Hardware blockchain acceleration
Abstract
Hardware acceleration supports complex software processes. In particular, a hardware security module provides encryption support for transaction chains. In one implementation, the security module circuitry provides high-speed security features and acceleration of the security features for blockchain processing.
Term
11.2 yearsto projected expiry
Projected expiry 19 December 2037, counted from filing; an application has no term until it is granted.
- Priority
- Filed
- Published
- Today
- Projected expiry
15 claims: 3 independent, 12 dependent
- 1A method comprising:in a hardware security system: establishing a communication connection with a hardware security module (HSM);providing security controller circuitry comprising: an HSM interface that includes: a security circuitry application programming interface (API);and an API-to-API mapping;receiving, at the security controller circuitry, a security function call made to the security circuitry API;mapping the security function call to an HSM specific function call, the mapping performed via the API-to-API mapping;transmitting the HSM specific function call to the HSM;and receiving a security response from the HSM, the security response received over the communication connection, and the security response received in response to the HSM specific function call.
- 8A security system comprising:a communication interface configured to connect to a hardware security module (HSM);an HSM interface comprising: a security circuitry programming interface (API);and an API-to-API mapping;and security controller circuitry configured to: receive, at the security controller circuitry, a security function call made to the security circuitry API;map the security function call to an HSM specific function call, the mapping performed via the API-to-API mapping;transmit the HSM specific function call to the HSM;and receive a security response from the HSM, the security response received over the communication interface, and the security response received in response to the HSM specific function call.
- 14A security system comprising:a hardware support interface to a hardware security module (HSM) defining an HSM application programming interface (API) that exposes HSM functions;a security controller interface configured to receive a security request function call;and security controller circuitry in communication with the security controller interface and the hardware support interface, the security controller circuitry comprising an HSM function interface including: a security circuitry API that exposes security circuitry functions;and an API-to-API mapping between the security circuitry functions and the HSM functions;the security controller circuitry configured to: receive, at the security controller interface, a security function call made via the security circuitry API;translate, via the API-to-API mapping , the security function call to an HSM specific function call;transmit the HSM specific function call to the HSM;and receive a security response from the HSM over the hardware support interface in response to the HSM specific function call.
Independent claims3
48 paragraphs, as filed
Cross Reference
0001This application claims priority to European application number <patcit id="pcit0001" dnum="EP17425005A"><text>17425005.0, filed 27-January-2017</text></patcit>, which is entirely incorporated herein by reference.
Technical Field
0002This disclosure relates to computer hardware acceleration of software processes. This disclosure also relates to hardware security support for software processes that support transaction chains, including blockchains.
Background
0003Rapid advances in electronics and communication technologies, driven by immense customer demand, have resulted in newly emerging complex network transaction chains. Improvements in the hardware and software implementations of the underlying processing for the transaction chains will increase the security, features, and speed of the implementations.
Brief Description of the Drawings
0004<ul id="ul0001" list-style="none" compact="compact"><li><figref idref="f0001">Figure 1</figref> shows a hardware accelerated transaction architecture.</li><li><figref idref="f0002">Figure 2</figref> illustrates an expanded view of the hardware accelerated transaction architecture.</li><li><figref idref="f0003">Figure 3</figref> shows an implementation example in which security manager circuitry exposes specific security manager functions as a security manager API.</li><li><figref idref="f0004">Figure 4</figref> shows another implementation example in which security manager circuitry exposes specific security manager functions as a security manager API.</li><li><figref idref="f0005">Figure 5</figref> illustrates an additional implementation example in which security manager circuitry exposes specific security manager functions.</li><li><figref idref="f0006">Figure 6</figref> illustrates an additional implementation example in which security manager circuitry exposes specific security manager functions.</li><li><figref idref="f0007">Figure 7</figref> shows a hybrid implementation example of the HSM interface implementing a security circuitry API.</li><li><figref idref="f0008">Figure 8</figref> shows an implementation example of the HSM interface 802 supporting multiple HSMs.</li><li><figref idref="f0009">Figure 9</figref> shows logic that a hardware accelerated transaction processing system may implement.</li></ul>
Detailed Description
0005<figref idref="f0001">Figure 1</figref> shows an example hardware accelerated transaction architecture 100 ("architecture" 100) that provides efficient and secure execution of complex transactions between entities. The entities may vary widely, and may be, as a few examples, hardware systems, software processes, or individuals. In <figref idref="f0001">Figure 1</figref>, the smartphones 102 and 104 are shown as an example hardware platforms that permit entities to engage in transactions with support by the architecture 100. In this example, Entity A is associated with the smartphone 102 and Entity B is associated with the smartphone 104. In the example of <figref idref="f0001">Figure 1</figref>, Entity A will engage in a digital exchange with Entity B. The digital exchange may be, e.g., a transfer of value between accounts held at different financial institutions. <figref idref="f0001">Figure 1</figref> provides one technological backdrop for a discussion of the technical solutions in hardware acceleration, but note that the hardware acceleration may be implemented in many other system contexts to support transactions of widely varying types.
0006In the example in <figref idref="f0001">Figure 1</figref>, a smartphone application 106 accepts transaction input from Entity A that specifies a transaction amount and a transaction recipient: Entity B in this example. Smartphone 102 and 104 store an enrollment certificate 108 which the smartphone application 106 passes, e.g., in a transaction request 110, to an authentication system 112. The authentication system 112 may, as one example, implement a hyperledger fabric client (HFC) 113, e.g., in dedicated hardware or in a virtual machine or docker container for a virtual machine. An authentication interface 114 includes an exposed authentication application programming interface (API)) that receives the transaction request 110. The authentication system 112 may provide further layers of security, e.g., by requiring the transaction request 110 to travel over hypertext transfer protocol secure sockets (HTTPS), secured by transport layer security (TLS). (Logic flow (1) in <figref idref="f0001">Figure 1</figref>.)
0007The enrolment certificate achieves authentication by encrypting the payload from the smartphone 102 with a public key associated with the enrolment certificate. The counterpart private key is securely held within the HFC certificate authority (CA) 116. The private key allows the authentication system 112 to verify the request. (Logic flow (2) in <figref idref="f0001">Figure 1</figref>.)
0008A membership service running at a system node, e.g., the system node 118, may verify the account for Entity A that is specified in the transaction request 110. In addition, a transaction CA generates a unique transaction token. The transaction token uniquely identifies each transaction and is used to sign the request. The certificate allows the request to be passed into the validating peer node for Entity A 132 (e.g., an on-site server supporting operations for Entity A), where is it received at security controller circuitry 134. The security controller circuitry 134 responsively invokes the processing chaincodes. Chaincodes are the programmatic logic implemented to specifically support an implementation of the data storage layer, e.g., a blockchain shared ledger. In the example noted regarding transferring value, the chaincode is called to update the balances of two accounts in the shared global ledger. These accounts are stored in a serialized, encrypted format to provide separation of concerns for the systems. In other words, all of the accounts for the sender are encrypted with the sender's peer node (e.g., bank A) keys, and cannot be decrypted by the receiver's peer noted (e.g., bank B) keys, and vice versa. Accordingly, a request for encryption or decryption is sent to the relevant system hardware security module (HSM), e.g., the HSM 128 which supports the peer node for Entity A 132. (Logic flow (3) in <figref idref="f0001">Figure 1</figref>.) Example HSMs include, but are not limited to, the nShield Solo (TM), nShield Edge (TM), and nShield Connect (TM) devices available from Thales e-Security.
0009In one implementation, the serialized, encrypted format is a Java script object notation (JSON) file, but other representations are also suitable. The format includes the account data (e.g., sender, recipient, quantity, timestamp, and other data) and a 'cipher' field. Upon encryption, the account data within the account is encrypted in the peer node HSM and the output is placed in the 'cipher' field. The peer node then resets selected fields within the account data, e.g., by setting pre-determined sensitive data fields to zero. The security controller circuitry 134 may employ symmetric cryptography, with all keys remaining securely in the HSMs. Each account includes a uniform resource locator (URL) field that specifies the URL for the security manager with which it was onboarded. Accordingly, any peer node may view the account and locate the API (via the URL field) to request encryption/decryption of an account.
0010In more detail, the chaincode sends a network request 122 to the security controller interface 124 which (preferably) has a hardware support interface 126 to the HSM 128. The interfaces 124 and 126 may include hardwired or wireless connections over proprietary or non-proprietary buses or communication networks, for instance. The network request 122 asks for the HSM 128 to decrypt a specific account so that the chaincode can alter the account balance. In support of obtaining the account to decrypt, the authentication system 112 abstracts the global world state stored in the blockchain by two exposed functions, putState() and getState(). The authentication system 112 also mirrors a key/value store in the peer nodes, with the key/value store containing a list of the encrypted, serialized format account objects, linked by their unique identifier.
0011Expressed another way, the cryptographic functions are executed by a high security hardware device: the HSM 128, and are not limited to implementation in software. With the HSM 128, the implementation of the data storage layer no longer needs to directly perform encryption and decryption of data. As a result, the implementation show in <figref idref="f0001">Figure 1</figref> has increased security and scalability as compared to, for example, software only based security systems, and returns control to the enterprises that support the transactions. In some secure environments, the security controller circuitry 134 which controls the HSM 128 is physically housed with or near the HSM 128, e.g., in an enterprise secure data center. (Logic flow (4) in <figref idref="f0001">Figure 1</figref>.)
0012Once the accounts for Entity A and Entity B are in decrypted format and following the balance updates in the respective accounts, the updated accounts are re-encrypted before being saved into the serialized encrypted data structure (e.g., the JSON file). To that end, the chaincode sends the encryption request 130 for the account to the security manager interface 124, which passes it to the HSM 128 for encryption. The encryption results return to the chaincode, and a new transaction is created within the bank's node, and the transaction is submitted / requested for inclusion in a new block in the blockchain. (Logic flow (5) in <figref idref="f0001">Figure 1</figref>.)
0013Note that in this example implementation, both the Entity A account and the Entity B account are modified as a result of actions taken by the peer node which receives the transaction request. For instance, assume Bank A receives a request from their member Entity A to transfer value to Entity B associated with Bank B. Then, the Bank A peer node will request the authentication system 112 to identify update the accounts. In response, the authentication system 112 will call the security manager API (via the URL fields noted above) to request decryption for both accounts. The chaincode then modifies the balances of both accounts, and uses the same API previously identified to request encryption from the same HSMs. After modification and encryption, the chaincode requests submission of the updated accounts to the blockchain and consensus is run to ensure that all nodes share the same account state. Finally, update accounts are mirrored between all nodes.
0014Before the new block with the updated accounts can be added to the blockchain, every node in the system checks that its version of the world state is identical to ensure that there are no compromised nodes. After consensus is reached (e.g., all nodes have the same copy of the data structure), the new transaction is formally injected into the blockchain. The authentication system 112 may implement, for instance, the Practical Byzantine Fault Tolerance (PBFT) algorithm to provide increased speed and scalability to reach consensus in a private, permission blockchain system. (Logic flow (6) in <figref idref="f0001">Figure 1</figref>.)
0015After consensus has been reached and the transaction is included in the blockchain, there is a polling mechanism which consistently checks for new blocks that have been added to the data structure. If a new transaction has been added to the ledger, a message is sent to the respective parties informing them of their account changes. In one implementation, Google Cloud Messaging (GCM) performs the notification to the smartphones 102 and 104. (Logic Point 7 in <figref idref="f0001">Figure 1</figref>.)
0016<figref idref="f0002">Figure 2</figref> shows an expanded view 200 of the hardware accelerated transaction architecture. In <figref idref="f0002">Figure 2</figref>, the Entity A peer node 132 includes the security controller circuitry 134. The security controller circuitry 134 defines an HSM interface 250 that includes a security manager API 202 and an API-to-API mapping 206. The security manager API 202 exposes a set of security manager functions, e.g., the security manager function 204 to request that the peer node 132 execute specified security functions (e.g., encrypt or decrypt data). The API-to-API mapping 206 implements, explicitly or implicitly, a security manager API to HSM API-to-API mapping tailored to the particular HSM in use, as described further below.
0017<figref idref="f0002">Figure 2</figref> also shows an example architecture 200 illustrating that the HSM 128 provides a secure execution environment (SEE) in which dedicated hardware security circuitry 208 performs encryption, decryption, key generation, key storage, key management, and other security functions. The HSM 128 defines an HSM API 210 that exposes a set of security functions, e.g., the HSM security function 212. The HSM security functions execute on the native HSM hardware to carry out the requested security functions 214 (e.g., decrypt data), and return security responses 216 (e.g., the decrypted data).
0018The API-to-API mapping 206 transforms incoming security requests received at the peer node 132 into an HSM specific function. The security controller circuitry 134 transmits the HSM specific functions to the HSM 128 in the form of the requested security functions 214. Similarly, the security controller circuitry 134 receives the security responses 216 from the HSM 128 after the HSM 128 executes the requested security function.
0019The HSM interface 250 provides a highly flexible and reconfiguration technical solution the problem of connecting a peer node to a wide range of possible HSMs. By reconfiguring the API-to-API mapping 206 to point to particular functions exposed in any given HSM, the peer node 132 may be efficiently adapted for use with a wide range of security hardware. Further, multiple instances of the HSM interface 250, each with different API-to-API mappings for different HSMs, may be implemented in any given peer node to simultaneously support multiple different HSMs, e.g., for redundant operation and fault tolerance.
0020<figref idref="f0003">Figure 3</figref> shows an implementation example 300 in which the security controller circuitry 134 exposes five specific security manager functions as the security manager API 302. Table 1, below, describes the security manager functions and indicates, in this one example, where mappings may be provided to specific HSMs or to software. That is, the security manager API 302, in concert with the API-to-API mapping 304, supports connection and messaging between multiple different HSMs. Note further that the API-to-API mapping 304 may provide redirection not only to HSM functions, but also to software implemented security functions, e.g., in cases where no HSM communicates with the peer node. <tables id="tabl0001" num="0001"><table frame="none"><title>Table 1</title><tgroup cols="3" colsep="0" rowsep="0"><colspec colnum="1" colname="col1" colwidth="50mm" /><colspec colnum="2" colname="col2" colwidth="77mm" /><colspec colnum="3" colname="col3" colwidth="36mm" /><thead><row><entry align="center" valign="middle">API Security Manager Function</entry><entry align="center" valign="middle">Description</entry><entry align="center" valign="middle">HSM Connection</entry></row></thead><tbody><row><entry morerows="2" valign="middle">symmetricEncrypt</entry><entry morerows="2" valign="middle">Encrypt data with a symmetric key</entry><entry align="center" valign="middle">Mapping to HSM 1</entry></row><row><entry align="center" valign="middle">Mapping to HSM 2</entry></row><row><entry align="center" valign="middle">Mapping to Software</entry></row><row><entry morerows="2" valign="middle">symmetricDecrypt</entry><entry morerows="2" valign="middle">Decrypt data with a symmetric key</entry><entry align="center" valign="middle">Mapping to HSM 1</entry></row><row><entry align="center" valign="middle">Mapping to HSM 2</entry></row><row><entry align="center" valign="middle">Mapping to Software</entry></row><row><entry valign="middle">applyDigitalSignature</entry><entry valign="middle">Apply a Digital Signature to a message</entry><entry align="center" valign="middle">Mapping to HSM 1</entry></row><row><entry valign="middle">verifyDigitalSignature</entry><entry valign="middle">Verify the Digital Signature of a message</entry><entry align="center" valign="middle">Mapping to HSM 1</entry></row><row><entry valign="middle">generateECKeyPair</entry><entry valign="middle">Generate a key pair using the Elliptic Curve algorithm</entry><entry align="center" valign="middle">Mapping to HSM 1</entry></row></tbody></tgroup></table></tables>
0021A specific implementation example of the security manager function symmetricEncrypt is provided below in Tables 2 - 5 and a specific implementation example of the security manager function symmetricDecrypt is provided below in Tables 6 - 9.
symmetricEncrypt
0022This function encrypts data with a symmetric key. <tables id="tabl0002" num="0002"><table frame="all"><tgroup cols="5"><colspec colnum="1" colname="col1" colwidth="28mm" /><colspec colnum="2" colname="col2" colwidth="70mm" /><colspec colnum="3" colname="col3" colwidth="34mm" /><colspec colnum="4" colname="col4" colwidth="21mm" /><colspec colnum="5" colname="col5" colwidth="14mm" /><thead><row><entry namest="col1" nameend="col5" align="center" valign="middle"><b>Table 2: symmetricEncrypt Input:</b></entry></row><row><entry align="center" valign="middle"><b>Parameter</b></entry><entry align="center" valign="middle"><b>Description</b></entry><entry align="center" valign="middle"><b>Mandatory / Optional</b></entry><entry align="center" valign="middle"><b>Header /Url/ Body</b></entry><entry align="center" valign="middle"><b>Type</b></entry></row></thead><tbody><row><entry align="center" valign="middle">callerIdentifier</entry><entry align="center" valign="middle">Identifier of the caller system</entry><entry align="center" valign="middle">O</entry><entry align="center" valign="middle">B</entry><entry align="center" valign="middle">String</entry></row><row><entry align="center" valign="middle">hsmKeyAlias</entry><entry align="center" valign="middle">Alias of the key to use (if not provided a default one will be used)</entry><entry align="center" valign="middle">O</entry><entry align="center" valign="middle">B</entry><entry align="center" valign="middle">String</entry></row><row><entry align="center" valign="middle">dataToEncryp t</entry><entry align="center" valign="middle">Data to encrypt (hex encoded)</entry><entry align="center" valign="middle">M</entry><entry align="center" valign="middle">B</entry><entry align="center" valign="middle">String</entry></row></tbody></tgroup></table></tables><tables id="tabl0003" num="0003"><table frame="all"><tgroup cols="4"><colspec colnum="1" colname="col1" colwidth="32mm" /><colspec colnum="2" colname="col2" colwidth="53mm" /><colspec colnum="3" colname="col3" colwidth="37mm" /><colspec colnum="4" colname="col4" colwidth="15mm" /><thead><row><entry namest="col1" nameend="col4" align="center" valign="middle"><b>Table 3: symmetricEncrypt Output:</b></entry></row><row><entry align="center" valign="middle"><b>Parameter</b></entry><entry align="center" valign="middle"><b>Description</b></entry><entry align="center" valign="middle"><b>Mandatory / Optional</b></entry><entry align="center" valign="middle"><b>Type</b></entry></row></thead><tbody><row><entry>resultCode</entry><entry><i>The Result code of the task</i></entry><entry align="center">M</entry><entry>String</entry></row><row><entry>errorManagement</entry><entry><i>Object identifying the error</i></entry><entry align="center">O*</entry><entry>Object</entry></row><row><entry> errorCode</entry><entry><i>Code that identifies error occurred</i></entry><entry align="center">M</entry><entry>String</entry></row><row><entry> errorDescription</entry><entry><i>Error description</i></entry><entry align="center">M</entry><entry>String</entry></row><row><entry>encrypted Data</entry><entry><i>The encrypted data</i></entry><entry align="center">M</entry><entry>String</entry></row></tbody></tgroup><tgroup cols="4" rowsep="0"><colspec colnum="1" colname="col1" colwidth="32mm" /><colspec colnum="2" colname="col2" colwidth="53mm" /><colspec colnum="3" colname="col3" colwidth="37mm" /><colspec colnum="4" colname="col4" colwidth="15mm" /><tbody><row><entry namest="col1" nameend="col4" align="justify">* included if resultCode is FAILED</entry></row></tbody></tgroup></table></tables><tables id="tabl0004" num="0004"><table frame="all"><tgroup cols="2"><colspec colnum="1" colname="col1" colwidth="28mm" /><colspec colnum="2" colname="col2" colwidth="46mm" /><thead><row><entry namest="col1" nameend="col2" align="center" valign="top"><b>Table 4: symmetricEncrypt Results</b></entry></row><row><entry align="center" valign="top"><b>Result Code</b></entry><entry align="center" valign="top"><b>Result Description</b></entry></row></thead><tbody><row><entry align="center">SUCCESS</entry><entry>Service executed successfully</entry></row><row><entry align="center">FAILED</entry><entry>Service execution failed</entry></row></tbody></tgroup></table></tables><tables id="tabl0005" num="0005"><table frame="all"><tgroup cols="2"><colspec colnum="1" colname="col1" colwidth="26mm" /><colspec colnum="2" colname="col2" colwidth="101mm" /><thead><row><entry namest="col1" nameend="col2" align="center" valign="top"><b>Table 5: symmetricEncrypt Example</b></entry></row></thead><tbody><row><entry><b>Protocol</b></entry><entry>REST</entry></row><row><entry><b>Path</b></entry><entry>[I P: PORT]/cxf/securityManager/symmetricEncrypt</entry></row><row><entry><b>Method</b></entry><entry>POST</entry></row><row><entry><b>Content type</b></entry><entry>application/json</entry></row><row rowsep="0"><entry /><entry>Example JSON request:</entry></row><row rowsep="0"><entry /><entry>{</entry></row><row rowsep="0"><entry /><entry> "callerIdentifier": "bankA",</entry></row><row rowsep="0"><entry /><entry> "hsmKeyAlias":"aeskey" ,</entry></row><row rowsep="0"><entry /><entry> "dataToEncrypt": "33363231"</entry></row><row rowsep="0"><entry /><entry>}</entry></row><row rowsep="0"><entry /><entry /></row><row rowsep="0"><entry /><entry>Example JSON response:</entry></row><row rowsep="0"><entry /><entry /></row><row rowsep="0"><entry /><entry>{</entry></row><row rowsep="0"><entry /><entry> "baseResponse": {</entry></row><row rowsep="0"><entry /><entry> "result": "SUCCESS"</entry></row><row rowsep="0"><entry /><entry> },</entry></row><row rowsep="0"><entry /><entry> "encryptedData": "C8BF4E043AFA5595D21 F56E16DD15571"</entry></row><row><entry /><entry>}</entry></row></tbody></tgroup></table></tables>
symmetricDecrypt
0023This function decrypts data with a symmetric key. <tables id="tabl0006" num="0006"><table frame="all"><tgroup cols="5"><colspec colnum="1" colname="col1" colwidth="27mm" /><colspec colnum="2" colname="col2" colwidth="78mm" /><colspec colnum="3" colname="col3" colwidth="22mm" /><colspec colnum="4" colname="col4" colwidth="27mm" /><colspec colnum="5" colname="col5" colwidth="14mm" /><thead><row><entry namest="col1" nameend="col5" align="center" valign="middle"><b>Table 6: symmetricDecrypt Input:</b></entry></row><row><entry align="center" valign="middle"><b>Parameter</b></entry><entry align="center" valign="middle"><b>Description</b></entry><entry align="center" valign="middle"><b>Mandatory / Optional</b></entry><entry align="center" valign="middle"><b>Header IUrl / Body</b></entry><entry align="center" valign="middle"><b>Type</b></entry></row></thead><tbody><row><entry align="center" valign="middle">callerIdentifier</entry><entry valign="middle">Identifier of the caller system</entry><entry align="center" valign="middle">O</entry><entry align="center" valign="middle">B</entry><entry align="center" valign="middle">String</entry></row><row><entry align="center" valign="middle">hsmKeyAlias</entry><entry valign="middle">Alias of the symmetric key to use (if not provided a default one will be used)</entry><entry align="center" valign="middle">O</entry><entry align="center" valign="middle">B</entry><entry align="center" valign="middle">String</entry></row><row><entry align="center" valign="middle">dataToDecrypt</entry><entry valign="middle">Data to decrypt (hex encoded)</entry><entry align="center" valign="middle">M</entry><entry align="center" valign="middle">B</entry><entry align="center" valign="middle">String</entry></row></tbody></tgroup></table></tables><tables id="tabl0007" num="0007"><table frame="all"><tgroup cols="4"><colspec colnum="1" colname="col1" colwidth="31mm" /><colspec colnum="2" colname="col2" colwidth="53mm" /><colspec colnum="3" colname="col3" colwidth="35mm" /><colspec colnum="4" colname="col4" colwidth="15mm" /><thead><row><entry namest="col1" nameend="col4" align="center" valign="top"><b>Table 7: symmetricDecrypt Output:</b></entry></row><row><entry valign="top">Parameter</entry><entry valign="top">Description</entry><entry valign="top">Mandatory / Optional</entry><entry valign="top">Type</entry></row></thead><tbody><row><entry>resultCode</entry><entry>The Result code of the task</entry><entry>M</entry><entry>String</entry></row><row><entry>errorManagement</entry><entry>Object identifying the error</entry><entry>O*</entry><entry>Object</entry></row><row><entry>errorCode</entry><entry>Code that identifies error occurred</entry><entry>M</entry><entry>String</entry></row><row><entry>errorDescription</entry><entry>Error description</entry><entry>M</entry><entry>String</entry></row><row><entry>decrypted Data</entry><entry>The decrypted data</entry><entry>M</entry><entry>String</entry></row></tbody></tgroup><tgroup cols="4" rowsep="0"><colspec colnum="1" colname="col1" colwidth="31mm" /><colspec colnum="2" colname="col2" colwidth="53mm" /><colspec colnum="3" colname="col3" colwidth="35mm" /><colspec colnum="4" colname="col4" colwidth="15mm" /><tbody><row><entry namest="col1" nameend="col4" align="justify">* included if resultCode is FAILED</entry></row></tbody></tgroup></table></tables><tables id="tabl0008" num="0008"><table frame="all"><tgroup cols="2"><colspec colnum="1" colname="col1" colwidth="28mm" /><colspec colnum="2" colname="col2" colwidth="46mm" /><thead><row><entry namest="col1" nameend="col2" align="center" valign="top"><b>Table 8: symmetricDecrypt Results</b></entry></row></thead><tbody><row><entry>Result Code</entry><entry>Result Description</entry></row><row><entry>SUCCESS</entry><entry>Service executed successfully</entry></row><row><entry>FAILED</entry><entry>Service execution failed</entry></row></tbody></tgroup></table></tables><tables id="tabl0009" num="0009"><table frame="all"><tgroup cols="2"><colspec colnum="1" colname="col1" colwidth="28mm" /><colspec colnum="2" colname="col2" colwidth="113mm" /><thead><row><entry namest="col1" nameend="col2" align="center" valign="middle"><b>Table 9: symmetricDecrypt Example</b></entry></row></thead><tbody><row><entry valign="middle"><b>Protocol</b></entry><entry valign="middle">REST</entry></row><row><entry valign="middle"><b>Path</b></entry><entry valign="middle">[IP:PORT]/cxf/securityManager/symmetricDecrypt</entry></row><row><entry valign="middle"><b>Method</b></entry><entry valign="middle">POST</entry></row><row><entry valign="middle"><b>Content type</b></entry><entry valign="middle">application/json</entry></row><row rowsep="0"><entry valign="middle" /><entry valign="middle">Example JSON request:</entry></row><row><entry valign="middle" /><entry valign="middle">{</entry></row><row rowsep="0"><entry /><entry> "callerldentifier": "bankA",</entry></row><row rowsep="0"><entry /><entry> "hsmKeyAlias":"aeskey" ,</entry></row><row rowsep="0"><entry /><entry> "dataToDecrypt": "C8BF4E043AFA5595D21 F56E16DD15571"</entry></row><row rowsep="0"><entry /><entry>}</entry></row><row rowsep="0"><entry /><entry /></row><row rowsep="0"><entry /><entry>Example JSON response:</entry></row><row rowsep="0"><entry /><entry /></row><row rowsep="0"><entry /><entry>{</entry></row><row rowsep="0"><entry /><entry> "baseResponse": {</entry></row><row rowsep="0"><entry /><entry> "result": "SUCCESS"</entry></row><row rowsep="0"><entry /><entry> },</entry></row><row rowsep="0"><entry /><entry> "decryptedData": 33363231</entry></row><row><entry /><entry>}</entry></row></tbody></tgroup></table></tables>
0024The function transformations 306 implement a mapping from the security manager functions and corresponding objects to HSM specific requested security functions 308 defined in the HSM chosen or configured to perform the security manager function in question.
0025<figref idref="f0004">Figure 4</figref> shows an implementation example 400 in which the HSM interface 402 defines a security circuitry API 404 that includes the five functions noted above. The HSM interface 402 further includes the API-to-API mapping 406. In this particular example, the API-to-API mapping 406 has implemented the symmetricDecrypt function transformation 408, the symmetricDecrypt function transformation 410, the applyDigitalSignature function transformation 412, the generateECKeyPair function transformation 414, and the verifyDigitalSignature function transformation 416. The function transformations 408 - 416 map each of the five functions available from security circuitry API 404 to HSM specific functions 418 defined for the particular HSM in use, in this case the HSM 420. Here, the API for the HSM 420 implements the functions called "aesEncryption" (used for both encryption and decryption), "applyDigitalSignature", "verifyDigitalSignature", and "generateEllipitcCurveKeyPair". As one specific example, an API call to the symmetricDecrypt function maps to the aesEncryption HSM API function. Table 10 summarizes the mapping from the security circuitry API 404 to the HSM 420 for this particular example. <tables id="tabl0010" num="0010"><table frame="all"><tgroup cols="2"><colspec colnum="1" colname="col1" colwidth="39mm" /><colspec colnum="2" colname="col2" colwidth="86mm" /><thead><row><entry namest="col1" nameend="col2" align="center" valign="top"><b>Table 10: Mapping for HSM 420</b></entry></row></thead><tbody><row><entry /><entry>symmetricEncrypt</entry></row><row rowsep="0"><entry morerows="2" rowsep="1"><b>HSM specific function</b></entry><entry>Package: com.comp.cpaas.dcpp.hsm.integration.nshield</entry></row><row rowsep="0"><entry>Object: NShieldInterface</entry></row><row><entry>Method: aesEncryption</entry></row><row><entry /><entry /></row><row><entry /><entry>symmetricDecrypt</entry></row><row rowsep="0"><entry morerows="2" rowsep="1"><b>HSM specific function</b></entry><entry>Package: com. comp.cpaas.dcpp.hsm.integration.nshield</entry></row><row rowsep="0"><entry>Object: NShieldInterface</entry></row><row><entry>Method: aesEncryption</entry></row><row><entry /><entry /></row><row><entry /><entry>applyDigitalSignature</entry></row><row rowsep="0"><entry morerows="2" rowsep="1"><b>HSM specific function</b></entry><entry>Package: com.comp.cpaas.dcpp.hsm.integration.nshield</entry></row><row rowsep="0"><entry>Object: NShieldInterface</entry></row><row><entry>Method: applyDigitalSignature</entry></row><row><entry /><entry /></row><row><entry /><entry>verifyDigitalSignature</entry></row><row rowsep="0"><entry morerows="2" rowsep="1"><b>HSM specific function</b></entry><entry>Package: com.comp.cpaas.dcpp.hsm.integration.nshield</entry></row><row rowsep="0"><entry>Object: NShieldInterface</entry></row><row><entry>Method: verifyDigitalSignature</entry></row><row><entry /><entry /></row><row><entry /><entry>generateECKeyPair</entry></row><row rowsep="0"><entry morerows="2" rowsep="1"><b>HSM specific function</b></entry><entry>Package: com.comp.cpaas.dcpp.hsm.integration.nshield</entry></row><row rowsep="0"><entry>Object: NShieldInterface</entry></row><row><entry>Method: generateEllipticCurveKeyPair</entry></row></tbody></tgroup></table></tables>
0026<figref idref="f0005">Figure 5</figref> shows another implementation example 500 in which the HSM interface 502 defines a security circuitry API 504 that also includes the five functions noted above. The HSM interface 502 includes the API-to-API mapping 506. In this particular example, the API-to-API mapping 506 has implemented the symmetricDecrypt function transformation 508 and the symmetricDecrypt function transformation 510. Note that the API-to-API mapping 506 need not provide a mapping for every function, and in this case no mapping is defined for the applyDigitialSignature function, the generateECKeyPair function, or the verifyDigitalSignature function. Calls to those functions may be unsupported, may return an error code, may be handled by software in the peer node, may be passed to other systems, or may be handled in other manners.
0027The function transformations 508 and 510 map two of the five functions available from security circuitry API 504 to HSM specific functions 518 defined in the particular HSM in use, in this case the HSM 520. Here, the API for the HSM 520 implements the functions called "encrypt" for symmetric encryption and "decrypt" for symmetric decryption. As one specific example, an API call to the symmetricEncrypt function maps to the "encrypt" HSM API function. Table 11 summarizes the mapping from the security circuitry API 504 to the HSM 520 for this particular example. <tables id="tabl0011" num="0011"><table frame="all"><tgroup cols="2"><colspec colnum="1" colname="col1" colwidth="43mm" /><colspec colnum="2" colname="col2" colwidth="110mm" /><thead><row><entry namest="col1" nameend="col2" align="center" valign="middle"><b>Table 11: Mapping for HSM 520</b></entry></row></thead><tbody><row><entry valign="middle" /><entry valign="middle">symmetricEncrypt</entry></row><row rowsep="0"><entry morerows="2" rowsep="1" valign="middle"><b>HSM specific function</b></entry><entry valign="middle">Package: com.comp.cpaas.dcpp.enabler.securitymanager.manager.util</entry></row><row rowsep="0"><entry valign="middle">Object: KeyManager</entry></row><row><entry valign="middle">Method: encrypt</entry></row><row><entry valign="middle" /><entry valign="middle" /></row><row><entry valign="middle" /><entry valign="middle">symmetricDecrypt</entry></row><row rowsep="0"><entry morerows="2" rowsep="1" valign="middle"><b>HSM specific function</b></entry><entry valign="middle">Package: com.comp.cpaas.dcpp.enabler.securitymanager. manager. util</entry></row><row rowsep="0"><entry valign="middle">Object: KeyManager</entry></row><row><entry valign="middle">Method: decrypt</entry></row><row><entry valign="middle" /><entry valign="middle" /></row><row><entry valign="middle" /><entry valign="middle">applyDigitalSignature</entry></row><row><entry valign="middle"><b>HSM specific function</b></entry><entry valign="middle">None</entry></row><row><entry valign="middle" /><entry valign="middle" /></row><row><entry valign="middle" /><entry valign="middle">verifyDigitalSignature</entry></row><row><entry valign="middle"><b>HSM specific function</b></entry><entry valign="middle">None</entry></row><row><entry valign="middle" /><entry valign="middle" /></row><row><entry valign="middle" /><entry valign="middle">generateECKeyPair</entry></row><row><entry valign="middle"><b>HSM specific function</b></entry><entry valign="middle">None</entry></row></tbody></tgroup></table></tables>
0028<figref idref="f0006">Figure 6</figref> shows a third implementation example 600 in which the HSM interface 602 defines a security circuitry API 604. As before, the security circuitry API 604 includes the five functions noted above. The HSM interface 602 includes the API-to-API mapping 606. In this particular example, the API-to-API mapping 606 has implemented the symmetricDecrypt function transformation 608 and the symmetricDecrypt function transformation 610.
0029The function transformations 608 and 610 map two of the five functions available from security circuitry API 604 to software. That is, in this example, the peer node will rely on software implemented security functions, and an HSM is not called to provide hardware execution of the security functions. To that end, the function transformations 608 and 610 specify a software function to execute in response to API calls to the symmetricDecrypt function: the "decryptSw" function, and a software function to execute in response to API calls to the symmetricEncrypt function: the "encryptSw" function.
0030Table 12 summarizes the mapping from the security circuitry API 604 to the HSM 620 for this particular example. <tables id="tabl0012" num="0012"><table frame="all"><tgroup cols="2"><colspec colnum="1" colname="col1" colwidth="41mm" /><colspec colnum="2" colname="col2" colwidth="98mm" /><thead><row><entry namest="col1" nameend="col2" align="center" valign="middle"><b>Table 12: Mapping for HSM 620</b></entry></row></thead><tbody><row><entry valign="middle" /><entry valign="middle">symmetricEncrypt</entry></row><row rowsep="0"><entry morerows="3" rowsep="1" valign="middle"><b>HSM specific function</b></entry><entry valign="middle">Package:</entry></row><row rowsep="0"><entry valign="middle">com.accenture.cpaas.dcpp.enabler.securitymanager.manager.util</entry></row><row rowsep="0"><entry valign="middle">Object: SecurityManager</entry></row><row><entry valign="middle">Method: encryptSw</entry></row><row><entry valign="middle" /><entry valign="middle" /></row><row><entry valign="middle" /><entry valign="middle">symmetricDecrypt</entry></row><row rowsep="0"><entry morerows="3" rowsep="1" valign="middle"><b>HSM specific function</b></entry><entry valign="middle">Package:</entry></row><row rowsep="0"><entry valign="middle">com.accenture.cpaas.dcpp.enabler.securitymanager.manager.util</entry></row><row rowsep="0"><entry valign="middle">Object: SecurityManager</entry></row><row><entry valign="middle">Method: decryptSw</entry></row><row><entry valign="middle" /><entry valign="middle" /></row><row><entry valign="middle" /><entry valign="middle">applyDigitalSignature</entry></row><row><entry valign="middle"><b>HSM specific function</b></entry><entry valign="middle">None</entry></row><row><entry valign="middle" /><entry valign="middle" /></row><row><entry valign="middle" /><entry valign="middle">verifyDigitalSignature</entry></row><row><entry valign="middle"><b>HSM specific function</b></entry><entry valign="middle">None</entry></row><row><entry valign="middle" /><entry valign="middle" /></row><row><entry valign="middle" /><entry valign="middle">generateECKeyPair</entry></row><row><entry valign="middle"><b>HSM specific function</b></entry><entry valign="middle">None</entry></row></tbody></tgroup></table></tables>
0031<figref idref="f0007">Figure 7</figref> shows a hybrid implementation example 700 of the HSM interface 702 implementing a security circuitry API 704. In this particular example, the API-to-API mapping 706 has implemented the symmetricDecrypt function transformation 708, the symmetricDecrypt function transformation 710, the applyDigitialSignature function transformation 712, the generateECKeyPair function transformation 714, and the verifyDigitalSignature function transformation 716. However, in this example, the API-to-API mapping 706 uses a mix of HSM and software functions to carry out the calls to the security circuitry API 704.
0032The function transformations 708, 710, and 714 map three of the five functions available from security circuitry API 704 to HSM specific functions 718 for the HSM 720. More specifically, the calls to symmetricDecrypt, symmetricEncrypt, and generateECKeyPair are mapped to their counterpart functions in the HSM 720. On the other hand, the function transformations 712 and 716 handle calls to apply or verify a digital signature by mapping the calls to software functions: sWapplyDigitalSignature and sWverifyDigitalSignature, respectively. Table 13 summarizes the mapping from the security circuitry API 704 to the HSM 720 for this particular example. <tables id="tabl0013" num="0013"><table frame="all"><tgroup cols="2"><colspec colnum="1" colname="col1" colwidth="41mm" /><colspec colnum="2" colname="col2" colwidth="98mm" /><thead><row><entry namest="col1" nameend="col2" align="center" valign="middle"><b>Table 13: Mapping for HSM 720</b></entry></row></thead><tbody><row><entry valign="middle" /><entry valign="middle">symmetricEncrypt</entry></row><row rowsep="0"><entry morerows="2" rowsep="1" valign="middle"><b>HSM specific function</b></entry><entry valign="middle">Package: com.comp.cpaas.dcpp.hsm.integration.nshield</entry></row><row rowsep="0"><entry valign="middle">Object: NShieldlnterface</entry></row><row><entry valign="middle">Method: aesEncryption</entry></row><row><entry valign="middle" /><entry valign="middle" /></row><row><entry valign="middle" /><entry valign="middle">symmetricDecrypt</entry></row><row rowsep="0"><entry morerows="2" rowsep="1" valign="middle"><b>HSM specific function</b></entry><entry valign="middle">Package: com.comp.cpaas.dcpp.hsm.integration.nshield</entry></row><row rowsep="0"><entry valign="middle">Object: NShieldInterface</entry></row><row><entry valign="middle">Method: aesEncryption</entry></row><row><entry valign="middle" /><entry valign="middle" /></row><row><entry valign="middle" /><entry valign="middle">applyDigitalSignature</entry></row><row rowsep="0"><entry morerows="3" rowsep="1" valign="middle"><b>HSM specific function</b></entry><entry valign="middle">Package:</entry></row><row rowsep="0"><entry valign="middle">com.accenture.cpaas.dcpp.enabler.securitymanager.manager.util</entry></row><row rowsep="0"><entry valign="middle">object: SecurityManager</entry></row><row><entry valign="middle">Method: sWapplyDigitalSignature</entry></row><row><entry valign="middle" /><entry valign="middle" /></row><row><entry valign="middle" /><entry valign="middle">verifyDigitalSignature</entry></row><row rowsep="0"><entry morerows="3" rowsep="1" valign="middle"><b>HSM specific function</b></entry><entry valign="middle">Package:</entry></row><row rowsep="0"><entry valign="middle">com.accenture.cpaas.dcpp.enabler.securitymanager.manager.util</entry></row><row rowsep="0"><entry valign="middle">Object: SecurityManager</entry></row><row><entry valign="middle">Method: sWverifyDigitalSignature</entry></row><row><entry valign="middle" /><entry valign="middle" /></row><row><entry valign="middle" /><entry valign="middle">generateECKeyPair</entry></row><row rowsep="0"><entry morerows="2" rowsep="1" valign="middle"><b>HSM specific function</b></entry><entry valign="middle">Package: com.comp.cpaas.dcpp.hsm.integration.nshield</entry></row><row rowsep="0"><entry valign="middle">Object: NShieldInterface</entry></row><row><entry valign="middle">Method: generateEllipticCurveKeyPair</entry></row></tbody></tgroup></table></tables>
0033<figref idref="f0008">Figure 8</figref> shows another implementation example 800 of the HSM interface 802 including the security circuitry API 804. In this example, the HSM interface 802 supports multiple HSMs 820 for a single peer node, e.g., the HSMs 1 through HSM 'n'. The HSMs may be the same or different HSMs, and may be provided for redundancy, load balancing, fault tolerance, or for other reasons. In support of the multiple HSMs 820, the HSM interface 802 defines multiple API-to-API mappings 806, one for each unique HSM. Then, as the HSM interface 802 switches between different HSMs, the HSM interface 802 performs mappings according to the HSM in use at the time. In some implementations, configuration files 850 specify the API-to-API mappings for any pre-determined HSMs. The security controller circuitry may load one or more corresponding configuration files to define the API-to-API mappings to quickly and efficiently establish the mapping to whichever HSM the security controller circuitry will have assist with security functions.
0034<figref idref="f0009">Figure 9</figref> shows logic 900 that a hardware accelerated transaction processing system may implement. A hardware transaction processing system receives, at an authentication interface, a transaction request and an enrollment certificate (902). The system verifies a sender account linked to the transaction request (904) and may return a verification error message if verification fails (906).
0035The system issues a decryption request to a hardware security module for hardware decryption of the sender account (908). To that end, security manager circuitry may receive a decryption request function call (910), map the function call to the HSM API (912), and transmit the HSM specific function call to the HSM (914). The security manager circuitry receives decrypted data for the sender account from the hardware security module (916), e.g., as a return value from the HSM specific API function call.
0036The security manager circuitry may then perform a data update on the decrypted data. For instance, the security manager circuitry may generate updated account data responsive to the transaction request, e.g., by debiting or crediting an account (918). Once updated, the system issues an encryption request to the hardware security module for hardware encryption of the updated sender account data (920). The encryption request may pass to the HSM through an API function call, for instance. As with decryption, the API may implement a pre-determined mapping to a method implemented by one or more different HSMs for encryption. That is, the security manager circuitry receives an encryption request function call (922), translates the function call to the HSM API (924), and transmits the HSM specific function call to the HSM (926).
0037The system then adds the updated account data to a serialized encrypted transaction chain data structure. For instance, the system may issue a request for inclusion of the encrypted updated account data that reflects the transaction request in a block in the serialized encrypted transaction chain data structure (928). In one implementation, after consensus is reached (e.g., all nodes have the same copy of the data structure), the new transaction is handed out to all other bank nodes and is formally injected into the blockchain. The system may implement, for instance, the Practical Byzantine Fault Tolerance (PBFT) algorithm to provide increased speed and scalability to reach consensus in a private, permission blockchain system. After consensus has been reached and the transaction is included in the blockchain, a polling mechanism at the system and other like systems consistently checks for new blocks that have been added to the data structure (930).
0038The methods, devices, architectures, processing, circuitry, and logic described above may be implemented in many different ways and in many different combinations of hardware and software. For example, all or parts of the implementations may be circuitry that includes an instruction processor, such as a Central Processing Unit (CPU), microcontroller, or a microprocessor; or as an Application Specific Integrated Circuit (ASIC), Programmable Logic Device (PLD), or Field Programmable Gate Array (FPGA); or as circuitry that includes discrete logic or other circuit components, including analog circuit components, digital circuit components or both; or any combination thereof. The circuitry may include discrete interconnected hardware components or may be combined on a single integrated circuit die, distributed among multiple integrated circuit dies, or implemented in a Multiple Chip Module (MCM) of multiple integrated circuit dies in a common package, as examples.
0039Accordingly, the circuitry may store or access instructions for execution, or may implement its functionality in hardware alone. The instructions may be stored in a tangible storage medium that is other than a transitory signal, such as a flash memory, a Random Access Memory (RAM), a Read Only Memory (ROM), an Erasable Programmable Read Only Memory (EPROM); or on a magnetic or optical disc, such as a Compact Disc Read Only Memory (CDROM), Hard Disk Drive (HDD), or other magnetic or optical disk; or in or on another machine-readable medium. A product, such as a computer program product, may include a storage medium and instructions stored in or on the medium, and the instructions when executed by the circuitry in a device may cause the device to implement any of the processing described above or illustrated in the drawings.
0040The implementations may be distributed. For instance, the circuitry may include multiple distinct system components, such as multiple processors and memories, and may span multiple distributed processing systems. Parameters, databases, and other data structures may be separately stored and managed, may be incorporated into a single memory or database, may be logically and physically organized in many different ways, and may be implemented in many different ways. Example implementations include linked lists, program variables, hash tables, arrays, records (e.g., database records), objects, and implicit storage mechanisms. Instructions may form parts (e.g., subroutines or other code sections) of a single program, may form multiple separate programs, may be distributed across multiple memories and processors, and may be implemented in many different ways. Example implementations include stand-alone programs, and as part of a library, such as a shared library like a Dynamic Link Library (DLL). The library, for example, may contain shared data and one or more shared programs that include instructions that perform any of the processing described above or illustrated in the drawings, when executed by the circuitry.
0041Various implementations have been specifically described. However, many other implementations are also possible. For instance, any of the components and functionality in the architecture may be hosted in virtual machines managed by a cloud services provider. That is, while some implementations may be completely localized within a given enterprise, other implementations are completely migrated into the cloud, or are hybrid implementations with mixed local and cloud implementation. Regarding querying devices, the smartphones applications and desktop computers noted above are just particular examples, and other querying devices may be used, including hands-free systems in vehicles, digital personal assistants in smartphones or desktop PCs, hands-free control systems for the home, and many other types of devices.
10 sheets
Sheet 1 Sheet 2 Sheet 3 Sheet 4 Sheet 5 Sheet 6 Sheet 7 Sheet 8 Sheet 9 Sheet 10
Every citation, both ways
| Document | Relation | Office | Cited during |
|---|---|---|---|
| CN109347804A | Cited by | China | Search report |
| CN110012015A | Cited by | China | Search report |
| US2004098600A1 | Cites | United States of America | Search report |
| US2013010955A1 | Cites | United States of America | Search report |
| US2015358161A1 | Cites | United States of America | Search report |
| US2016260169A1 | Cites | United States of America | Examiner |
| US2016292672A1 | Cites | United States of America | Search report |
| DAVID CROSS: "Operating System Windows 2000 Server and PKI: Using the nCipher Hardware Security Module", 7 April 2001 (2001-04-07), XP055663886, Retrieved from the Internet <URL:http://www.di-srv.unisa.it/professori/ads/corso-security/www/CORSO-0001/win2000/pki/winpkihsm.doc> [retrieved on 20200131] | Non-patent | – | Examiner |
13 members in 4 offices; this record represents the family
Priority claims2
| Document | Office | Kind | Date |
|---|---|---|---|
| 17425005 | European Patent Office (EPO) | – | |
| 17425005 | European Patent Office (EPO) | A |
Members13
| Document | Office | Kind | |
|---|---|---|---|
| CA2989600A1 | Canada | A1 | |
| EP3355217A1This record | European Patent Office (EPO) | A1 | |
| US2018219671A1 | United States of America | A1 | |
| AU2017276160A1 | Australia | A1 | |
| US10243731B2 | United States of America | B2 | |
| AU2019203284A1 | Australia | A1 | |
| US2019182031A1 | United States of America | A1 | |
| US10742395B2 | United States of America | B2 | |
| AU2019203284B2 | Australia | B2 | |
| EP3355217B1 | European Patent Office (EPO) | B1 | |
| EP3982278A1 | European Patent Office (EPO) | A1 | |
| EP3982278B1 | European Patent Office (EPO) | B1 | |
| EP3982278B8 | European Patent Office (EPO) | B8 |
84 legal events, as 9 offices reported them to INPADOC
Over the term
Point at a mark for the eventEvents
| Event | Code | Office | |
|---|---|---|---|
| Annual fee paid to national office [announced via postgrant information from national office to epo]GrantedPGFP | PGFP | EP | |
| Annual fee paid to national office [announced via postgrant information from national office to epo]GrantedPGFP | PGFP | EP | |
| Annual fee paid to national office [announced via postgrant information from national office to epo]GrantedPGFP | PGFP | EP | |
| Annual fee paid to national office [announced via postgrant information from national office to epo]GrantedPGFP | PGFP | EP | |
| Annual fee paid to national office [announced via postgrant information from national office to epo]GrantedPGFP | PGFP | EP | |
| Lapsed in a contracting state [announced via postgrant information from national office to epo]LapsedPG25 | PG25 | EP | |
| Lapsed in a contracting state [announced via postgrant information from national office to epo]LapsedPG25 | PG25 | EP | |
| Lapsed in a contracting state [announced via postgrant information from national office to epo]LapsedPG25 | PG25 | EP | |
| Lapsed in a contracting state [announced via postgrant information from national office to epo]LapsedPG25 | PG25 | EP | |
| Opt-out of the competence of the unified patent court (upc) registeredP01 | P01 | EP | |
| Lapsed in a contracting state [announced via postgrant information from national office to epo]LapsedPG25 | PG25 | EP | |
| Lapsed in a contracting state [announced via postgrant information from national office to epo]LapsedPG25 | PG25 | EP | |
| Lapsed in a contracting state [announced via postgrant information from national office to epo]LapsedPG25 | PG25 | EP | |
| Lapsed in a contracting state [announced via postgrant information from national office to epo]LapsedPG25 | PG25 | EP | |
| Lapsed in a contracting state [announced via postgrant information from national office to epo]LapsedPG25 | PG25 | EP | |
| Lapsed in a contracting state [announced via postgrant information from national office to epo]LapsedPG25 | PG25 | EP | |
| No opposition filedOpposition26N | 26N | EP | |
| Lapsed in a contracting state [announced via postgrant information from national office to epo]LapsedPG25 | PG25 | EP | |
| Lapsed in a contracting state [announced via postgrant information from national office to epo]LapsedPG25 | PG25 | EP | |
| Lapsed in a contracting state [announced via postgrant information from national office to epo]LapsedPG25 | PG25 | EP | |
| No opposition filed within time limitOppositionORIGINAL CODE: 0009261PLBE | PLBE | EP | |
| Information on the status of an ep patent application or granted ep patentGrantedSTATUS: NO OPPOSITION FILED WITHIN TIME LIMITSTAA | STAA | EP | |
| Lapsed in a contracting state [announced via postgrant information from national office to epo]LapsedPG25 | PG25 | EP | |
| Lapsed in a contracting state [announced via postgrant information from national office to epo]LapsedPG25 | PG25 | EP | |
| Lapsed because of non-payment of the annual feeLapsedMM | MM | BE | |
| No opposition filed against granted patent, or epo opposition proceedings concluded without decisionGrantedR097 | R097 | DE | |
| Lapsed in a contracting state [announced via postgrant information from national office to epo]LapsedPG25 | PG25 | EP | |
| Lapsed in a contracting state [announced via postgrant information from national office to epo]LapsedPG25 | PG25 | EP | |
| Lapsed in a contracting state [announced via postgrant information from national office to epo]LapsedPG25 | PG25 | EP | |
| Lapsed in a contracting state [announced via postgrant information from national office to epo]LapsedPG25 | PG25 | EP | |
| Lapsed in a contracting state [announced via postgrant information from national office to epo]LapsedPG25 | PG25 | EP | |
| Lapsed in a contracting state [announced via postgrant information from national office to epo]LapsedPG25 | PG25 | EP | |
| Lapsed in a contracting state [announced via postgrant information from national office to epo]LapsedPG25 | PG25 | EP | |
| Lapsed in a contracting state [announced via postgrant information from national office to epo]LapsedPG25 | PG25 | EP | |
| Patent ceasedCeasedPL | PL | CH | |
| Lapsed in a contracting state [announced via postgrant information from national office to epo]LapsedPG25 | PG25 | EP | |
| Lapsed in a contracting state [announced via postgrant information from national office to epo]LapsedPG25 | PG25 | EP | |
| Lapsed in a contracting state [announced via postgrant information from national office to epo]LapsedPG25 | PG25 | EP | |
| Lapsed in a contracting state [announced via postgrant information from national office to epo]LapsedPG25 | PG25 | EP | |
| Lapsed in a contracting state [announced via postgrant information from national office to epo]LapsedPG25 | PG25 | EP | |
| Lapsed in a contracting state [announced via postgrant information from national office to epo]LapsedPG25 | PG25 | EP | |
| Lapsed in a contracting state [announced via postgrant information from national office to epo]LapsedPG25 | PG25 | EP | |
| Deletion acc. to par. 5 (withdrawal of the translation of the ep patent)MK05 | MK05 | AT | |
| Lapsed in a contracting state [announced via postgrant information from national office to epo]LapsedPG25 | PG25 | EP | |
| Lapsed in a contracting state [announced via postgrant information from national office to epo]LapsedPG25 | PG25 | EP | |
| Lapsed in a contracting state [announced via postgrant information from national office to epo]LapsedPG25 | PG25 | EP | |
| Lapsed in a contracting state [announced via postgrant information from national office to epo]LapsedPG25 | PG25 | EP | |
| Patent invalid in the netherlands as no translation has been filedMP | MP | NL | |
| Invalidation of extension of european patentsMG9D | MG9D | LT | |
| European patents granted designating irelandGrantedFG4D | FG4D | IE | |
| Dpma publication of mentioned ep patent grantGrantedR096 | R096 | DE | |
| European patent takes effect as a national patent in ch/liEP | EP | CH | |
| Reference to at number (ep patent validated in austria)REF | REF | AT | |
| Designated contracting statesAK | AK | EP | |
| European patent grantedGrantedFG4D | FG4D | GB | |
| (expected) grantORIGINAL CODE: 0009210GRAA | GRAA | EP | |
| Information on the status of an ep patent application or granted ep patentGrantedSTATUS: THE PATENT HAS BEEN GRANTEDSTAA | STAA | EP | |
| Grant fee paidORIGINAL CODE: EPIDOSNIGR3GRAS | GRAS | EP | |
| Intention to grant announcedINTG | INTG | EP | |
| Information on inventor provided before grant (corrected)RIN1 | RIN1 | EP | |
| Information on inventor provided before grant (corrected)RIN1 | RIN1 | EP | |
| Information on inventor provided before grant (corrected)RIN1 | RIN1 | EP | |
| Information on inventor provided before grant (corrected)RIN1 | RIN1 | EP | |
| Information on inventor provided before grant (corrected)RIN1 | RIN1 | EP | |
| Information on inventor provided before grant (corrected)RIN1 | RIN1 | EP | |
| Information on inventor provided before grant (corrected)RIN1 | RIN1 | EP | |
| Despatch of communication of intention to grant a patentORIGINAL CODE: EPIDOSNIGR1GRAP | GRAP | EP | |
| Information on the status of an ep patent application or granted ep patentGrantedSTATUS: GRANT OF PATENT IS INTENDEDSTAA | STAA | EP | |
| First examination report despatched17Q | 17Q | EP | |
| Information on the status of an ep patent application or granted ep patentGrantedSTATUS: EXAMINATION IS IN PROGRESSSTAA | STAA | EP | |
| Information on inventor provided before grant (corrected)RIN1 | RIN1 | EP | |
| Information on inventor provided before grant (corrected)RIN1 | RIN1 | EP | |
| Information on inventor provided before grant (corrected)RIN1 | RIN1 | EP | |
| Information on inventor provided before grant (corrected)RIN1 | RIN1 | EP | |
| Information on inventor provided before grant (corrected)RIN1 | RIN1 | EP | |
| Information on inventor provided before grant (corrected)RIN1 | RIN1 | EP | |
| Information on inventor provided before grant (corrected)RIN1 | RIN1 | EP | |
| Request for examination filed17P | 17P | EP | |
| Designated contracting states (corrected)RBV | RBV | EP | |
| Information on the status of an ep patent application or granted ep patentGrantedSTATUS: REQUEST FOR EXAMINATION WAS MADESTAA | STAA | EP | |
| Designated contracting statesAK | AK | EP | |
| Request for extension of the european patentAX | AX | EP | |
| Public reference made under article 153(3) epc to a published international application that has entered the european phaseORIGINAL CODE: 0009012PUAI | PUAI | EP | |
| Information on the status of an ep patent application or granted ep patentGrantedSTATUS: THE APPLICATION HAS BEEN PUBLISHEDSTAA | STAA | EP |
Numbers
- Publication
- 3355217
- Application
- 172083685
Titles3
- German
- HARDWARE-BLOCKCHAIN-BESCHLEUNIGUNG
- English
- HARDWARE BLOCKCHAIN ACCELERATION
- French
- ACCÉLÉRATION DE CHAÎNES DE BLOC MATÉRIELLE
Classification
- CPC, 19
- G06F21/10
- H04L9/30
- H04L63/04
- H04W12/10
- H04L9/0897
- H04L9/3239
- H04L2209/122
- H04L9/50
- H04L63/08
- H04L63/0853
- H04L9/3234
- H04L9/0877
- G06F9/54
- G06F21/72
- H04L9/0637
- H04L9/0861
- H04L9/14
- H04L9/3247
- H04L9/3263
- IPC, 3
- G06F21 10
- H04L29 06
- H04W12 10
Designated states43
- Contracting states, 38
- Albania
- Austria
- Belgium
- Bulgaria
- Switzerland
- Cyprus
- Czechia
- Germany
- Denmark
- Estonia
- Spain
- Finland
- France
- United Kingdom
- Greece
- Croatia
- Hungary
- Ireland
- Iceland
- Italy
- Liechtenstein
- Lithuania
- Luxembourg
- Latvia
and 14 moreShow fewer
- Monaco
- North Macedonia
- Malta
- Netherlands (Kingdom of the)
- Norway
- Poland
- Portugal
- Romania
- Serbia
- Sweden
- Slovenia
- Slovakia
- San Marino
- Türkiye
- Extension states, 2
- Bosnia and Herzegovina
- Montenegro
- Validation states, 3
- Morocco
- Republic of Moldova
- Tunisia