Connecting web2 with web3: Verifying private off chain data sources

Transcript

hi my name is Adi benari I'm a Founder Co of a company called applied blockchain I'm going to present you today uh connecting web 2 with web 3 uh and how do we verify private offchain data sources um I don't know about you but I've been to a few different talks today and I think this is officially the hottest room in the entire building so if there's so many of you here I can only assume that you're really interested in this subject so I'll try to make it worth your while um just a little bit before I start uh apply blockchain is a company which develops blockchain applications so we're we're a software development shop I started the company in Devcon 1 in 2015 uh and we're close to 100 uh

developers focused primarily on different types of daps blockchain applications uh and so on and we have two two products that we've developed ourselves as well one is called Silent data and the other one is called London Bridge and I'm going to focus on silent data today and describe a bit more what we're doing and why um so first of all um I like to keep things a bit interactive let me just see how many of you um would would say you know what an oracle is okay can someone volunteer to just tell me what what you think it is okay I'm not going to get that so I'll tell you um essentially there's two two types of oracles that we see oracles are connecting data from outside the blockchain bringing it into the

blockchain uh in the blockchain in general we have a very trusted environment where we have cryptography and cryptographic Primitives and a cryptographic secured history and so we can trust everything that happens inside the smart contract if there's any data from outside the blockchain then then by default we don't trust it uh and so we typically have an oracle application or infr structure that enables us to bring data in and to be able to trust and act on it um I think of two types of Oracle Services one is for public data um which is generally pricing so in many uh Defi and other blockchain applications we need to know the price of assets and the price of an asset might come from external sources as well as sources on chain so

that's your very typical uh Oracle data Oracle um but the other type we've been exploring ourselves uh is is a privacy preserving Oracle right and there are some types of data that you might want to use in a blockchain application which belong to a user or which belong to a company and so you probably don't want or they probably don't want that data shared uh in any way with any third parties let alone with a bunch of validators uh who are who are validating a blockchain um now those external data sources uh I've got a few examples here uh but we think about open banking so I put pla on here as a source for bank

account data credit scoring um zero company invoices um Instagram to prove that you're Maybe the owner of an Instagram account uh maybe some kyc checks and so on so there's there's a bunch of different uh external data sources that you might want to verify uh in order for your dap for your web3 application to function um generally we see that these fall into two categories uh or two use cases the first one is tokenization right few technical issues here H in in defi let's call it 1.0 so what we've

seen in the last 18 months I'll just shout most of the focus is on ative assets uh what we think we're going to see more of uh as the technology prevails and and and hopefully the next wave will be more real world assets um and for those real world assets the assets are originated and anchored and they have part of their value comes from the external data sources from The Real World that means that we need to be able to import that information into the blockchain and where that information is sensitive so it's about a company it's about an individual and so on uh that's where we need a privacy preserving Oracle um so tokenization of real world

assets and the second is verification of offchain credentials so identity obviously anything to do with identity is super sensitive we don't really want to reveal it onchain at all so we need to be able to prove things about it without revealing uh so these are the types of data sources that we've been integrating with now there's an unsecure way of doing this and there's a secure way of doing it the unsecure way is what most people seem to do by default which is I'm building an application it's got a web server component so it's got a web two component um I'll inte with different web 2 Data sources through that and then I'll send the data to the blockchain right I'll send it to a problem with that type of application or that type of integration is you are

the third party or whoever is hosting that web two application is the third party they have to be trusted one to see the data and not to reveal it to others or not to abuse the fact that they can see the data and two they can actually change it to the original data source uh and therefore the the blockchain or the smart contract application has no way to know whether this is original data that's come from the original API or whether it's it's it's actually been fabricated or interfered with by the by the API layer right um the way this is solved in some oracles is to decentralize that API layer right which basically means we're

going to have a bunch of these Integrations hosted by different participants that's better because then uh instead of one party that can interfere we have a group which is a bit harder to uh to for them to to actually interfere and defa the system but they still all get to see the data and if the group is small enough so if it's not very decentralized then obviously they collude to interfere with the data as well so in general that's we wouldn't recommend the this type of approach because it carries a lot of risk and if in your smart contract you've got valuable assets you don't want those assets to be moving Based on data that isn't as secure as the blockchain itself so the the way we solve this we

built a platform called Silent data silent data uses a technology called Hardware secure enclaves right specifically we use Intel sgx now I know that in the crypto Community not everybody is a is is a huge fan of the technology because there's a there's a hardware manufacturer there's a corporate name behind it in practice uh the technology itself is is is fairly secure uh it has some known and published vulnerabilities just like any any type of solution including any types of cryptography um but it does have some super interesting properties that allow us to solve this problem very well uh those properties two primary properties it's a hardware secure Enclave so when you put data in there the data isn't

visible to anyone right it's not visible to the operator of the platform to the operator of the machine to the administrator of the machine and so on so nobody can actually see your data and and the way silent data works is is The Enclave itself the the our solution in The Enclave calls out to the web 2 apis using https so there's nowhere in the Middle where we could intercept or see that data it goes straight into The Enclave encrypted once it's in The Enclave we can query it and then we can produce a cryptographic proof um proving some properties of that data which we can then send to the blockchain so we have privacy the second Super interesting property of these uh of these Hardware secure enclaves is the attestation so the way it works is we

put the silent data code into The Enclave The Enclave itself has a unique key which was put in there by the manufacturer that signs our code and we send that to Intel we send it to the manufacturer manufacturer comes back signing that saying it's one of ours and we attest to the fact that that this is correct and they can't fabricate that because it's based on the original keys that they put in The Enclave right so they don't get to see our code they just get a hash of it and they they they really have no way of interfering in this right the only thing they could potentially do is maybe not respond to us so we get an attested version of the code now that's very interesting because we can then take the output from our enclave and we can prove the calculation

that's been done there right we can prove the source code that we use to query our data we can prove where the data came from through TLS so through https we have a certificate of the server from the bank or from wherever we we pulled the data from the the web 2 API so we can prove where the data's come from what query was run on it the fact that it was queried in a in a in a privacy preserving environment and it hasn't been leaked um and we can take that Al that proof alone to the smart contract and the smart contract can verify that right in in a in a very concise way so we can basically extend the the we're effectively extending the computation logic of the smart contract into a privacy preserving environment

where we can query these web two data sources does that make any sense yeah okay um so I guess the the the overall uh benefit of that is we can integrate with web 2 apis those apis don't have to change right so unlike um unlike uh other types of ways of keeping data private such as zero knowledge proofs um in knowledge proofs you typically have to take the original data have it exposed somewhere and then generate the proof which means that the data source would have to adopt the technology or it would have to be revealed somewhere uh with this type of Technology uh and with this solution

with silent data the apis don't need to change the data source doesn't need to change so we've connected directly with open banking for example in its current form and we can get the data from there and prove that it's that the actual bank account data has been queried they're not modified in the process an example query for a bank account might be I want to prove that someone's got more than1 a month €100 a month income right and they've had it for the last three months but I don't want to know anything else about the account well I want to know they've got a certain amount of funds in the account or they want to prove that to me um and so these are things that can be used uh for things like credit checking additional background checks if you think about defi protocols you want

to look at onchain data but you might also want to augment that with proof about offchain credentials uh and this is how we do it another example by way is social media so we've got an application that we're building where um we want to be able to prove people are using Instagram accounts to sell we want to be able to prove that the owner of a wallet is actually the seller right so the owner of a wallet is actually the owner of the Instagram account so we can use an integration that we have in silent data to enable a wallet to be linked to an Instagram account and to prove to provide the proof to the smart contract uh that the link is there uh without us actually having any access to that

account or to its credentials or anything like that so they're not revealed to anyone any questions y yeah so I mean the enclaves are built by the manufacturers right so most chip manufacturers to today Intel AMD um even Apple have enclaves in the in the chipsets and so it's a standard technology in the chipet uh we for silent data we've used intels because it has some some more advanced features that we rely on um but it's a feature of the uh of modern chips basically um I mean there are some

vulnerabilities known with these enclaves enclaves are everywhere by the way I mean I have it here my Apple pay is secured by an enclave that's on the iPhone right um one of the the known vulnerabilities is side Channel attack so if somebody has access to the hardware they can try to listen into the energy levels and try and guess what's going on inside the chip so some people have managed to uh to do some types of attacks and there's ways of pro of protecting against those as well so it's not a perfect technology but it has a lot of really important really useful features uh that we can bring into a blockchain environment yeah how close are we to web to financial

services wanting to integrate with something like site data say Equifax and credit checking yeah I mean the way Equifax works is it kind of collects everybody's data into the middle right and and kind of acts as that honey pot and has all of that data we're kind of thinking about more of a decentralized world right so we think the actual financing happens onchain because that's where it's most efficient and then there's really signals that come from offchain that can then be brought to the smart contract now ideally from a privacy perspective that's not one place that's Gathering that data right you're going to different data sources that the user is enabling right is giving access to those go into an environment where nobody not

an Equifax or anybody can actually access that data there's some proof that comes out that says this this is good for a defi loan for this type of smart contract verifies that and that's it so the data doesn't get revealed anywhere right it's just with the user or with their original web 2 accounts right so data sits in the bank we can't help that right for now um but we the original data source is the only place the data is ever expose yes exactly so so we have we have open banking that was the first one that we launched with that Works in Europe UK US uh we have for example an nft platform which takes as well as crypto

payments they take fat payments and they use the open banking to verify if someone has the fat um money amount in their account in order to be able to bid for a high value nft for example right so there are there's uses for open banking already um we've also uh the next one that we're releasing is Instagram so I mentioned that we're doing a proof of ownership of for the Instagram account that will be released in September um and we have a kyc email integration with onedo as well which we're preparing and really the next stage for us is to open theel so people can build their own adapters okay um yeah have a look silent dat.com

you can see information papers and so on please take a look oh very quickly we've also also built on the Intel sgx and en Clay's we've got a token Bridge which will built between aland and ethereum uh to enable liquidity between those two blockchains and we'll be integrating with others as well but we use we use the attestation feature of The Enclave to make the bridge more secure so again as a as a as a as a bridge operator we can't interfere thank you very much [Applause]