Blockchain 101

How it works

Underlying technologies

Blockchain is unique in its application of certain pre-existing technological concepts to achieve an extremely secure method of recording information. As a result, information stored in a blockchain can be trusted to be not only correct, but effectively incorruptible. An explanation of these underlying technologies follows.

Public key encryption

Blockchain does not rely on the username and password system which is most commonly implemented for achieving access to and protection of secure information. Instead, it relies on a two-step authentication process using public key encryption.

Each participant is issued a public key. Each public key is an algorithmically-generated string of numbers and/or letters which represents that participant. The public key is recorded as being linked to the relevant participant and can be shared with other participants to enable them to interact.

Each participant is also issued one or multiple private keys. Each private key is also an algorithmically-generated string of numbers and/or letters, but unlike the public key, these must be kept secure by the participant. Private keys are typically stored in a text file on a computer or mobile device and can themselves be encrypted to prevent others from using them. If a participant's private key were to become known to another person, that person would be able to impersonate the participant in the blockchain network.

Issuance of public and private keys, and their pairings is managed through software at the application layer. The asymmetric algorithm used to create each set of public and private keys is such that the paired keys have a mathematical relationship that allows the private key to decrypt the information encrypted using the public key.

Therefore, with public key encryption, participants in a blockchain network can send information in a secure manner. The sender will sign his or her message with a private key and, because the corresponding public key will be the only key mathematically linked to the sender's private key, any participant who knows the sender's public key (which in theory could be everyone else in the network) can be confident that the message came from the sender. The rest of the blockchain network can then validate this information through the relevant consensus protocol, after which the information can be collected to form part of a block to be recorded in the database.

In a blockchain network, the public keys of the participants would be knowable by the other participants, although the real identity of each participant could be protected and, thus, remain unknown. The ability to remain pseudo-anonymous in a blockchain network is particularly attractive from a data protection perspective.

Public key encryption explained

Merkle Trees

As stated above, a hash function can take an input of any size and convert it into the same sized output and the resulting hash cannot be reverse engineered. This means that it is possible to run two hashes through a hash function to get a resulting third hash, which is even harder to reverse engineer than the two originals. And this can be repeated again and again.

For example, eight initial pieces of information can be run through a hash function to produce eight initial hashes. These eight hashes can be grouped by two and run through a hash function to produce four hashes. Continuing on in this manner would result in one ultimate hash which represents the entirely of those eight initial pieces of information.

All of these hashes, when taken together, create a tree structure known as a "Merkle Tree"^3.

A participant in a blockchain network can collect multiple sets of information to be recorded in the database to form a block. Before that block is actually added to the blockchain, the following steps must take place:

1. The information is hashed together to form a Merkle Tree. The Merkle Tree is stored in the body of the block.
2. The Merkle Root is stored in the block header. Also contained in the block header are: the block number (this will be sequential in the chain); a timestamp (so the network knows when the block was formed); and the previous block's header hash (called the "pointer").
3. Certain elements in the header are hashed together to output the header hash of the block.
4. The details of the block are broadcast out to the blockchain network for verification.

Anatomy of a block

Whether or not a block is actually added to the blockchain depends on the consensus protocol adopted by the blockchain network. A consensus protocol can be any set of rules adopted by the network. It may involve the participants being required to solve a mathematical challenge (for example, as required by the Bitcoin network) or it may only require a certain percentage of participants in the network to agree that the block should be added. The requirements of each blockchain network will dictate what consensus protocol is used.

Once the requirements of the relevant consensus protocol have been satisfied, the block is added to the blockchain and the database is updated across the network. The blockchaining process will continue as participants seek to record additional information in the database, with each block being chained together by the pointers.

The pointer in each block contains the block header hash of the previous block, thus forming a sequential chain of information.

It should now be evident why blockchain is considered to be so secure. The chain of information stored in blocks is represented through linked hashes, each with a specific relationship to the underlying information. If a person were to seek to change any part of that underlying information, a cascade of errors would propagate across the entire blockchain, causing it to fail completely. All of the subsequent hashes in the relevant Merkle Tree and, therefore, the block header hash and, therefore, the pointer would be changed because an initial input had changed. If the pointer no longer points to the previous block then every subsequent block would cease to be chained properly.

A change to the underlying information will cascade up the Merkle Tree and change the Merkle Root of the block. This, in turn, will change the inputs for the block header hash. If the block header hash is changed, the pointer in the subsequent block will break and every subsequent block will ceased to be chained properly.

Therefore, to change any information in the database, every single piece of information from that initial point and subsequent would need to be updated in every single database hosted by every participant in the network. The amount of effort required to achieve this is a significant deterrent to would-be hackers or other persons attempting to interfere with the blockchain.

Security

Although using blockchain technology makes the recording and storage of information extremely secure, it is not invulnerable to attack. However, as noted above, the amount of computing power and effort to effectively attack a blockchain is a significant deterrent. Additionally, in general, as the interests of participants in blockchains are aligned, attacking the system from within is self-defeating.

A key factor that will influence the level of security risk is whether the network is "permissionless" (public) or "permissioned" (private).

Permissionless networks

A permissionless network is one in which anyone is able to (i) view the information in the database, (ii) submit information to be recorded in the database and (iii) host a version of the database and participate in the verification of information and blocks. Bitcoin is the most well-known permissionless blockchain network.

Because there could be hundreds or thousands of participants in a permissionless network, there is an increased risk that one of them may have malicious intent, but also a decreased risk that any one of them would have the computing power to carry out an attack on the blockchain.

While a permissionless network could empower a single administrator or group of administrators to dictate, control or change the consensus protocol, it is more likely that control will remain fully decentralised.

In addition, participation in a permissionless network will typically be pseudo-anonymous, given the information recorded in the database (even if encrypted) is publically accessible.

Permissioned networks

A permissioned network is one in which its participants are pre-selected or subjected to either specified participation criteria or approval by an administrator or group of administrators.

Permissioned networks are likely to comprise a smaller group of participants who have decided to form the blockchain network together to achieve a common purpose. The database in a permissioned network is also more likely to be accessible only by its participants. However, there could be uses where the information is made available to the public or to specific external entities.

Permissioned networks are expected to be more commonly adopted for uses where more sensitive information is being recorded, such as in relation to financial, identity or health services.

Due to fewer participants in a permissioned network, there is an increased risk attached if one of them has malicious intent and the computing power to carry out an attack on the blockchain. However, where the blockchain network comprises commercial partners, it seems unlikely that a participant would be incentivised to abuse its power

Potential attacks

• 51% attacks

As discussed above, each blockchain network can establish a consensus protocol setting out rules for how and when information can be verified and added to the database. The power to control the network can be widely distributed (as in a permissionless network) or concentrated in only a few participants (as is more likely in a permissioned network).

If one or a group of participants controls at least 51% of the hashing power on the network, meaning it provides more than half of the computing power being used to operate the blockchain, that participant or group of participants could dominate activity on the blockchain.
If a dominant participant has malicious intent, it could effect a denial of service attack on the blockchain by filling blocks with useless data while preventing other participants from submitting or recording information. Or, the dominant participant could control which participants are able to interact on the blockchain.
Attacking the blockchain in this manner would render it useless.

• Zero confirmation attacks

In a scenario where the information being recorded on the blockchain is meant to form a record of transactions, such as payments or transfers of other assets, the recording of that information in a verified blockchain acts as a confirmation that the transaction is valid.

A participant could attempt a fraud on the network, for example, by seeking to record information about two different transactions in which it seeks to transfer the same asset. Using public key encryption, the participant might sign each transaction with its private key and provide both counterparties with its public key.

The counterparties to these transactions would likely not be aware that the participant has promised to transfer the asset to both of them. If the consensus protocol for the blockchain network is such that the first verified block containing information about one of the transactions gets added to the blockchain (without requiring a check as to whether or not there are conflicting transactions), then the other transaction would be invalid at this point. The counterparty to this invalid transaction would lose out on the asset.

Implementing blockchain

Blockchain is just one technology in the arsenal of next generation technologies underlying "Web 3.0". Businesses and organisations around the world are looking towards these Web 3.0 technologies to help transform all aspects of what they do and how they serve their end users.

Implementing blockchain, however, is not a straightforward task. Most of the commercial applications of blockchain remain in proof of concept stage. It is expected that commercial, widespread,  deployment of blockchain will occur in the mid-term. Pending that there are also significant legal and regulatory considerations which need to be resolved (we will look at these in other publications).

However, significant players in the technology industry, such as IBM, Linux, Cisco and Intel, are working together to create a blockchain platform that can be adopted more widely by businesses. New players have also emerged to provide blockchain-as-a-service solutions.

Businesses looking to implement blockchain need to start engaging now.