Granted Patent B2

US 11,431,486 · App. 16/667,845 · Granted Aug 30, 2022

Inventor: Prithvi Krishnan Padmanabhan (San Ramon, CA)

Assignee: SALESFORCE.COM, INC.

H04L9/085G06F16/13G06F16/162G06F16/1837H04L9/0637H04L9/0822H04L9/0825H04L9/0838H04L9/0894H04L2209/38

Abstract

Claims (50)

1. A method performed by a system of a host organization for managing read access of data in a blockchain managed by a plurality of nodes of a blockchain network, the system providing a blockchain interface to the blockchain on behalf of a plurality of tenants of the host organization, the method comprising:

receiving a transaction to be stored to the blockchain via the blockchain interface;

encrypting transaction data from the transaction using a key generated by the blockchain interface;

dividing the key into a set of shared secrets corresponding to each node in the blockchain network;

storing metadata about the transaction data to the blockchain, wherein the metadata indicates an owner among the plurality of tenants for access control to the transaction data;

receiving, from a first tenant of the plurality of tenants, a request to access the transaction data by the blockchain interface;

receiving enough of the shared secrets from the plurality of nodes to indicate a consensus of the blockchain network that one or more criteria for accessing the transaction data have been met, the one or more criteria including that the first tenant is the owner indicated by the metadata; and

decrypting the transaction data in response to receiving the enough of the shared secrets.

2. The method of claim 1 , further comprising:

encrypting each shared secret in the set of shared secrets using a public key of the respective node.

3. The method of claim 1 , further comprising:

storing encrypted the set of shared secrets in the metadata about the transaction data.

4. The method of claim 1 , wherein the transaction data is decrypted in response to receiving a threshold number of shared secrets.

5. The method of claim 1 , wherein a decryption key is recovered from received shared secrets.

6. The method of claim 1 , further comprising:

denying access to the transaction data in response to a number of the received shared secrets being below a threshold for recovering the key for encryption.

7. A computing system of a host organization configured to perform a method for managing read access of data in a blockchain managed by a plurality of nodes of a blockchain network, the computer system providing a blockchain interface to the blockchain on behalf of a plurality of tenants of the host organization, the computing system comprising:

a computer readable medium having stored therein the blockchain interface; and

a processor coupled to the blockchain interface, the processor configured to execute the blockchain interface to:

receive a transaction to be stored to the blockchain;

encrypt transaction data from the transaction using a key generated by the blockchain interface;

divide the key into a set of shared secrets corresponding to each node in the blockchain network;

store metadata about the transaction data to the blockchain, wherein the metadata indicates an owner among the plurality of tenants for access control to the transaction data;

receive, from a first tenant of the plurality of tenants, a request to access the transaction data;

receive enough of the shared secrets from the plurality of nodes to indicate a consensus of the blockchain network that one or more criteria for accessing the transaction data have been met, the one or more criteria including that the first tenant is the owner indicated by the metadata; and

decrypt the transaction data in response to receiving the enough of the shared secrets.

8. The computer system of claim 7 , wherein the blockchain interface is further to encrypt each shared secret in the set of shared secrets using a public key of the respective node.

9. The computer system of claim 7 , wherein the blockchain interface is further to store encrypted the set of shared secrets in the metadata about the transaction data.

10. The computer system of claim 7 , wherein the transaction data is decrypted in response to receiving a threshold number of shared secrets.

11. The computer system of claim 7 , wherein a decryption key is recovered from received shared secrets.

12. The computer system of claim 7 , wherein the blockchain interface is further to deny access to the transaction data in response to a number of the received shared secrets being below a threshold for recovering the key for encryption.

13. A non-transitory computer-readable medium having stored therein a set of instructions, which when executed cause a computer system of a host organization to perform a set of operations of a method for managing read access of data in a blockchain managed by a plurality of nodes of a blockchain network, the computer system providing a blockchain interface to the blockchain on behalf of a plurality of tenants of the host organization, the set of operations comprising:

receiving a transaction to be stored to the blockchain via the blockchain interface;

encrypting transaction data from the transaction using a key generated by the blockchain interface;

dividing the key into a set of shared secrets corresponding to each node in the blockchain network;

storing metadata about the transaction data to the blockchain, wherein the metadata indicates an owner among the plurality of tenants for access control to the transaction data;

receiving, from a first tenant of the plurality of tenants, a request to access the transaction data by the blockchain interface;

receiving enough of the shared secrets from the plurality of nodes to indicate a consensus of the blockchain network that one or more criteria for accessing the transaction data have been met, the one or more criteria including that the first tenant is the owner indicated by the metadata; and

decrypting the transaction data in response to receiving the enough of the shared secrets.

14. The non-transitory computer-readable medium of claim 13 , the operations further comprising:

encrypting each shared secret in the set of shared secrets using a public key of the respective node.

15. The non-transitory computer-readable medium of claim 13 , the operations further comprising:

storing encrypted the set of shared secrets in the metadata about the transaction data.

16. The non-transitory computer-readable medium of claim 13 , wherein the transaction data is decrypted in response to receiving a threshold number of shared secrets.

17. The non-transitory computer-readable medium of claim 13 , wherein a decryption key is recovered from received shared secrets.

18. The non-transitory computer-readable medium of claim 13 , the operations further comprising:

denying access to the transaction data in response to a number of the received shared secrets being below a threshold for recovering the key for encryption.

19. The method of claim 1 , wherein storing the metadata about the transaction data to the blockchain is responsive to a consensus of the blockchain network to commit the transaction to the blockchain.

20. The computer system of claim 7 , wherein storing the metadata about the transaction data to the blockchain is responsive to a consensus of the blockchain network to commit the transaction to the blockchain.

21. The non-transitory computer-readable medium of claim 13 , wherein storing the metadata about the transaction data to the blockchain is responsive to a consensus of the blockchain network to commit the transaction to the blockchain.

Assignments (2)

Cited By (13)

US 12,306,846 US 12,307,222 US 12,321,724 US 12,353,855 US 12,354,089 US 12,380,430 US 12,469,077 US 12,488,343 US 12,526,155 US 12,632,442 US 12,645,674 US 12,670,151 US 12,688,196