Onchain and Offchain Permissioning with Besu

Transcript

at least my clock is 50 so um thank you everybody for being here this talk as the title implies is going to be about permissioning permissioning specifically on aetherium and the using the bayes little client okay I think it's I'm gonna be talking a little bit about in the beginning about Enterprise aetherium and why it's important and why we should be looking at it differently from what the community the Thurman community feels about that subject in general and after that we'll get into the details okay but first my name is Philippe and I'm a developer advocate for Pegasus Pegasus

being the protocol engineering group at consensus and and one of the main things we do is build a zoo so hyper edge of a zoo being an interim client right fully compatible with public maintenance and has some very interesting enterprise features built on top so this is a concept for the this short 20 minute talk we're going to be looking at that intro I mentioned so why enterprises theorem is not boring how quickly in two slides percent Pegasus and what we do and it's going to help contextualize the the why we do the things we do them that

way and and then we'll be looking at permissioning types with the help of our friend here friend in the corner and finally I don't think we're gonna have any time for demos but if you want you can come see me after a talk and we'll do some live demos on one to one so Enterprise aetherium is not boring I a couple disclaimers I think this is kind of like a feeling the community I mean this is what I feel sometimes the feedback I get from the community that Enterprise aetherium is shilling or or tube is Devi and it goes against the theorem communities values and I will do think it's a mistake and we should be concentrating more on building this in

particular one of the reasons is because of mass adoption I believe that we're gonna get massive the option of theorem type technologies through the usage of it by enterprises and companies and businesses out there I don't think we're gonna get mass adoption by end users actually just one day up and deciding to use it areum I think if I'm gonna be using it through services and applications that other companies are going to be building for them that's my personal opinion it's a bit controversial I guess but I do think we will arrive to that state of mass adoption and and and from this current early adopter stage that were in because

we're all here early adopters through the uses of an apposite theorem I also think it's a bridge you know these are some reasons why internet the internet got mass adopted back in the in the 90s I personally believe and I remember Netscape being a very very big factor to that and it was built by a company and that you know it was just a way for normal users to use interact with the Internet and that's a time and I think it's fair to say that we're at a stage in which those two are kind of comparable also Enterprise aetherium isn't only private or permission to networks right and opacity theorem also has permit main net use cases big

companies out there are already you know building stuff or proofs of concepts or betas or just testing these features out you know JPMorgan Microsoft Samsung etc all of these are a why are really kind of advocating for the usage of public maintenance and there's a very very wide variety of solutions it really isn't boring it's it's it's a huge super diverse application layer and networking and infrastructure layer that is available for for developers and and all types of profiles to work in today right so again just enterprises program is not boring and finally there's potentially lots of

if they're in 2.0 use cases for enterprises to work in future right typically one of those could be 2.0 staking services and and the whole community is gonna gain from this right because imagine we get the top ten companies in the world to take a little bit of their market cap value into this area of the ecosystem not only are we gonna gain in terms of cerium being more secure in terms of network security but also it's gonna produce you know a snowball effect in which they're gonna want to they're gonna be you know using aetherium and then that produces more uses of it itself but okay so let's get on with it I work at Pegasus and

Pegasus as I said is the protocol engineering group of consensus and so what we do is we work on all things protocol layer so that means if they're in 1.0 or 31 point X and if they're in 2.0 in that sense we we mainly build software are our main project if you will is hyper ledger baizhu which is as I mentioned a client and aetherium client fully compatible and has some really nice privacy crypts and just basically a nice nice enterprise features added on top of it one of those is permission right which I'll talk about in detail but the other things we do at Pegasus is you know help with the

theorem 2.0 and help what I mean by that is we actually build a client as well so it's called take ooh previously known as Artemis and we do a lot of research in this area 2.0 space so so we're trying to advance that in in the good direction right and on top of all of that we offer Enterprise Services so mainly support and features for enterprises to use and interact with the etherium network so in other words we really really try to make cerium easier to work with and more Enterprise ready right so all of our projects are standardized Enterprise ethereum so basically the EA defines

specs today for for software to work with and to and to follow and basically today if all of those very strictly I think it's the only client that actually fully comply little complies with the EI spec it is it has all of it has Apache 2.0 licenses so full open-source licenses for all of our projects which is really kind of what moves this space forward I would say and again production support for those companies anyways so getting on with actual permission I usually like to start anything with just looking up the on the dictionary what what the thing means right in this case we can all see that permissioning is

basically a system for granting authorization right there's many many many potential reasons we would want to have a permission network this slide is cut off purpose because I think there's many more that I just couldn't think of or that effective fit in here but in the following example with with fred that i introduced in the beginning will just probably be just looking at this the one identity requirement use case right so basically kyc yeah yeah now whether we like it or not that's something that's present in today's world that's something that's needed that's the way the world works today right well I'd love it if there weren't any kyc or email requirements in

the world that's not the case so keep that in mind there's basically four types of permissioning invasive today local account local node on chain node and on chain account permissioning types right so if you look it to the left there's each so the four groups are also divided in two groups each so you can either have local permissioning or our chain for machining and if you look to the right you can also have either account targeted permissioning or no targeted permissioning okay so in this example we have Fred and chocolate and afraid once to send you know some money Charlie you want to send five dollars to

Charlie so but the thing is they live far away so Fred lives in Paris say and Charlie lives in tools so Fred decides to send the money to Charlie using this magic internet money cloud called the theorem Network of course I think most people in this room know that's not the case that's not the definition it's more a p2p network that has you know trustless nodes in which we can send transactions that we can know that information is valid right so what Fred does and Charlie does as well they both create an account so oh xo1 an oxo - and then Fred sends five bucks to a node and then the five bucks are sent to Charlie first that's not

exactly what happens so Fred sends a transaction with a value of five to a specific node and then Charlie can just go and have and receive a receipt of that transaction right so let's say um Fred's been a bad boy okay he hasn't been very good and we want to block Fred from the network because he hasn't done his kyc you or whatever reason you want so we can actually tell that node up there so we can tell that node to block Fred's account from sending transaction or information to the network right so that's what local account permissioning is it's local because it's at a machine level so you would configure this node

by node right so the actual computer itself the server the node itself is gonna be configured in order to block or waitlist rather addresses in an accept information for certain from certain accounts right so Fred you know he's mad cuz he wants to send those five dollars to his friend Charlie and and he thinks of other reasons or other ways sorry to send this and really he just wants to do it so he goes ahead and obviously just sends another transaction to the node B right so node a is now blocking Fred's of transactions mean node B can actually still receive him of course and we all know that and in fact not only

that but node B is also going to propagate the the transaction on to the network and even note a is going to receive it as well so Charlie can even go into salt node a get that received of that transaction itself right so we can actually tell node a two-block node B from that from any from receiving any information from from that and that's what local node permissioning is again local because we're gonna modify the machine itself and we're gonna block the target is going to be the nodes itself so we're gonna block the nodes through a machine config on them on the node so in that case no they a nor B are separated right but the transaction is still going to be able to send through and it's nobody's gonna be able to send over the propagated to node C and then arrived at node a so that's when no

permissioning data comes in so on chain we can create a smart contract that's gonna allow us to have permissions on the network in which we can add data on top of it and we can actually tell that smart contract to whitelist certain things in this case we're gonna tell them it's not whitelist transactions from node B right so the whole network network Y permissions are going to be applied at the same moment because it's smart contract on chain right so that's what I'll change no permission hands very simply right so in this case node B is completely isolated and he can't interact with the network in fact it was probably a Fred's computer in the first

place so what we've now blocked node B in Fred Fred's computers from from interacting with our network but of course Fred can also send the transaction to node C I mean it was easier for him to send that transaction locally on his machine but he can also send it to any other endpoint in the internet right but at that point what we can do is add account permissioning data onto that smart contract and of course as you've already probably understood that's gonna be on chain account permissioning and that's gonna block both know Fred's nodes and accounts from interacting with the network so we can actually really isolate him completely from the story right that's at the end of this little of this little story and the way basically this is implemented today is

is as follows right so this is the ei arching account specification as you can see you it's quite simple in fact basically our implementation is is very very little from this but it has a center and a target that's the most two of the the most important parts of this of this line right you have the address sender which is going to be white listed or not into the network and the same thing goes for a ei on chain note specifications it's a bit more complicated because basically you have to decode that you know the URL of each one of the notes right so it has to have you know high and low which is basically the division of this very long string

right and the know you node IP and the e note port and all those get integrated into this implementation of the into this interface sorry and it gets added into small contract data it just as a small aside the EA Unchained note spec only utilizes just one bit from the 32 available bits today and the other 31 are reserved for future use cases but basically that first bit over there says you know 1 of 0 true/false is he allowed or is he not allowed into the network as I mentioned so no time for demo although I did go a bit faster than I imagined

but if you want to see the on chain permissioning demo live just come and see me after the this talk it's not gonna be an on a mini till but probably of my computer and we are obviously very very helped with them thankful if you can all help us through you know your issues your commits upp ours comments feedback anything and in fact we have that survey that you can answer today if you do ask for that survey we'll get some really nice swag for you so Pegasus swag have these nice tote bags really sturdy like very good quality yeah and last thing there's a bunch of links on

that QR code so there's documentation there's repos our wiki the chat basically a whole bunch of information regarding hydrology Basel Pegasus and and and more and the permissioning webinar and the pro concerning demo tutorial I think are there as well so that's it thank you very much again my name is Philippe and I'm here to you know answer any questions you all have after the talk so contact me in these and these addresses if you want thank you we actually I still have five minutes left so if

anybody has any permissioning questions or just basically any basic questions i can also answer them hi I have a question because I don't fully understand how does it relate to the et Romanians like is it the separate promotion doctrine or how does it work yeah actually good question I should probably mention that I assume that that was maybe known but no so this is this only works information the bachchans right information the network's the permissioning aspect of baizhu is not a pliable on main net the reason being is that for this to work basically you have to deploy the network with a

smart contract already deployed on top of it yeah so but normal it's real like maenette you can have permissioning based on the counts like you can you can whitelist accounts like morality for example is doing and what's the reason - what is the reason - the permission notes like if notes only process data anyway so what is the reason to permission them so note provisioning is really more in the context of enterprises theorem so in consortium in context right in consortium context you would have different enterprises let's say Airbus Air France and Iberia I don't know and they all want to make sure that the nodes are participating in this

network especially validator nodes but not only those right are our specific entities and so you can whitelist only specific like pre attributed nodes in that network anybody else does the basil permission system supports a an integrated voting mechanism or to update the permission permission settings for example how do we update the permission yeah good question it's not specifically a voting

system but we do have and we implemented a aid app that you know has a web UI in which you can you know very naturally and easily add either account addresses or email addresses in order to waitlist as you can see here you know whitelisted accounts admins or whites listed nodes in their right does that answer the question I'm not sure but for example we have two companies and they'd like to make sure no the other company doesn't you make the permission system that

doesn't change the permission in system as we need something - I don't know - yes for that I think you're referring to the the admin accounts so basically in these contexts in general you have you do have sort of like a and a all right Google admin account that I can actually modify these things right it's in these consortium networks you know they still kind of trust each other I mean they have to trust you because they work together right the data belongs to you as a node provide early so you can actually really have that data in on-prem but but yeah they're still admin accounts that will change these notes

thank you so I think that's it we don't have any more time but thank you very much again [Applause]