The techniques further include endorsing a proposed transaction for transferring the asset from a first controller associated with a first blockchain network to a second controller associated with a second blockchain network, where the proposed transaction utilizes the decentralized asset identifier. The techniques further include exchanging, in a document associated with the decentralized asset identifier and retrieved from an identity network, the first controller for the second controller.

Decentralized asset identifiers for cross-blockchain networks

The processor may collect, from a first peer, a first data set associated with a channel. The channel may include one or more assets associated with a first peer. The channel may link the first peer to a second peer. The processor may analyze the first data set to determine a first status for the one or more assets. The processor may provide the first status of the one or more assets in a viewable channel to the blockchain network.

Visibility of digital assets at channel level

An example operation may include one or more of receiving a data file with off-chain content that originated in a first security domain of a multi-domain blockchain network, verifying that the on-chain and off-chain content satisfies a cross-domain security policy between the first security domain and a second security domain within the multi-domain blockchain network with a different security policy than the first security domain, in response to verifying the on-chain and off-chain content, signing the on-chain portion of the data file with a signature of a cross-domain endorsement peer, transmitting the signed on-chain portion of the data file to an ordering service of the multi-domain blockchain network, and transmitting the off-chain portion of the data file to a cross-domain content controller in the first security domain.

Blockchain controlled cross-domain data transfer

A computer-implemented method and a computer program product for enforcing verifiable mandatory access control (MAC) labels, and a data processing system. One embodiment may comprise receiving, from an entity, a first verifiable MAC label associated with an object, receiving, from the entity, a second verifiable MAC label associated with a subject requesting to access the object, and determining whether to grant, to the subject, access to the object responsive to the request based on comparing the first verifiable MAC label associated with the object and the second verifiable MAC label associated with the subject to a verifiable MAC policy. Each of the first verifiable MAC label, the second verifiable MAC label, and the verifiable MAC policy in some embodiments may be formatted as a verifiable credential that is machine readable and digitally signed.

Verifiable labels for mandatory access control

An example operation may include one or more of receiving a gossip message originated from a domain anchor peer in a first security domain, verifying that block content within the gossip message does not violate a cross-domain security policy, in response to verifying the block content, updating an endpoint of the gossip message with an address of a domain anchor peer in a second security domain, and transmitting the updated gossip message to the domain anchor peer in the second security domain.

Cross-domain state synchronization

A node in a blockchain network may receive a request for information regarding a token, retrieve token information regarding the token from the blockchain network, generate based on the token information, a token connection object (TCO) for the token, wherein the TCO includes a subset of the token information, and send the TCO to a requestor.

Entangled token structure for blockchain networks

A processor may register one or more verifiable asset credential schemas. A verifiable asset credential schema may prescribe the format and content of asserting blockchain-backed asset state. The processor may register an issuer policy for the verifiable asset credentials. The issuer policy may be associated with a schema and intended credential holder(s). The processor may subscribe the asset credential issuer to one or more peers on the blockchain. The processor may issue commit notifications to a subscribing asset credential issuer in the form of schema-compliant committing-peer verifiable credentials. The processor may collect the committing-peer verifiable credentials from one or more peers. The processor may validate the committing-peer verifiable credentials satisfy the security policy and schema for a designated intended credential holder. The processor may issue a schema-compliant verifiable asset credential to the policy-designated credential holder(s).

Blockchain-issued verifiable credentials for portable trusted asset claims

An example operation may include one or more of receiving an endorsed storage event from a first security domain that conforms to a first security policy and that is isolated from a second security domain that conforms to a second security policy which is different than the first security policy, determining that the storage event satisfies a cross-domain security policy based on the first and second security policies, creating a cross-domain data block which stores the storage event that satisfies the cross-domain security policy as a blockchain transaction, and transmitting the cross-domain data block to a first blockchain node included in the first security domain and a second blockchain node included in the second security domain.

Multi-domain blockchain network with data flow control

An example operation includes one or more of connecting, by an identity provisioning node, a blockchain one to a blockchain two, creating, by an identity provisioning node, an interoperation identity network (IIN) for the blockchain one and for the blockchain two as an instance of a self-sovereign identity (SSI) network, executing a smart contract to: invoke an IIN access control policy, map attributes and permissions of the blockchain one to attributes and permissions of the blockchain two based on the IIN access control policy, and generate a valid verifiable credential (VC) of the IIN in the blockchain one and in the blockchain two based on the mapped attributes and the permissions.

Growing community of inventors

Port Orchard, WA, United States of America

Timothy Olson