US9967088B2 — Rewritable blockchain (Part 2 of 2)
Document text
Research, not advice. Part of the Bitcoin research archive (October 2026). Claims labelled unverified, contested or fringe are reported, not endorsed; statuses of bills and rules are as of the date checked. Government, court and patent records are public domain; the research notes are CC BY 4.0.
quickly 50 non -tamper- evident rewrites to the core part 1002 when N
without coordination among multiple parties. portions of the key secret are combined (where N > M ).
Further, in some schemes , some trusted entities may be In an example scenario , the hybrid blockchain could be
authorized to make edits without scars , while other trusted used to construct a ledger with fully immutable transaction
parties may leave scars when making edits . For example , in data that is paired with transaction description/comment data
a multiple rewritable chain scheme, one trusted party may 55 that may be rewritten by a select group of curators for the
have a key for all chains while other parties have keys for ledger . In some cases, the ledger entries may include size
only a portion of the chains . A party with all keys may make caps or constraints in the type of data that may be entered .
edits without scars , while parties with only a portion of the Constraining allowed rewrites may frustrate attempts to
keys may leave scars when editing. The multiple chain write irrelevant or malicious content into the immutable
schememay be combined with the distributed key schemes, 60 ledger portions of the blocks . The description / comment field
such that, parties may aggregate their keys to make edits within the rewritable portions of the blocksmay be subject
without scars in case where the parties would leave scars to fewer entry restrictions. However, the curators may alter
when acting alone. or remove previously written content in the description
FIG . 9 shows an example dual chain blockchain portion comments fields without the changes being tamper evident.
900, 950 , where the block B2 902 is modified . The key 65 FIG . 11 shows an example rewritable blockchain scenario
secret 903 held by the one or more trusted parties allows the 1100 . In the rewritable blockchain scenario 1100 , a trusted
trusted parties to open the link 904 and change the block B2 party 1101 in control of a key secret 1150 (or master key
US 9, 967, 088 B2
27 28
secret) may perform rewrites 1172 on its own authority . For vice provider (e.g ., a bank, financial institution , or other
example , the trusted party may be in full control of the key enterprise ) may maintain a blockchain holding records of
secret, because the trusted party does not necessarily have to transactions .
coordinate with other parties to perform rewrites 1172 . The FIG . 13 shows an example blockchain record mainte
trusted party 1101 may control a BRS 400 , e . g . directly or 5 nance scenario 1300 . In some cases , the blockchain 1302 ,
from one ormore terminals 1110 , the BRS 400 may store the which can be rewritten , may be maintained by the service
key secret 1150 in memory 420 (e .g ., protected memory provider 1304 in a public location where parties 1308 to a
transaction may append blocks 1310 , ( e . g ., containing trans
480) or access/ receive the key secret 1150 from remote action records
locations , such as terminals 1110 , cloud storage , or other 10 when the parties1399 ) to the end of the blockchain 1302 ,
complete transactions. The service provider
network locations. The terminals 1110 may include various 1304 holds the key secret 1350 and is a trusted party.
communication devices such as, computers , webservers ,
laptops, cellular telephones , smartphones, tablets, internet Because
the
parties 1308 performing transactions are untrusted ,
service provider 1304 may rely the append -only nature
connected appliances , internet of things devices , or other of the blockchain to deter tampering with past records.
communication devices. The BRS 400 may may execute KML
RML 15 In some jurisdictions , such as the European Union , indi
441 and /or rewrite logic 600 to preform blockchain rewrites viduals may have a right to be forgotten . Further, because the
1172 . Untrusted parties 1102 may access the BRS 400 , other blockchain 1302 includes transaction records 1399 and is
BRSs 400 systems, terminals 1110 , or BPSs 300 which may publicly available , the blockchain 1302 may provide a
verify the blockchain and / or append blocks 1174 ( e . g ., public record 1398 of fraudulent activity by past users . Since
adding new blocks to the end of the blockchain ). 20 individuals may have an extensive right to have references
Some untrusted parties may control BRSs 400 , including to a past crime removed from the public sphere after
the BRS 400 under control of the trusted party . However, the completing a sentence for that crime, the service provider
untrusted parties are unable to access the stored key secret 1304 may have a legal duty to remove the public record
1150 . For example , some untrusted parties may lack user 1398 of fraudulent activity . If the blockchain 1302 could not
account authority on the BRS 400 to access the key secret 25 be rewritten , the service provider 1304 may be forced to
1150 of the trusted party , but may still have access to other either invalidate the blockchain 1302 or clear the entire
functions of the BRS 400 . Additionally or alternatively, blockchain 1302 to comply with the law . However, since the
untrusted parties , with respect to a first rewritable block service provider 1304 may perform non -tamper -evident
chain , may serve as trusted parties with regard to other 30 rewrites to the blockchain 1302, the service provider may
remove the public record 1398 without evidence of tamper
blockchains. Accordingly, a single BRS 400 may provide that would invalidate the blockchain . Accordingly, the
rewrite operations 1172 to multiple different trusted parties rewritable blockchain techniques and architectures dis
for multiple different blockchains . cussed above, provide a concrete technical solution to a
The BRS 400 may access blockchains . When instructed real -world application in public record keeping and statutory
under the authority of the trusted
sted party ,, the
the BRS
BRS 400
400 may
may ,35 compliance .
perform rewrites on the accessed blockchains using the key In another real -world application , rewritable blockchains
secret 1150 . may be used in maintaining data stream records from
FIG . 12 shows an example distributed key secret block - internet of things (IoT) devices . FIG . 14 shows an example
chain rewrite scenario 1200 . In the example scenario 1200 , IoT rewriteable blockchain scenario 1400 . An IoT security
the parties may include individually untrusted parties IUPs 40 camera 1402 may record audio visual (AN ) data 1404 and
( 1299 ), trusted parties 1101 , and untrusted parties 1102. The store the A /V data within a rewritable blockchain 1408 . An
IUPs 1299 may be in control of portions 1260 of a key enterprise 1410 operating the IoT security camera 1402 may
secret, while trusted parties 1101 may be in control of an use it to monitor an area (e . g ., a parking lot of a retail
entire key secret 1150 . In the example scenario , rewrites location ) open to third - party clients 1499. When a dispute
1272 may be performed when the IUPs 1299 combine their 45 among the clients 1499 occurs ( e . g., a minor automobile
key secret portions 1260 ( e . g ., by PKE or other secret accident), the enterprise 1410 may provide the A / V data
exchange scheme, as discussed above) or a single -party 1404 to clients 1499 within the blockchain 1408 .
rewrite 1172 under the authority of the trusted party 1101 Accordingly, the enterprise 1410 may be confident that
using its key secret 1150 . However, various other example the individual clients 1499 are unable to alter the A / V data
distributed key secret blockchain rewrite scenarios no single 50 1404 . Thus , the authenticity of the A / V data 1404 can be
party may be in full control of a key secret 1150 , and verified by the clients 1499 themselves (or by virtually any
accordingly, non - tamper evident blockchain rewrites 1272 party, such as an insurer, mediator, or court). As a result ,
are possible when the IUPs 1299 combine their portions providing the video within a blockchain may reduce the
1260 . future potential burden on the enterprise 1410 in authenti
Referring again to the example distributed key secret 55 cating the AN data 1404 for the clients 1499 . Further, since
blockchain rewrite scenario 1200 , the IUPs 1299 may com the blockchain 1408 is rewritable, the enterprise may trun
bine their portions to perform a non -tamper- evident rewrite cate the AN data 1404 and provide a segment 1420 with the
1272 . The IUPs 1299 may store their key secret portions relevant AN data . Without the ability to rewrite the block
1260 on BRSS 400 , BPSs 300, terminals 1110 , or other chain 1408 , the enterprise 1410 may face of choice of
memory locations. The IUPs 1299 may combine their por - 60 providing non -relevant AN segments or removing the block
tions using one of the exchange schemes describe above . chain protection and facing the risk of more burdensome
Once the combined key secret 1262 is available , a BRS 400 authentication requirements . In various implementations ,
may access the combined key secret 1262 to perform the segments 1420 may be wrapped -up into a closed block
non -tamper- evident rewrites. chain loop , as discussed below .
Moving now to a discussion of real world applications of 65 The rewritable blockchain techniques and architectures
rewritable blockchains , blockchain may be used ( e. g ., by a may support blockchain forms that are impractical or impos
private company) to maintain records. For example , a ser - sible without the technical solution of rewrite capabilities .
US 9 ,967,088 B2
29 30
For example , with blockchain rewrite support , a blockchain example , all or parts ofthe implementationsmay be circuitry
may be “ wrapped -up ” into a loop form by a trusted party. In that includes an instruction processor, such as a Central
other words, a first block of a given linear blockchain may Processing Unit (CPU ) , microcontroller, or a microproces
be rewritten to include an integrity output coding -consistent sor; an Application Specific Integrated Circuit (ASIC ), Pro
with a subsequent block of the blockchain . This reforms the 5 grammable Logic Device ( PLD ), or Field Programmable
blockchain into a loop , at least in part. Without rewrite Gate Array ( FPGA); or circuitry that includes discrete logic
support constructing loops within a blockchain may be or other circuit components, including analog circuit com
impossible or impractical unless the content of all blocks ponents , digital circuit components or both ; or any combi
within the loop is known prior to the addition of the first nation
block in the loop . In some cases, branching , e.g., having two 10 nected thereof . The circuitry may include discrete intercon
hardware components and /or may be combined on a
separate possible blocks that could follow a first block , is an
indicator of blockchain invalidity . Without branching , open single integrated circuit die , distributed among multiple
integrated circuit dies , or implemented in a Multiple Chip
loops , e .g . loops not connecting two ends of a blockchain ,
cannot be constructed . Accordingly, open loops may be valid Module (MCM ) of multiple integrated circuit dies in a
in implementations where the presence of branching does 15 common package , as examples.
The circuitry may further include or access instructions
not necessarily invalidate a blockchain .
Where the first block is the oldest block of the blockchain for execution by the circuitry . The instructions may be
and the subsequent block is the most recent block , the embodied as a signal and /or data stream and/ or may be
trusted party reforms the blockchain into a closed block - stored in a tangible storage medium that is other than a
chain loop. Blockchain loops may be used by parties to 20 transitory signal, such as a flash memory, a Random Access
provide self -consistent tamper resistance for finite length Memory (RAM ), a Read Only Memory (ROM ), an Erasable
blockchains . For example , where a blockchain covers a Programmable Read Only Memory (EPROM ); or on a
completed series of transactions, the blockchain may be magnetic or optical disc, such as a Compact Disc Read Only
wrapped -up into a closed loop to provide a self- consistent Memory (CDROM ), Hard Disk Drive (HDD ) , or other
record not necessarily dependent on future block additions 25 magnetic or optical disk ; or in or on another machine
for security. readable medium . A product, such as a computer program
FIG . 15 shows example wrapped -up blockchains 1530 , product, may particularly include a storage medium and
1550. The example blockchain loop 1530 is an open loop . instructions stored in or on the medium , and the instructions
The example blockchain 1500 is a closed loop . A trusted when executed by the circuitry in a device may cause the
party 1504 may wrap - up the blockchain into an open loop 30 device to implement any of the processing described above
blockchain 1530 by selecting at least one non - end block or illustrated in the drawings .
( e .g ., a block from the group 1532 ) to lock to another block . The implementationsmay be distributed as circuitry, e. g .,
Alternatively, the trusted party 1504 may wrap -up the block - hardware , and /or a combination of hardware and software
chain into a closed loop blockchain 1550 by selecting two among multiple system components, such as among mul
end blocks (e . g ., the two blocks from group 1552). 35 tiple processors and memories, optionally including multiple
For open loop 1530 , block 1538 may be rewritten with distributed processing systems. Parameters , databases , and
content 1546 such that the integrity output 1536 stored in other data structures may be separately stored and managed ,
block 1534 indicates that block 1538 precedes block 1534 may be incorporated into a single memory or database, may
( e. g., integrity output 1536 should be coding -consistent with be logically and physically organized in many different
content 1546 ). Since block 1534 remains unchanged , the 40 ways, and may be implemented in many different ways ,
content of block 1542 may also be coding - consistent with including as data structures such as linked lists , hash tables ,
the integrity output 1536 stored in block 1534 . The integrity arrays, records, objects, or implicit storage mechanisms.
output 1536 may be written to block 1544 to ensure that Programs may be parts ( e .g ., subroutines ) of a single pro
block 1538 is coding-consistentwith block 1544 after being gram , separate programs, distributed across severalmemo
rewritten . Block 1544 may be rewritten with integrity output 45 ries and processors , or implemented in many different ways ,
1536 such that the integrity output 1548 of block 1558 such as in a library , such as a shared library ( e. g ., a Dynamic
remains coding -consistent with block 1544 after the rewrite . Link Library (DLL )). The DLL , for example , may store
For closed loop blockchain 1550, block 1554 may be instructions that perform any of the processing described
rewritten with integrity output 1556 which indicates that above or illustrated in the drawings , when executed by the
block 1558 precedes block 1554 ( e . g ., integrity output 1556 50 circuitry .
should be coding - consistent with content 1558 ) . Block 1554 The techniques and architectures described herein may be
may be rewritten with integrity output 1556 such that the used in various implementations . As one example , a method
integrity output 1566 of block 1541 remains coding -consis - may be executed in a hardware security system . The method
tent with block 1554 after the rewrite . Accordingly , after the may include: receiving, atprocessing circuitry, a first portion
closed loop 1550 is created by the trusted party 1504 , a 55 of a key secret via a key secret exchange protocol; combin
rewrite block 1558 by an untrusted party of would be ing, with the processing circuitry, the first portion with a
coding- inconsistent with integrity output 1556 and would be second portion of the key secret to obtain the key secret;
tamper - evident. In addition , in implementations where determining , with the processing circuitry , to rewrite origi
branching invalidates a blockchain , appending a block after nal data in a selected block of a blockchain with altered data
block 1558 would invalidate the closed loop 1550 . Accord - 60 that is different than the original data previously stored in the
ingly , closed - loop blockchain 1550 may be protected from selected block ; and determining , with the processing cir
both non - tamper - evident rewrites and non -tamper -evident cuitry and using the key secret , collision data including the
additions, in implementations where branching invalidates a altered data , the collision data coding-consistent with a
blockchain . previously determined integrity output stored within a spe
The methods, devices , processing, and logic described 65 cific block of the blockchain that follows the selected block ,
above may be implemented in many different ways and in the previously determined integrity output generated respon
many different combinations of hardware and software . For s ive to and coding- consistent with the original data .
US 9, 967, 088 B2
32
As another example, a system may include : memory, a In another example, a system may include : memory,
blockchain store within the memory , and rewrite circuitry in communication interface circuitry , and rewrite circuitry in
data communication with the communication interface . The data communication with the communication interface and
blockchain may include , a selected block including original the memory . The memory may be configured to store a key
data ; and a specific block including an integrity output , the 5 secret for a chameleon hash that secures a blockchain . The
integrity output determined using the original data as an communication interface circuitry may be configured to :
input. The communication interface may be configured to : access the blockchain in the memory , the blockchain includ
perform a key secret exchange operation to receive portions ing: a selected block , a second block subsequent to the
of a key secret, the portions sent by multiple individually selected block on the blockchain , and a third block preced
untrusted parties; receive a command coordinated with the 10 ing the selected block on the blockchain . The selected block
key secret exchange protocol, the command to overwrite the may include : a payload field operable to store original data ;
original data with altered data . The rewrite circuitry may be a first previous -hash field operable to store a first chameleon
configured to : obtain a portion combination using the por - hash output; and a randomness field . The second block may
tions of the key secret ; when a count of the portions exceeds include a second previous -hash field operable to store a
a threshold count for rewrite privileges : computing collision 15 second chameleon hash output. The first chameleon hash
data that includes the altered data : the collision data coding - output may be generated using content of the third block as
consistent with the integrity output, and the computing the an input. The communication interface circuitry may be
collision data performed using the portion combination and further configured to : receive a trusted -party instruction to
the altered data as inputs . perform a non - tamper- evident rewrite to the payload field ,
In some implementations, the rewrite circuitry may be 20 the instruction specifying altered data which will replace the
further configured to fail to compute the collision data , when original data previously stored in the payload field ; receive ,
the count does not exceed the threshold count for rewrite to facilitate performance of the instruction , an authorization
privileges. to access the key secret within the memory , the authorization
In some implementations , the rewrite circuitry may be initiated by a trusted party for the blockchain ; and send a
configured to fail to compute the collision data by : deter - 25 rewrite instruction for the blockchain . The rewrite circuitry
mining that the count does not exceed the threshold ; and may be configured to : using the payload field , the first
responsive to determining that the count does not exceed the previous -hash field , and the key secret as inputs , determine
threshold , forgoing computation of the collision data . randomness data to write to the randomness field , the
In some implementations, the rewrite circuitry may be randomness data selected such that the second chameleon
configured to : fail to compute the collision data by gener - 30 hash output is coding - consistent with the selected block
ating invalid data by attempting to compute the collision when the payload field contains the altered data and the
data with incomplete knowledge of the key secret , the randomness field contains the randomness data ; an generate
invalid data coding - inconsistent with integrity output; and the rewrite instruction ; and cause the communication inter
perform a tamper -evident rewrite of the blockchain by face to send the rewrite instruction . The rewrite instruction
overwriting at least the original data with the invalid data . 35 may include: a first command to write the randomness data
In some implementations , the specific block may follow into the randomness field ; and a second command to replace
the selected block within the blockchain . the original data with the altered data .
In some implementations, the specific block may include In another example , a system may include memory and
a block adjacent to the selected block within the blockchain . rewrite circuitry . The memory may be configured to store a
In yet another example , a method may be executed in a 40 blockchain . The blockchain may include a selected block
hardware security system . The method may include: deter - including original data ; and a specific block including an
mining , with processing circuitry , to rewrite original data in integrity output. The rewrite circuitry may be configured to
a selected block of a blockchain with altered data different perform a non - tamper - evident rewrite of the selected block ,
than the original data previously stored in the selected block ; the specific block , or both .
identifying a specific block of the blockchain , the specific 45 In some implementations, the rewrite circuitry may be
block including: a first integrity code and a second integrity configured to perform the non -tamper - evident rewrite by
code ; determining, with the processing circuitry and using a wrapping -up the blockchain into a loop .
key secret, collision data including the altered data ; and In some implementations, rewrite circuitry may be con
performing, with the processing circuitry , a tamper -evident figured to wrap - up the blockchain into the loop , by replacing
rewrite of the blockchain by replacing the original data with 50 the original data with altered data coding-consistent with the
the collision data . The collision data being coding- consistent integrity output.
with a first integrity output stored within the specific block In some implementations, the rewrite circuitry may be
of the blockchain , and coding - inconsistent with the second configured to wrap -up the blockchain into the loop by
integrity output stored within the specific block . The first wrapping -up the blockchain into a closed loop , an open
and second integrity outputs generated responsive to and 55 loop , or both .
coding-consistent with the original data . In some implementations, the blockchain may include a
In another example, a system may include : memory , a tertiary portion and a core portion .
blockchain stored within the memory , and rewrite circuitry. In another example , a system may include memory and a
The blockchain may include: a first block including original hybrid blockchain stored on the memory . The hybrid block
data ; and a second block including : a first integrity output 60 chain may include a core portion ; and a tertiary portion .
computed using the original data as an input; and a second Meeting a criterion for rewrite privileges may qualify a party
integrity output computed using the original data as an input to rewrite the tertiary portion but not the core portion .
The rewrite circuitry may be configured to : generate a scar In some implementations, the criterion may include com
in the blockchain by rewriting the first block with altered bining a first threshold number of key secret portions.
data different than the original data , the altered data coding - 65 In some implementations , the core portion may be
consistent with the first integrity output but coding- incon - secured by an integrity code that lacks an associated key
sistent with the second integrity output. secret.
US 9 ,967,088 B2
33 34
In another example , a system may comprise : memory ; a redacted version of the original data , rewriting the original
blockchain stored in the memory, theblockchain comprising data with supplemental data relative to the original data, or
a block with original data, the blockchain secured by a first both .
integrity output for a first integrity code , the first integrity In some implementations, the blockchain is secured by an
code is configured to yield the first integrity output when 5 integrity code comprising a cryptographic hash , a chame
applied to the original data ; and rewrite circuitry in data leon hash , or both ; and the key secret is specific to the
communication with the memory , the rewrite circuitry con - integrity code .
figured to : access the blockchain ; access a key secret for the In some implementations, the blockchain comprises a
first integrity code , the key secret facilitating identification dual chain that uses a first integrity code and a second
of collision data , the collision data different from the original 10 integrity code .
data , the first integrity code is configured to yield the first In some implementations, the altered data comprises a
integrity output when applied to the collision data ; receive a coding -inconsistency with a second integrity output of the
command to rewrite the original data in the block with second integrity code, the second integrity output different
altered data that is different than the original data , the first than the previously determined integrity output.
integrity code does not yield the first integrity output when 15 In some implementations, the coding - inconsistency with
applied to the altered data ; generate additional data respon - the second integrity output of the second integrity code is
sive to the key secret and the altered data ; generate the configured to act as a rewrite identifier that marks the
collision data based on the altered data and the additional blockchain as rewritten .
data ; and rewrite the block with the collision data . In some implementations, the first integrity code com
In some implementations , the altered data comprises a 20 prises a first chameleon hash ; and the second integrity code
redacted version of the original data , supplemental data comprises a rewrite -protected cryptographic hash , a second
relative to the original data , or both . chameleon hash , or both .
In some implementations, where the first integrity code In some implementations, the first integrity code com
comprises a cryptographic hash , a chameleon hash , or both . prises an inner hash nested within an outer hash .
In some implementations, the blockchain comprises a 25 In some implementations, the inner hash comprises a
dual chain constructed from the first integrity code and a chameleon hash configured to provide a hash output to the
second integrity code . outer hash ; and the outer hash comprises a rewrite -protected
In some implementations , the second integrity code does cryptographic hash .
not yield a second integrity output when applied to the In some implementations, accessing the key secret com
collision data . 30 prises combining multiple portions of the key secret.
In some implementations, the second integrity output is In another example a computer program or product may
configured to act as a rewrite identifier that marks the include : a machine- readable medium other than a transitory
blockchain as rewritten . signal; and instructions stored on the machine -readable
In some implementations, the first integrity code com medium . The instructions may, when executed , cause a
prises a first chameleon hash ; and the second integrity code 35 system to : access original data within a blockchain , the
comprises a rewrite -protected cryptographic hash , a second original data secured by a first integrity output for an
chameleon hash , or both . integrity code that is configured to yield the first integrity
In some implementations, the first integrity code com output when applied to the original data ; determine to
prises an inner hash nested within an outer hash . rewrite the original data in the block with altered data
In some implementations , the inner hash comprises a 40 different than the original data , such that rewriting the
chameleon hash that is configured to provide a hash output original data with the altered data produces a tamper - evident
to the outer hash ; and the outer hash comprises a rewrite - rewrite ; access a key secret in memory ; and responsive to the
protected cryptographic hash . key secret, execute a non -tamper- evident rewrite of the
In some implementations , the rewrite circuitry is config - blockchain that replaces the first data with at least the altered
ured to access the key secret by combiningmultiple portions 45 data such that the integrity code is configured to yield the
of the key secret. first integrity output when applied to the non -tamper-evident
In some implementations, themultiple portions are stored rewrite.
in separate memory locations maintained by individually . In some implementations, the altered data includes a
untrusted parties that together makeup a trusted party . redacted version of the original data , supplemental data
In some implementations , where the rewrite circuitry is 50 relative to the original data , or any combination thereof.
configured to combine the multiple portions using a public - In some implementations , the integrity code includes a
key exchange protocol. chameleon hash .
In another example , a method comprises: in a hardware In some implementations, the instructions are further
security system : accessing, using processing circuitry, a key configured to access the key secret by combining multiple
secret for a blockchain ; determining, with the processing 55 portions of the key secret .
circuitry , to rewrite original data in a selected block of the In some implementations, the multiple portions are stored
blockchain with altered data that is different than the original in separate memory locations maintained by individually
data previously stored in the selected block ; and determin - untrusted parties that together makeup a trusted party for the
ing, with the processing circuitry and using the key secret , blockchain .
collision data including the altered data , the collision data 60 In some implementations, the instructions are further
coding- consistent with a previously determined integrity configured to prevent the individually -untrusted parties from
output stored within a specific block of the blockchain that individually obtaining knowledge of an entirety of the key
follows the selected block , the previously determined integ secret by combining the multiple portions using a public -key
rity output generated responsive to and coding -consistent exchange protocol.
with the original data . 65 In another example, a method includes accessing, via
In some implementations, rewriting the original data with rewrite circuitry , a blockchain stored on memory , where the
the altered data comprises rewriting the original data with a blockchain includes a block with first data ; and the block
US 9, 967,088 B2
35 36
chain is secured by a first integrity output for an integrity selected block ; and determine , using the key secret, collision
code that is configured to yield the first integrity output when data including the altered data , the collision data coding
applied to the original data . Themethod may further include : consistent with a previously determined integrity output
accessing , via the rewrite circuitry, a key secret for the stored within a specific block of the blockchain that follows
integrity code , the key secret facilitating identification of 5 the selected block , the previously determined integrity out
collision data different from the original data , the integrity put generated responsive to and coding - consistent with the
code is configured to yield the first integrity output when original data.
applied to the collision data ; determining to rewrite the In some implementations, the specific block follows the
original data in the block with altered data different than the
selected block within the blockchain .
original data , the integrity code does not yield the first 10 In some implementations , the specific block includes a
integrity output when applied to the altered data ; generating block adjacent to the selected block within the blockchain .
additional data responsive to the key secret and the altered In some implementations, the communication interface
data ; generating collision data based on the altered data and circuitry is configured to receive the first portion of the key
the additional data ; and rewriting the block with the collision secret via the key secret exchange protocol by receiving the
data . 15 first portion of the key secret via a public key exchange
In some implementations accessing the key secret protocol.
includes combining multiple portions of the key secret, the In some implementations, the communication interface
multiple portions stored in separatememory locations main circuitry is configured to receive the first portion of the key
tained by individually - untrusted parties that together secret the key secret exchange protocol by performing the
makeup a trusted party . 20 key secret exchange protocol under authority of multiple
In another example , a method includes, in a hardware individually untrusted parties .
security system : accessing, using processing circuitry , a key In some implementations, the rewrite circuitry is further
secret for a blockchain ; determining , with the processing configured to access the second portion of the key secret in
circuitry , to rewrite original data in a selected block of the a protected memory prior to combining the first and second
blockchain with altered data that is different than the original 25 portions of the key secret.
data previously stored in the selected block ; and determin In some implementations, the rewrite circuitry is further
ing, with the processing circuitry and using the key secret, configured to grant, using the key secret, a third portion of
collision data including the altered data , the collision data the key secret to a previously untrusted party .
coding - consistent with a previously determined integrity In some implementations , the rewrite circuitry is config
output stored within a specific block of the blockchain that 30 ured to grant the third portion of the key secret by decrypt
follows the selected block , the previously determined integ ing, using the key secret, a cache storing multiple portions
rity output generated responsive to and coding-consistent of the key secret.
with the original data . In some implementations, the rewrite circuitry is config
In some implementations, the blockchain is secured by an ured to determine to rewrite the original data in the selected
integrity code including a cryptographic hash , a chameleon 35 block of the blockchain with the altered data by determining
hash , or both . The key secret is specific to the integrity code . to remove a detectable rewrite artifact left by performing a
In some implementations, the blockchain includes a dual rewrite without access to the first portion , the second por
chain that uses a first integrity code and a second integrity tion , or both .
code . In another example , a method includes: accessing, in
In some implementations, the altered data includes a 40 memory, a blockchain including : a selected block including
coding-inconsistency with a second integrity output of the original data ; and a specific block including an integrity
second integrity code , the second integrity output different output, the integrity output determined from the original
than the previously determined integrity output. data as an input. The method may further include , at
In some implementations , the coding-inconsistency with communication interference circuitry : performing a key
the second integrity output of the second integrity code is 45 secret exchange operation to receive portions of a key secret,
configured to act as a rewrite identifier that marks the the portions sent by multiple individually untrusted parties;
blockchain as rewritten . receiving a command coordinated with the key secret
In some implementations : the first integrity code includes exchange operation , the command specifying to overwrite
a first chameleon hash ; and the second integrity code the original data with altered data . The method may further
includes a rewrite -protected cryptographic hash , a second 50 include , at rewrite circuitry : obtaining a portion combination
chameleon hash , or both . from the portions of the key secret; and when a count of the
In some implementations, the first integrity code includes portions exceeds a rewriting threshold for rewrite privileges,
an inner hash nested within an outer hash . computing collision data that includes the altered data ,
In some implementations: the inner hash includes a cha - where : the collision data is coding - consistent with the integ
meleon hash configured to provide a hash output to the outer 55 rity output, and collision data is algorithmically determined
hash ; and the outer hash includes a rewrite - protected cryp - from the portion combination and the altered data as inputs .
tographic hash . In some implementations, the method further includes
In another example , a system includes communication failing to compute the collision data , when the count does
interface circuitry and rewrite circuitry in data communica - not exceed the rewriting threshold for rewrite privileges.
tion with the communication interface circuitry. The com - 60 In some implementations, failing to compute the collision
munication interface circuitry is configured to receive , at data includes : determining that the count does not exceed the
processing circuitry , a first portion of a key secret via a key rewriting threshold ; and responsive to determining that the
secret exchange protocol. The rewrite circuitry is configured count does not exceed the rewriting threshold , forgoing
to : combine the first portion with a second portion of the key computation of the collision data .
secret to obtain the key secret; determine to rewrite original 65 In some implementations, failing to compute the collision
data in a selected block of a blockchain with altered data that data includes : generating invalid data by attempting to
is different than the original data previously stored in the compute the collision data with incomplete knowledge of
US 9 ,967,088 B2
37 38
the key secret, the invalid data coding -inconsistent with consistent with the integrity output, and the collision data is
integrity output; and performing a tamper- evident rewrite of algorithmically determined from the portion combination
the blockchain includes overwriting at least the original data and the altered data as inputs .
with the invalid data . In some implementations, the rewrite circuitry is further
In some implementations, the method further includes 5 configured to fail to compute the collision data when the
decrypting a cache of key secret portions when the count count does not exceed the rewriting threshold for rewrite
exceeds a granting threshold for key secret granting privi privileges .
leges .
In another example , a method comprises: in a hardware uredIn some implementations, the rewrite circuitry is config
to fail to compute the collision data by : determining
security system : receiving, at processing circuitry , a first 10
portion of a key secret via a key secret exchange protocol; that the count does not exceed the rewriting threshold ; and
responsive to determining that the count does not exceed the
combining, with the processing circuitry , the first portion rewriting threshold , forgoing computation of the collision
with a second portion of the key secret to obtain the key
secret; determining, with the processing circuitry, to rewrite data .
original data in a selected block of a blockchain with altered 15 uredInT some
to :
implementations, the rewrite circuitry is config
fail to compute the collision data by generating
data that is different than the original data previously stored
in the selected block : and determining, with the processing invalid data by attempting to compute the collision data with
circuitry and using the key secret, collision data including incomplete knowledge of the key secret, the invalid data
the altered data , the collision data coding -consistent with 18a coding -inconsistent with integrity output; and perform a
previously determined integrity output stored within a spe- 20 tamper -evident rewrite of the blockchain by overwriting at
cific block of the blockchain that follows the selected block , least the original data with the invalid data .
the previously determined integrity output generated respon - In some implementations, the specific block comprises a
sive to and coding- consistent with the original data . block adjacent to the selected block within the blockchain .
In some implementations , the specific block follows the In some implementations, the rewrite circuitry is further
selected block within the blockchain . 25 configured to decrypt a cache of key secret portions when
In some implementations, the specific block comprises a the count exceeds a granting threshold for key secret grant
block adjacent to the selected block within the blockchain . ing privileges.
In some implementations , receiving the first portion of the In another example , a method includes , in a hardware
key secret via the key secret exchange protocol comprises : security system : accessing a blockchain stored in memory ,
receiving the first portion of the key secret via a public key 30 the blockchain including a first block including original
exchange protocol. data ; and a second block including : a first integrity output
In some implementations , receiving the first portion of the computed using the original data as an input; and a second
key secret the key secret exchange protocol comprises: integrity output computed using the original data as an input.
performing the key secret exchange protocol under authority The method further includes generating , using rewrite cir
of multiple individually -untrusted parties . 35 cuitry , a rewrite artifact in the blockchain by rewriting the
In some implementations, the method further comprises: first block with altered data different than the original data ,
accessing the second portion of the key secret in a protected the altered data coding -consistent with the first integrity
memory prior to combining the first and second portions of output but coding- inconsistent with the second integrity
the key secret . output .
In some implementations , the method further comprises : 40 In some implementations , generating the rewrite artifact
granting, using the key secret, a third portion of the key in the blockchain includes rewriting the first block with the
secret to a previously untrusted party . altered data by performing a valid rewrite of the blockchain .
In some implementations, granting the third portion of the In some implementations, the method further includes
key secret comprises: decrypting, using the key secret, a removing the rewrite artifactby rewriting the first block with
cache storing multiple portions of the key secret. 45 ratification data using a ratification key secret, the ratifica
In some implementations , determining to rewrite the tion data coding - consistentwith the first integrity output and
original data in the selected block of the blockchain with the the second integrity output.
altered data comprises : determining to remove a detectable In some implementations, the ratification data includes
rewrite artifact left by performing a rewrite without access the altered data ; and rewriting the first block with the
to the first portion , the second portion , or both . 50 ratification data by performing a multiple trusted -party
In another example , a system comprises : a memory ; a rewrite ratification for the blockchain .
blockchain stored within the memory , the blockchain com - In some implementations, rewriting the first block with
prising: a selected block comprising original data ; and the altered data includes rewriting the first block with the
a specific block comprising an integrity output, the integ - altered data using a key secret; and the method further
rity output determined from the original data as an input; 55 includes , generating the key secret by combining multiple
communication interface circuitry configured to : perform a portions of the key secret in a key secret exchange prior to
key secret exchange operation to receive portions of a key rewriting the first block with the altered data .
secret, the portions received on behalf ofmultiple individu - In some implementations, combining the multiple por
ally untrusted parties ; receive a command coordinated with tions includes combining multiple portions when a count of
the key secret exchange operation , the command specifying 60 the multiple portions exceeds a first threshold for valid
to overwrite the original data with altered data ; and rewrite tamper - evident rewrites .
circuitry in data communication with the communication In some implementations, combining the multiple por
interface circuitry, the rewrite circuitry configured to : obtain tions includes combining multiple portions when a count of
a portion combination from the portions of the key secret; the multiple portions exceeds a first threshold for valid
and when a count of the portions exceeds a rewriting 65 tamper - evident rewrites but does not exceed a second
threshold for rewrite privileges : compute collision data that threshold for valid non -tamper evident rewrites coding
includes the altered data , where : the collision data is coding consistent with the second integrity output.
US 9 ,967,088 B2
39 40
In another example, a computer program or product sistent with the original data ; and performing , with the
includes : a machine -readable medium , other than a transi processing circuitry, a tamper -evident rewrite of the block
tory signal; and instructions stored on the machine -readable chain by replacing the original data with the collision data .
medium , the instructions configured to , when executed , In some implementations, performing the tamper -evident
cause a system to : determine to rewrite original data in a 5 rewrite coding - consistent with the first integrity output com
selected block of a blockchain with altered data different prises performing a valid rewrite of the blockchain .
than the original data previously stored in the selected block ; In some implementations, performing the tamper - evident
identify a specific block of the blockchain , the specific block rewrite coding -inconsistent with the second integrity output
including: a first integrity output and a second integrity comprises generating a rewrite artifact thatmarks the block
output ; determine , using a first key secret, collision data 10 chain as rewritten .
including the altered data ; and perform a tamper- evident In some implementations , the method further comprises :
rewrite of the blockchain by replacing the original data with after performing the tamper- evident rewrite of the block
the collision data. Where the collision data is coding chain , determining to rewrite the collision data with ratifi
consistent with the first integrity output, and is coding - cation data using a second key secret, the ratification data
inconsistent with the second integrity output, the first and 15 coding - consistent with the first integrity output and the
second integrity outputs generated responsive to and coding- second integrity output.
consistent with the original data . In some implementations, the ratification data includes
In some implementations , the instructions are configured the altered data ; and determining to rewrite the collision data
to cause the processing circuitry to perform the tamper- with the ratification data comprises determining to perform
evident rewrite coding -consistent with the first integrity 20 a multiple trusted -party ratification of the tamper-evident
output by performing a valid rewrite of the blockchain . rewrite of the blockchain .
In some implementations , the instructions are configured In some implementations , the method further comprises :
to cause the processing circuitry to perform the tamper- generating the first key secret by combining multiple por
evident rewrite coding- inconsistent with the second integrity tions of the first key secret in a key secret exchange .
output by generating a rewrite artifact thatmarks the block - 25 In some implementations, combining the multiple por
chain as rewritten . tions comprises combining multiple portions when a count
In some implementations , the instructions are further of the multiple portions exceeds a first threshold for valid
configured to cause the processing circuitry to determine to tamper- evident rewrites .
rewrite the collision data with ratification data using a In some implementations, combining the multiple por
second key secret after performing the tamper- evident 30 tions comprises combining multiple portions when a count
rewrite of the blockchain , the ratification data coding -con - of the multiple portions exceeds a first threshold for valid
sistent with the first integrity output and the second integrity tamper- evident rewrites but does not exceed a second
output. threshold for valid non - tamper evident rewrites.
In some implementations, the ratification data includes In another example, a system comprises: memory ; a
the altered data ; and the instructions are configured to cause 35 blockchain stored within the memory , the blockchain com
the processing circuitry to determine to rewrite the collision prising : a first block comprising original data; and a second
data with the ratification data by determining to perform a block comprising: a first integrity output computed using the
multiple trusted -party ratification of the tamper -evident original data as an input; and a second integrity output
rewrite of the blockchain . computed using the original data as an input; and rewrite
In some implementations, the instructions are further 40 circuitry configured to : generate a rewrite artifact in the
configured to cause the processing circuitry to generate the blockchain by rewriting the first block with altered data
first key secret by combining multiple portions of the first different than the original data , the altered data coding
key secret in a key secret exchange . consistent with the first integrity output but coding -incon
In some implementations, the instructions are configured sistent with the second integrity output.
to cause the processing circuitry to combine the multiple 45 In some implementations, the rewrite circuitry is config
portionsby combiningmultiple portions when a count of the ured to generate the rewrite artifact in the blockchain by
multiple portions exceeds a first threshold for valid tamper - rewriting the first block with the altered data by performing
evident rewrites . a valid rewrite of the blockchain .
In some implementations , the instructions are configured In some implementations , the rewrite circuitry is further
to cause the processing circuitry to combine the multiple 50 configured to remove the rewrite artifact by rewriting the
portions by combining multiple portions when a count of the first block with ratification data using a ratification key
multiple portions exceeds a first threshold for valid tamper - secret, the ratification data coding - consistent with the first
evident rewrites but does not exceed a second threshold for integrity output and the second integrity output.
valid non -tamper evident rewrites coding-consistent with In some implementations, the ratification data includes
the second integrity output. 55 the altered data ; and the rewrite circuitry is configured to
In another example , a method comprises : in a hardware rewrite the first block with the ratification data by perform
security system : determining, with processing circuitry, to ing a multiple trusted - party rewrite ratification for the block
rewrite original data in a selected block of a blockchain with chain .
altered data different than the original data previously stored In some implementations , the rewrite circuitry is config
in the selected block ; identifying a specific block of the 60 ured to : rewrite the first block with the altered data using a
blockchain , the specific block comprising: a first integrity key secret; and prior to rewriting the first block with the
output and a second integrity output ; determining, with the altered data , generate the key secret by combining multiple
processing circuitry and using a first key secret , collision portions of the key secret in a key secret exchange .
data including the altered data , the collision data : coding . In some implementations , the rewrite circuitry is config
consistent with the first integrity output; and coding -incon - 65 ured to combine the multiple portions by combining the
sistent with the second integrity output, the first and second multiple portions when a count of the multiple portions
integrity outputs generated responsive to and coding- con exceeds a first threshold for valid tamper- evident rewrites.
US 9 ,967,088 B2
41
In some implementations , the rewrite circuitry is config - In some implementations, the randomness field is nested
ured to combine the multiple portions by combining the within the first previous - hash field within the specific block
multiple portions when a count of the multiple portions to mask existence of the randomness field .
exceeds a first threshold for valid tamper - evident rewrites In some implementations , sending the delete instruction
but does not exceed a second threshold for valid non -tamper 5 includes complying with a data privacy rule .
evident rewrites coding -consistent with the second integrity In another example , a computer program or product
output . includes: a machine -readable medium other than a transitory
In another example , a method includes , in a hardware signal; and instructions stored on the machine-readable
security system : accessing , via communication interface medium
circuitry, a blockchain database configured to store a block - 10 cause a .system
The instructions are configured to , when executed ,
to : access a blockchain database configured
chain secured by a chameleon hash , the blockchain includ to store a blockchain secured by a chameleon hash , the
ing: a selected block including: a payload field ; and a blockchain including: a selected block including: a payload
randomness field ; a specific block subsequent to the selected field and a randomness field ; a specific block subsequent to
block on the blockchain , the specific block including a first
previous -hash field operable to store a first chameleon hash 15 the selected block on the blockchain , the specific block
including a first previous-hash field operable to store a first
output; and an intermediate block between the selected
block and the specific block on the blockchain , the first chameleon hash output; and an intermediate block between
chameleon hash output generated using content of the inter - the selected block and the specific block on the blockchain ,
mediate block as an input. The method further includes , in the first chameleon hash output generated using content of
the hardware security system : receiving a trusted -party 20 the intermediate block as an input. The instructions are
instruction to delete the intermediate block from the block - further configured to , when executed , cause the system to :
chain ; receiving , to facilitate performance of the instruction , receive a trusted -party instruction to delete the intermediate
an authorization to access a key secret for the chameleon block from theblockchain ; receive, to facilitate performance
hash , the authorization initiated by a trusted party for the of the instruction , an authorization to access a key secret for
blockchain ; using the payload field , the first previous-hash 25 the chameleon hash , the authorization initiated by a trusted
field , and the key secret as inputs , determining randomness party for the blockchain ; using the payload field , the first
data to write to the randomness field , the randomness data previous -hash field , and the key secret as inputs, determine
selected such that the chameleon hash is configured to yield randomness data to write to the randomness field , the
the first chameleon hash output is when : the intermediate randomness data selected such that the chameleon hash is
block is deleted from the blockchain ; and the chameleon 30 configured to yield the first chameleon hash output when :
hash is applied to the selected block . The method further the intermediate block is deleted from the blockchain ; and
includes : generating, at rewrite circuitry , a delete instruction ; the chameleon hash is applied to the selected block . The
and sending , to the blockchain database and via communi instructions are further configured to , when executed , cause
cation interface circuitry , the delete instruction . The delete the system to : generate a delete instruction ; and send, the
instruction includes : a first command to write the random - 35 delete instruction to the blockchain database . The delete
ness data into the randomness field ; and a second command instruction includes : a first command to write the random
to delete the intermediate block from the blockchain . ness data into the randomness field , and a second command
In some implementations, the intermediate block includes to delete the intermediate block from the blockchain .
one of multiple blocks between the selected block and the In another example , a system comprises : memory con
specific block on the blockchain . 40 figured to store a key secret for a chameleon hash that
In some implementations, the chameleon hash includes a secures a blockchain ; communication interface circuitry
rewritable cryptographic hash nested within a rewrite -pro - configured to : access the blockchain in the memory, the
tected cryptographic hash . blockchain comprising : a selected block comprising: a pay
In some implementations, the specific block further load field operable to store original data ; a first previous
includes a third previous -hash field , the third previous -hash 45 hash field operable to store a first chameleon hash output;
field including a write -protected hash output generated using and a randomness field ; a second block subsequent to the
a rewrite -protected cryptographic hash that secures the selected block on the blockchain , the second block com
blockchain in parallel with the chameleon hash . prising a second previous - hash field operable to store a
In some implementations, the rewrite -protected crypto - second chameleon hash output; and a third block preceding
graphic hash does not yield the write -protected hash output 50 the selected block on the blockchain , the first chameleon
when : the intermediate block is deleted from the blockchain ; hash output generated using content of the third block as an
and the rewrite -protected cryptographic hash is applied to input; receive a trusted -party instruction to perform a non
the selected block . tamper - evident rewrite to the payload field , the trusted -party
In some implementations, the trusted -party includes mul- instruction specifying altered data to replace the original
tiple individually untrusted parties ; and the method further 55 data previously stored in the payload field ; receive, to
includes combining multiple key secret portions controlled facilitate performance of the instruction , an authorization to
by the individually untrusted parties using a public key access the key secret within the memory, the authorization
encryption based exchange protocol. initiated by a trusted party for the blockchain ; and send a
In some implementations, determining the randomness rewrite instruction for the blockchain ; and rewrite circuitry
data includes successfully generating the randomness data 60 in data communication with the communication interface
when a count of the multiple key secret portions exceeds a circuitry and the memory, the rewrite circuitry configured to :
threshold for rewrite privileges . using the payload field , the first previous-hash field , and the
In some implementations, each of the multiple key secret key secret as inputs, determine randomness data to write to
portions contribute equally to the count. the randomness field , the randomness data selected such that
In some implementations, a first one of the multiple key 65 the chameleon hash is configured to yield the second cha
secret portions contributes more to the count than a second meleon hash output when : the payload field contains the
one of the multiple key secrets portions. altered data ; the randomness field contains the randomness
US 9, 967,088 B2
43 44
data; and the chameleon hash is applied to the selected the payload field ; receiving , to facilitate performance of the
block ; generate the rewrite instruction , the rewrite instruc instruction , an authorization to access a key secret for the
tion comprising: chameleon hash , the authorization initiated by a trusted
a first command to write the randomness data into the party for the blockchain ; and in rewrite circuitry of the
randomness field ; and a second command to replace the 5 hardware security system : using the payload field , the first
original data with the altered data ; and cause the commu- previous - hash field , and the key secret as inputs, determine
nication interface circuitry to send the rewrite instruction . randomness data to write to the randomness field , the
In some implementations, the chameleon hash comprises
a rewritable cryptographic hash nested within a rewrite randomness
configured to
data selected such that the chameleon hash is
yield the second chameleon hash output when :
protected cryptographic hash . 10
In some implementations, the second block further com field contains the contains
the payload field the altered data ; the randomness
prises a third previous -hash field , the third previous- hash is applied to the selected blockdata
randomness ; and the chameleon hash
; generate a rewrite instruc
field comprising a write - protected hash output generated
using a rewrite -protected cryptographic hash that secures the tion , the rewrite instruction comprising : a first command to
blockchain in parallel with the chameleon hash . is write the randomness data into the randomness field ; and a
In some implementations , the rewrite -protected crypto second command to replace the original data with the altered
graphic hash does not produce the write -protected hash data ; and sending , to the blockchain database and via
output when : the payload field contains the altered data ; the communication interface circuitry, the rewrite instruction .
randomness field contains the randomness data ; and the In some implementations, the chameleon hash comprises
rewrite - protected cryptographic hash is applied to the 20 a rewritable cryptographic hash nested within a rewrite
selected block . protected cryptographic hash .
In some implementations, the trusted -party comprises In some implementations, the second block further com
multiple individually untrusted parties ; and the rewrite cir - prises a third previous-hash field , the third previous -hash
cuitry is configured to combine multiple key secret portions field comprising a write - protected hash output generated
controlled by the individually untrusted parties using a 25 using a rewrite - protected cryptographic hash that secures the
public key encryption based exchange protocol. blockchain in parallel with the chameleon hash .
In some implementations, the rewrite circuitry is config - Various implementations have been specifically
ured to successfully generate the randomness data when a described . However , many other implementations are also
count of the multiple key secret portions exceeds a threshold possible . Headings and / or subheadings used herein are
for rewrite privileges. 30 intended only to aid the reader with understanding described
In some implementations, each of the multiple key secret implementations . The invention is defined by the claims.
portions contribute equally to the count.
In some implementations, a first one of the multiple key What is claimed is:
secret portions contributes more to the count than a second 1 . A system comprising:
one of the multiple key secrets portions. 35
35 memory
memory ;
In some implementations , the randomness field is nested a blockchain stored in the memory , the blockchain com
within the first previous -hash field within the selected block prising a selected block with original data , the block
to mask existence of the randomness field . chain secured by a first integrity output for a first
In some implementations, the altered data with respect to integrity code , the first integrity code is configured to
the original data comprises an addition of data to the payload 40 yield the first integrity output when applied to the
field , a redaction of data from the payload field , or both . original data ; and
In some implementations, the altered data with respect to rewrite circuitry in data communication with the memory ,
the original data comprises a redaction of data from the the rewrite circuitry configured to :
payload field ; and the rewrite circuitry is configured to access the blockchain ;
replace the original data with the altered data to comply with 45 access a key secret for the first integrity code , the key
a data privacy rule . secret facilitating identification of collision data , the
In some implementations, the system further comprises a collision data different from the original data , the
trigger configured to deploy an anti -theft countermeasure first integrity code is configured to yield the first
when activated ; and the memory comprises protected integrity output when applied to the collision data ;
memory coupled to the trigger . 50 receive a command to rewrite the original data in the
In another example , a method comprises , in a hardware selected block with altered data that is different than
security system : accessing, via communication interface the original data , the first integrity code does not
circuitry , a blockchain database configured to store a block yield the first integrity output when applied to the
chain secured by a chameleon hash , the blockchain com altered data ;
prising: a selected block comprising: a payload field oper - 55 generate additional data responsive to the key secret
able to store original data ; a first previous-hash field and the altered data ;
operable to store a first chameleon hash output; and a generate the collision data based on the altered data and
randomness field ; a second block subsequent to the selected the additional data ;
block on the blockchain , the second block comprising a rewrite the selected block with the collision data ; and
second previous-hash field operable to store a second cha - 60 after rewriting , cause communication circuitry to dis
meleon hash output ; and a third block preceding the selected tribute a blockchain update including the blockchain
block on the blockchain , the first chameleon hash output with a block other than the selected block omitted .
generated using content of the third block as an input; 2 . The system of claim 1 , where the altered data comprises
receiving, via the communication interface circuitry , a a redacted version of the original data , supplemental data
trusted -party instruction to perform a non -tamper -evident 65 relative to the original data , or both .
rewrite to the payload field , the instruction specifying 3 . The system of claim 1 , where the first integrity code
altered data to replace the original data previously stored in comprises a cryptographic hash , a chameleon hash , or both .
US 9 ,967,088 B2
45 46
4 . The system of claim 1 , where the blockchain comprises 17 . The product of claim 16 , where the multiple portions
a dual chain constructed from the first integrity code and a are stored in separate memory locations maintained by
second integrity code. individually -untrusted parties that together makeup a trusted
5 . The system of claim 4 , where the second integrity code party for the blockchain .
does not yield a second integrity output when applied to the 5 18 . The product of claim 17 , where the instructions are
collision data . further configured to prevent the individually -untrusted par
6 . The system of claim 5 , where the second integrity ties from individually obtaining knowledge of an entirety of
output is configured to act as a rewrite identifier that marks the key secret by combining the multiple portions using a
the blockchain as rewritten .
7 . The system of claim 4 , where : 10 public -key exchange protocol.
19 . A method comprising:
the first integrity code comprises a first chameleon hash ; accessing , via rewrite circuitry , a blockchain stored on
and memory, where:
the second integrity code comprises a rewrite -protected the blockchain comprises a selected block with first
cryptographic hash , a second chameleon hash , or both . 1 data ; and
8 . The system of claim 1, where the first integrity code the blockchain is secured by a first integrity output for
comprises an inner hash nested within an outer hash . an integrity code that is configured to yield the first
9 . The system of claim 8 , where : integrity output when applied to the original data ;
the inner hash comprises a chameleon hash that is con- accessing , via the rewrite circuitry, a key secret for the
figured to provide a hash output to the outer hash ; and 20 integrity code,
the outer hash comprises a rewrite -protected crypto the key secret facilitating identification of collision data
graphic hash . different from the original data , the integrity code is
10 . The system of claim 1, where the rewrite circuitry is configured to yield the first integrity output when
configured to access the key secret by combining multiple applied to the collision data ;
portions of the key secret. 25 determining to rewrite the original data in the selected
11 . The system of claim 10 , where the multiple portions block with altered data different than the original data ,
are stored in separate memory locations maintained by the integrity code does not yield the first integrity
individually -untrusted parties that together makeup a trusted output when applied to the altered data ;
party . generating additional data responsive to the key secret and
12 . The system of claim 10 , where the rewrite circuitry is 30 the altered data ;
configured to combine the multiple portions using a public generating collision data based on the altered data and the
key exchange protocol. additional data ; and
13 . A product comprising : rewriting the selected block with the collision data ; and
amachine -readablemedium other than a transitory signal; 35 after rewriting, distributing, via communication circuitry,
and a blockchain update including the blockchain with a
instructions stored on the machine -readable medium block other than the selected block omitted .
which , when executed , cause a processor to : 20 . The method of claim 19 , where accessing the key
access original data within selected block of a block - secret comprises : combining multiple portions of the key
chain , the original data secured by a first integrity 40 secret , the multiple portions stored in separate memory
output for an integrity code that is configured to yield locations maintained by individually - untrusted parties that
the first integrity output when applied to the original together makeup a trusted party.
data ; 21 . A method comprising :
determine to rewrite the original data in the selected in a hardware security system :
block with altered data different than the original 45 accessing, using processing circuitry, a key secret for a
data , such that rewriting the original data with the blockchain ;
altered data produces a tamper- evident rewrite ; determining , with the processing circuitry , to rewrite
access a key secret in memory ; original data in a selected block of the blockchain
responsive to the key secret, execute a non - tamper with altered data that is different than the original
evident rewrite of the blockchain that replaces the 30 data previously stored in the selected block ; and
original data with at least the altered data such that determining , with theprocessing circuitry and using the
the integrity code is configured to yield the first key secret, collision data including the altered data ,
integrity output when applied to the non - tamper the collision data coding- consistent with a previ
evident rewrite ; and ously determined integrity output stored within a
after rewriting, cause communication circuitry to dis specific block of the blockchain that follows the
selected block , the previously determined integrity
tribute a blockchain update including the blockchain output generated responsive to and coding -consistent
with a block other than the selected block omitted . with the original data ;
14 . The product of claim 13 , where the altered data rewriting the selected block with the collision data ; and
comprises a redacted version of the original data , supple - 60 after rewriting, distributing , using communication cir
mental data relative to the original data , or any combination cuitry , a blockchain update including the blockchain
thereof. with a block other than the selected block omitted .
15. The product of claim 13, where the integrity code 22 . The method of claim 21 , where rewriting the original
comprises a chameleon hash . data with the altered data comprises rewriting the original
16 . The product of claim 13 , where the instructions are 65 data with a redacted version of the original data , rewriting
further configured to access the key secret by combining the original data with supplemental data relative to the
multiple portions of the key secret. original data, or both .
US 9 ,967,088 B2
47 48
23 . The method of claim 21 , where :
the blockchain is secured by an integrity code comprising
a cryptographic hash , a chameleon hash , or both ; and
the key secret is specific to the integrity code .
24 . Themethod of claim 21 , where the blockchain com - 5
prises a dual chain that uses a first integrity code and a
second integrity code.
25 . The method of claim 24 , where the altered data
comprises a coding - inconsistency with a second integrity
output of the second integrity code, the second integrity 10
output different than the previously determined integrity
output .
26 . The method of claim 25 , where the coding -inconsis
tency with the second integrity outputof the second integrity
code is configured to act as a rewrite identifier thatmarks the 15
blockchain as rewritten .
27 . The method of claim 24 , where :
the first integrity code comprises a first chameleon hash ;
and
the second integrity code comprises a rewrite -protected 20
cryptographic hash , a second chameleon hash , or both .
28 . The method of claim 24 , where the first integrity code
comprises an inner hash nested within an outer hash .
29 . The method of claim 28 , where :
the inner hash comprises a chameleon hash configured to 25
provide a hash output to the outer hash ; and
the outer hash comprises a rewrite -protected crypto
graphic hash .
30 . The method of claim 21 , where accessing the key
secret comprises combining multiple portions of the key 30
secret .
* * * * *