Membership compiler for applications

1. A method for evaluating a membership conversion proposal submitted by a client application (App) on a client that is subject to a first membership services provider (MSP 1 ) of a first organization, the method comprising:

evaluating a validity of the client according to membership rules associated with a channel supporting MSP 1 and a second membership services provider (MSP 2 ) of a second organization using a preparatory application membership chaincode (appmem-cc) instantiated in the channel, the appmem-cc comprising a table mapping MSP 1 information necessary for compliance with the MSP 2 ;

generating, using the appmem-cc, a request to create MSP 2 compliant credentials using information from MSP 1 credentials of the client;

generating, using the appmem-cc, new credentials for the client including the information necessary for compliance with the MSP 2 ;

generating a new certificate for the MSP 2 based on the new credentials;

validating the new certificate against the MSP 2 ;

constructing the membership conversion proposal using the new certificate; and

requesting endorsement of the membership conversion proposal.

2. The method of claim 1 , further comprising:

determining a privacy requirement of a user associated with the first organization; and

in response to determining that only an identity of the first organization needs to be hidden:

mapping user characteristics information not pertaining to the first organization to membership characteristics information of the new credentials, and

acquiring an inherent namespace derived by chaincode; or

in response to determining that attributes associated with the user, an enrollment identifier, and an identity of the first organization all need to be hidden:

encrypting the user attributes, the enrollment identifier, and the identity of the first organization inside the new certificate;

storing the new credentials in a local database with the membership conversion proposal; and

returning the new credentials to the client inside a proposal response message.

3. The method of claim 2 , wherein:

the new credentials contain information identifying at least one of:

a blockchain for which the newly generated certificate is intended, and

a timestamp; and

wherein the method further comprises:

accessing the information by transaction orderers when the new certificate is used to represent a creator of a transaction.

4. The method of claim 1 , wherein the method further comprises:

setting up a new MSP and declaring its configuration in the channel;

including, by the new MSP, a certificate corresponding to a cryptographic key of the client App chaincode as a root or intermediate certificate authority (CA);

checking, by the new MSP, that a blockchain listed in the transaction certificate corresponds to a blockchain associated with membership conversion proposal; and

checking, by the new MSP, that the transaction certificate has not expired when it is validated.

5. The method of claim 1 , wherein:

submitting, by the client App a transaction to chaincode (cc) that accepts invocations from certificates compliant with MSP 2 , wherein the client is compliant with MSP 1 ;

setting up, by the client App, MSP 2 compliant peers with chaincode for endorsing transaction proposals from the client;

installing, by the client App, the appmem-cc on the MSP 2 compliant peers, the appmem-cc configured to convert MSP 1 certificates to MSP 2 certificates; and

instantiating, by the client App, the appmem-cc in the channel with a table that maps attributes, roles, and permissions of clients compliant with MSP 1 , to attributes, roles, and permissions needed to be compliant with MSP 2 .

6. The method of claim 5 , wherein:

invoking, by the client App, endorsers (appmem-cc endorsers) satisfying endorsement policies of the appmem to generate a cryptographically signed request to create new MSP 2 compliant credentials using information from client MSP 1 credentials of the client App.

7. The method of claim 6 , wherein:

validating, by an appmem-cc endorser of the appmem-cc endorsers, the MSP 1 compliant client;

obtaining, by the appmem-cc endorser, a list of attributes that need to be included in new MSP 2 compliant credentials; and

creating, by the appmem-cc endorser, the new MSP 2 compliant credentials,

wherein the new credentials are used to generate a new certificate (client-msp2-cert) for client App's use under MSP 2 (client-msp2-cert), and

wherein the method further comprises:

validating, by the client App, the client-msp2-cert against the MSP 2 ;

constructing, by the client App, a transaction using the MSP 2 compliant client credentials; and

invoking, by the client App, chaincode on endorsers under MSP 2 to endorse the transaction.

8. A system to evaluate a membership conversion proposal submitted by a client application (App) on a client that is subject to a first membership services provider (MSP 1 ) of a first organization, the system comprising:

a memory storing instructions; and

a processor that when executing the instructions is configured to:

evaluate a validity of the client according to membership rules associated with a channel supporting MSP 1 and a second membership services provider (MSP 2 ) of a second organization using a preparatory application membership chaincode (appmem-cc) instantiated in the channel, the appmem-cc comprising a table mapping MSP 1 information necessary for compliance with the MSP 2 ,

generate, using the appmem-cc, a request to create MSP 2 compliant credentials using information from MSP 1 credentials of the client,

generate, using the appmem-cc, new credentials for the client including the information necessary for compliance with the MSP 2 ,

generate a new certificate for the MSP 2 based on the new credentials,

validate the new certificate against the MSP 2 ;

construct the membership conversion proposal using the new certificate, and

request endorsement of the membership conversion proposal.

9. The system of claim 8 , wherein the processor is further configured to:

determine a privacy requirement of a user associated with the first organization; and

in response to a determination that only an identity of the first organization needs to be hidden:

map user characteristics information not pertaining to the first organization to membership characteristics information of the new credentials, and acquire an inherent namespace derived by chaincode; or

in response to a determination that attributes associated with the user, an enrollment identifier, and an identity of the first organization all need to be hidden:

encrypt the user attributes, the enrollment identifier, and the identity of the first organization inside the new certificate;

store the new credentials in a local database with the membership conversion proposal; and

return the credentials to the client inside a proposal response message.

10. The system of claim 9 , wherein:

the new credentials contain information identifying at least one of:

a blockchain for which the newly generated certificate is intended, and a timestamp; and

wherein the processor is further configured to:

access the information by transaction orderers when the new certificate is used to represent a creator of a transaction.

11. The system of claim 8 , wherein the processor is further configured to:

set up a new MSP and declare its configuration in the channel, wherein the new MSP is configured to:

include a certificate corresponding to a cryptographic key of the client App chaincode as a root or intermediate certificate authority (CA);

check that a blockchain listed in the transaction certificate corresponds to a blockchain associated with membership conversion proposal; and

check that the transaction certificate has not expired when it is validated.

12. The system of claim 8 , wherein:

the client App is configured to submit a transaction to chaincode (cc) that accepts invocations from certificates compliant with MSP 2 , wherein the client is compliant with MSP 1 ;

the client App is configured to set up MSP 2 compliant peers with chaincode to endorse transaction proposals from the client;

the client App is configured to install the appmem-cc on the MSP 2 compliant peers, the appmem-cc configured to convert MSP 1 certificates to MSP 2 certificates; and

the client App is configured to instantiate the appmem-cc in the channel with a table that maps attributes, roles, and permissions of clients compliant with MSP 1 , to attributes, roles, and permissions needed to be compliant with MSP 2 .

13. The system of claim 12 , wherein the client App is configured to:

invoke endorsers (appmem-cc endorsers) satisfying endorsement policies of the appmem-to generate a cryptographically signed request to create new MSP 2 compliant credentials using information from client MSP 1 credentials of the client App.

14. The system of claim 13 , wherein an appmem-cc endorser is configured to:

validate the MSP 1 compliant client;

obtain a list of attributes that need to be included in new MSP 2 compliant credentials; and

create the new MSP 2 compliant credentials,

wherein the new credentials are used to generate a new certificate (client-msp2-cert) for client App's use under MSP 2 (client-msp2-cert), and

wherein the client App is further configured to:

validate the client-msp2-cert against the MSP 2 ,

construct constructs a transaction based on the MSP 2 compliant client credentials, and

invoke chaincode on endorsers under MSP 2 to endorse the transaction.

15. A non-transitory computer readable medium comprising instructions for evaluating a membership conversion proposal submitted by a client application (App) on a client that is subject to a first membership services provider (MSP 1 ) of a first organization that when executed by a processor configures the processor to perform:

evaluating a validity of the client according to membership rules associated with a channel supporting MSP 1 and a second membership services provider (MSP 2 ) of a second organization using a preparatory application membership chaincode (appmem-cc) instantiated in the channel, the appmem-cc comprising a table mapping MSP 1 information necessary for compliance with the MSP 2 ;

generating, using the appmem-cc, a request to create MSP 2 compliant credentials using information from MSP 1 credentials of the client;

generating, using the appmem-cc, new credentials for the client including the information necessary for compliance with the MSP 2 ;

generating a new certificate for the MSP 2 based on the new credentials;

validating the new certificate against the MSP 2 ;

constructing the membership conversion proposal using the new certificate; and

requesting endorsement of the membership conversion proposal.

16. The non-transitory computer readable medium of claim 15 , wherein the instructions further configure the processor to perform:

determining a privacy requirement of a user associated with the first organization; and

in response to determining that only an identity of the first organization needs to be hidden:

mapping user characteristics information not pertaining to the first organization to membership characteristics information of the new credentials, and

acquiring an inherent namespace derived by chaincode; and

in response to determining that attributes associated with the user, an enrollment identifier, and an identity of the first organization all need to be hidden:

encrypting the user attributes, the enrollment identifier, and the identity of the first organization inside the new certificate;

storing the new credentials in a local database with the membership conversion proposal; and

returning the new credentials to the client inside a proposal response message.

17. The non-transitory computer readable medium of claim 16 , wherein:

the new credentials contain information identifying at least one of:

a blockchain for which the newly generated certificate is intended, and

a timestamp; and

wherein the method further comprises:

accessing the information by transaction orderers when the new certificate is used to represent a creator of a transaction.

18. The non-transitory computer readable medium of claim 15 , wherein the method further comprises:

setting up a new MSP and declaring its configuration in the channel;

including, by the new MSP, a certificate corresponding to a cryptographic key of the client App chaincode as a root or intermediate certificate authority (CA);

checking, by the new MSP, that a blockchain listed in the transaction certificate corresponds to a blockchain associated with membership conversion proposal; and

checking, by the new MSP, that the transaction certificate has not expired when it is validated.

19. The non-transitory computer readable medium of claim 15 , wherein the instructions further configure the processor to perform:

submitting, by the client App a transaction to chaincode (cc) that accepts invocations from certificates compliant with MSP 2 , wherein the client is compliant with MSP 1 ;

setting up, by the client App, MSP 2 compliant peers with chaincode for endorsing transaction proposals from the client;

installing, by the client App, the appmem-cc on the MSP 2 compliant peers, the appmem-cc configured to convert MSP 1 certificates to MSP 2 certificates; and

instantiating, by the client App, the appmem-cc in the channel with a table that maps attributes, roles, and permissions of clients compliant with MSP 1 , to attributes, roles, and permissions needed to be compliant with MSP 2 .

20. The non-transitory computer readable medium of claim 19 , wherein the instructions further configure the processor to perform:

invoking, by the client App, endorsers (appmem-cc endorsers) satisfying endorsement policies of the appmem-to generate a cryptographically signed request to create new MSP 2 compliant credentials using information from client MSP 1 credentials of the client App;

obtaining, by the appmem-cc endorser, a list of attributes that need to be included in new MSP 2 compliant credentials; and

creating, by the appmem-cc endorser, the new MSP 2 compliant credentials,

wherein the new credentials are used to generate a new certificate (client-msp2-cert) for client App's use under MSP 2 (client-msp2-cert), and

wherein the instructions further configure the processor to perform:

validating, by the client App, the client-msp2-cert against the MSP 2 ;

constructing, by the client App, a transaction using the MSP 2 compliant client credentials; and

invoking, by the client App, chaincode on endorsers under MSP 2 to endorse the transaction.