This invention relates generally to blockchain transactions, and more particularly to methods and devices for structuring and executing transactions in which outputs and inputs are delinked in a manner that still ensures security and full completion of the set of transactions. In particular, the present application provides methods and systems for a plurality of input nodes to collaboratively distribute tokens to a plurality of output nodes in a secure and deterministic manner that prevents token loss and theft, whilst preserving a trustless network structure.

In this document we use the term ‘blockchain’ to include all forms of electronic, computer-based, distributed ledgers. These include, but are not limited to blockchain and transaction-chain technologies, permissioned and un-permissioned ledgers, shared ledgers and variations thereof. The most widely known application of blockchain technology is the Bitcoin ledger, although other blockchain implementations have been proposed and developed. While Bitcoin may be referred to herein for the purpose of convenience and illustration, it should be noted that the invention is not limited to use with the Bitcoin blockchain and alternative blockchain implementations and protocols fall within the scope of the present invention.

A blockchain is a consensus-based, electronic ledger which is implemented as a computer-based decentralised, distributed system made up of blocks which in turn are made up of transactions. Each transaction is a data structure that encodes the transfer of control of a digital asset between participants in the blockchain system, and includes at least one input and at least one output. Each block contains a hash of the previous block to that blocks become chained together to create a permanent, unalterable record of all transactions which have been written to the blockchain since its inception. Transactions contain small programs known as scripts embedded into their inputs and outputs, which specify how and by whom the outputs of the transactions can be accessed. On the Bitcoin platform, these scripts are written using a stack-based scripting language.

In order for a transaction to be written to the blockchain, it must be “validated”. Network nodes (miners) perform work to ensure that each transaction is valid, with invalid transactions rejected from the network. Software clients installed on the nodes perform this validation work on an unspent transaction (UTXO) by executing its locking and unlocking scripts. If execution of the locking and unlocking scripts evaluate to TRUE, the transaction is valid and the transaction is written to the blockchain. Thus, in order for a transaction to be written to the blockchain, it must be i) validated by the first node that receives the transaction—if the transaction is validated, the node relays it to the other nodes in the network; and ii) added to anew block built by a miner; and iii) mined, i.e. added to the public ledger of past transactions.

Transactions involves the transfer of one or more tokens from one node to another node. Tokens may represent future control of network resources. In some cases, the tokens may represent an asset or value, but not necessarily. For example, in some cases, the tokens may be understood as a cryptocurrency. However, the present application is not limited to implementations in the context of cryptocurrency and is more broadly understood as relating to blockchain networks for distributed transfer of control tokens.

One of the perceived advantages of blockchain technology, such as Bitcoin, is the anonymity of transactions. Personal details of a Bitcoin user are not formally and explicitly attached to Bitcoin addresses, and the Bitcoin ledger of the blockchain only contains public address information. However, using secondary data (e.g. a shipping address required to complete a transaction) and analytics, interested third parties may be able to combine publicly available information to associate the identities of users to specific Bitcoin addresses.

In order to facilitate greater levels of anonymity in the Bitcoin protocol, a mixing solution may be implemented. In centralized mixing, a set of participants, where at least one participant seeks to move blockchain tokens from one address to another, transfer their tokens to a central pool that is governed by a mixing service provider. The service provider then distributes the tokens from the central pool to appropriate output addresses. A mixing protocol relies on the trustworthiness of the service provider, which has knowledge of the input-output relationships of other participants. This centralized structure can be problematic as (1) a dishonest mixing service may try to steal users' tokens, and (2) a mixing service may be pressured by regulatory bodies or other interested parties to release the mapping of input and output addresses. More generally, mixing is a specific type of distribution protocol by which a plurality of input nodes distribute control over a number of tokens among a plurality of output nodes.

Many token distribution services and potential protocols may suffer from either poor delinking or compromised security. For a distribution protocol to be effective in the context of a distributed blockchain network, it must be designed and operated so as to try to minimize reliance on centralized authority yet ensure completion by all participating nodes to avoid malicious or unbalanced outcomes in token distribution. Thus, it is desirable to provide improved methods and devices for facilitating token distribution, while avoiding token loss or theft and while ensuring the process is implemented so as to be “trustless”. Implementing such a process in a distributed blockchain network without using centralized authorities presents a significant technical challenge. In a multi-round token distribution process, it is particularly challenging to ensure the prescribed token distribution is realized and to guard against intentional or accidental misallocation of tokens, for example due to an offline participant node during one or more rounds of the process.

Such an improved solution has now been devised.

Thus, in accordance with the present invention there are provided methods and devices as defined in the appended claims.

The invention may provide a computer-implemented method and corresponding system. The method/system may be described as a blockchain-implemented method/system. The invention may be described as a security method or cryptographic method/system. It may provide for the secure transfer of a digital asset such as a portion or quantity of cryptocurrency. Additionally or alternatively, it may provide a control mechanism for controlling the transfer of a digital asset such as a portion or quantity of cryptocurrency.

The present application describes a computer-implemented method to participate in a token transfer process for transferring a first quantity of tokens from a sender node to a recipient node using a blockchain, the token transfer process including a plurality of participating nodes and execution of a set of indirect token transactions between multiple pairs of the participating nodes, the sender node and the recipient node being included in the token transfer process as participating nodes. The method, implemented at a participating node, includes: obtaining a subset of the set of indirect token transactions, the subset including those transactions for which the participating node is either an input node or an output node, wherein the set of indirect token transactions is generated based on the first quantity of tokens and a predefined number of transaction rounds in the token transfer process; for each indirect token transaction in the subset, collaborating with a respective second participating node included in the indirect token transaction to generate a commitment channel for the indirect token transaction between the participating node and the second participating node; and collaborating with all other participating nodes in executing the indirect token transactions of the subset using the generated commitment channels.

In some implementations, generating the commitment channel for the indirect token transaction includes: collaborating with the second participating node to: generate a first blockchain transaction (Tc) for committing an indirect quantity of tokens to transfer to an output address of the indirect token transaction; generate a second blockchain transaction (Tr,0) that returns the committed indirect quantity of tokens to an input address of the indirect token transaction; and generate a third blockchain transaction (Ti) for executing transfer of the committed indirect quantity of tokens to the output address of the indirect token transaction.

In some implementations, the first blockchain transaction (Tc) is submitted to the blockchain after the second blockchain transaction (Tr,0) is signed by an output node of the indirect token transaction.

In some implementations, the second blockchain transaction (Tc) includes a transaction parameter (nLockTime) specifying a point in time after which the second blockchain transaction becomes eligible for submission to the blockchain.

In some implementations, the method may further involve obtaining a key share (ki) of a first private key (k), the first private key being unknown to all of the participating nodes and collaborating in deriving a first public key (Q) corresponding to the first private key (k) using secret share joining.

In some implementations, the third blockchain transaction (Ti) includes an unlocking script containing a secret value (sv) that is based on the first private key (k).

In some implementations, collaborating with all other participating nodes in executing the indirect token transactions of the subset includes collaborating with all other participating nodes in deriving the first private key (k) using the key share.

In some implementations, the secret value is the sum of the first private key (k) and a random number provided by an output node of the indirect token transaction.

In some implementations, the method may further involve verifying the validity of the key share (ki) and its compatibility with the first public key (Q) using a publicly verifiable secret sharing scheme (PVSS).

In some implementations, collaborating in deriving the first public key (Q) includes calculating a term of a first Lagrange polynomial interpolation that includes the key share, and summing the term with terms of the first Lagrange polynomial provided by all other participating nodes.

In some implementations, the set of indirect token transactions is further based on a predefined number of transactions per transaction round.

In some implementations, the participating nodes include a plurality of sender-recipient pairs and wherein the set of indirect token transactions is generated based on respective quantities of tokens associated with the plurality of sender-recipient pairs.

In some implementations, for each indirect token transaction of the set, an indirect quantity of tokens for the indirect token transaction is less than a threshold value that is dependent on committed quantity of tokens made available by the transferor.

The present application further describes computing devices for performing the described methods, where the computing devices include at least one processor, memory, a network interface, and a blockchain application containing processor-executable instructions that, when executed, cause the processor to carry out the described operations of one or more of the methods described herein.

The present application further describes non-transitory processor-readable medium storing processor-executable instructions to participate in a token transfer process among a plurality of participating nodes, wherein the processor-executable instructions, when executed by a processor in one of the participating nodes, cause the processor to carry out the operations of one or more of the methods described herein.

The present application further describes a computer-implemented method to initiate a token transfer process for transferring respective first quantities of tokens between a plurality of pairs of sender nodes and respective recipient nodes using a blockchain. The method includes: determining a number of transaction rounds in the token transfer process; generating a set (T) of indirect token transactions based on the respective first quantities of tokens and the number of transaction rounds, wherein execution of all of the indirect token transactions in the set results in net transfer of the respective quantities of tokens from the sender nodes to their respective recipient nodes and wherein the set of indirect token transactions includes randomized pairings of the sender nodes and recipient nodes in which each may be an input node or an output node for a particular indirect token transaction; and for each of the sender and recipient nodes, transmitting a subset of the set of indirect token transactions to that node, the subset including those transactions for which that node is either the input node or the output node.

In some implementations, the set of indirect token transactions includes a first group of randomly generated transactions, each transaction in the first group specifying a respective indirect token quantity for transfer between a randomly selected pair of participating nodes.

In some implementations, the indirect token quantity is randomly selected.

In some implementations, the indirect token quantity is determined from a probability distribution.

In some implementations, the indirect token quantity is less than or equal to a threshold amount.

In some implementations, the set of indirect token transactions further includes a second group of transactions for reconciling net token transfer resulting from the first group of transactions with the net transfer of the first quantities of tokens between the sender node and the recipient node.

In some implementations, transmitting the subset to the participating node comprises sending an encrypted message containing the subset to the participating node, the message being encrypted using a public key associated with the participating node.

In some implementations, the set of indirect token transactions is generated based on a number of transactions per round (q).

The present application further describes computing devices to initiate a token transfer process that includes a plurality of participating nodes, where the computing devices include memory, a network interface to provide network connectivity, and a processor configured to carry out the methods described herein.

The present application further describes non-transitory processor-readable medium storing processor-executable instructions to initiate a token transfer process among a plurality of participating nodes, wherein the processor-executable instructions, when executed by a processor, cause the processor to carry out the operations of one or more of the methods described herein.

