Hyperledger Foundation Hyperledger Global Forum 2020, 9 Mar 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Demo: Fabric Private Chaincode - Bruno Vavala, Intel & Marcus Brandenburger, IBM Corp.

Description

Demo: Fabric Private Chaincode - Bruno Vavala, Intel & Marcus Brandenburger, IBM Corp.

IBM and Intel demonstrate the privacy-enhanced capabilities that the Fabric Private Chaincode (FPC) project brings to Hyperledger Fabric, a popular blockchain framework for the enterprise. Such capabilities allow Fabric chaincode to maintain and work on encrypted data, thereby hiding any sensitive information from Fabric Peers and hosting organizations. This enables privacy-sensitive applications such as sealed auctions and analytics over medical data. The demo aims at familiarizing and engaging the audience with FPC as follows.

First, it argues that the Fabric framework can be seamlessly augmented with a privacy-enhancement feature through a sound and low-cost mechanism. In particular, it briefly overviews the functional and the security aspects of FPC chaincodes. The former describes how FPC chaincodes are executed on Fabric and how clients can interact with them. This will appear straightforward to Fabric users, since FPC does not modify Fabric’s programming model. The latter guides the audience through sensitive-information flows between clients and chaincodes (in the trusted execution environment), and between chaincodes and the ledger.

Second, the demo introduces a concrete system which implements FPC based on Intel SGX. It briefly overviews the FPC code base released in Hyperledger Labs, explaining how developers can integrate it with Fabric. Also, it demonstrates how the system can be used in simulation-mode on non-SGX-capable platform.

This allows a larger audience to immediately experiment with the code, while work is in progress to support additional platforms.

Third, the demo focuses on an application solving a real-world problem, which could not have been easily addressed by Fabric.

----
Hyperledger – Open Source Blockchain Technologies

Hyperledger is an open source community focused on developing a suite of stable frameworks, tools and libraries for enterprise-grade blockchain deployments.
It serves as a neutral home for various distributed ledger frameworks including Hyperledger Besu, Fabric, Sawtooth, Indy, as well as tools like Hyperledger Avalon, Cactus and libraries like Hyperledger Aries, Ursa. Learn more about Hyperledger projects: https://www.hyperledger.org/use

Case Studies: https://www.hyperledger.org/learn/case-studies
Training & Certification: https://www.hyperledger.org/learn/training
Tutorials: https://www.hyperledger.org/use/tutorials
Webinars: https://www.hyperledger.org/learn/webinars
Events: https://www.hyperledger.org/events
Vendor Directory: https://www.hyperledger.org/use/vendor-directory

Subscribe to the Hyperledger Newsletter: https://www.hyperledger.org/newsletter

Follow-us on Twitter @Hyperledger

Learn about Hyperledger Membership: https://www.hyperledger.org/about/join

#Hyperledger #HyperledgerGlobalForum2020 #Blockchain

A

Alright, should we start awesome, so someone in the room who has not seen the other talk five minutes ago. Okay, so now you already have an idea. What fabric private chain cut is that's great? Okay. Let's now talk about the name of fabric, private, seek chain cut and seed, an action.

A

So, as you already learned, so what what does fabric Ravishankar private private chain code basically takes fabric and extends it with the capabilities? What which we get from trusted execution environments, in particular, when we run our chain cut now in the trusted execution environment we get the confidentiality of it. We get and verifiability aspect of it, and we can also verify that everything was executed inside such a GG. Using this attestation. We just discussed before.

A

Let's talk about a use case where we believe fabric private chain could make sense, and one of those use cases is a sealed bid. Auction and this kind of fortune is often used for when 5g mobile licences, for instance, are sell to us all to telecom providers.

A

You can think about that in this kind of auction, I mean make already told you that this involves really billions of dollars so and in particular, when we think about so. Why would we run such a system on a blockchain? It's it's really obvious. So we really and just use case. We really like the transparency aspect of a blockchain, so that means we can send our transactions to the network, and then we elevate evaluate the auction. Everyone can see.

A

Okay, my bid has really considered in the evaluation, but the confident really as confidentiality aspect, that our bits should remain secret. Until we do that evaluation, we can get this from fabric private chain cut. So in our demo we are talking about such a use case where a government or a government organization wants to serve spectrum licenses for mobile communication. So we can imagine that we have an deployment where we have fabric network with a bunch of telecom providers, a telecom v-net and see mobile and the auctioneer, which can be the government so how's.

A

This then implemented.

A

So we implement the logic of our auction as a chain code and run it inside a te so and the auction logic basically gives us all the the towards the auctioneer needs to run such such a complex auction. So those auctions are normally conducted into multiple rounds, so the auctioneer still has to do things like start around close around and in the end it has to trigger that the auction is evaluated, but, on the other hand, the the participants of the auction, so a telecom v-net in Samoa.

A

They prepare their bits in a way that it can only be decrypted and processed by the Chang code. Inside of the enclaves and.

A

This looks like that, so people on the participants they submit their transactions to the chain code. It's executed all the transactions, all the bits they appear on the blockchain encrypted in a way that only the chain code itself can decrypt it and then, in the end, once the auctioneer has triggered the evaluation, the research is published in clear okay.

A

So let's have a look at the auction in action. Bruno.

B

All right so to see the action in action. Let's first put here our tab of the ledger. This is the ledger view. Okay, so all the participants, basically the auctioneer and all the mobile operators will see- will have access basically to to this view and to whatever happens on the ledger: that's the world state available to everybody and, as you can see here, there are already some transactions because we initialize the chain code in the four communes. We also create credit on action now in these other tabs.

B

Here what we are going to do, we are going to play two different roles. We are going to put the role of the auctioneer here and then of a bidder.

B

Basically, so we we action here- and we can see here that the auctioneer has already created the action, sending all the critical information inside in the to the chain code inside a nice jackson, clave and, as you can see here, there are the set of participants, the bidders that are allowed to submit bids to participate in this auction and together with a set of items that are that are being auctioned. So these are channels or licenses in different territories, and you can see the opening bidding price and this sort of information. So what happens now?

B

The auctioneer decides to after create a new action, says ok time to really run the auction and let the beat there's put bid something on those items. So, as you can see, the transactions start popping up with from different Peters, beat it and then the auctioneer that perform some operations like closing around and perhaps starting another one. If it's thick, it fits the case for for this specific auction until the termination condition is has been reached now.

B

One thing to to note before placing a bid is that in these two tabs here, for example, so we made this for convenience, but in the end, the mobile operator and the auctioneer will have different views and different privileges in executing some action.

B

Related to this auction, in particular, here see mobile as a view of the auction information, but cannot, for instance, start or terminate round, because those are commands that only the auctioneer can can race, and we can see we can see those the possibility of starting these operations here now. In order to perform this, we need authentication mechanisms that we can. We can leverage thanks to fabric that provides us some mechanisms to authenticate who is performing the transaction, but inside FPC.

B

Then we need to make sure that it's indeed the auctioneer that the one that wanted to start around and not, for instance, another participant of the channel, perhaps telecom operator, for which this kind of operation must be forbidden. So now, let's go to the bidder view and let's place a bit.

B

So what happens here is that there have already been three rounds and in this case, what we want to do. We want to.

B

Reduce the quantity of, for example, of licenses that see mobile wants to acquire in a specific territory because it says okay, we got to a third round. It's the bid price is too high for us, so we're not going to go ahead with this with this quantity here.

B

So, let's submit a bid, and what happens here is that the FPC client chain code takes care of encrypted deduction directly to the chain code inside inside the clave, and only the chain code, disabled, then to to the crypt and store the action in order to be later processed.

B

So do the bid arrived in at the chain code and also into the fabric blockchain after this auction, the the beat the auction continues with other bids bidder, submitting the transactions- and the interesting thing here is that even us here cannot see the content of these transactions because FPC keeps them keeps those confidential and I want to give you brief overview of what's turning the ledger directly and here, as you can see, there are a few. So these are key value pairs. This is what's stored on in the world status.

B

Actually- and you can tell that there are some keys- that you can recognize- auction static, state, dynamic, state and so on, but all of these are encrypted values, so we cannot see them. We cannot see these values whether we are the auctioneer or we are a different participant.

B

Okay, now the auctioneer, since all the bids have been placed the auctioneer says: okay, it's time to terminate the auction and go ahead with the evaluation of the winner. So let's run another transaction to terminate the auction and.

B

Eventually evaluate who the winner is now, this is all done inside by the chain code and then given back as a result to the auctioneer and and also the participant. In addition, in addition, we we decided to implement also another transaction to publish the results on the ledger in in this case.

B

What happens here is that this there is a new transaction to publish results, even in this case, these transactions, like all the others, have an in clarity station here that allows all the participants to verify that the transaction is indeed a correct one that comes from the right chain code from a genuine, genuine s, Jackson clave, in this case differently from the others.

B

Here, it's a bit subtle, but you can see that all the transactions have a lock here, meaning that the date is encrypted, but the published results here is not encrypted data and, in fact, if we look at what's stored on the ledger in raw data, we can see that there is all the previous state which is immutable. This is this: it's a ledger. It's supposed to be immutable, and here we have a published result.

B

Key with a with some data and clear text- and you can well basically it's human readable, so this is what it's supposed to do. Okay, so the demo terminates here and I want to go briefly back to the presentation to simple recap: what you get from fabric preaching good. So this is an extension of hyper leisure fabric to bring data confidentiality at the peers from so you can get data confidentiality from that is not visible to the peers and not even to the organizations that run those peers.

B

Essentially, you get this with the combination of fabric and a trusted execution environment still. Although the data is confidential, all the parties are able to verify that the operations were performed as they were intended to. So you get the operational transparency. The fabric provides, but still confidentiality and very variability by by fabric private chain code and the demo and all the code is on github and I guess. Markus would like.

A

Okay, yes, thank you very much for showing us this demo. I mean I. This didn't really make sense. I mean this really shows the benefits of fabric private chain code. So we can process data securely and only we will the data which are necessary for the use case. We learned a lot about spectrum auctions. I mean more than I thought we will we have to in order to implement that. But for us this is just a toy use case.

A

However, there are people out there we're having a real use case with real security concerns, and we would really like to learn more about your use. Cases when you have concerns about confidentiality and maybe favorite pravachan code can help your with your use case. So we would like to invite you to check out the repository approached us on on other channels, so on it's not God's neck Dan rocket red reaches on rocket set.

A

We have weekly meetings, we are open and I would like to welcome you to join if you have a use case for FPC. That's awesome. If you want to make this thing more robust help us to move from a prototype to real fabric feature, we really appreciate your help. So thank you so much and if you have any questions, yes,.

A

So we definitely we have we as a hyper that, as a fabric, private, anchored hyper lateral lab project, we have the plan to be integrated into fabric. However, we can not decide that the fabric community will decide that. However, we did the first step I think to last week or two weeks ago that we created an RFC proposing that as a feature of a fabric, and now we are in the state where we are collaborating with the community and I mean enhancing this RC and make it real for fabric.

B

So comments, suggestions and feedback are welcome.

A

Any other question T's.

A

A

I mean when I said: yes, our architecture in both said. However, the prototype looks slightly different here, so the thing is that fabric private raincoat I mean it's a framework, let the user build such systems. So that means that we provide the users the opportunity to use different forms of encryption. So in that case, what we saw here, we had just every single enclaves performing all the transactions for us.

A

However, in the real environment, when we have multiple enclaves, encryption is actually a tricky thing, because we need some kind of deterministic encryption in order to pass the endorsement. Poreless endorsement step right, because when many enclaves or tes produce an output of a transaction, they should come to the same research if they're just encrypted. That's tricky.

A

Right it says so we have two things, I mean so we have so missed fabric private Chang cut it's possible to encrypt the read right set. Okay. This is one thing, but in addition to that, we also have a signature over the readwrite set produced inside the end clave, which ensures us or which demonstrates others- that this read wipe that was actually produced inside of a trusted execution environment. So there we have two different things.

A

So one is the encryption part and one is let's say te based endorsement signature and for I mean when we talk about encryption. This really depends on the application, how the user actually wants to deploy FPC and what form of encryption has to be used there. If there are multiple enclaves involved, then you need a shared key, ideally which is distributed in a bootstrapping process which we haven't talked in the sessions, but we have basically, we have a protocol for that to establish a shared key which can then be used to encrypt the state.

A

Basically, the readwrite sets in a way that all the enclaves can later also decrypt the data.

A

Right so I mean with so I think everything goes back to that queue we just implemented or which is rooted in the CPU, but so this key is actually leveraged during this at the station process. But so on top of that we have an let's say, an FPC specific public/private key pair when our chain cut and cliffs boots up for the first time, then we perform the attestation with that and clave, and the attestation basically binds our public key of that end.

A

Clave to that attestation, which we store in this in clef registry and then can be reused by others. So that means, when we see on our ledger transaction signed by the enclaves, we can get the corresponding public key to verify that signature and then also go to the NCLEX registry to fetch the corresponding attestation report, which is bound to that public key and verify that this belongs to a proper FPC chain code. And then we can also check with this attestation. Is this actually the chain code I assumed there?

A

So that means that all the participants in that auction they can verify that the correct action chain code, which everyone agreed on, has been actually executed.

B

So briefly, for the other people as well, Trust is rooted in hardware, the hardware tests being clave the chain code and the keys of associated to dissing clave, and from this case then we encrypt and sign other data. So there is a chain of trust here.

C

A

A

Any other questions otherwise I'm also happy to discuss more details of nine.

C

C

A

Right, so what we are I mean content, so I mean we conceptually store the letter inside the nightlife, but this is not how its implemented, because I mean an anklet, so we cannot put entire letter inside the anklet I mean, if you think about Bitcoin that doesn't fit okay. So, however, what would we store in our trusted? Legitimated and trusted letter in clave is only it's a a concise view of that letter. So, basically we store.

A

We call this integrity metadata, which I agree can still be I mean if we have a large state, can also be large. However, using that data seen a mechanism, there are also a ways how to outsource this data securely on the untrusted host stored on disk and loaded on demand and verify that this data has not been tampered with. So we can. Basically, we can build the lettering cliff in a way that is, it can verify our large data and consume only the the data which is needed for that verification.

A

So it's outside the N cliff, but whenever the Enclave writes something to disk, the data is encrypted and authenticated in inside the end clave, and when it it's loaded back into the NDF, it's verified decrypted in Burford. Okay, what there was another question in the back.

A

All right, thank you again and please check out the Ripper.