Verification systems for blockchains and distributed ledgers
Provided herein are exemplary systems and methods for creating a secure self-validating network of blockchain/distributed ledger participants. Some exemplary mechanisms support self-validation, mutual-validation, external-validation and privacy controls. Such mechanisms enable the deployment and continued operation of large scale blockchain and distributed ledger systems with a self-certifying security system. They create the ability for rules to be codified to control the rights, privileges and access of nodes depending on their self-certification and external-certification. Also provided is an audit trail of these certifications which can be used for liability claims, insurance, security analytics and forensics.
1 . A method for creating a secure self-validating network of distributed ledger participants, the method comprising:
providing a security verification service communicatively coupled to a central blockchain, the security verification service comprising time-based analysis of security certifications of a plurality of entities to determine a trustworthiness of each of the plurality of entities communicatively coupled to the central blockchain, the security verification service determining a trustworthiness independent of actual participants in the central blockchain;
providing a consensus message to the plurality of entities to rollback the central blockchain to a last time a compromised party published a secure transaction to the central blockchain; and
verifying a security evaluation, validation, or certification of other entities on the secure self-validating network comprising:
each entity signing a message with a private key;
each entity verifying an operating system version;
each entity verifying a software version;
each entity confirming a copy of the central blockchain; and
each entity using a hash of the central blockchain for each respective entity combined with a hash of an environment for each respective entity and sending the hash to the central blockchain with a timestamp and a nonce.
2 . The method of claim 1 , further comprising encrypting the security evaluation, validation, or certification, the encrypting allowing only authorized entities to read encrypted information.
3 . The method of claim 2 , further comprising an entity cross-certifying another entity in the secure self-validating network.
4 . The method of claim 3 , further comprising an entity in the secure self-validating network issuing a security challenge to another entity in the secure self-validating network.
5 . The method of claim 4 , further comprising an entity in the secure self-validating network revoking a public key in the central blockchain on the network.
6 . The method of claim 5 , further comprising an entity in the secure self-validating network revoking a private key in the central blockchain on the secure self-validating network.
7 . The method of claim 6 , further comprising one or more of the plurality of the entities in the secure self-validating network predefining a condition for a rollback of the central blockchain.
8 . The method of claim 7 , further comprising one or more of the plurality of the entities in the secure self-validating network predefining a condition for a rollback of a subset of transactions in the central blockchain.
9 . The method of claim 1 , wherein the security verification service includes a percentage score of each of the plurality of entities in the secure self-validating network based on a certification from other entities in the secure self-validating network.
10 . The method of claim 1 , wherein the security verification service comprises detecting operating system changes for the plurality of entities in the secure self-validating network and detecting unpatched operating system versions for the plurality of entities in the secure self-validating network.
11 . A system for creating a secure self-validating network of distributed ledger participants, the system comprising:
a memory storing at least computer-executable instructions; and
at least one processor operatively coupled to the memory, the at least one processor executing the computer-executable instructions to:
provide a security verification service communicatively coupled to a central blockchain, the security verification service comprising time-based analysis of security certifications of a plurality of entities to determine a trustworthiness of each of the plurality of entities communicatively coupled to the central blockchain, the security verification service determining a trustworthiness independent of actual participants in the central blockchain;
provide a consensus message to the plurality of entities to rollback the central blockchain to a last time a compromised party published a secure transaction to the central blockchain; and
verify a security evaluation, validation, or certification of other entities on the secure self-validating network comprising:
each entity signing a message with a private key,
each entity verifying an operating system version,
each entity verifying a software version,
each entity confirming a copy of the central blockchain, and
each entity using a hash of the central blockchain for each respective entity combined with a hash of an environment for each respective entity and sending the hash to the central blockchain with a timestamp and a nonce.
12 . The system of claim 11 , wherein the security verification service comprises detecting operating system changes for the plurality of entities in the secure self-validating network and detecting unpatched operating system versions for the plurality of entities in the secure self-validating network.
13 . The system of claim 11 , causing the at least one processor to execute the computer-executable instructions to further cause: one or more of the plurality of the entities in the secure self-validating network to define a condition for the rollback of the central blockchain.
14 . The system of claim 11 , causing the at least one processor to execute the computer-executable instructions to further: encrypt the security evaluation, validation, or certification, the encrypting allowing only authorized entities to read encrypted information, the encrypted information being encrypted and decrypted using encryption keys managed in hardware, the hardware being a Hardware Security Module (HSM).
15 . The system of claim 11 , wherein the security verification service is a revocation authority, the revocation authority removing an entity of the plurality of entities.
16 . The system of claim 11 , wherein the security verification service is an attestation service, the attestation service periodically checking integrity of an entity of the plurality of entities.
17 . The system of claim 11 , wherein the security verification service works with third party services to maintain proper controls, third party services providing Know Your Customer verification.
18 . The system of claim 11 , causing the at least one processor to execute the computer-executable instructions to further: encrypt the security evaluation, validation, or certification, the encrypting allowing only authorized entities to read encrypted information, wherein the encrypted information is encrypted and decrypted using encryption keys, the encryption keys including symmetric keys and a public key of authorized receivers.
19 . The system of claim 11 , causing the at least one processor to execute the computer-executable instructions to further: encrypt the security evaluation, validation, or certification, the encrypting allowing only authorized entities to read encrypted information, wherein the encrypted information is encrypted and decrypted using encryption keys, the encryption keys including a public key of authorized receivers allowing for publication in plain text of a security scan result.
20 . One or more non-transitory computer-readable storage media storing computer-readable instructions for creating a secure self-validating network of distributed ledger participants, that when executed by at least one processor cause the at least one processor to perform operations comprising:
providing a security verification service communicatively coupled to a central blockchain, the security verification service comprising time-based analysis of security certifications of a plurality of entities to determine a trustworthiness of each of the plurality of entities communicatively coupled to the central blockchain, the security verification service determining a trustworthiness independent of actual participants in the central blockchain;
providing a consensus message to the plurality of entities to rollback the central blockchain to a last time a compromised party published a secure transaction to the central blockchain; and
verifying a security evaluation, validation, or certification of other entities on the secure self-validating network comprising;
each entity signing a message with a private key,
each entity verifying an operating system version,
each entity verifying a software version,
each entity confirming a copy of the central blockchain, and
each entity using a hash of the central blockchain for each respective entity combined with a hash of an environment for each respective entity and sending the hash to the central blockchain with a timestamp and a nonce.