Consensus service for blockchain networks

1. A computer-implemented method for establishing consensus in a blockchain network, comprising:

providing a first total ordering service gateway (“TOS gateway”) for an organization in a blockchain network, wherein the TOS gateway has read/write access to a shared message queue that makes messages available to each other TOS gateway in the blockchain network, wherein contents of the messages are unreadable by an entity managing the shared message queue;

generating a symmetric key at the first TOS gateway;

splitting the symmetric key to generate a plurality of key shares;

distributing at least one of the plurality of key shares to a second TOS gateway in the blockchain network; and

receiving, at the first TOS gateway from the second TOS gateway via the shared queue, a request for the symmetric key; and in response:

receiving an ephemeral public counterpart from the second TOS gateway;

generating an ephemeral key pair, wherein the ephemeral key pair comprises an ephemeral private key and an ephemeral public counterpart for the first TOS gateway;

generating an ephemeral symmetric key;

encrypting the ephemeral symmetric key using the ephemeral public counterpart from the second TOS gateway;

encrypting a shared key using the ephemeral symmetric key; and

publishing the encrypted shared key to the shared queue.

2. The computer-implemented method of claim 1 , wherein the symmetric key is only known to a plurality of TOS gateways in the blockchain network.

3. The computer-implemented method of claim 1 , further comprising:

storing at least one of the plurality of key shares in persistent memory; and

storing the symmetric key only in volatile memory.

4. The computer-implemented method of claim 1 , further comprising:

receiving a transaction payload at the first TOS gateway;

encrypting the transaction using the symmetric key; and

publishing the encrypted transaction to the shared message queue.

5. The computer-implemented method of claim 4 , further comprising:

forming one or more blocks associated with the transaction; and

autonomously signing the one or more blocks with a blockchain key.

6. The computer-implemented method of claim 5 , wherein the contents of the messages comprises the transaction payload.

7. The computer-implemented method of claim 5 , further comprising appending the signed one or more blocks to a blockchain associated with the blockchain network.

8. The computer-implemented method of claim 1 , further comprising recovering the symmetric key, comprising:

requesting one of the key shares from the second gateway in the blockchain network; and

reconstructing the symmetric key using the one of the key shares.

9. The computer-implemented method of claim 8 , wherein requesting the one of the key shares from the second gateway comprises:

generating an ephemeral key pair at the first TOS gateway, wherein the ephemeral key pair comprises an ephemeral private key and ephemeral public counterpart;

publishing the ephemeral public counterpart to the shared queue;

receiving, from the second TOS gateway via the shared queue, an ephemeral symmetric key, wherein the ephemeral symmetric key is generated in part using the ephemeral public counterpart of the first TOS gateway;

receiving, from the second TOS gateway via the shared queue, the one of the key shares, wherein the one of the key shares is encrypted using the ephemeral symmetric key;

decrypting the one of the key shares using the ephemeral symmetric key; and

forgetting the ephemeral key pair.

10. The computer-implemented method of claim 9 , wherein the second TOS gateway is a new TOS gateway in the blockchain network.

11. The computer-implemented method of claim 1 , further comprising rotating the symmetric key, comprising:

receiving a channel reconfiguration message at the first TOS gateway;

generating an ephemeral key pair at the first TOS gateway, wherein the ephemeral key pair comprises an ephemeral private key and ephemeral public counterpart;

publishing the ephemeral public counterpart to the shared queue;

receiving a key split from the second TOS gateway via the shared queue, wherein the key split is encrypted using the ephemeral public counterpart; and

decrypting the key split using the ephemeral private key.

12. The computer-implemented method of claim 11 , wherein the channel reconfiguration message is in response to a TOS gateway removal action.

13. A computer program product for a confidential ordering service, the computer program product comprising:

one or more computer readable storage media, and program instructions collectively stored on the one or more computer readable storage media, the program instructions comprising:

running a total ordering service gateway (“TOS gateway”) for each organization in a blockchain network, wherein each total ordering service gateway has read/write access to a shared message queue that distributes messages to each organization, wherein each total ordering service gateway for each of the organizations in the group of organizations is aware of one or more certificates associated with other organizations in the group of organizations;

identifying a group of organizations within the organizations; and

generating a channel that includes the group of organizations, wherein the group of organizations cooperate autonomously;

wherein the plurality of TOS gateways contain program instructions to:

receive a transaction payload;

encrypt the transaction payload using the symmetric key; and

publish the encrypted transaction payload to the shared message queue.

14. The computer program product of claim 13 , further comprising program instructions for:

generating a symmetric key only known to the group of organizations;

splitting the symmetric key into respective shares associated with a number of organizations in the group of organizations; and

storing the shares while not storing the symmetric key as a whole.

15. The computer program product of claim 14 , further comprising program instructions for:

receiving, by a total ordering service gateway of at least one organization in the group of organizations, a transaction;

encrypting the transaction with the symmetric key;

forming one or more blocks associated with the transaction;

signing the one or more blocks autonomously with the respective share; and

broadcasting the signed one or more blocks to the group of organizations.

16. A total ordering service for a blockchain network, comprising:

a plurality of total ordering service gateways (“TOS gateways”), each associated with one of a plurality of member organizations in a blockchain network, wherein the plurality of TOS gateways each comprise a processor operably connected to a memory, the memory containing program instructions to, when executed on the processor:

generate a symmetric key at a first of the plurality of TOS gateways;

split the symmetric key into a plurality of key shares; and

distribute at least one of the plurality of key shares to a second TOS gateway in the blockchain network;

a shared message queue adapted redistribute the symmetric key to the plurality of TOS gateways in the blockchain network;

wherein the plurality of TOS gateways further contain program instructions to:

receive a transaction payload;

encrypt the transaction payload using the symmetric key; and

publish the encrypted transaction payload to the shared message queue; and

wherein the shared message queue is further adapted redistribute transaction payload to the plurality of TOS gateways in the blockchain network without reading the message content.

17. The blockchain network of claim 16 , wherein the plurality of TOS gateways further contain program instructions to:

store one of the key shares in persistent memory; and

store the symmetric key only in volatile memory.