Keeping Blockchain Data Private For Enterprise Applications

As more enterprise-focused blockchain applications are moved into production, the question of data privacy has become a key consideration.

Privacy is a big concern with blockchain technology due to its decentralized nature. Where centralized networks are operated by a single, trusted entity that's able to view and control access to all of the data moving across it, decentralized infrastructures are transparent. The transaction data is shared between all participants as a matter of course. This is a fundamental aspect of blockchain that allows all parties to agree on transaction validity through a process known in the industry as "consensus". But while consensus ensures a blockchain is immutable and can't be tampered with, it becomes a problem in cases where an organization wants to keep transaction data private.

Taking Bitcoin as an example, we can use a blockchain explorer to view every single transaction that has ever been made. These are recorded onto each individual node that supports the Bitcoin blockchain. Though all we can see is the transaction amounts and the sending and receiving address, it is not impossible to identify the individual or organization that owns a specific wallet.

So blockchain presents a conundrum, in that data must be shared to validate transactions, even though certain users may not wish to share this data. Luckily, there are a few projects working to implement solutions to this problem and pave the way for enterprises to use blockchains to support their applications and keep their data secure.

Trusted Execution Environments

Trusted computing is a concept that's derived from the world of video games, and refers to certain situations where a games console may have more details of what's happening in a game than the person playing the game. In a multiplayer first-person shooting game such as Call of Duty, for instance, the player might be unaware that their opponent is hiding behind a wall, waiting for the right moment to pop out and snipe them. However, the location of the opponent will be known to the console itself, even if the player has no knowledge of it.

Consoles can do this thanks to a feature known as Security Guard Extensions (SGX), which is found in modern central programming units. SGX uses what are known as "trusted execution environments" (TEE), which are an isolated part of the chip's memory that can only be accessed via a specific application programming interface (API). Because the TEE cannot be accessed any other way – not even by the BIOS or operating system, it's sometimes known as a "secure enclave". There is also a private key that's unknown to the owner of the console, which is used to decrypt data within the TEE to ensure logic on that data can be executed while it remains secret.

Some very smart minds are working to implement TEEs in the context of blockchain transactions to ensure they can be encrypted and sent to SGX-equipped nodes to be validated. For example, Hyperledger Sawtooth is an enterprise solution for building, deploying, and running distributed ledgers. With Hyperledger Sawtooth, SGX nodes decrypt each transaction and validate them within a TEE. If the node decides the transaction is valid, it can be signed inside the TEE using the private key. In this way, it becomes possible for multiple machines owned by different individuals or organizations to validate blockchain transactions, while simultaneously ensuring that the exact details of each transaction are kept secret. This is possible because no one, not even the operator of the SGX-equipped node, can access the confidential data within the TEE.

A second company working to develop blockchain-based TEEs is Visa, which has created a system called LucidiTEE that works in much the same way as Hyperledger Sawtooth, enabling multiple parties to jointly compute private data on-chain while guaranteeing policy compliance.

While TEEs are certainly a very promising technology, enterprises may be worried that a number of security vulnerabilities have been found in SGX.

Zero Knowledge Proofs

Due to the security concerns of TEEs, some projects are instead pinning their hopes on advanced cryptography to ensure data stays hidden, while providing just enough information about that data to validate transactions.

Obviously, it isn't possible to just obscure blockchain transaction data completely because it would mean transactions are impossible to verify. What's needed is a bit more balance, which can be achieved through a technique that's known as zero-knowledge proofs.

A zero-knowledge proof is able to prove that a certain piece of information is known, without revealing exactly what that information is. In other words, zero-knowledge proofs can be thought of as an indirect kind of proof of data, allowing two parties to prove they know a secret without sharing the details with anyone else.

One of the best examples of this is the anonymous cryptocurrency protocol Monero, which relies on "ring signatures" to hide the sender of a transaction, in combination with homomorphic encryption to verify that the sum of inputs relating to a transaction is equal to the sum of its outputs. Finally, it uses zero-knowledge proofs to validate that a secret number – the amount of XMR sent in the transaction – is within a known range of between 0 and a very large number, thereby proving that the amount sent is correct.

Monero is well known for its ability to process transactions anonymously, and other projects are aiming to take this concept further. For instance, Manta Networks relies on a variation of ZK-proofs known as zkSnarks to be able to obfuscate transaction amounts and the addresses of the sender and receiver in DeFi transactions. This is an essential capability for DeFi to become more widespread among institutional investors. After all, the last thing big businesses want to do is leave a data trail of all of their transactions for their competitors to see.

Crucially, Manta is building on the Polkadot blockchain, which is an interconnected ecosystem of various blockchains that are built to host different kinds of decentralized apps. Through its privacy-preserving zkSnarks, Manta is making it possible to verify information publicly on that blockchain, while ensuring that data cannot be seen by other users. It can even do this for cross-chain transactions within the Polkadot ecosystem.

For businesses who want to use blockchain privately, ZK-proofs are an encouraging development that has already been used in the wild on multiple public networks.

Parallel Blockchains

A unique alternative to the complexity of Zk-proofs is ParallelChain Lab's idea of a twin public-private blockchain infrastructure.

ParallelChain is a Layer-1 infrastructure much like Ethereum, with the main difference being that it offers two, interconnected blockchain networks, one public and one private. This flexibility can allow ParallelChain to provide a secure solution to any business looking to create secure decentralized applications.

ParallelChain Private was first launched back in 2018 and provides the infrastructure for high-performing, privately-owned applications for various enterprise use cases. It claims to support a blazing-fast 120,000 transactions per second with low latency of just 0.003 milliseconds on average. This enables it to accommodate enterprise applications for supply chain tracking, data security monitoring, AI applications and more.

ParallelChain Private is defined by several capabilities, including data privacy protection and GDPR compliance. Further, it also provides Proof-of-Immutability (PoIM) to prove its private network is tamper-proof without exposing the data stored upon it.  Finally, it also provides biometric identification capabilities, allowing users to access a wallet using biometrics only, instead of a traditional passphrase.

As for ParallelChain Mainnet, scheduled to launch later this year, it is designed to support decentralized applications that can be accessed by anyone, similar to a traditional blockchain like Ethereum. Thanks to its unique proof-of-stake consensus mechanism, it delivers both high performance and the flexibility required to support decentralized exchanges, GameFi, NFTs and other kinds of decentralized applications.

The real secret sauce that splices everything together for enterprises is ParallelChain's interoperability protocol, which enables inter-ParallelChain communication. Through this, a ParallelChain Private deployment can communicate directly with ParallelChain Mainnet, enabling any application developed on the former to run perfectly on the latter. In this way, ParallelChain is in a unique position to bridge the gap between traditional, centralized systems and their decentralized counterparts. It creates an innovative method of connectivity that allows decentralized applications to tap into private data that will remain stored on a private blockchain network for security reasons.

Selective Multi-Casts

Selective multi-casts are an extension of "multicast networking", where data transmission is addressed to a group of destination computers simultaneously. But instead of sharing data between all nodes on a network, selective multi-casting only sends transaction information to the specific parties involved in validating that transaction, along with an optional consensus service known as a "notary".

This is the idea being pursued by Corda, which is an open-source blockchain platform that's aimed specifically at businesses. The platform makes it possible for companies to build interoperable blockchain networks for applications that are restricted by privacy and compliance regulations.

Corda is notable for its advanced privacy features that are designed to ensure business transactions remain private, even though they're also publicly validated. What's key to understand is that every participant in the network is "known", and must first undergo KYC before they can begin using it.

The way it works is this. If Adam wants to send a token representing $10 to Bob, the transaction will not be shared with the entire network. Instead, only the sender and the recipient of that token will share the transaction data, along with the optional notary service, if used. The recipient of the token (Bob) also receives the transaction history of the token they received, allowing them to verify that the person who sent it (Adam) received it legitimately in the first place. Once that token is transferred to another participant, the new recipient will be able to verify that Bob also received the token legitimately. In this way, illegitimate tokens will be discovered as soon as they're sent to a new user.

Depending on the exact mechanism chosen, the optional notary service will either receive the full transaction history of that token as well, or a simple hash of that transaction.

There's a trade-off here, because using a validating notary will make the network tamper-resistant, as it means only valid transactions can be recorded on the distributed ledger. However, it also requires participants of that transaction to share private data with the notary. On the other hand, they can use a non-validating notary in order to keep the transaction data private. The risk with this is that the distributed ledger is not tamper-proof. Still, this may not be a concern in networks where all participants are known.