there is little doubt that modern accounting systems have benefitted , ever since the advent of commercial computing machines , from the digitization of the processing and recording of financial transactions .the automated processing of payroll information in the 1950ies was perhaps one of the earliest examples of such benefits : ibm introduced its _ 702 data processing system _ for businesses in 1953 . and the use of rfid technology or smart phones for contactless payment of small items such as coffees is a more recent example thereof .it is then striking that the mechanisms used for managing the integrity of accounts are , in essence , those developed at least a thousand years ago .what we call the modern _ double - entry bookkeeping _ was already used by florentine merchants in the 13th century , for example . without going into great detail ,the key idea is in simplified terms that each account has an associated _ dual _ account and that each credit in one account is recorded as a debit in that dual account .this allows for the formulation and verification of an important _ financial invariant _ : no matter how complex financial transactions may be , or how many transactions may occur , it must always be the case that over the totality of accounts  _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ `` assets equal liabilities plus capital . ''_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _  modern realizations of this method may enrich account entries with time stamps and other contextual data so that the flow of assets can be better understood , for example to support an audit. the above invariant may be quite simple to verify , and its verification may give us reassurance that every debit has an associated credit .but it does not prevent the recording of transactions that may be unauthorized , fraudulent , or that may be incorrect due to human error .for example , transaction records within accounting books may be manipulated to commit fraud whilst these manipulations still satisfy the above invariant .one may say that processing of transactions is governed by a form of _ legal code _ that is informed by policy on fraud prevention and detection , regulation , compliance , risk , and so forth .but the enforcement of such legal code within the _ technical code _ that operationalizes modern financial processes has been difficult at best , and too costly or impossible at worst .digitized financial processes can , of course , utilize cryptographic primitives to help with narrowing this gap between legal and technical code : digital signatures can be associated to transactions ( for example embedded within transaction objects ) , and commitment schemes can be used to realize consistent distributed storage whose consistency is resilient to adversarial manipulation ; see for example the discussion of byzantine agreement protocols in .but the advent of de - centralized , _ eventual consistency _ storage protocols , as pioneered in the cryptocurrency bitcoin , opened up a new way of thinking about the processing of financial transactions , even of creating and managing a currency as a unit of account .there is little doubt that cryptocurrencies are one of the most important innovations , along with the invention and introduction of central banks , in financial services since the advent of the double - entry bookkeeping .  in bitcoin, transactions are grouped into blocks , and blocks are recorded and linked in a chain of blocks  the blockchain .currency units are created through the solution of a cryptographic mining puzzle , a process in which network nodes ( called miners ) compete in determining the next block to be added to the chain and where the winner will become the owner of the currency created in that new block .these solutions causally link this new block to the last one , using cryptographic hash functions , creating thus the resiliency of this chain against manipulation .these acts of creating currency are treated as ( special ) transactions and their outputs are associated with their owners in a ( pseudo)anonymous manner  using public - key cryptography .the system dynamics is adjusted so that , on average , a new block is added to the blockchain about every 10 minutes .  in bitcoin , transactions are now technical code . without going into the technical details ,a transaction can be seen as a program that has a number of inputs and a number of outputs , each representing a unit of currency associated with some owner .that program also contains a _ proof _ that the program is authorized to rewire inputs to outputs in this manner .for example , this proof may be a cryptographic demonstration that the program_ owns _ all inputs .transactions enjoy an important invariant : the sum of currency units of all transaction outputs can not be larger than the sum of currency units of all its inputs  and any positive difference becomes a credit for the miner that created the block within which the transaction is found .the bitcoin network has many nodes that contain a full copy of the blockchain .more accurately , each node contains a tree of possible chains and identifies one of those chains deterministically as the _ real _ blockchain .the propagation of possible winning blocks and consensus protocols between these nodes ensure that nodes eventually agree on which of the chains they each store is the _ real _ chain .this does have its problems .for example , miners may collude to gain more control of mining competitions and so may force all network nodes to accept an alternative blockchain as the real one  allowing them to rewrite the transaction history .another problem is that nodes need to keep a record of which outputs of transactions recorded on the _ real _ blockchain have not been spent yet in new transactions on the blockchain ; and the above consensus mechanisms for _ eventual consistency _ do nt give hard guarantees , meaning that transaction outputs may be double spent and that transactions in a blockchain may only be trusted if their block has been linked with a certain number of blocks added to the chain subsequently .the incentive mechanism of bitcoin also led to the creation of puzzle - solving pools of miners and a complex and risky dynamics between such pools , the development of hardware for solving such puzzles and other factors .understanding such dynamics in predictable ways is one research challenge for cryptocurrencies .another risk resides in the verification of transactions , done by a run - time system that executes a verification script . whilst the designer(s ) of bitcoin deliberately chose a simple scripting language that makes its execution more secure , early implementations of that system still had security vulnerabilities .there is also a tradeoff here between security and expressiveness of technical code .other cryptocurrencies seek to program more complex transactions ( so called _ smart contracts _ ) to create new financial services , for example .but these require scripting languages that are turing complete and are therefore much more at risk of security attacks  see the dao hack of ethereum and the way in which this was dealt with as a good example thereof .the risks of cryptocurrencies discussed above suggest that there is value in also exploring alternative approaches , in which technical code for transactions is more centralized , governed or controlled by parties with specific interests or duties .for example , rscoin is proposed as a cryptocurrency in which central banks control monetary supply and where a number of distributed authorities prevent double - spending attacks .this addresses or mitigates risks of de - centralized , open cryptocurrencies but does support a more conventional model of currency control .there is also the question of whether a central bank would want to risk running any such system to scale up a currency nationally , given that such technical code may be subject to security vulnerabilities in configuration , implementation or lifecycle management .but such risks may be manageable .the oldest central bank , sweden s riksbank , for example , is actively considering whether or not to introduce a national cryptocurrency _ ekrona _ within the next two years .  in this paper ,we investigate how governed , closed blockchains can be designed so that they can support the resilient , distributed , and _ trustworthy _ storage of authentication of transactions within conventional financial processes .such governed systems with restricted access give us better control on balancing the use of energy for puzzle solving with the security of the proof of work algorithm when compared with open systems that rely on proof of work , such as bitcoin .specifically , we propose that transactions ( in the sense of bitcoin ) within blocks are hashes of transactions ( within conventional financial processes ) .we then define mathematical models that describe the design space of such a blockchain in terms of the cryptographic puzzle used  in this paper proof of work , in terms of expected availability , resiliency , security , and cost , and in terms that reflect that the system is centrally governed .we stress that our approach is also consistent with transactions within blockchains that encode transaction history , which we do nt consider in the use case of this paper .we believe that our approach has potential .it may , for example , allow designers to minimize the need for consensus mechanism by guaranteeing that puzzles have a unique winner within a certain period of time with very large probability whilst still maintaining sufficient system resiliency and security ; and this could inform the design of bespoke consensus protocols .  [ [ outline - of - paper . ] ] outline of paper. + + + + + + + + + + + + + + + + +  in section [ section : usecase ] we present our use case . our mathematical model for proof of work in our setting is subject of section [ section : probabilisticmodel ] .the derivation of optimization problems for these mathematical models is done in section [ section : optimization ] .an algorithm for solving such optimization problems , experimental results , and a statistical validation of our model are reported in section [ section : experiments ] , and the paper concludes in section [ section : conclusion ] .the use case we consider is one of a financial process that creates financial transactions .we would like to enhance the trustworthiness of this process through a blockchain that records hash - based authentications of transactions , as seen in figure [ fig : architecture ] , where the interaction between the legacy process and the blockchain is conceptually simple  and consistent with the use of double - entry bookkeeping if desired .our assumption is that the event streams of such transactions are not linearizable and so we can not rely on techniques such as hash chains  to obtain immutability of transactions .our data model represents a transaction as a string that can be authenticated with a hash .string may be a serialization of a transaction object that contains relevant information such as a time stamp of the transaction , a digital signature of the core transaction data and so forth .the trustworthiness of transaction is represented outside of the blockchain by the triple   where is either the block height ( ) of a block in the blockchain such that occurs in block or is null , indicating that the transaction is not yet confirmed on the blockchain .the hashes of transactions that still need to be confirmed are propagated on the blockchain network , where they are picked up by miners and integrated into blocks for proof of work .we assume a suitable mechanism by which nodes that manage legacy accounts learn the blockheights of their transactions that have been successfully added to the blockchain .for example , such nodes may have a full copy of the blockchain and so update values in its accounts if the hash of the corresponding transaction occurs in a block that was just added .a transaction is unverified if its value is null or if its hash does not equal the one stored externally as in ( [ equ : triple ] ) ; it is trustworthy if and where is a suitable constant and denotes the number of blocks added to the blockchain so far .the value of may be a function of how fast blocks are added to the chain on average , to ensure sufficient resiliency of trustworthiness .an auditor could then inspect any transaction by examining its triple stored as in ( [ equ : triple ] ) . if equals null orif , the transaction is considered neither valid nor trustworthy by the auditor . otherwise , we have and and the auditor uses the merkle tree hash in block to verify that is in the block of height . if that is the case , the auditor considers the transaction to be verified ; otherwise , the auditor considers the transaction not to be trustworthy .a system architecture that could support such a use case is shown in figure [ fig : architecture ] .unverified transactions have their hashes propagated on the network .miners pick up those hashes and integrate them into blocks for proof of work .we abstract away how miners manage their pools of hashes and how proof of work blocks are propagated and added to the blockchain ; this gives us flexibility in the use of blockchain technology .once blocks are added to the blockchain , blockheights are propagated to the legacy account .as mentioned above , these accounts could have full copies of the blockchain and thus implement their own update mechanisms for value in triples stored as in ( [ equ : triple ] ) .  ]auditors would interface with both accounts and the blockchain to verify , in a trustworthy manner , the authenticity , that is to say the _ veracity _ , of transactions .any transaction that is not verified as discussed above would be flagged up in this audit .any pre - existing audit process  which may focus on compliance , regulations and other aspects is consistent with such _ veracity checking _ ; and the trustworthiness of the pre - existing audit process would be increased as it would refuse to certify any financial transaction histories that involved a transaction that is not authenticated on the blockchain .the approach we advocate here is pretty flexible .it seems consistent with consensus mechanisms as used in bitcoin but it may also support 2-phase commitment schemes as proposed in .our system architecture allows for full nodes to be associated with accounts , sets of accounts or corporate boundaries .our blockchain does not create any currency , and so there is no inherent incentive to mine .but there is an incentive for the owners of this blockchain to allocate mining resources in a manner that establishes trustworthiness of transactions as recorded in this blockchain .we think that the elimination of incentives and their game - theoretic implications are a benefit , as are the relatively simple ways of propagating trust through hashes of transactions .such a blockchain may also be consulted by legacy systems to inform the authorization of further financial transactions .our blockchain does not spend any funds and so has no problem of _ double spending _ , and double spending in the legacy system would be detectable with existing mechanisms such as audits .our approach does allow for _ double authentication _ though : a transaction hash may occur more than once in a blockchain , be it in the same block or in different blocks .we deem this to be unproblematic as audits would only need to establish _ some _ , sufficiently old , authentication of the transaction in the blockchain to establish its trustworthiness  noting that hash - based authentication is deterministic .let us now briefly reflect on security issues for the system shown in figure [ fig : architecture ] .there are various actors within that system : miners , nodes that run full copies of the blockchain , nodes that propagate transaction hashes to miners , auditors ( which may be insiders or external agents with limited inside access ) , insiders such as accountants and system administrators , external forces that seek to infiltrate these corporate networks , and so forth . hereare possible scenarios of interest :  * internal auditors may want to corrupt the state of the blockchain in order to cover up the traces of internal fraudulent activity * external forces may want to corrupt transaction hashes propagated in the internal network as a denial of service attack on the blockchain itself * control over a set of miners or nodes that propagate transaction hashes may be obtained so that certain transaction hashes have priority for mining * classical security attacks such as those on key management may be launched .scenario s1 may be part of an insider attack in which skilled and sufficiently authorized insiders collude to commit fraud .the blockchain can not ensure that only legitimate transactions have their hash recorded within it .but a _ security policiy _ external to the blockchain  could specify that certain transactions are always recorded in the blockchain , for example , the hashes of security log entries that may be triggered by transactions within legacy accounts .scenario s2 is typical for a denial of service attack .the service that is being denied here is the blockchain , as the mechanism that creates sufficient trustworthiness into transactions as recorded within legacy system .these threats can be mitigated against , for example , legacy systems and the entire blockchain network may be placed behind a corporate firewall .scenario s3 is concerned with the management of transaction hashes that have not yet been recorded in the blockchain .the extent to which this is a security problem beyond that of service availability will depend on the use context of the legacy accounts .for example , for the attack discussed in scenario s1 it might help internal attackers to have control over which transaction hashes would enter the blockchain first , with a preference of recording the fraudulent transaction that changed the recipient of payments of the originally recorded transaction .  in scenario s4 ,a cyber attack may get control of the part of the system that provides authenticated information about the public keys of all used miners , for example , it might be able to learn a system admin key that allows for the modification of such information to change the private / public key pairs of miners to values of machines controlled by the attacker .security would certainly be improved in these and other scenarios if all actions of financial processes that modify accounts have their hashes recorded onto the blockchain , be these financial transactions , actions that create log entries , actions that give authority to perform financial transaction , and so forth . from this perspective , our blockchain could also facilitate a _audit not just one concerned with compliance and regulation .our model assumes a cryptographic hash function where such that has _ puzzle friendliness _. the _ level of difficulty _ is an integer satisfying : proof of work has to produce some where has at least many leftmost bits .we write for the time to compute a sole hash and to decide whether it has at least leftmost zeros .since the range of will be relatively small , we make a device - dependent constant .our probabilistic modeling will treat in the _ random oracle model _ ( rom ) : function is chosen uniformly at random from all functions of type ; that is to say , is a deterministic function such that any for which has not yet been queried will have the property that is governed by a truly random probability distribution over .we may assume that consists of a block header which contains some random data field  a nonce of bitlength , that this nonce is initialized , and that the nonce is then increased by each time the hash of does not obtain proof of work . in particular , this yields that where : the input to will be of form where and have and bits , respectively .our use of rom will rely on the assumption that mining , be it by a sole miner or in a mining race of more than one miner , will never revisit the same input again :  [ assumption : mininginvariant ] the mining of a block with one or more miners will use an input to at most once , be it within or across miners input spaces .this assumption and appeal to rom give us that hash values are always uniformly distributed in the output space during a mining race .we now develop the probability space for mining with a sole miner , and then adapt this to the setting of more than one miner .our basic probability space has and as implicit parameters , and assumes the enumeration of values of without loss of generality .the set of basic events of this probability space is    where denotes the event that all nonce values failed to obtain proof of work for at level of difficulty , and models the event in which the first such nonce values failed to obtain proof of work for at level but the value of did render such proof of work for .we next want to define a discrete probability distribution  ] therefore models the probability that none of the miners obtains proof of work in the first rounds . appealing again to rom and assumption [ assumption : mininginvariant ] , the behavior at round is independent of that of the first rounds . therefore , we need to multiply the above probability with the one for which at least one of the miners will obtain a proof of work in a single round .the latter probability is the complementary one of the probability that none of the miners will get a proof of work in a sole round , which is due to the rom independence .therefore , we get \ ] ]  this defines a probability distribution with a non - zero probability of .firstly ,  ] .we may rewrite the latter expression so that summations are eliminated and reduced to exponentiations : concretely , we rewrite to summations , each one starting at a value between and , where we exploit .this renders   where we use the abbreviation   the expected time needed to get a proof of work for input is then given by   we derive an analytical expression for the above probability next .note that models that the actual time taken for hash rounds is larger than .therefore , we capture as & = & { } \nonumber\\ ( 1 - 2^{-d})^{s\cdot ( \lceil ( th / t ) -1\rceil + 1 ) } - ( 1- 2^{-d})^{s\cdot ( \lambda+1 ) } & = & { } \nonumber\\ y^{\lceil ( th / t ) -1\rceil + 1 } - y^{\lambda+1 } & { } & \nonumber\end{aligned}\ ] ]  assuming that , the latter therefore becoming a constraint that we need to add to our optimization problem .one may be tempted to choose the value of based on the markov inequality , which gives us   but we should keep in mind that upper bound depends on the parameters , , and ; for example , the analytical expression for in ( [ equ : noranalytical ] ) is dependent on and so dependent on as well . the representation in ( [ equ : moretimes ] ) also maintains that expression   is in $ ] , i.e. a proper probability . since is in , this is already guaranteed if , i.e. if .but we already added that constraint to our model .similarly to how we proceded for , we get   which needs as additional constraint .  to derive an analytical expression for , each miner can perform hashes within seconds .let us set .the probability that a given miner finds pow within seconds is = 2^{-d}\cdot [ 1 - z]\ ] ]  therefore , the probability that no miner finds pow within seconds is \bigr ) ^s = \bigl ( 1 -  2^{-d}\cdot [ 1 - z]\bigr ) ^s\ ] ]  the probability that exactly one miner finds pow within seconds is \bigr ) ^{s-1 } \cdot 2^{-d}\cdot [ 1 - z]\ ] ]  thus , the probability that more than one miner finds pow within seconds is   then we can calculate to be equal to )^{s-1}\cdot \bigl [ 1 + ( s-1)\cdot 2^{-d}\cdot [ 1-z]\bigr ] \ ] ]  figure [ fig : firstoptexplicit ] shows the set of constraints from figure [ fig : firstopt ] with analytical expressions and their additional constraints , we add constraint to get consistency for the analytical representation of .)^{s-1}\cdot \bigl [ 1 + ( s-1)\cdot 2^{-d}\cdot [ 1-z]\bigr ] \nonumber \ ] ]   our model above captures design requirements or design decisions as a set of constraints , to optimize or trade off measures of interest subject to such constraints .we can extend this model to also _ manage uncertainty _ via robust optimization  . such uncertaintymay arise during the lifetime of a system through the possibility of having corrupted miners , needed flexibility in adjusting the level of difficulty , and so forth .for example , corrupted miners may refuse to mine , deny their service by returning invalid block headers , pool their mining power to get more mining influence or they may simply break down .  consider corrupted miners .we can model their _ pool power _ by appeal to rom and the fact that the mining race is roughly synchronized : the probability that these miners win many subsequent mining races is then seen to be .we can therefore bound this with a constant , or equivalently we can add to the set of constraints from figure [ fig : firstoptexplicit ] the constraint .we model uncertainty in the number of miners available by an integer constant as follows : if miners are deployed , then we assume that at least and at most many miners participate reliably in the mining of legitimate blocks .therefore , allows us to model aspects such as denial of service attacks or a combination of such attacks with classical faults : for example , subsumes the scenario in which one miner fails and two miners mine invalid blocks .furthermore , an integer constant models the uncertainty we have in the deployed level of difficulty : the intuition is that our analysis should give us results that are robust in that they hedge against the fact that any of the values satisfying may be the actually running level of difficulty .this enables us to understand a design if we are unsure about which level of difficulty will be deployed or if we want some flexibility in dynamically adjusting the value of in the running system .the corresponding robust optimization problem for cost minimization is seen in figure [ fig : robustcost ] .it adds to the constraints we already consider the requirements on constants , , and as well as the constraint .the robustness of analysis is achieved by a change of the objective function from to   the latter computes a worst - case cost for triple where and may vary independently subject to the strict uncertainties and , respectively .we call a triple _ feasible _ if it satisfies all constraints of its optimization problem .costs such as the one in ( [ equ : robustcost ] ) for a triple are only considered for optimization if all triples used in the robust cost computation in ( [ equ : robustcost ] ) are feasible realized with predicate : robust optimization guarantees that the feasibility of solutions is invariant under the specified uncertainty ( here and ) .we submitted simple instances of the optimization problem in figure [ fig : robustcost ] to state of the art minlp solvers .all these solvers reported , erroneously , in their preprocessing stage that the problem is infeasible .these solvers were not designed to deal with problems that combine such small numbers and large powers , and rely on standard floating point implementations .therefore , we wrote a bespoke solver in haskell that exploits the fact that we have only few integral variables so that we can explore their combinatorial space completely to determine feasibility .[ fig : algorithm ]   we solve the robust optimization problem for the analytical expressions we derived above with the algorithm depicted in figure [ fig : algorithm ] .this algorithm has as input the set of constraints , a parameter and a parameter .it will output at most robustly feasible tuples from a list of all robustly feasible such tuples as follows : it will identify the maximal values of for which such tuples are robustly feasible , and it will report exactly one such tuple for each value of where is minimal , and is minimal whilst also bounded above by where is the globally minimal cost .this also determines the values of in these tuples and so the algorithm terminates .now , having defined the required analytical expressions and the algorithm to report the best robustly feasible tuples in figure [ fig : algorithm ] , we also want to validate these expressions and the algorithm experimentally .our setup for this is based on pure haskell code , as functional  and in particular haskell programs offer the advantages of being modular in the dimension of functionality , being strongly typed as well as supporting an easy deconstruction of data structures , particularly lists  .furthermore , the arbitrary - precision verification is handled by the external package , which is also written in haskell .further verification and validation of the received results is pursued by unit testing using an arbitrary precision calculator .moreover , our experiments ran on a machine with the following specifications : intel(r ) xeon(r ) cpu e5 - 4650 with 64 cores and 2.70ghz and 64 gb ram on each core .  we instantiate the model in figure [ fig : robustcost ] with the constants shown in table [ table : const ] .we choose to be for a mining asic from early 2016 with an estimated cost of 2700 usd at that time , so a fixed cost of usd seems reasonable .let us now explain the value , which models the energy cost of a sole hash ( we can ignore other costs on that time scale ) .a conservative estimate for the power consumption of an asic is watts per gigahashes per second , i.e.  watts per .we estimate the cost of one kilowatt hour to be about cents .a is times and one is watts .so watts per equals watts , which amounts to .so the cost for this is cents per hour , i.e. cents per hour .but then this costs cents per second .the price for a sole hash is therefore divided by , which equals .we insist on having at least miners and cap this at miners . the _ shared _ nonce space for miners is assumed to be between and bits .the level of difficulty is constrained to be between and .we list optimal tuples that are within a factor of of the optimal cost .we make the value irrelevant by setting which makes the constraint for vacuously true .the probability for mining failure is not allowed to exceed .setting means that we do nt insist on the average mining time to be above any particular positive time .the probability that mining a block takes more than seconds is bounded by . and the probability that more than one miner finds pow within seconds is also bounded by .the algorithm reports the top optimal tuples  and reports fewer if there are no feasible tuples .the remaining constants for robustness are as given in figure [ fig : robustcost ] .let us now specify some values of of interest . as reported in ,bitcoin is believed to handle up to transactions per second , paypal at least transactions per second ( which we take as an average here ) , and visa anywhere between and transactions per second on average . by _transactions per second _ we mean that blocks are mined within a period of time consistent with this .of course , this depends on how many transactions are included in a block .for sake of concreteness and illustration , we take an average number of transactions in a bitcoin block , as reported for the beginning of april 2016 , that is transactions .  for a bitcoin style rate , but in our _ governed _ setting , this means that a block is mined in about seconds . since is the expected ( average ) time to mine a block , we can model that we have transactions per second on average by setting to be .similarly , we may compute and based on respective and transactions per second :    [ [ transactions - per - second - as - in - bitcoin - paypal - and - visa . ] ] transactions per second as in bitcoin , paypal , and visa .+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +  we show in table [ table : firstresults ] the top optimal robustly feasible tuples for the various values of in ( [ equ : taus ] ) .we see that all three transaction rates per second can be realized with miners and a -bit shared nonce space in our governed setting .the achievable level of difficulty ( within the uncertainty in and ) drops from for the bitcoin style rate to for a paypal style rate , and down to for a visa style rate .  let us see what changes if we keep all constants as above but now   this models that the probability that more than two miners find pow within seconds , as well as the probability of mining to take more than seconds , are very small .we now only report the changes to the results shown in table [ table : firstresults ] for the top rated , optimal tuple . for , the level of difficulty drops from to but there are still miners and a shared nonce space of bits .this tuple is also optimal for now , whereas the problem now becomes infeasible for .we may explore the _ feasibility boundary _ for given the values of all other constants as just discussed : the optimization problem is infeasible for but becomes feasible when equals .next , let us keep the constants as in ( [ equ : smalldeltas ] ) but where we now change to , decreasing the probability that corrupt miners can win consecutive mining races .the optimal robustly feasible tuple for is where cost is again rounded up for three decimal places .this increase of therefore requires more miners , more bit of shared nonce space , but can still realize as level of difficulty .this same tuple is also optimal for whereas the problem remains infeasible for .[ [ larger - transaction - rates - per - second . ] ] larger transaction rates per second .+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +  in our next experiment we want to vary the average number of transactions in a block from to larger values .this is sensible for our use case as transactions only record a hash , which may be bytes each .these results are seen in table [ table : secondresults ] for transactions on average in a block with the constants as in table [ table : const ] again .let us discuss the impact of changing the average number of transactions in a block from to .this has no impact when transactions per second are desired , the level of difficulty increases by from to for transactions per second , and the level of difficulty increased by from to for transactions per second .this quantifies the security benefits of packing more transactions into a block for mining throughput .  let us now see how these results change when we set and to as in ( [ equ : smalldeltas ] ) .the optimal tuples still have miners and a shared nonce space of bit .but for bitcoin style rate as well as for paypal style rate , the level of difficulty drops by from to whereas it drops by from to for a visa style rate of .note that these are the same results as for and but for this problem was infeasible .if we now change to and keep the values for and as in ( [ equ : smalldeltas ] ) , then the optimal tuples are now the same ones as for and reported above ( respectively ) .this problem was infeasible for but is feasible now for with optimal tuple as for the other two cases .[ [ feasibility - boundary - for - transaction - rates - per - second . ] ] feasibility boundary for transaction rates per second .+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +  we now repeat the last experiment by varying the average number of transaction blocks from to half a million , in increments of . for as average number of transactions ,we redo the three experiments ( original constants in as table [ table : const ] , larger as in ( [ equ : smalldeltas ] ) , and larger with as in ( [ equ : smalldeltas ] ) ) and can note only one change : for and the constants in table [ table : const ] the level of difficulty increases by from to .all other values of stay the same in these three experiments ; there is no change whatsoever for and when is between and in increments of .when we increase the average number of transactions in a block to , we similarly see only one change for for the experiment with the constants in table [ table : const ] such that the level of difficulty increases now by from to . increasing the average number of transactions in a block to does not change these results , but changing this number to also results in only one change : for the experiment with the constants in table [ table : const ] the level of difficulty increases now by from to .none of the three experiments then result in any more changes when the average number of transactions per block changes to , , , or .[ [ transactions - per - second - for-500000-transactions - on - average - in - blocks . ] ] transactions per second for transactions on average in blocks .+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +  now we explore how many transactions per second can be processed when we have where is the desired number of transactions processed per second .table [ table : thirdresults ] shows the optimal robustly feasible tuple for the experiment with constants as in table [ table : const ] as a function of , except that as in ( [ equ : smalldeltas ] ) and .this shows that for this higher average number of hashes recorded in a block , the rate of such hashes processed on the blockchain per second can span orders of magnitude without changing the optimal tuple of miners , bits of shared nonce space , and level of difficulty .    [ [ range - of - feasible - sizes - for - nonce - space . ] ] range of feasible sizes for nonce space .+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +  our tools can also compute and validate whether a robustly feasible tuple has any other values for which is robustly feasible .for example , for all the optimal tuples we computed above , we conclude that we may change to any satisfying .we will evaluate our model by comparing its random variables , represented in analytical form , with empirical counterparts generated through experiments .we make this comparison in terms of both absolute and relative error .we ran experiments consistent with assumptions [ assumption : mininginvariant]-[assumption : synchronous ] to generate data for testing the random variables used in our model .specifically , for a triple we generated mining races with hash function _double sha-256 _ and recorded their outcome : either a failure of all miners to proof work for level of difficulty or an integer saying that mining took many rounds for proof of work with level of difficulty .the triples we studied where in   the data we thus generated amount to three million and two - hundred thousand mining races .suppose , for a given , that of these outcomes where integers .then the _ empirical failure probability _ for triple equals . for the evaluation of , we compute the arithmetic average of all values for a triple and compare this with the exact value of by computing the _ absolute _ error in ( [ equ : absnor ] ) and the _ relative _ error in ( [ equ : relnor ] )   we analyze the absolute error first : for each threshold value from , let be the set of all outcomes for all triples whose empirical or analytical failure probability ( i.e.  or ) is strictly less than .then for the set   function , seen in figure [ fig : absnor ] , renders a discrete graph of the maximal absolute error from set ; whereas function , named in the same figure , denotes the arithmetic average of the elements in . for the worst - case absolute errors , we see that they remain well below rounds , namely at about rounds for failure probabilities . in that range of failure probabilities ,the average absolute error is about rounds which is a very small difference . to illustrate , for the time to compute a sole hash used above, this would mean that the average absolute error for failure probability amounts to a time difference of about seconds .we did the same analysis for the relative error in ( [ equ : relnor ] ) .for example , the relative maximal error is then about and the arithmetic average of relative errors is about .   and where is arithmetic average of in ( [ equ : wx ] ) [ fig : absnor ] ]  in summary, we could show that the random variable accounts really well for our experimental data , and does so for failure probabilities that even extend into significant ranges such as a failure probability .but it also highlights that modelers need to be mindful of choosing values for in figure [ fig : firstopt ] that wo nt invalidate the predictive value of random variables such as .clearly , for values of considered above , for example  , this is a non - issue .  for the evaluation of ,the absolute error is   where is as above the number of successful mining races of overall such races for triple that defines .the worst - case , maximal , value of all absolute errors in ( [ equ : fae ] ) ranging over all combinations of is about .the average of the absolute errors in ( [ equ : fae ] ) for all these combinations is about .this shows that our model of failure probabilities is very precise , both in a worst - case and in a statistical average sense when compared to our experimental data .  for the evaluation of ,let the experiment for triple have been run on a machine which takes time ( in seconds ) to compute a sole hash .we use as a rough approximation of how long it takes to mine a block .then we set as a reasonable test value of , an increase of twenty percent .let be the number of times that a reported outcome for triple   which defines   satisfies .then we want to compute exactly as above , and compute the absolute error   as the difference between the formal and the empirical probability .however , we only consider data for tuples for which the constraint is met ; otherwise , our computation of would result in negative and therefore unsound absolute errors .this is a valid evaluation approach since triples that violate would never contribute to optimizations in our models .the worst - case , maximal , absolute error ranging over all triples that satisfy is about .the arithmetic average of all these absolute errors is about   which suggests a very good fit of our model with these experimental data .  for the evaluation of , we now set as a reasonable test value of , a _ decrease _ of twenty percent .let be the number of times that values in our data for   defining   satisfies .we compute as above , and report the worst - case absolute error   over all triples for which the empirical or analytical failure probability is strictly less than .the results , depicted in figure [ fig : th1abs ] , show that for failure probabilities below the _ worst - case _ absolute errors are about and so very small .the worst - case absolute errors for larger failure probabilities are about .the arithmetic average of all these absolute errors is more variable in : it ranges from for to ( which is also the maximal arithmetic average over all considered ) for equal to ; and these are very small values .results for the corresponding relative error are of the same quality and so omitted .  ) for all triples with failure probability . graph _average _ shows the same result for arithmetic average of these absolute errors [ fig : th1abs ] ]  these findings above are evidence of the validity of our random variables and their use in our modelling approach .but they also highlight that failure probabilities of mining larger than 30% may require caution in using our approach .we emphasize that these experiments indirectly depended on security properties of the underlying hash function .the results for the statistical evaluation of will be included in a future version of this paper .in this paper we considered blockchains as a well known mechanism for the creation of trustworthiness in transactions , as pioneered in the bitcoin system .we studied how blockchains , and the choice and operation of cryptographic puzzles that drive the creation of new blocks , could be controlled and owned by one or more organizations .our proposal for such governed and more central control is that puzzle solvers are mere resources procured by those who control or own the blockchain , and that the solution of puzzles does not provide any monetary or other reward . in particular, a newly solved block will not create units of some cryptocurrency and there is therefore no inherent incentive in solving puzzles .the absence of incentives thus avoids the well known problems with game - theoretic behavior , for example that seen within and across mining pools in proof of work systems such as bitcoin .furthermore , it lends itself well to the development of proprietary or private blockchains that are _ domain - specific _ and whose specific purpose may determine who can access it and in what ways .we illustrated this idea with a use case in which financial transactions recorded within conventional accounts would be recorded as hashes within a governed blockchain and where it would be impractical to use hash chains , due to non - linearizability of transaction flows .a blockchain design should of course have specifications of its desired behavior , including but not limited to the expected time for creating a new block , resiliency against corruption of some of the puzzle solvers , service level guarantees such as a negligible probability that the time needed for creating a new block exceeds a critical threshold or a negligible probability that more than one solver does solve a puzzle within a specified period of time .we developed mathematical foundations for specifying and validating a crucial part of a governed blockchain system , the solving of cryptographic puzzles  where we focussed on proof of work . in our approach ,owners of a blockchain system can specify allowed ranges for the size of the shared nonce space , the desired level of difficulty , and the number of miners used ; and they can add mathematical constraints that specify requirements on availability , security , resiliency , and cost containment .this gives rise to minlp optimization problems that we were able to express in analytical form , by appeal to the rom model of cryptographic hash functions used for cryptographic puzzles .we then wrote an algorithm that can solve such minlp problems for sizes of practical relevance .we illustrated this on some instances of that minlp problem .this demonstrated that we have the capability of computing optimal design decisions for a governed proof of work system , where resiliency is modeled through robust optimization . this _ mining calculus _ also supports change management .for example , if we wanted to increase mining capacity and/or mining resiliency , our mathematical model could be used to determine how many new miners are needed to realize this  be it for the same or better hardware specifications . for another example, our tool could be used to determine optimal numbers of used miners or parameters by reacting to new energy prices .our approach and mathematical model are consistent with the consideration of several organizations controlling and procuring heterogeneous system resources , with each such organization having its bespoke blockchain , and with the provision of puzzle solving as an outsourced service .we leave the refinement of our mathematical models to such settings as future work .it will also be of interest to develop mathematical techniques for the real - time analysis of such blockchains , for example , to assess statistically whether the observed history of cryptographic puzzle solutions is consistent with the design specifications .we hope that the work reported in this paper will provoke more thinking about the design , implementation , and validation of blockchains that are centrally  or in a federated manner  owned and controlled and that may fulfill domain - specific needs for the creation of trustworthiness .we believe that many domains have such needs that the approach advocated in this paper might well be able to meet : existing financial processes and payment workflows ( which conventional cryptocurrencies are more likely to replace than to adequately support ) , trustworthiness of information in internet of things systems ( where the difficulty of the puzzle , for example , may have to be contained ) , but also systems that have governed blockchains at the heart of their initial design ( for example , a payment system in which the temporal and causal history of payments , logs , and audits is recorded on the blockchain ) .* acknowledgements : * this work was supported by the uk engineering and physical sciences research council with a doctoral training fees award for the first author and with projects [ grant numbers ep / n020030/1 and ep / n023242/1 ] .we expressly thank ruth misener for having run some of our models on state - of - the - art global minlp solvers the tools antigone , baron , and scip   to conclude that these solvers judge the models to be infeasible , although they are feasible .

Abstract: we propose the formal study of governed blockchains that are owned and controlled by organizations and that neither create cryptocurrencies nor provide any incentives to solvers of cryptographic puzzles . we view such approaches as frameworks in which system parts , such as the cryptographic puzzle , may be instantiated with different technology . owners of such a blockchain procure puzzle solvers as resources they control , and use a mathematical model to compute optimal parameters for the cryptographic puzzle mechanism or other parts of the blockchain . we illustrate this approach with a use case in which blockchains record hashes of financial process transactions to increase their trustworthiness and that of their audits . for proof of work as cryptographic puzzle , we develop a detailed mathematical model to derive minlp optimization problems for computing optimal proof of work configuration parameters that trade off potentially conflicting aspects such as availability , resiliency , security , and cost in this governed setting . we demonstrate the utility of such a _ mining calculus _ by solving some instances of this problem . this experimental validation is strengthened by statistical experiments that confirm the validity of random variables used in formulating our mathematical model . we hope that our work may facilitate the creation of _ domain - specific _ blockchains for a wide range of applications such as trustworthy information in internet of things systems and bespoke improvements of legacy financial services .  * optimizing governed blockchains + for financial process authentications * +


how many data points can be missed off ( set to zero ) from a 1-d discrete , regularly spaced time series record and still be recoverable ?such a question is prompted by many situations , often associated to the automated collection of data .we are motivated to address this question by our experimental field work to record the behaviour of the strength of optical turbulence parameter , , over time intervals of several weeks , under different climate conditions .the data of interest to us are path integrated measures of measured across the visible to near infrared region .the measurement path is a 600 m stretch of free space , approximately 1.5 m altitude above sea water in the caribbean .the probe beam originated from an led centered on 0.9 m ; the instrumentation are two identical optical scientific inc .loa-004 systems , which employ aperture averaging to estimate the value of .the loa-004s are generally left unattended over the course of up to a few days during field operation , which mean that they are susceptible to spurious events which result in gaps in the data record .although for some types of data analysis techniques , data gaps of a limited size can be tolerated , this is not universal .moreover , there exists a new class of very powerful techniques based on empirical mode decomposition that are exceedingly sensitive to lossy datasets .it is for this reason we are exploring different methodologies to synthetically fill the data holes ; we describe the results from our studies using principal component analysis in this paper .the principal components of any ensemble can be used to identify the members of that ensemble .this idea forms the foundation of face recognition and tracking through _ eigenfaces _ ( see , for example , turk and pentland 1991 ) . we may extend this method to reconstruct the missing data for any data record under given restrictions .the key point is that the gappy data record must have the same , or similar , salient features as all the members of the ensemble .the principal components are the eigenvectors of the covariance matrix of the data and represent the features of the dataset . provided that a reference library can be created, each member of the library will contribute to each eigenvector , more or less .as such , each member can be exactly represented by a linear combination of eigenvectors .any similar data record external to the library will also be represented by a linear combination of eigenvectors , within a margin of error .the first step for the filling procedure must therefore be to define the reference library .we may do so by collecting a family of turbulence data series that share certain specific characteristics ; a difficult task since the definition of such is an open question .moreover , since the mean value of the family of reference data plays a key part , all the members of the library would require normalisation . again how to do this is an open question .alternatively we may use the neighbouring record around a data hole , sectioning this information to provide the ensemble members .we opt for the latter technique since the record pre and post the data hole ( within a certain time interval ) ought to be similar in nature to the missing data .the mean value of this type of library would probably not differ greatly from the mean of the missing data , so normalisation would not be so crucial .how does one determine the principal components of a reference library ?following sirovich and kirby , let the members ( each of length ) of the reference ensemble be .thus , the average data record of this ensemble will be it is very reasonable to assume that departures from the mean record will provide an efficient procedure for extracting the primary features of the data .therefore , we define now , if we consider the dyadic matrix where each term of the sum signifies a second rank tensor product , we can recognize this as the ensemble average of the two point correlation of the deviations from the mean . here , is the transpose of .we require eigenvectors of the matrix . for ensembleswhose members have a large number of points , matrix issingular and its order can not exceed .to find those eigenvectors of corresponding to nonzero eigen values , turk and pentland used a standard singular value decomposition technique , as described below . where are the eigenvalues .this deduction can be equated to where .thus and have the same eigenvalues and their eigenvectors are related through , provided that .the treatment described is recognizable as the karhunen love ( kl ) method .the implication is that a dataset can be obtained from a limited summation where the coefficients are obtained through the inner product we emphasise that is not considered to be part of the , although it is similar in features .to demonstrate the validity of the assertion of the previous section , we take a perfect data record of measurements over a 7 hour period starting from midnight , smoothed by a forward moving rolling average of 5 minutes interval ( 60 data points ) .the data contain 2492 points in total .the test data , split into 21 sections .the data are padded before division with a set of points taken from the tail of the time series and mirrored outward . ]we split up the test data into 21 sections , where all but 1 are members of the reference library , as shown in fig .[ fig : cn2data ] .the exclusive section is set to zero , and the algorithm described in sec . [sect : pca ] is employed on the 20 library elements .the reconstructions are created from the kl coeffiecients of the eigenvectors equivalent to the sections adjacent to the missing data .hence we will talk of a prior and posterior reconstruction meaning e.g. for omitted section 5 , we use for the prior the kl coefficient equivalent to section 4 and for the posterior reconstruction we use the coefficient equivalent to section 6 of the test data set .note that this does not reconstruct those sections , since the eigenvectors are generated from the entire reference library .the reconstructions shown in the left hand set of fig .[ fig : klresult ] represent the best level of error , while the right hand set shows the worst .it is clear that the greater the difference between the ( masked off ) original data section and its neighbours , the poorer the reconstruction will be .nevertheless , the reconstruction errors for the full set of test data are all 1 order of magnitude less than the mean value of the reconstruction and the original data segment .evidently the end points have not been synthesised to be continuous with the adjacent segments of the reference library signal , as can be seen from the error .a continuity condition in terms of the both the function and its derivative has to be imposed on both ends of the reconstructed segment in order to achieve smoothness .the most effective way to do so is currently being investigated .\(a )  best and worst reconstruction result using pca for ( a ) section 5 and ( b ) section 13 respectively .the layout in each set is : ( top left ) segment prior to the selection .( top middle ) the original selected data .( top right ) segment after selection .( centre left ) the difference between the reconstruction using the coefficient of eigenvector related to the prior segment and the original .the value shown is the mean absolute difference per pixel .( centre right ) the ( prior ) reconstruction .( bottom left ) the difference between the reconstruction using the coefficient related to the posterior segment and the original .( bottom middle ) the ( posterior ) reconstruction .( bottom right ) the eigenvalue spectrum.,title="fig : " ] + ( b )  best and worst reconstruction result using pca for ( a ) section 5 and ( b ) section 13 respectively .the layout in each set is : ( top left ) segment prior to the selection .( top middle ) the original selected data .( top right ) segment after selection .( centre left ) the difference between the reconstruction using the coefficient of eigenvector related to the prior segment and the original .the value shown is the mean absolute difference per pixel .( centre right ) the ( prior ) reconstruction .( bottom left ) the difference between the reconstruction using the coefficient related to the posterior segment and the original .( bottom middle ) the ( posterior ) reconstruction .( bottom right ) the eigenvalue spectrum.,title="fig : " ]  the eigenvalues determined through this method show a similar distribution in both cases , with minor variations only at the upper end of the spectrum , implying that the kl differences between best and worst section for reconstruction is not very large .   in the absence of a workable continuity condition, we present here the effects of crudely patching the data hole with reconstructions determined from the prior and posterior terms with respect to the gap .we apply the empirical mode decomposition ( emd ) algorithm to the reconstructions .emd is a novel adaptive method for separating a nonlinear time series into components based on instantaneous frequency .basically it acts as a dyadic filter bank ; the set for the best reconstruction case are illustrated in figs .[ fig : emd ] .we refer to these sets as and .the original data s intrinsic mode functions ( imfs ) and residuals ( set ) are also shown and for comparison , we present the effect of a simple minded linear interpolation between the endpoints of the known data on the imfs .  upon visual inspection , we see that the original data generates 9 components : 8 intrinsic modes and 1 residual ( the stopping criterion for our emd implementation is the same as in huang _et al _ ) .on the other hand , the interpolated data have only 8 components . numbering the imfs from highest instantaneous frequency to lowest ,starting from imf 1 , we can see by inspection that both and are strongly similar to in imfs 4,5,6 and 7 .the differences appear in the higher frequency components , due to the discontinuity between the inserted segment and the unadulterated data .the endpoint discontinuities evidently modify the variances of imfs 1,2 and 3 , although it seems that they are only affected in the area local to the discontinuity , per imf .  by way of comparison ,a linear interpolant between the edges of the known data show that there is contamination all through the imfs .it is so strong that imf 7 , which in the other sets clearly distinguishes the baseline rise and fall of the turbulence over the interval under study , is unable to pick out a clean pedestal .  [cols="^,^ " , ]   we applied an arima(0,,0 ) model to predict the behaviour of the final section of the split test data .the length of each section is 119 points long ; by basing the data behaviour on the previous 2373 points and by setting the difference operator to be we generated the imf results shown in fig .[ fig : emdarima ] .  as can be seen, the effect of the arima( ) extrapolation is to fill in the higher order imfs in a smooth fashion ( apparently , by visual inspection , imfs 5 to 8 are smoothly filled at the tail ) .it is only untrustworthy when considering the higher frequency components , because arima considers only the conditional first moment .note that the number of imfs and residual are the same as the unadulterated signal .we have discussed a data hole filling method for stochastic data , a necessary step to be able to use the new technique of empirical mode decomposition upon a time series record .the karhunen love eigenvectors from an ensemble of neighbouring sections of complete data around a data hole can be used to reconstruct the missing segment to a reasonable degree of accuracy , at least for the purposes of applying emd .we have shown that the edge continuity is important , although the effect of discontinuities is not universal through all the intrinsic modes of the data .the quality of the reconstruction is much better using pca than a simplistic linear interpolant ( or merely ignoring the data gap ) .we compared this to a simplified arima(0,,0 ) model , which performed better than the linear interpolant but less effectively than the kl algorithm , disregarding edge effects .  in summary ,when a data hole is present , merely ignoring the data hole or filling it with a linear interpolant is a poor technique from the point of view of emd .the result of doing so leads to leakage of spurious effects both laterally in time ( per imf ) and longitudinally across all the imfs . by reconstructing the datagap with arima( )one can limit the leakage laterally and longitudinally , although the lowest imfs remain strongly contaminated with artificial structure .kl reconstruction limits the leakage best , and even without considering the continuity between the adjacent sections and the reconstructed datagap , it promises to provide the best reconstruction of the three methods described in this paper .f. santiago , m. p. j. l. chang , c. o. font , e. a. roura , c. wilcox , and s. r. restaino , `` low altitude horizontal scintillation measurements of atmospheric turbulence over the sea : experimental results , '' _ proc .spie _ * 6014 * , 2005 .c. o. font , m. p. j. l. chang , e. oh , and g. c. gilbreath , `` humidity contribution to the refractive index structure function , '' in _ atmospheric propagation iii _ , c. y. young and g. c. gilbreath , eds .spie _ * 6215 * , 2006 .m. p. j. l. chang , c. o. font , g. c. gilbreath , and e. oh , `` humidity s influence on visible region refractive index structure parameter , '' _ applied optics ( accepted ) , arxiv physics e - prints _ * physics/0606075 * , june 2006 .n. e. huang , z. shen , s. r. long , m. c. wu , h. h. shih , q. zheng , n .- c .yen , c. c. tung , and h. h. liu , `` the empirical mode decomposition and the hilbert spectrum for nonlinear and non - stationary time series analysis , '' _ proc .ser . a _ * 454 * , pp .903995 , 1998 .h. e. stanley , l. a. n. amaral , a. l. goldberger , s. havlin , p. c. ivanov , and c .- k .peng , `` statistical physics and physiology : monofractal and multifractal approaches , '' _ physica a _ * 270 * , pp . 309324 , 1999 .m. p. j. l. chang , e. a. roura , c. o. font , e. oh , and c. gilbreath , `` applying the hilbert - huang decomposition to horizontal light propagation data , '' in _ advances in stellar interferometry , _ these proceedings _ _ , _ proc .spie _ * 6268 * , 2006 .

Abstract: measurements of optical turbulence time series data using unattended instruments over long time intervals inevitably lead to data drop - outs or degraded signals . we present a comparison of methods using both principal component analysis , which is also known as the karhunen  love decomposition , and arima that seek to correct for these event - induced and mechanically - induced signal drop - outs and degradations . we report on the quality of the correction by examining the intrinsic mode functions generated by empirical mode decomposition . the data studied are optical turbulence parameter time series from a commercial long path length optical anemometer / scintillometer , measured over several hundred metres in outdoor environments .