A outer circumferential part of a body to be coupled having an annular groove formed 31 in the outer periphery of a shaft 1 is press-fitted into the inner circumferential part of a coupling hole in the central portion of a hub 2, the vicinity of the hole in the end of the hub is plastic-deformed over the whole periphery, and material for the hub is caused to plastic-flow so as to bury a recess of the shaft, and to apply compression stress to the shaft, whereby a coupling force between a thin hub and a small diameter shaft is obtained by shearing force and compressing force of the material for the hub.

The present invention relates to a method for coupling a shaft with a hub of a spindle motor having a dynamic pressure bearing construction, which motor is a spindle motor used for a disk device, DVD, and CD-ROM of a computer or the like, particularly, a thin-type hard disk drive motor mounted on a portable personal computer such as a note-type personal computer.
Conventional methods for coupling a shaft with a hub include methods such as press-fitting, shrink fitting, and joining by way of adhesives, and welding.
However, in these conventional coupling methods, where a small diameter shaft (for example, 3 mm of outside diameter) is coupled with a thin hub (for example, 1 mm of thickness) of a dynamic pressure bearing type spindle motor of a thin type hard disk device, the respective methods had the following problems.
As is well-known, the press-fitting method has a limit in strength and particularly is weak in shock. In the shrink fitting method, since a shaft is small in diameter, a shrink fitting allowance cannot be secured, and the method has a limit in strength, similarly to the press-fitting. Further, heating is necessary, and the precision after shrink fitting is poor, so that after coupling processing is necessary. Furthermore, it takes much time for heating and cooling, resulting in poor productivity.
In the method using the adhesive, since the length of adhesion is short, the method has a limit in strength and is weak in shock. The extra adhesive forced out from the joined part adversely influences on the performance of a motor. Furthermore, setting of the adhesive requires time and heating, thus lowering the productivity.
In the welding method, the thermal deformation occurs, and particularly, the bend occurs due to the thermal shrinkage, failing to secure the accuracy. Where the material for a shaft comprises a martensite texture of high volume of carbon such as SUS440C, there was a problem such that a crack occurs in the shaft. Further, an expensive machine such as a laser welder was necessary.
As described above, in the conventional methods, it was difficult to achieve the coupling capable of securing the strength such as loose, bending, turning torque or the like necessary for stress occurring in the coupled part between a shaft and a hub by clamping a disk to the hub, and the run out accuracy relative to the surface of the disk on which the shaft and the hub are mounted, and the coupling for giving sealing properties to the coupled part.
The present invention has been accomplished in order to solve the problems noted above with respect to prior art, and provides a method for coupling a small diameter shaft with a thin hub with high strength and high accuracy, and a coupling method for giving high sealing properties to the coupled part.
For achieving the first object, according to the present invention, there is provided a method comprising: press-fitting an outer circumferential part having an annular groove formed in the outer periphery of a shaft into a coupling hole in the central portion of a hub; plastic-deforming the vicinity of the hole in the end of a hub over the whole periphery; and causing material for the hub to plastic-flow so as to burry an recess of the shaft by the plastic-deformation and to apply compression stress to the shaft; whereby the coupling force is obtained by shearing force and compressing force provided by the material used for the hub, to couple the shaft with the hub. For achieving the second object, there is provided a method comprising: press-fitting an outer circumferential part having a plurality of annular grooves formed in the outer periphery of the shaft and being provided with a crest of a cylindrical part between the grooves into a coupling hole in the central portion of the hub; plastic-deforming the vicinity of the coupling hole in the end of the hub over the whole periphery; and causing material for the hub to plastic-flow so as to burry an recess of the shaft by the plastic-deformation and to apply compression stress to the shaft; whereby the coupling force is obtained by shearing force and compressing force provided by the material used for the hub, to couple the shaft with the hub. In this case, it is essential to adopt the press-fitting for coupling force.
According to the present invention as constructed above, even in coupling between a thin hub and a small diameter shaft, the satisfactory strength and accuracy, and sealing properties are obtained, and coupling can be attained with excellent productivity by inexpensive equipment.

Press-fit and plastic-flow coupling of a shaft to a hub of a disk device


A tag authentication method, and a tag and reader performing the method are provided. The tag authentication method, including: a reader generating a first random number and transmitting the first random number to a tag; the reader receiving a second random number and a first verification value from the tag; the reader computing a second verification value based on the first random number and the second random number; and the reader comparing the first verification value and the second verification value.

1. Field of the Invention
Aspects of the present invention relate to a tag authentication method using rotation, and a tag and reader performing the method.
2. Description of the Related Art
A personal area network (PAN) refers to a communication network to process necessary information using a portable information terminal. The PAN is smaller than a local area network (LAN), and includes a system which transmit/receives various information using a personal information terminal or a system which uses saltwater of a human body as a conductor to exchange information easily. In the system using saltwater as a conductor, an electric signal of a card computer is transmitted to another card computer by shaking hands. For another example, the PAN can be configured using a radio frequency identification (RFID) system.
The RFID system wirelessly receives/transmits various kinds of data using a particular frequency band. A magnetic strip, a barcode, and the like are easily damaged by wear and a recognition performance thereof gradually deteriorates. However, an RFID system can overcome the above-described disadvantages in the magnetic strip, the barcode, and the like. Accordingly, the RFID system is replacing barcode and magnetic cards in the marketplace, and is the fastest growing segment in security services, time cards, parking management, and goods distribution management fields.
FIG. 1 illustrates an example of a typical RFID system. The RFID system described above generally includes a tag 101, a reader 102, and a back-end database 103. In this instance, a communication environment between the reader 102 and the back-end database 103 can be a secure channel 104, and a communication environment between the reader 102 and the tag 101 can be an insecure channel 105.
As described above, since an insecure channel 105 is used between the reader 102 and the tag 101 in the RFID system, a reliable tag authentication method and a system which can prevent tag spoofing and securely authenticate the tag are needed.

Tag authentication method using rotation, and tag and reader performing the method


A system for passively cooling an electronic component includes a conduit configured to carry a pressurized cooling fluid. The conduit has a plurality of delivery orifices configured to dispense the pressurized cooling fluid from the conduit to cool the electronic component. Each delivery orifice has a hydrogel mechanism associated therewith, which is configured to individually control each of the plurality of delivery orifices to automatically regulate flow of the cooling fluid in response to a variation in a property of an ambient environment surrounding the hydrogel mechanism. The property of the ambient environment is influenced by an operation of the electronic component.

Various systems require the adjustment of environmental conditions to function at or near optimal levels. For example, many electronic and mechanical systems operate inefficiently, or will even fail, in the presence of excessive heat. This problem is exacerbated by the fact that most electronic and mechanical systems generate their own heat as a by-product of their operation. Therefore, a cooling system is desirable to decrease the heat in such electronic and mechanical systems. Similarly, alkalinity, humidity, and other environmental properties also affect various electronic, mechanical, chemical, and biological systems.
With the advent of more powerful electronic components having increasingly large component densities, the removal of heat, in particular, has become an increasingly challenging technical issue. Furthermore, typical processor boards can, in some instances, include multiple central processing modules (CPUs) modules, application-specific integrated circuits (ASICs), and static random access memory (SRAM), ac/dc converters, as well as other components, which may all contribute to the generation of heat. Heat sinks are often employed to increase the heat-dissipating surface area of such devices. However, heat sinks, and their interfaces to the electronic components, often interfere in the heat flow, which often leads to uneven cooling.
Other known cooling methods for electronic components include free-flowing and forced-air convection, free-flowing and forced-liquid convection, pool boiling (that is, boiling a liquid cooling fluid off of a submerged device), and spray cooling (that is, boiling a liquid cooling fluid off of a device being sprayed with the liquid). Because liquids typically have a high latent heat of vaporization, these latter two methods provide for a high heat-transfer efficiency, absorbing a large quantity of heat at a constant temperature. Typically, the cooling fluid used has a relatively low boiling point and is inert to the heat source.
Current spray cooling systems employ either pressurized liquid spraying or pressurized gas atomizing. Both techniques require the use of mechanical valves, which must be monitored, controlled and actuated by electronic and/or physical means. Thus, separate systems are generally required to facilitate spray cooling of electronic components. These additional monitoring and control systems add undesirable complexity and expense to cooling systems, while also adding another device that may require maintenance. Moreover, in electronic systems where space is a premium, additional monitoring and controls systems consume valuable real estate and increase the size of electronic systems.

Passive cooling in response to ambient environmental properties

Hewlett-Packard Development Company, L.P.


Provided are a computer program product, system, and method for using queues corresponding to attribute values and priorities associated with units of work and sub-units of the unit of work to select the units of work and their sub-units to process. There are a plurality of work unit queues, wherein each of the work unit queues are associated with different work unit attribute values that are associated with units of work, wherein a plurality of the work unit queues include records for units of work to process having work unit attribute values associated with the work unit attribute values of the work unit queues, and wherein the work unit queues are each associated with a different priority. A record for a unit of work to perform is added to the work unit queue associated with a priority and work unit attribute value associated with the work unit.

1. Field of the Invention
The present invention relates to a computer program product, system, and method for using queues corresponding to attribute values and priorities associated with units of work and sub-units of the unit of work to select the units of work and their sub-units to process.
2. Description of the Related Art
To perform work in a workload management environment, the workload manager may queue units of work in a work queue and then select the units of work from the queue to process. A workload process may search through the queued data to find a "best candidate" to process, using an algorithm to provide the required fairness. One drawback of this type of "best candidate" selection process is that it requires searching through large amounts of queued data looking for the "best candidate". Another aged selection criteria that may be used in conjunction with best candidate algorithm selects queued data that has been on the queue for an excessive duration. The combination of these two algorithms independently working on the queue may yield unpredictable selection results.
When processing a volume to transfer having extents spread across ranks of disks in a Redundant Array of Independent Disk (RAID) configuration, the volume may be divided into parts to process and the parts may be processed according to their RAID rank. In certain implementations, there may be part agents to process different parts of the volume, and each part agent would process tracks in a RAID rank assigned to that part process.
There is a need in the art for improved techniques for queuing units of work to process.

Using queues corresponding to attribute values and priorities associated with units of work and sub-units of the unit of work to select the units of work and their sub-units to process

INTERNATIONAL BUSINESS MACHINES CORPORATION


Method for the secure execution of programs (smart contracts) implemented between a first wallet node (WN) (WN1) and a second wallet node (WN2), at least the second WN being implemented in an enclave of a processor, and the WNs being capable of executing programs designated in the messages that reach them, the method comprising the following steps: a) sending by WN1 to WN2 of a pre-message; b1) in response to this pre-message, execution in the enclave of a first program (WNRoT); b2) generation by the enclave of a certificate of authenticity of said first program and of the integrity of its execution; b3) sending said certificate to WN1; c) verification by WN1 of said certificate; d) in the event of successful verification, sending by WN1 to WN2 of a message intended to trigger the execution of a given program in WN2, and e) execution of said program in WN2.

It will be noted here that some parts of the following description are in English, their faithful translation into French also to be regarded as forming part of the description. Moreover, reference will be made to application WO2016120826A2 in the name of the applicant, the contents of which are incorporated here by reference.
The decentralized PGP trust model is already known (Web-of-Trust, 1992) enabling peers to act as introducers and validators of public keys and proposing a decentralized validation metric of a digital identity, which is focused on the email addresses of the peers in question. Other approaches have since been proposed to establish identity without the certification authority (like those by Carl Ellison in 1996). Moreover, methods are known using an "out-of-band channel" approach and requiring the use of a reliable terminal to perform a secure exchange of public keys when faced with the risk of a "Man-in-the-Middle (MitM) attack," specifically the SafeSlinger method [http://www.netsec.ethz.ch/publications/papers/farb_safeslinger_mobicom2013.pdf] designed to optimize the case where each of the users in a group, such as in a "key signing party," exchanges keys with all of the other users.
The invention aims firstly to enable a decentralized identification that is both simple and of broader use, and directly meets the requirements of implementing "smart contract" type executable commitments [https://en.wikipedia.org/wiki/Smart_contract], now used in consensus protocols, particularly in a permissionless environment where anyone can join and leave dynamically, and where there is no prior knowledge of the consensus nodes, usually supported by computational puzzles [Dwork & Naor, 1992: http://www.hashcash.org/papers/pvp.pdf; Back, 2002: http://www.hashcash. org/papers/hashcash.pdf] to counter "sybil attacks" and with the theory that a major part of the calculation power is held by honest participants [Nakamoto, 2008: https://bitcoin.org/bitcoin.pdf]. The state of the art as regards smart contracts is mainly represented by the Ethereum system [https://github.com/ethereum/wiki/wiki/White-Paper]. There is no known implementation of smart contracts (with no trusted third-party), whose security is based on the hardware of trusted manufacturers.
New architectures of processors, such as the ARM processors or the more recent Intel processors, enable "Trusted Execution Environments" (TEE), such as the SGX enclaves of Intel processors, to be used. However, these enclaves are currently proposed only for the more lightweight protocols based on blockchain. For example, the PoET protocol proposed by Intel is still based on a blockchain.
One aspect of the invention is to enable the use of such secure environments in order to do away with blockchain or to make it optional. The invention aims more specifically an implementation on hardware that is available to a large number of manufacturers, in order to achieve decentralization even with respect to the manufacturers themselves, and also aims to propose decentralized identification mechanisms that mitigate Sybil attacks (when an adversary creates any number of new nodes that it controls within the network).
Another aspect of the invention is to be able to make wallet node type entities and secured unit type entities (TEE) cooperate together, specifically SGX type enclaves of Intel processors (hereinafter, the word "enclave" will describe such an enclave or generally any TEE). Thanks to the hardware, the invention aims not only for the advantages of speed (consensus by blockchain is slow) and cost (transaction fees), but also qualitative advantages that will be discussed later. The blockchain approach involves by nature a data structure that is centralized but also replicated on a large scale. The real decentralization proposed by the invention does away with the need for "scaling" which constitutes the most high-priority challenge for Bitcoin and Ethereum today.
According to a first aspect, a method is proposed for the secure execution of programs (smart contracts) implemented between a first WN (WN1) and a second WN (WN2), at least the second WN being implemented in an enclave of a processor, and the WNs being capable of executing programs designated in the messages that reach them, the method comprising the following steps:                a) sending a pre-message by WN1 to WN2;        b1) in response to this pre-message, execution in the enclave of a first program (WNRoT);        b2) generation, by the enclave, of a certificate of authenticity of said first program and of the integrity of its execution;        b3) sending said certificate to WN1;        c) verification by WN1 of said certificate;        d) in the event of successful verification, sending by WN1 to WN2 of a message intended to trigger the execution of a given program in WN2, and        e) execution of said program in WN2.
Some preferred but optional aspects are as follows:                step b2) also comprises the generation of a nonce, step b3) also comprises the sending of said nonce to WN1, and the method furthermore comprises, before step d), a step implemented at WN1 of encryption of the message to be sent with the nonce, and before step        e), a step implemented at WN2 of decryption of said encrypted message;        the designation of a program to be executed in a WN is performed by a hash of the contents of said program;        said pre-message contains a designation of said given program, with a view to pre-loading said program by WN2 into a working memory;        WN1 is also an enclave of a processor, in which at each receipt of a pre-message or a message by WN2 coming from WN1, WN2 verifies the presence in this pre-message or message of a certificate of authenticity and integrity of execution of a program executed in        WN1, and having triggered the sending of this pre-message or message;        the method also comprises:                    between steps a) and c), a step of generation by WN2 of a pair of public/private keys derived from a secret key of WN2 and from the designation of said given program;            before step d), a step of sending the public derived key to WN1;            before step d), a step of encryption of a data part of said message with said public derived key in WN1, and            after step d), a step of decryption in WN2 of said data part with the private derived key;                        said pair of derived keys is also generated from designation information contained in the pre-message;        the step of sending the public derived key to WN1 is implemented during step b3).
According to a second aspect, a method is proposed for the secure execution of transactional programs implemented between a first WN (WN1) and a second WN (WN2), WN1 and WN2 each being either an enclave of a processor or a dedicated SoC, in which the WNs are capable of communicating by transactional messages containing a designation of a program to be executed in the receiver WN, and a pair of WNs exchanging transactional messages, both executing the same program in secure conditions.
According to a third aspect, a method is proposed for securing the operation of a network of nodes (WNs) capable of executing programs (WPs) in response to the receipt of messages (WMs), the nodes being implemented by an enclave of a processor or by an SoC and the nodes being capable of being linked together on the basis of connection weight values, comprising the following steps:                assign to each node at least one countersigner node having a connection weight in relation thereto;        for each node, keep a list of countersigner nodes capable of receiving messages from the node in question, each node and its countersigner nodes forming a set of mirror nodes;        date or authorize a message between an emitter node and a receiver node based on coherence constraints at the mirror nodes to which the emitter node and/or receiver node belong.
In another field (subsequently Weighted Lightning Network), according to a fourth aspect of the invention, a transactional system is proposed with peer-to-peer architecture, implementing unit of account transfer transactions between unit emitter nodes and unit receiver nodes, each incoming transaction having an input referring to an output of a previous transaction (or several inputs each referring to an output of a previous transaction) and itself having at least one new output specifying a number of units of account and a receiver node, each transaction capable of being validated in response to a broadcast, by insertion, in a blockchain stored in a distributed manner between at least some nodes, of at least one signature of the transaction, at least some nodes also being capable of exchanging units of account by transactions without compulsory broadcast via payment channels between nodes, each node having a channel (Ch(i,j)) with another node possessing a ceiling (C(i,j)) of units of account transferable through this channel without the need to broadcast, and a transfer of units of account between two nodes, the transfer being capable of being performed via a node chain having in pairs a payment channel, characterized in that the nodes have connection weights (W(i,j)) with respect to other nodes, representative of a degree of trust or proximity between the nodes or users associated with the nodes, and in that it comprises means of adjustment of the unit of account ceiling of a given node on a given channel based on a connection weight of said node with respect to the node with which it possesses said given channel.
Some preferred but optional aspects are as follows:                the adjustment involves a raising of the ceiling in relation to the weight;        the weight of one node with respect to another is determined on the basis of the existence of real connections (IRL Connections) or quasi-real connections in the surroundings of both nodes.
According to a fifth aspect (subsequently Manufacturer's Weight), a transactional system is proposed with peer-to-peer architecture, to execute secure transactions using hardware nodes (SoC; enclave) capable of being manufactured by manufacturers in a decentralized manner, each node having, with respect to another node, a degree of trust or proximity embodied chiefly by a connection weight or by a number of mirror nodes in common between both nodes,
characterized in that it comprises means to assign to each manufacturer a manufacturer's weight, and to adjust the degree of trust of a hardware node with respect to another node (not necessarily a hardware node) based on the manufacturer's weight of the manufacturer of this hardware node.
Some preferred but optional aspects are as follows:                the manufacturer's weight is linked to the number of hardware nodes manufactured by the manufacturer in question;        the manufacturer's weight is linked to the number of active hardware nodes in the system and manufactured by the manufacturer in question;        the system comprises means for determining the activity of a hardware node based on the existence of transactions using said node;        the system comprises means for determining the activity of a hardware node based on the existence of interactions with other nodes and on connection weight values of the nodes involved in these interactions.
According to a sixth aspect (subsequently Body SoC and Body Enclave), a secure processor (SoC; enclave) is proposed, characterized in that it is capable of hosting a plurality of WNs of a network, and in that it comprises a cryptographic memory management unit (CMMU) with encryption, capable of ensuring a secure execution of programs in which:                stored (or dynamically regenerated) in the CMMU is a secret program encryption key that can only be accessed by the CMMU;        the CMMU is capable of storing at least one program to be executed after encryption by the CMMU with the aid of said secret key and of generating a hash of the program or of each program enabling the encrypted program to be found;        said processor is capable of executing programs only at the command of the CMMU;        the interactions between network nodes are performed exclusively by messages and the messages are received/emitted exclusively by the CMMU;        the messages contain the identification of a receiver WN hosted in the processor and the identification of a certain program to be executed by the receiver WN, identified by its hash;        in response to the receipt of a message:                    the processor initializes as a receiver WN and the CMMU (i) accesses the encrypted program to be executed by this WN on the basis of the hash of the program received in the message (specifically via a PHT), (ii) decrypts the program instructions, and (iii) transmits to the processor to execute the decrypted instructions concerning said received data,            the processor storing for each hosted WN a pair of keys intended for the signature of contents of messages generated by said WN with the aid of the private key of said pair.
Some preferred but optional aspects are as follows:                at least one hosted WN constitutes a countersigner WN of another WN within a group of mirror WNs, the pair of keys of this countersigner WN being identical to the pairs of keys of the other WNs of said group;        the processor is capable of storing processor variables, WN variables and WP variables separately from one another;        the processor is associated with an SAM and the processor variables comprise activation or sensor data associated with said module, accessible by at least two WNs.
According to a seventh aspect (subsequently Guard WN), a transactional system with peer-to-peer distributed architecture is proposed, implementing transactions with cryptographic security for the transfer of units of account between unit emitter nodes and unit receiver nodes, each incoming transaction having an input referring to an output of a previous transaction (or several inputs each referring to an output of a previous transaction) and itself having at least one new output specifying a number of units of account and a receiver node, each transaction capable of being validated in response to a broadcast, by insertion, in a blockchain stored in a distributed manner between at least some nodes, of at least one transaction signature, at least some nodes also being capable of exchanging units of account by transactions without compulsory broadcast, broadcast, it being possible to associate to each node information on the degree of trust or proximity with respect to another node, the system comprising means, within an uptree chain of transactions that have not been broadcast, capable of determining whether the information on the degree of trust or proximity of at least one node, among the nodes (GuardWNs) having generated the farthest upstream transactions in said chain, with respect to the node having received the farthest downstream transaction in the chain, satisfies a determined criterion and, in the affirmative, accepting said farthest downstream transaction.
Some preferred but optional aspects are as follows:                the degree of trust or proximity information contains a number of mirror nodes in common between at least one node, among the nodes having generated the farthest upstream transactions in said chain, and the node having received the farthest downstream transaction in the chain;        each node is designed to sign a transaction as a GuardWN only if the outputs of said transaction require its signature in the transactions that said transaction will feed, so that a GuardWN having generated a farthest upstream transaction that is farthest upstream controls the transactions (avoids double spending) that will be fed by the transaction that is farthest downstream;        each node is designed to sign a transaction as a GuardWN only if the outputs of said transaction require its signature in the transactions that said transaction will feed, so that a GuardWN having generated a transaction that is farthest upstream controls (avoids double spending) on the entire dtree of downstream transactions starting with itself;        the request for signature by a GuardWN is extended to each collateral node of another node (these two nodes being respective signer GuardWNs required on the outputs of two transactions feeding in common the same downstream transaction) whose signature is required.
According to another aspect, a system-on-chip is proposed, capable of receiving messages in order to execute programs in secure execution conditions, in which is stored a secret key (SK) constituting the private key of a pair of public/private keys, comprising:                means that are capable, on receiving a message from another system-on-chip system (WN or secure unit (enclave) of a processor), of deriving a new pair of keys called derived keys from said secret key SK and information contained in the message received, and of sending the public derived key to said other WN or enclave, and        means capable, on receipt, from said other WN or enclave, of a message containing the same information, of decrypting another part of said message with said private derived key.
According to another aspect, a method is proposed, executed in a secure unit (enclave) of a processor, comprising, upon receipt of a message from either a system-on-chip or a secure unit of another processor (another enclave), the following execution steps implemented without leaving the enclave:                derive a pair of derived keys from the secret key SK of the enclave and from information contained in said message,        send the public derived key to said WN or other enclave, and        wait for the receipt from said WN or other enclave of an additional message containing the same information, and        upon receipt of said additional message, decrypt another part of said message with the private derived key.
Some preferred but optional aspects are as follows:                the step of sending also involves sending a certificate of authenticity and integrity of execution of the program in the process of execution;        the method comprises an additional step preceding the step of sending and consisting in generating a random key, the step of sending comprising sending this random key to said WN or other enclave, and in which the step of decrypting uses said random key.
According to another aspect, we propose a method executed in a secure unit (enclave) of a processor comprising, upon receipt of a message from either a system-on-chip or a secure unit of another processor (other enclave), the following execution steps implemented without leaving the enclave:                generate a random key;        send said random key to said WN or other enclave, and        wait for the receipt from said WN or other enclave of an additional message containing the same information, and        upon receipt of said additional message, decrypt another part of said message with said random key.
Some preferred but optional aspects are as follows:                the method comprises, following receipt of the additional message and without leaving the enclave, a step of loading and executing a program corresponding to said information contained in the message and taking as an input said other decrypted part;        the method also comprises, on execution of the program, the generation of a message bound for a WN or other enclave, containing said information as well as a certificate of execution of said program corresponding to said information.
According to another aspect, a processor is proposed that comprises a secure unit (enclave), said enclave comprising:                a secret key;        means to generate a secret key derived from a combination of said secret key and other information;        means to load, via a correspondence table, a program corresponding to given information and for executing said program, characterized in that said enclave also comprises means that are capable:        upon receipt of a message, part of which is encrypted and can only be decrypted by means of said derived key;        of activating said means in order to generate this derived key on the basis of said other information contained in the message received;        of loading, without leaving the enclave, a program corresponding to said other information and of executing said program on the input data containing the message received, of which said encrypted part has been decrypted by means of the secret derived key.
According to another aspect of the invention, a processor is proposed comprising a secure unit (enclave), said enclave comprising:                a secret key;        means to load via a correspondence table a program corresponding to given information and to execute said program, characterized in that said enclave comprises means that are capable, on receipt from a WN or another enclave of a message containing given information, of loading a first program and of executing it in a secure manner, this execution comprising the following steps:        a) sending to this WN or other enclave a request comprising:                    a certificate signed by the enclave with its secret key and certifying that this first program is in the process of execution;            a random key;                        b) loading via a correspondence table a program corresponding to said information, and waiting for the response to the request sent at step a);        c) on receipt of this response, the latter comprising at least one part (payload) encrypted by means of said random key, decrypting said encrypted part (payload), and        d) triggering the execution of the program on input data containing the response received, after decryption.
Some preferred but optional aspects are as follows:                the request sent at step a) also contains an identifier of said received message;        the request sent at step a) is encrypted with the public key of the WN or other enclave;        the execution of the program comprises the generation of a message bound for a WN or other enclave containing said information as well as a certificate of execution of said program corresponding to said information;        the message received from a WN or from another enclave also contains a certificate of execution by this WN or other enclave of said program corresponding to said information;        the message received from the WN or other enclave is received in an encrypted state, thanks to the public key of the processor enclave, and is decrypted with the secret key thereof;        the enclave also comprises means capable, on receipt by another enclave of a request containing a certificate certifying that said first program (WNRoT) is in the process of execution and of a random key, of generating and returning a message containing at least one part (payload) encrypted by means of said random key.
According to yet another aspect, a processor is proposed that comprises a secure unit (enclave), said enclave comprising:                the secret key of a main pair of private/public keys;        means to generate a pair of private/public keys derived from a combination of the main secret key and some information, and        means to load, via a correspondence table, a program corresponding to some given information and to execute it,
characterized in that said enclave comprises means that are capable, upon receipt from a WN or another enclave of a message containing some given information, of loading a first program and executing it in a secure manner, this execution comprising the following steps:                a) using (generating or retrieving from the memory) a pair of keys derived from the main secret key and said received given information;        b) sending to this WN or other enclave a request containing:                    certificate signed by the enclave with its secret key and certifying that this first program is in the process of execution;            the public key of the pair of derived keys;                        c) loading, via a correspondence table, a program corresponding to said information and waiting for the response to the request sent at step b), and        d) upon receipt of this response, the latter comprising at least one part (payload) encrypted by means of the public derived key, decrypting this encrypted part (payload) with the secret derived key, and triggering the execution of the program on the input data containing the response received after decryption.
Advantageously but optionally, the request sent at step b) also contains an identifier of said received message.
According to another aspect, a processor is proposed that comprises a secure unit (enclave), said enclave comprising:                the secret key of a main pair of private/public keys;        means for generating a random key;        means for loading, via a correspondence table, a program corresponding to given information and for executing it,
characterized in that said enclave comprises means that are capable, upon receipt from a WN or from another enclave of a message containing given information, of loading a first program and executing it in a secure manner, this execution comprising the following steps:                a) sending to this WN or other enclave a request containing:                    a certificate signed by the enclave with its secret key and certifying that this first program is in the process of execution;            the random key;                        b) loading, via a correspondence table, a program corresponding to said information and waiting for the response to the request sent at step a), and        c) upon receipt of this response (WM2), the latter comprising at least one part (payload) encrypted by means of the random key, decrypting this encrypted part (payload) with the random key and triggering the execution of the program (WP) on the input data containing the response received after decryption.
Some preferred but optional aspects are as follows:                the request sent at the sending step is encrypted with the public key of the WN or other enclave;        the message received from the WN or other enclave also contains the public key and a pair of private/public keys derived from the same given information, and the request sent at the sending step to WN or to the other enclave is encrypted with said public key derived from the WN or other enclave;        the execution of the program also comprises the generation of a message bound for a WN or other enclave containing said information as well as a certificate of execution of said program corresponding to said information;        the message received from the WN or other enclave also contains a certificate of execution by said WN or other enclave of said program corresponding to said information;        the message received from said WN or other enclave is received in an encrypted state, thanks to the public key of the enclave, and is decrypted with the secret key thereof;        the enclave also comprises means capable, upon receipt by another enclave of a request containing a certificate certifying that said first program is in the process of execution and of said public key of the derived pair of keys, of generating and returning a message containing at least one part (payload) encrypted by means of said public key;        said received request also contains a random key and the encryption means in order to return a message containing this key.
Furthermore, the secure processes of implementing smart contracts are usually completely disconnected from the physical world. In this regard, to make a processing unit implemented in a process communicate with the outside world in principle opens the door to possible fraud.
One aspect of the invention aims to enable the execution of smart contracts to be connected with the real world, as will be seen later, while preserving the security of this execution.
To this end, a secure system-on-chip (SoC) is proposed, in which a private SoC key is stored in a manner that is accessible only by the SoC, or the SoC is capable of dynamically regenerating this private key, the SoC being capable of communicating with another device through messages and being capable of executing smart contracts (WP) in response to the receipt of messages, and of storing at least one smart contract to be executed in secure processing conditions, the SoC also comprising means of communication between the system and an external module comprising at least one sensor and/or an actuator, these means comprising, at least on the system side, a communication management unit, and means of securing said communication capable of preventing at least the replacement of one module by another module, the execution of at least one smart contract being capable of receiving as input from said management unit a sensor datum coming from said module and/or of emitting as output an activation datum to said module.
Some preferred but non-limiting aspects are as follows:                the system comprises means of signing with the aid of said private key a sensor datum received from the module in the context of the execution of a smart contract, and of sending said signed datum to another secure device constituting a party to the smart contract;        the system comprises means of receiving a signed activation instruction from another secure device constituting a party to a smart contract, in order to verify said signature and to apply said instruction to said module;        the security means comprise a means of learning at least one permanent property of the connection between the SoC and the module;        the learning means are capable of storing said property of said connection, and the securing means are capable of periodically comparing the current property with the stored property;        the connection is wired and said property is an impedance property;        the connection is wireless, and said property comprises at least one characteristic of the time and/or frequency domain of said connection;        said property comprises a combination of characteristics of the time and/or frequency domain of said connection;        the module comprises a part forming an RFID tag;        the module comprises a standard wireless communication tag fixed in a tamper-proof way to an off-the-shelf sensor and/or actuator;        the tag is an RFID label;        the security means comprise means of logical pairing between the system and the module;        the security means comprise means of verification of the persistence of pairing;
the means of verification of the persistence of pairing and/or the means of communication comprise the sending of a nonce to the module and the analysis of a response from the module taking said nonce into account;                the system comprises a specific memory for data from the sensor and/or actuator coming from/bound for said module and a management unit of said memory capable of reading and/or writing data into said memory during the execution of a smart contract from among the smart contracts authorized to access these data;        said memory management unit forms part of a general memory management unit also comprising a management unit of the access to a memory of smart contracts and a memory of data respectively associated with the different smart contracts;        said general memory management unit also comprises a management unit of a memory for units of account (tags) received by transactions included in messages, capable of reading and/or writing data in said unit of account memory during the execution of a smart contract from among the smart contracts authorized to access these units of account;        the general memory management unit is capable of loading a smart contract for execution from a smart contract designation contained in a message arriving in the system;        sensor and/or actuator data coming from/bound for said module are transmitted on the fly between a means of execution of a smart contract and the communication management unit.Other Aspects
With respect to the above-mentioned qualitative advantages, the article "Why Many Smart Contract Use Cases Are Simply Impossible" [http://www.coindesk.com/three-smart-contract-misconceptions/] describes the limitations of Ethereum as regards interactions with the outside world (see, in particular, "Contacting External Services":
"Often, the first use case proposed is a smart contract that changes its behavior in response to some external event. For example, an agricultural insurance policy which pays out conditionally based on the quantity of rainfall in a given month.
The imagined process goes something like this: The smart contract waits until the predetermined time, retrieves the weather report from an external service and behaves appropriately based on the data received.
This all sounds simple enough, but it's also impossible. Why? Because a blockchain is a consensus-based system, meaning that it only works if every node reaches an identical state after processing every transaction and block.
Everything that takes place on a blockchain must be completely deterministic, with no possible way for differences to creep in. The moment that two honest nodes disagree about the chain's state, the entire system becomes worthless.
Now, recall that smart contracts are executed independently by every node on a chain. Therefore, if a smart contract retrieves some information from an external source, this retrieval is performed repeatedly and separately by each node. But because this source is outside of the blockchain, there is no guarantee that every node will receive the same answer.
Perhaps the source will change its response in the time between requests from different nodes, or perhaps it will become temporarily unavailable. Either way, consensus is broken and the entire blockchain dies. So, what's the workaround? Actually, it's rather simple. Instead of a smart contract initiating the retrieval of external data, one or more trusted parties ("oracles") creates a transaction which embeds that data in the chain. Every node will have an identical copy of this data, so it can be safely used in a smart contract computation." (sic)
This drawback is overcome firstly by allowing direct access by a "Wallet Node" WN (see WO2016120826A2), in a secure manner, to any https website (thus limiting the need for an "oracle" smart contract), by exploiting the end-to-end TLS protocol. This access can be implemented on a plurality of "Clone WNs" (which are a particular implementation of mirror nodes, see section on "Mirror WNs") capable of redundantly accessing a data source. As regards the risk of modification of the response between two requests by the source, the clone WNs are able to coordinate one another so as to process, according to pre-agreed rules (depending on configuration parameters), cases of different responses to the same requests (depending on the approaches such as taking the majority, the average, etc.)—the essential advantage introduced compared to Ethereum nodes being access to the network, thus avoiding intermediation by a trusted third party.
The above-mentioned article then raises the need to emit a message to the outside world: "When it comes to smart contracts causing events in the outside world, a similar problem appears. For example, many like the idea of a smart contract which calls a bank's API in order to transfer money. But if every node is independently executing the code in the chain, who is responsible for calling this API?
If the answer is just one node, what happens if that particular node malfunctions, deliberately or not?"
This drawback is overcome by allowing the implementation of a reliable protocol whereby just one of the mirror nodes of the node supposed to emit a message to the outside world, emits this message (see section below "WN emitting a message to the outside world"). (sic).
In the two cases of use mentioned above, the intrinsic limitation of the Ethereum nodes with regard to the network runs counter to its goal of decentralization; see above-mentioned article: "they both require a trusted entity to manage the interactions between the blockchain and the outside world. While this is technically possible, it undermines the goal of a decentralized system." (sic).
The other significant limitation of Ethereum described in the above-mentioned article is its intrinsic non-confidentiality:
"if one smart contract can't access another's data, have we solved the problem of blockchain confidentiality? Does it make sense to talk of hiding information in a smart contract? Unfortunately, the answer is no.
Because even if one smart contract can't read another's data, that data is still stored on every single node in the chain. For each blockchain participant, it's in the memory or disk of a system which that participant completely controls. And there's nothing to stop them reading the information from their own system, if and when they choose to do so."
This major limitation of Ethereum is overcome by the blindness property (meaning "confidentiality extended to hardware") of WNs, achieved by the hardware architecture proposed by the invention.
Ethereum smart contracts are regarded as "cryptographic "boxes" that contain value and only unlock it if certain conditions are met"[phrase taken from the previously cited Ethereum White Paper], whereas according to the system of the invention, smart contracts are implemented as Wallet Program (WP) executable contracts between nodes (WNs) of the Wallet Node network and have the following characteristics:                the WNs interact by Wallet Messages (WMs);        each WM specifying the WP that the receiver WN must execute in order to process it;        a WM being capable of containing one or more "value" transfer transactions from the emitter WN to the receiver WN;        values that will belong to the receiver WN (or at least will be managed by the receiver WN) which can in its turn transfer them by generating other transactions (in the context of the execution of a WP that in general may be different to the WP specified in the WM that transferred them to it);        the WN system comprising means in each WN to prevent double spending of these values, and        a WN advantageously comprising means to earmark the consumption of these values to one or more authorized WPs.
However, said "cryptographic boxes" can easily be built into the WNs. The system of the invention thus marries the conventional idea of contracts ("something that should be "fulfilled" or "complied with") with that of Ethereum ("rather, they are more like "autonomous agents" that live inside of the Ethereum execution environment, always executing a specific piece of code when "poked" by a message or transaction, and having direct control over their own ether balance and their own key/value store to keep track of persistent variables') [phrases also taken from the previously-cited Ethereum White Paper].
WNs are comparable to Ethereum nodes: the address of an Ethereum node, determined on the basis of the public key of a pair of keys, is similar to the address of a WN that is determined on the basis of the public key of the WN in question. In a WN, a smart contract is a Wallet Program executable code (identified by its hash "#WP"), a code that can be compiled from a language like Solidity [http://solidity.readthedocs.io/en/develop/introduction-to-smart-contracts.html (incorporated here by reference)] but with adaptations allowing the WNs access to the network, so that the transactions generated by a WN can transfer values in any unit (and not only ethers), etc.
Whereas in Ethereum an execution of contract is performed on a large number of (minor) nodes that validate it, in the case of WNs, when a contract (WP) is executed, the node in which this execution has been triggered is the only one that executes it and has its own persistent state variables. WNs represent a more general model in this sense because the persistent variables of a node are general-purpose, they do not solely represent an Ether balance and are not necessarily the variables associated with the contract for all of the nodes that execute it (they are not necessarily the shared variables constituting the key/value store of an Ethereum contract [see the previously-cited Ethereum White Paper]).
WNs guarantee the integrity of execution by hardware constraints and, advantageously, by redundancy (for even more security), said node then being a virtual node embodied by a plurality of mirror nodes storing, manipulating and maintaining the variables specific to said virtual node in a synchronized manner.
It is useful to refer to the description of FIG. 23 at the beginning of the section "Detailed description of preferred embodiments."
Moreover, we aim to make it possible to execute smart contracts (WP) on WNs by using the Bitcoin blockchain (or another blockchain), generating and inserting in the blockchain only some of the transactions, on the instruction of the WNs concerned, which offers the triple advantage of having the power of smart contracts in Bitcoin, avoiding the slowness of its consensus protocol, and not paying transaction fees (for transactions that are not inserted in the blockchain). The "Off-chain Bitcoin Transactions" section describes a method enabling units of values (such as bitcoins or ethers) to be consumed by different types of WPs, a method that thus confers on a Bitcoin-based system the power of the smart contracts of a system such as Ethereum.
The Bitcoin protocol imposes the need to wait for transaction confirmations block by block, which, depending on the approach adopted, currently take from a few seconds to around ten minutes each and limits the volumes of transactions. Ethereum, as well as the method described in FR 3 018 377 A1 in the name of the applicant, enables the decentralized execution of executable contracts. Sidechains technology was designed, essentially, to enable commitments and transactions to be managed in a manner other than that envisaged in Bitcoin and to be able to return to the original Bitcoin on demand [https://blockstream.com/sidechains.pdf] (which the invention essentially enables). More recently, in addition to these systems, "state-channel networks" such as "Lightning Network" [https://lightning.network/lightning-network-paper.pdf], and «Payment-Channel Network» [http://raiden.network/] have been proposed for Ethereum, to avoid the need to use blockchain for each transaction. This approach involves the nodes monitoring the blockchain to react in the event of the insertion of transactions that do not reflect the current state, in order to rectify this problem, which requires implementing locks to secure an observation time window, which rather slows down the process. The invention overcomes this difficulty by guaranteeing the integrity of execution of the WPs that it offers from the outset: the inserted transactions generated by WN do not require monitoring.
Moreover, it will be noted that the hardware proposed according to the invention ensures processing without disclosure, a property (called "confidentiality") offered chiefly by secure environments such as the new Intel processors for their secure "SGX" environments (enclaves), and research is known on homomorphic encryption for processing on the Cloud which offer guarantees of integrity of execution and non-disclosure of processed data or even of the executed code. However, homomorphic encryption technology is still in the research phase and is not yet operational except in restricted or specific cases.
It will be remembered that application WO2016/120826 A2 describes a system-on-chip (SoC, called "Wallet Node" or "WN," or even "entity") integrated into—or coupled with—a connected device such as a smartphone, a connected thing of the Internet of Things (IoT) or even a computer, offering guarantees of integrity of execution so that the access restrictions between its different parts cannot be altered or circumvented. Basically, the only possible execution of a WN is to react to an incoming message, by verifying its integrity and then executing the executable Wallet Program code corresponding to the hash specified in this message. With reference to this PCT application, in the present text, "message" means "Wallet Message" except when explicitly stated otherwise.
Definition of Other Aspects with which the Above Aspects May be Combined, Depending on the Combinations that a Person Skilled in the Art Deems Compatible.
According to yet another aspect, a method is proposed to establish connection weights between nodes of a network implemented by communicating computer processing units, each node being associated with a public key and a private key, a given node being capable of communicating its public key to another node, thus forming a so-called real connection ("IRL-connected") between the two nodes, and each node also being capable of communicating to another node a public key received from yet another node, thus forming a so-called indirect connection between the other node and the yet another node, a node being capable of having a specific connection weight with respect to another node with which it has a real or indirect connection, the method comprising, in order to determine the connection weight of a second node with respect to a first node, the calculation of a determined combination of weighting factors (influence, proximity) of third nodes that are IRL-connected to the second node.
Advantageously but Optionally:                the connection weight of the second node influences the weighting factors of the third nodes, and also comprises an update of the values of the weighting factors of the third nodes after calculating the connection weight of the second node;        the method is implemented iteratively until convergence;        the establishment of a so-called real connection (IRL-connection) between a first node and another node comprises the following steps:                    at a first processing unit implementing the first node, make a machine-readable code encrypting a random datum (nonce) accessible by proximity reading;            at another processing unit implementing the other node, read the machine-readable code, extract said random datum and calculate a hash of said random datum;            transmit from said other processing unit to the first processing unit via a communication channel the public key associated with said other node and a signature (of the hash) of the random datum performed with its private key;            at the first processing unit, check said signature with the aid of the public key received and the random datum used to generate the machine-readable code, and save said public key if the verification is successful;                        the establishment of a so-called real connection (IRL-connection) between a first node and another node comprises the following steps:                    at a first processing unit implementing the first node, generate a passphrase and make it accessible to the user of said first processing unit;            at another processing unit implementing the other node, enter said passphrase, which was communicated by the user of the first processing unit to the user of the other processing unit by a communication channel involving a human action between the two users;            transmit from said other processing unit to the first processing unit via a communication channel the public key associated with said other node and a signature (of the hash) of the phrase entered, achieved with its private key;            at the first processing unit, verify said signature with the aid of the public key received and the passphrase initially made accessible to the user of the first processing unit, and save said public key if the verification is successful;                        a plurality of second nodes have connection weights with the first node, and in which the determination of the connection weight of a second node with respect to the first node is also based on the connection weight of said other second nodes with respect to the first node.
According to another aspect, a method is proposed to determine the influence of a first node in a node network implemented by communicating computer processing units, one public key and one private key being associated to each node, one node being capable of communicating its public key to another node, thus forming a so-called real connection (IRL-connection) between the two nodes, and each node being equally capable of communicating to another node a public key received from yet another node, thus forming a so-called indirect connection between the other node and the yet another node, the method comprising the determination of an influence factor of a given node based on the number of second nodes having a real connection with said given node and on the values of connection weights determined by the method wherein a plurality of second nodes have connection weights with a first node, and wherein the determination of the connection weight of a second given node with respect to the first node is also based on the connection weights of said other second nodes with respect to the first node, for the different second nodes.
Advantageously but Optionally:                the connection weight of a second node with respect to the first node is also determined on the basis of the respective influence factor values of the third nodes having a real connection with said second node;        the values of connection weight and influence factor are determined iteratively until their convergence into values that no longer significantly vary.
According to another aspect, a method is proposed in order to establish so-called quasi-real connections between the nodes of a network implemented by communicating computer processing units, each node being associated with a public key and a private key, a given node being capable of communicating its public key to another node, thus forming a so-called real connection (IRL-connected) between the two nodes, and each node also being capable of communicating to another node a public key received from yet another node, thus forming a so-called indirect connection between the other node and the yet another node, each node being capable of having a specific connection weight with respect to another node with which it has a real or indirect connection, comprising the following steps:                from a first node and a second node between which a connection is to be established, select a plurality of intermediate nodes between the first node and the second node, from among those having the highest connection weights with respect to the first node;        communicate from the first node to the selected intermediate nodes a random datum (nonce) intended to be communicated to the second node;        via one or more separate communication channels of the communication channel between nodes, communicate redundantly from the intermediate nodes to the second node said random code as well as the public keys of said intermediate nodes;        at the second node, in response to the receipt of the redundant random code, generate a signature of the random code with the aid of the private key of the second node and return to the intermediate nodes said signature as well as the private key of the second node, encrypted with the aid of the public keys of the intermediate nodes, respectively;        at each of the intermediate nodes, verification of the signature of the random code received from the second node and, if successful, communication to the first node of the public key of the second node encrypted with the aid of the public key of the first node, and        at the first node, decryption and storage of the public key of the second node; the first and second nodes then being able to exchange encrypted information with a security linked to the connection weights of the intermediate nodes.
Advantageously but Optionally:                the selection of the intermediate nodes is also made from among those having the highest connection weights with respect to the second node;        the random code is generated jointly by a set of nodes formed by the first node and the intermediate nodes, by implementing the following steps:                    generation of a random code at each node of the set;            exchange of the hashes of said random codes between the nodes of the set, with encryption using the respective keys of the nodes;            exchange of the random codes as they are between said nodes of the set, with encryption using the respective keys of the nodes;            verification, at each node of the set, that the random codes correspond, as they stand, to their respective hashes received at the preceding step, and            generation of a final random code intended to be communicated to the second node by a predetermined combination of random codes generated at each node of the set;                        said separate communication channel is based on a social network and comprises a publication step by the second node on said social network of a signature of said random code and its public key;        the method also comprises, in response to the success of the step of verification of the signature of the random code received from the second node, a step of assigning a connection weight of the second node with respect to the first node;        the method according to the first aspect is used in a network comprising nodes with quasi-real connections established according to the third aspect, and the quasi-real connections are regarded as real connections in the sense of the method, with a weight taking into account the quasi-real nature of the connection.
According to yet another aspect, a method is proposed for securing the operation of a network of nodes capable of executing programs (WPs) in response to the receipt of messages (WMs), the nodes being capable of being connected together according to different connection weights determined by the method according to the first aspect or by the method according to the third aspect, the method comprising, on receipt of a message (WM) at the receiver node, the comparison of the connection weight of the node having emitted this message with the connection weights of other nodes with which the receiver node possesses real connections, and the acceptance of said message only if the connection weight of the emitter node is equal to or greater than the smallest of said connection weights.
According to another aspect, a method is proposed for securing the operation of a network of nodes capable of executing programs (WPs) in response to the receipt of messages (WMs), the nodes being capable of being connected together according to the different connection weights obtained particularly by the method according to the first aspect or by the method according to the third aspect or, in response to the success of the step of verification of the signature of the random code received from the second node, a step of attribution of a connection weight of the second node with respect to the first node is envisaged, comprising the following steps:                based on the connection weight values, assign to each node at least one countersigner node having with respect thereto a connection weight that exceeds a threshold;        at each node, keep a list of countersigner nodes of nodes capable of receiving messages (WMs) from the node in question, each node and its countersigner nodes forming a set of mirror nodes;        when a message must be sent by an emitter node to a receiver node, trigger the sending of this message by at least some mirror nodes of the emitter node to at least some of the mirror nodes of the receiver node;        validate the message only if a given fraction of the messages emitted has been received.
Advantageously but Optionally:                the messages are emitted to all of the mirror nodes of the receiver node;        the messages are emitted by the emitter node as well as solely by the countersigner nodes of the emitter node that are also countersigners of the receiver node;        a message sent from a first node to a second node is validated by the second node only if                    the respective sets of mirror nodes of the first and second nodes have an intersection of which the number of elements exceeds a certain threshold and if            the second node has received this same message (redundantly) by at least a given fraction of said mirror nodes belonging to this intersection;                        in a method according to the first aspect implemented in a network comprising mirror nodes according to the fifth aspect, a node is regarded as the countersigner of a given node only if the connection weight of the node in question is at least equal to the smallest of the connection weights of the nodes having real connections with the given node.
According to another aspect, a system is proposed to secure the operation of a network of nodes capable of executing programs (WPs) in response to the receipt of messages (WMs), the nodes being capable of being connected to each other according to the different connection weights, capable of:                on the basis of the connection weight values, assigning to each node at least one countersigner node having with respect thereto a connection weight that exceeds a threshold;        at each node, keeping a list of countersigner nodes of nodes capable of receiving messages from the node in question, each node and its countersigner nodes forming a set of mirror nodes;        when a message must be sent by an emitter node to a receiver node, triggering the sending of this message by at least some of the mirror nodes of the emitter node to at least some of the mirror nodes of the receiver node.                    Advantageously but Optionally:                        a node receiving a message (WM) validates it only if the respective sets of mirror nodes of the emitter and receiver nodes have an intersection of which the number of elements exceeds a given threshold and if the receiver node has received this same message (redundantly) from at least a given fraction of said mirror nodes belonging to this intersection.
According to another aspect, a system is proposed to secure the operation of a network of nodes formed by systems-on-chip capable of executing programs (WPs) in response to the receipt of messages (WMs), characterized in that it combines the following two architectures:                at each node, an architecture to access encrypted programs based on the hashes of these programs, contained in the incoming messages;        at each node, an architecture to determine countersigner nodes, duplication of messages from/to the countersigner nodes, and to determine the identical nature of the messages received.
According to another aspect, a system is proposed for the secure execution of programs in an architecture comprising a set of networked devices, characterized in that it comprises in at least one device, a secure system-on-chip (SoC) in which is stored a private SoC key in a manner that is accessible only to the SoC, or the SoC is capable of dynamically regenerating this private key (PUF technology);                an SoC being capable of communicating with another device only by messages and being capable of executing programs only in response to the receipt of messages;        an SoC being capable of storing at least one program to be executed after encryption by the SoC and of generating a hash of the, or each, program enabling the encrypted program to be retrieved;        the device also being capable of sending to the SoC a message containing input data for a certain program to be executed, as well as the hash of said program (#P2), the SoC being able, in response to such a message, in a secure manner, (i) to access the encoded program to be executed based on the hash (#P2) of the program received in the message, (ii) to decrypt on the fly the program instructions, and (iii) to execute on the fly the decrypted instructions.
Advantageously but Optionally:                before emission of a message by the SoC, the SoC inserts the hash (#P1) of the program in the process of execution into the message to be emitted, as well as the signature of this hash, by means of said secret private key of the SoC;        before emission of a message by the SoC, the SoC enters the hash (#P1) of the program in the process of execution into the body of the message to be emitted which the SoC signs by means of the secret private key of the SoC;        the SoC comprises a Crypto Memory Management Unit (CMMU) in which is stored—or is capable of being dynamically regenerated (PUF technology)—the secret key of the SoC which can only be accessed by the CMMU which never discloses it, and it is by this CMMU that the following actions are performed:        said encryption of the program before storing;        a memory address allocation (addr1 . . . addr2 range) for the program thus encrypted;        said generation of the program hash and        said decryption for on-the-fly execution by at least one processor unit contained in the SoC;        the CMMU encrypts and stores instruction block by instruction block and provides said processor with one block of decrypted instructions at a time, for them to be executed on the fly;        before emission of a message by the SoC, the CMMU inserts the hash (#P1) of the program in the process of execution into the message to be emitted, as well as the signature of this hash by the CMMU, by means of said secret private key of the SoC;        before emission of a message by the SoC, the CMMU inserts the hash (#P1) of the program in the process of execution into the body of the message to be emitted that it signs by means of the secret private key of the SoC;        an SoC is capable of emitting a message having the same hash for the program in the process of execution (#P1) and for the program to be executed by the recipient (#P1=#P2), this program (P1=P2) being an executable commitment (smart contract) if the recipient of said message is an SoC.
According to another aspect, a system-on-chip is proposed that is intended to form a Wallet Node (WN) of a network, comprising a Crypto Memory Management Unit (CMMU) capable of ensuring a blind execution of programs by at least one SoC processor, in which:                in the CMMU a private key (secret key) is stored (or dynamically regenerated) in a manner accessible only by the CMMU        the CMMU is capable of storing at least one program to be executed after encryption by the CMMU and of generating a hash of the, or each, program enabling the encrypted program to be retrieved;        said processor is capable of executing programs only at the command of the CMMU;        the interactions between the SoC and other nodes of the network are conducted solely by messages and the messages are received/emitted solely by the CMMU;        the messages contain the identification of a certain program to be executed, identified by its hash;        in response to the receipt of a message, the CMMU (i) accesses the encrypted program to be executed on the basis of the program hash received in the message (specifically via a PHT), (ii) decrypts the program instructions, and (iii) transmits to the processor in order to execute the decrypted instructions on said received data.
Advantageously but Optionally:                the or at least one processor is capable of accessing and manipulating (creating, updating, deleting), via the CMMU, the persistent status values (PSVs) associated with a given program, which are also encrypted and stored in the memory by the CMMU and decrypted on the fly;        said program to be executed and its persistent status values (PSV) are stored in a specific address space ensuring their isolation in relation to the other programs;        a message is capable of containing one or more unit of account (UA) transfer transactions from an emitter node to a receiver node, the units of account received by a receiver node being capable of being re-transferred by a transaction contained in a message emitted by said receiver node;        the method includes a memory space for units of account (tags) received by the transactions;        the method is capable of combining the units of account of different tags in the same transaction to be emitted;        the CMMU comprises means of neutralizing a tag that feeds an emitted transaction, so that the UAs thus consumed cannot be consumed by another transaction;        the CMMU comprises means of controlling the use of tags by the different programs, so that only an authorized program can feed a transaction to be generated from a given tag;        said memory is in the SoC;        said memory is separate from the SoC;        a program can alternatively be triggered on the elapse of a timeout for a given program and the CMMU is also capable, on the occurrence of a timeout associated with the hash of a program (i) of accessing in the memory the encrypted program on the basis of this hash, (ii) of decrypting the program instructions, and (iii) of transmitting to the processor in order to execute the decrypted instructions;        the CMMU performs said encryption and storage in the memory instruction block by instruction block and provides said processor with one decrypted block at a time, for on-the-fly execution;        before emitting a message, the CMMU unit inserts the hash (#P1) of the program in the process of execution into the message to be emitted, as well as the signature of this hash by the CMMU, by means of said secret private key;        before emitting a message, the CMMU inserts the hash (#P1) of the program in the process of execution into the body of the message to be emitted, which it signs by means of said secret private key;        the CMMU is capable of emitting a message having the same hash for the program in the process of execution (#P1) and for the program (#P2) to be executed by the receiver (#P1=P#2), this program (P1=P2) thus being an executable commitment (smart contract) in the case where the receiver of said message is also an SoC where, before emission of a message by the SoC, the SoC inserts the hash (#P1) of the program in the process of execution into the message to be emitted, as well as the signature of this hash, by means of said secret private key of the SoC;        certain messages (WMs) constitute tag transfer messages stored in systems with a memory space for units of account (tags) received by the transactions, and the validation of a tag transfer message at a receiver node is performed only if at the intersection there exists between the set of mirror nodes of the receiver node and the set of mirror nodes of each of the nodes upstream, from which such a tag was originally transferred, a number of nodes exceeding a given threshold.
According to another aspect, a transactional system with peer-to-peer architecture is proposed, implementing transactions enabling units of account to be transferred between unit emitter nodes and unit receiver nodes, each transaction having an input referring to an output of a previous transaction (or several inputs each referring to an output of a previous transaction) and itself having at least one new output specifying a number of units of account and a receiver node, it being possible to validate each transaction by the insertion, in a blockchain stored in a distributed manner between the nodes, of a signature of the transaction, characterized in that at least some of the transactions are performed by nodes capable of ensuring a blindness condition of said transaction, in that it comprises means to process a set of transactions satisfying the condition of blindness so as to simplify this set based on the quantities of units of account and addresses of the emitter nodes and receiver nodes involved in these transactions, in order to generate a smaller set of transactions and to generate and store in the blockchain only the signatures of transactions of the smaller set of transactions.
According to another aspect, a transactional system with peer-to-peer architecture is proposed implementing transactions enabling units of account to be transferred between unit emitter nodes and unit receiver nodes, each transaction having an input referring to an output of a previous transaction (or several inputs each referring to an output of a previous transaction) and itself having at least one new output specifying a number of units of account and a receiver node, it being possible to validate each transaction by entering, in a blockchain stored in a distributed manner between the nodes, a signature of the transaction, characterized in that at least some of the transactions are performed by nodes capable of ensuring a blindness condition of said transactions, in that it comprises means to process a set of transactions satisfying the condition of blindness so as to simplify this set based on the quantities of units of account and addresses of the emitter nodes and receiver nodes involved in these transactions, in order to generate a smaller set of transactions and so as generate and store in the blockchain only some of the signatures of transactions of said smaller set and only on the instruction of the nodes concerned.
According to another aspect, a method is proposed for performing a transaction between network nodes associated with users and capable of transferring units of account between one another and able to communicate between one another by messages, each message designating a WP to be executed in the node receiving this message, and the users being capable of broadcasting the bid elements containing one or more bid criteria and able to give rise to transactions on the network, the method comprising the following steps:                sending, by a bidding node to a requesting node of a user having emitted corresponding bid elements, a supply bid message meeting the criterion (or criteria) and committing said node, and identifying a given WP;        sending by the requesting node to the bidding node a message of acceptance of the supply bid, identifying the same given WP;        generating a certificate of performance, of the existence or availability of the supply accessible by the bidding node, capable of being verified by said given WP;        verification of the certificate by the given WP at one of the two nodes at least, and        if verification is successful, generation at the requesting node of a message to transfer units of account constituting the consideration for the supply and sending this message to the bidding node.
According to another advantageous aspect, in a method according to the second aspect and implemented in a network comprising nodes with quasi-real connections established in accordance with the method according to the third aspect, the quasi-real connections are regarded as real connections in the sense of the method, with a weight taking into account the quasi-real character of the connection.

Methods and systems for executing smart contracts in secure environments


Nucleic acid sequences from potato that encode the enzyme UDP-glucose:solanidine glucosyltransferase (SGT2) are disclosed. Recombinant DNA molecules containing the sequences, and use thereof, in particular, use of the sequences and antisense constructs to inhibit the production of SGT2 and thereby reduce the level of the more human-toxic of the two predominant steroidal glycoalkaloids α-chaconine and/or increase the level of the more insect-toxic α-solanine in Solanaceous plants such as potato are described.

1. Field of the Invention
The present invention is directed to the steroidal alkaloid glycosyl transferase enzyme UDP-glucose:solanidine glucosyltransferase (SGT2) that is involved in the biosynthesis of steroidal glycoalkaloids in Solanaceous plants. More particularly, the invention is directed to nucleic acid sequences that encode SGT2, recombinant polynucleotide molecules containing the sequences, and uses thereof. A particular use of the nucleic acid sequences and portions thereof is to inhibit SGT2 activity and reduce the levels of the steroidal glycoalkaloid α-chaconine and/or increase the levels of the steroidal glycoalkaloid α-solanine in Solanaceous plants.
2. Description of the Art
Solanaceous plants include such agronomically important crops as potato, tomato and eggplant. Many Solanaceous species, including potato, synthesize bitter tasting steroidal glycoalkaloids (nitrogen-containing steroidal glycosides) as a defense against microbial or insect pests or in response to environmental stress. Accumulation of these natural toxicants can affect food quality and safety, especially in improperly stored or processed potatoes. This has led to the implementation of a guidelines limiting glycoalkaloid content in a tuber of a given potato cultivar to 20 mg/100 gm. While the guidelines provide effective protection for the consumer, its effectiveness is dependent upon limiting the release of new cultivars for commercial production to those with acceptable glycoalkaloid levels. For potato breeding programs to develop new cultivars with improved agronomic or processing properties, the need to select also for low levels of glycoalkaloids can present a difficult problem. A method to decrease the glycoalkaloid content of any newly developed cultivar with minimum impact on other characteristics would be of great use to obtain valuable new commercial potato cultivars.

The United States of America, as represented by the Secretary of Agriculture


The present invention relates to a process for the preparation of compounds which are therapeutically active in the central nervous system.

Many diseases of the central nervous system are influenced by the adrenergic, the dopaminergic, and the serotonergic neurotransmitter systems. For example, serotonin has been implicated in a number of diseases and conditions which originate in the central nervous system. A number of pharmacological and genetic experiments involving receptors for serotonin strongly implicate the 5-HT2c receptor subtype in the regulation of food intake (Obes. Res. 1995, 3, Suppl. 4, 449S–462S). The 5-HT2c receptor subtype is transcribed and expressed in hypothalamic structures associated with appetite regulation. It has been demonstrated that the non-specific 5-HT2c receptor agonist m-chlorophenylpiperazine (mCPP), which has some preference for the 5-HT2c receptor, causes weight loss in mice that express the normal 5-HT2c receptor while the compound lacks activity in mice expressing the mutated inactive form of the 5-HT2c receptor (Nature 1995, 374, 542–546). In a recent clinical study, a slight but sustained reduction in body weight was obtained after 2 weeks of treatment with mCPP in obese subjects (Psychopharmacology 1997, 133, 309–312). Weight reduction has also been reported from clinical studies with other "serotonergic" agents (see e.g. IDrugs 1998, 1, 456–470). For example, the 5-HT reuptake inhibitor fluoxetine and the 5-HT releasing agent/reuptake inhibitor dexfenfluramine have exhibited weight reduction in controlled studies. However, currently available drugs that increase serotonergic transmission appear to have only a moderate and, in some cases, transient effects on the body weight.
The 5-HT2c receptor subtype has also been suggested to be involved in CNS disorders such as depression and anxiety (Exp. Opin. Invest. Drugs 1998, 7, 1587–1599; IDrugs, 1999, 2, 109–120).
The 5-HT2c receptor subtype has further been suggested to be involved in urinary disorders such as urinary incontinence (IDrugs, 1999, 2, 109–120).
Compounds which have a selective effect on the 5-HT2c receptor may therefore have a therapeutic potential in the treatment or prophylaxis of disorders like those mentioned above. Of course, selectivity also reduces the potential for adverse effects mediated by other serotonin receptors.
Examples of such compounds are (2R)-1-(3-{2-[(2-ethoxy-3-pyridinyl)oxy]ethoxy}-2-pyrazinyl)-2-methylpiperazine, (2R)-methyl-1-{3-[2-(3-pyridinyloxy]ethoxy]-2-pyrazinyl}piperazine and pharmaceutically acceptable acid salts thereof. WO 00/76984 (hereinafter called D1) relates to a process for the preparation of such compounds on a small scale such as a gram scale. A problem to be solved by the present invention was to prepare such compounds on a large scale such as on a kilogram scale. The following factors are more important for preparation on a large scale, in comparison to preparation on a small scale:    to obtain a high yield of the desired products for economy reasons,    that the processes for preparation are safe with regard to explosion,    that the reagents and solvents used are relatively non-toxic,    that the products obtained are relatively stable, and    that the reaction times are relatively short.These problems have been solved by the present invention. It has been shown that the yields of the desired products according to the present invention are higher than the yields according to D1. In the experimental part, the yields according to the present invention and D1 are compared. Regarding the choice of solvents for the process steps, dioxane, as used according to D1, has been replaced by solvents such as MtBE and THF (see step (ii) below) which are less prone to form peroxides and which are less carcinogenic than dioxane. Furthermore, it has been shown that (2R)-methyl-1-{3-[2-(3-pyridinyloxy)ethoxy]-2-pyrazinyl}piperazine, L-malate salt prepared according to the present invention (see Example 3A) has superior properties compared to (2R)-methyl-1-{3-[2-(3-pyridinyloxy)ethoxy]-2-pyrazinyl}piperazine, hydrochloride prepared according to D1 in that the former has a higher crystallinity, is less hygroscopic and has a higher chemical stability than the latter. Regarding chemical stability, D1 discloses the preparation of (2R)-1-(3-chloro-2-pyrazinyl)-2-methylpiperazine, which has also been prepared in Example 8 below. This compound is not stable for storage as a free base. As (2R)-1-(3-chloro-2-pyrazinyl)-2-methylpiperazine is a key intermediate, chemical stability during long term storage is important with regard to process economy. It has now been found that the corresponding hydrochloride salt thereof is considerably more stable, which has been prepared in Example 9 below.
The method to prepare Example 3C is a good way of increasing the purity of Example 2C. It has been shown that Example 2C with a purity of 60–70% gives Example 3C with a purity of 99% in one crystallization step. By contrast, the same purity increasing effect has not been achieved by making the acetate of Example 2C. Regarding reaction time, the reaction according to Example 2A below was complete at room temperature in 15 minutes. The same compound has been prepared in Example 173 in D 1. The procedure of Example 172, step 3 has been followed, wherein the reaction was stirred at 85° C. for 15 h. Furthermore, the reaction according to Example 2B below was complete in 35 minutes at 55° C. The same compound has been prepared in Example 200 in D1. The procedure of Example 192, step 3 has been followed, wherein the reaction was stirred at 90° C. for 2 h.

Process for the preparation of stable acid addition salt of 2,3-disubstituted pyrazine compounds

Abstract: In one aspect, the invention relates to a process for the preparation of compounds of the general formula (I):

Abstract: wherein HA is a pharmaceutically acceptable acid and R1–R4 are each independently selected from the group consisting of hydrogen, halogen, C1–C6-alkyl, C1–C6-alkoxy, and di-C1–C6-alkylamino-C2–C6-alkoxy.

Abstract: The invention also relates to the use of said compound to manufacture a medicament for the treatment of a serotonin-related disorder.


A machine and method for producing a package by folding a sheet of packing material about a respective article; a packing conveyor feeds along a packing path a folding head, which houses the package and has an electrically heated activating member for applying heat to a portion of the package; the folding head also has a movable magnetic core, which has a coil connected electrically to the activating member, and is positioned facing and coupled magnetically to a fixed magnetic core positioned parallel to the packing path; in use, a coil coupled to the fixed magnetic core is supplied with electric current to induce flow of a corresponding electric current through the coil of the movable magnetic core.

On a packing machine, each article is fed by a succession of packing conveyors along a packing path to be paired with a respective sheet of packing material, which is subsequently folded about the article to define a package. The package must be stabilized by permanently joining, by gluing or heat sealing, overlapping portions of the sheet of packing material. More specifically, when gluing is employed, a layer of glue is deposited on a number of portions of the sheet of packing material before the sheet of packing material is folded about the article.
Hot-melt glue, i.e. glue which is solid at ambient temperature and becomes fluid when heated, is known to be applied to the sheet of packing material long before the sheet of packing material is folded about the article, so as to allow the spots of glue on the flat sheet of packing material to set; and, once the package is completed by folding the sheet of packing material about the article, the spots of glue deposited beforehand are reactivated, i.e. melted, by heating the portions of the package at the glue spots. The above method of reactivating the glue spots after the package is completed has the advantage of enabling the gumming devices to be set up in the best location (i.e. for easy access and cleaning) and not necessarily immediately upstream from the folding members where space is normally limited. Moreover, in the event of temporary stoppage of the machine, the sheets of packing material on which glue has already been deposited, and which have not yet been folded, do not result in faulty packages when the machine is started up again.
On the other hand, reactivating the glue spots after the package is completed complicates the structure of the packing conveyors, in that the seats on the packing conveyors carrying the packages must be provided with heating members to heat the packages at the glue spots. Normally, a packing conveyor seat is equipped with electric resistors, which are powered by a fixed external electric power supply by means of brushes integral with the packing conveyor and which slide over a fixed contact positioned parallel to the path of the packing conveyor. This solution has the drawback of requiring periodic replacement of the brushes, which wear out relatively fast.
It has also been proposed to heat the heating members by magnetic induction. Such a method, however, cannot be used for packages comprising sheets of metalized packing material, in that the magnetic flux for heating the heating members tends to also heat and irreparably damage the sheets of metalized packing material.

Machine and method for producing a package by folding a sheet of packing material about a respective article