Data processing system utilising distributed ledger technology

Abstract

A system includes a firewall server and a plurality of computing nodes hosting a private distributed ledger. The private distributed ledger includes user accounts having addresses on the private distributed ledger and a firewall management contract storing filter rule data associating the addresses of at least some of said user accounts with respective filter rules for handling requests for data stored on the private distributed ledger. The firewall server is arranged to receive a request for data stored on the private distributed ledger, indicating an address of a first user account. In response to receiving said request, the firewall server is arranged to send a query to the firewall management contract for first filter rule data associated with the address of the first user account, receive a response from the firewall management contract, and process the request for data in accordance with the response from the firewall management contract.

What is claimed is: 
     
         1 . A system comprising:
 a plurality of computing nodes hosting a private distributed ledger, the private distributed ledger comprising:
 a plurality of user accounts each having an address on the private distributed ledger; and 
 a firewall management contract storing filter rule data associating the addresses of at least some of said user accounts on the private distributed ledger with respective filter rules for handling requests for data stored on the private distributed ledger; and 
   a firewall server arranged to:
 receive, from a computing device, a request for data stored on the private distributed ledger, the request indicating an address of a first user account of the plurality of user accounts; and 
 in response to receiving said request:
 send a query to the firewall management contract for first filter rule data associated with the address of the first user account; 
 receive a response from the firewall management contract; and 
 process the request for data in accordance with the response from the firewall management contract. 
 
   
     
     
         2 . The system of  claim 1 , wherein:
 the response from the firewall management contract indicates that a user associated with the first user account is permitted to access the requested data; and   processing the request for data in accordance with the response from the firewall management contract comprises providing the computing device with access to the requested data from the private distributed ledger.   
     
     
         3 . The system of  claim 2 , wherein providing the computing device with access to the requested data comprises:
 signing the requested data using a digital signature key; and   sending the signed data to the computing device.   
     
     
         4 . The system of  claim 1 , wherein:
 the response from the firewall management contract indicates a first set of processing operations comprising at least one of redacting, rewriting, encrypting, and hashing the retrieved data; and   processing the request for data in accordance with the response from the firewall management contract comprises:
 retrieving the requested data from the private distributed ledger; 
 processing the retrieved data using the first set of processing operations; and 
 sending the processed retrieved data to the computing device. 
   
     
     
         5 . The system of  claim 1 , wherein the private distributed ledger comprises one or more asset contracts each having an address of the private distributed ledger and each storing association data indicative of a respective one or more of the plurality of user accounts,
 wherein the request for data is a request for data stored in association with one of the one or more asset contracts.   
     
     
         6 . The system of  claim 5 , wherein the respective filter rules associated with at least some of the user accounts include asset-specific filter rules applicable only to data stored in association with specific asset contracts. 
     
     
         7 . The system of  claim 5 , wherein the requested data includes addresses on the private distributed ledger of one or more user accounts indicated in the association data stored by said one of the plurality of asset contracts. 
     
     
         8 . The system of  claim 5 , wherein:
 the firewall management contract stores trust level data indicating trust levels associated with at least some of the plurality of user accounts, including a first trust level associated with the first user account;   said one of the one or more asset contracts stores trust level data indicating a second trust level;   processing the request for data in accordance with the response from the firewall management contract comprises processing the request for data in dependence on a comparison between the first trust level and the second trust level.   
     
     
         9 . The system of  claim 5 , further comprising a data store, wherein the association data stored by said one of the one or more asset contracts for the first user account indicates a data location in a data store;
 the request is for data indicating the data location in the data store.   
     
     
         10 . The system of  claim 1 , wherein:
 the computing device is an application server communicatively coupled to one or more user devices; and   the computing device is arranged to send said request for data on behalf of one of the one or more user devices.   
     
     
         11 . The system of  claim 1 , wherein, in the event that the response from the firewall management contract indicates that no filter rule data is stored in association with the address of the first user account, the firewall server is arranged to apply a default filter rule of denying the computing device with access to the requested data. 
     
     
         12 . The system of  claim 1 , wherein, in the event that the response from the firewall management contract indicates one or more filter rules stored in association with the address of the first user account, the firewall server is arranged to apply a least restrictive of the indicated one or more filter rules. 
     
     
         13 . The system of  claim 1 , wherein said plurality of computing nodes is a first plurality of computing nodes, the system further comprising an application server communicatively coupled to the first plurality of computing nodes via the firewall server and further communicatively coupled to a second plurality of computing nodes hosting a public distributed ledger,
 wherein the application server is arranged to deploy a control contract on the public distributed ledger, where the control contract stores data identifying the private distributed ledger and is arranged to return, in response to receiving a request from a computing device, the data identifying the private distributed ledger.   
     
     
         14 . The system of  claim 13 , wherein the deployed control contract is further arranged to, in response to receiving a request indicating:
 an address on the public distributed ledger of a public user account;   an address on the private distributed ledger of a private user account; and   data identifying the private distributed ledger,   
       store information on the public distributed ledger, indicating an association between the address of the public user account and the address of the private user account. 
     
     
         15 . The system of  claim 14 , wherein the first application server is a first application server, the system further comprising:
 a data store; and   a second application server communicatively coupled with the data store and with the first plurality of computing nodes, wherein:   the private distributed ledger comprises one or more asset contracts each having an address of the private distributed ledger and each storing association data indicative of a respective one or more of the plurality of user accounts, said one or more asset contracts including a first asset contract;   the first application server is arranged to deploy a second asset contract on the public distributed ledger associated with the first asset contract on the private distributed ledger;   the second application server is arranged to receive data from the firewall server indicative of a certification of association data stored by the first asset contract, the association data comprising:
 the address on the private distributed ledger of the private user account; and 
 data indicative of a data location in the data store; 
   the second application server is further arranged to send a proxy certification request to the second asset contract, the proxy certification request conveying data comprising:
 the address on the public distributed ledger of the public user account; 
 data identifying the private distributed ledger; and 
 an address on the private distributed ledger of the first asset contract; and 
   the second asset contract is configured to generate, in response to receiving the proxy certification request, a proxy certification event on the public distributed ledger, the proxy certification event comprising:
 the address on the public distributed ledger of the public user account; 
 the data identifying the private distributed ledger; and 
 the address on the private distributed ledger of the first asset contract. 
   
     
     
         16 . A firewall server configured to:
 receive, from a computing device, a request for data stored on a private distributed ledger, the request indicating an address of a user account on the private distributed ledger;   send a query, in response to receiving said request, to a firewall management contract on the private distributed ledger for filter rule data associated with the address of the user account on the private distributed ledger; and   receive a response from the firewall management contract; and   process the request for data in accordance with the response from the firewall management contract.   
     
     
         17 . The firewall server of  claim 16 , wherein:
 the response from the firewall management contract indicates that a user associated with the first user account is permitted to access the requested data; and   processing the request for data in accordance with the response from the firewall management contract comprises providing the computing device with access to the requested data from the private distributed ledger.   
     
     
         18 . The firewall server of  claim 17 , wherein providing the computing device with access to the requested data comprises:
 signing the requested data using a digital signature key; and   sending the signed data to the computing device.   
     
     
         19 . The firewall server of  claim 16 , wherein:
 the response from the firewall management contract indicates a first set of processing operations comprising at least one of redacting, rewriting, encrypting, and hashing the retrieved data; and   processing the request for data in accordance with the response from the firewall management contract comprises:
 retrieving the requested data from the private distributed ledger; 
 processing the retrieved data using the first set of processing operations; and 
 sending the processed retrieved data to the computing device. 
   
     
     
         20 . A non-transient storage medium comprising machine-readable instructions which, when executed by a plurality of computing nodes hosting a private distributed ledger, cause the plurality of computing nodes to deploy a smart contract on the private distributed ledger, wherein the deployed smart contract is arranged to:
 store filter rule data associating addresses of user accounts on the private distributed ledger with filter rules for handling requests for data stored on the private distributed ledger; and   in response to receiving a query from a firewall server indicating an address of a first user account on the private distributed ledger, send a response to the firewall server indicative of a first set of filter rules associated with the address of the first user account.