Composite keys for authorization policies
A method and system are provided to support a decentralized distributed ledger in which transactions are recorded by parties to the transactions without the use of a blockchain. A distributed ledger system provides a protocol framework that supports the development of protocol flows. A protocol flow is computer code that controls the performance of a transaction by the party or parties to the transaction. Protocol flows can be developed for different types of transactions. The distributed ledger system allows transactions to be proposed, accepted, and notarized by a notary and stored without the use of a blockchain ledger. The distributed ledger system can avoid the expense of the computational and storage resources needed to redundantly verify a transaction and store evidence on the many nodes of a blockchain distributed ledger.
1. A method performed by one or more computing system, having one or more processors, for determining validity of a combination of digital signatures, each electronic signature generated using a private key of a public/private key pair that includes a public key corresponding to the private key, the method comprising:
accessing, with the one or more processors, a tree specifying a composite key, each leaf node specifying a public key and an associated algorithm identifier, each non-leaf node specifying a weight of each child node of the non-leaf node and a threshold weight;
validating, with the one or more processors, at least some of the digital signatures of the combination based the algorithm identifier of a leaf node that contains the public key corresponding to the private key used to generate the digital signature; and
traversing, with the more or more processors, the tree in a bottom up manner by, for each child node, summing in a bottom-up manner the weights its child nodes whose threshold is met or whose public key corresponds to a private key used to generate a valid signature to determine whether the combination of digital signatures is a valid combination.
2. The method of claim 1 wherein the weights and thresholds encode Boolean formulas.
3. The method of claim 1 wherein the tree specifies that one party is allowed to sign a transaction or multiple other parties are required to sign the transaction.
4. The method of claim 1 wherein the tree includes two leaf nodes such that a combination of digital signatures is valid only if both digital signatures are valid.
5. The method of claim 1 wherein an algorithm identifier identifies a SHA algorithm.
6. The method of claim 1 wherein the combination of digital signatures is used to sign a transaction.
7. The method of claim 1 wherein the combination of digital signatures are digital signatures of participants in a distributed notary.
8. The method of claim 1 wherein a digital signature is a hash of a transaction that is signed using a private key of a signer.
9. The method of claim 1 wherein a public key identifies a party to a transaction.
10. One or more computing systems, having one or more processors, for determining validity of a combination of digital signatures, each electronic signature generated using a private key of a party with a corresponding public key that identifies the party, the one or more computing systems comprising:
one or more computer-readable storage mediums for storing a tree specifying a composite key, each leaf node specifying a public key of a party, each non-leaf node specifying a weight of each child node of the non-leaf node and a threshold weight; and
computer-executable instructions for controlling the one or more computing systems to:
validate, with the more or more processors, at least some of the digital signatures of the combination based on an encryption algorithm and the public key of a leaf node that contains the public key that identifies a party generated a digital signature; and
traverse, with the more or more processors, the tree in a bottom up manner by, for each child node, summing in a bottom-up manner the weights its child nodes whose threshold is met or whose public key corresponds to a private key used to generate a valid signature to determine whether the combination of digital signatures is a valid combination.
11. The one or more computing systems of claim 10 wherein each leaf node includes an algorithm identifier of an encryption algorithm.
12. The one or more computing systems of claim 10 wherein the encryption algorithm is a SHA algorithm.
13. The one or more computing systems of claim 10 wherein the weights and thresholds encode Boolean formulas.
14. The one or more computing systems of claim 10 wherein the tree specifies that one party is allowed to sign a transaction or multiple other parties are required to sign the transaction.
15. The one or more computing systems of claim 10 wherein the tree includes two leaf nodes such that a combination of digital signatures is valid only if both digital signatures are valid.
16. The one or more computing systems of claim 10 wherein the combination of digital signatures is used to sign a transaction.
17. The one or more computing systems of claim 10 wherein the combination of digital signatures are digital signatures of participants in a distributed notary.
18. The one or more computing systems of claim 10 wherein a digital signature is a hash of a transaction that is signed using a private key of a signer.
19. The one or more computing systems of claim 10 wherein a public key identifies a party to a transaction.