Thomas Hulse - Fifth9 - Ethereum London

yep so I'm a blockchain consultants at 5959 also work in the OPM machine learning space so oh yeah who's Mike can everybody hear me if I speak like this can people hear at the back yes yeah hello okay that's working yeah so I'm interested in machine learning as well so these are some of the other companies I've consulted for and worked for in the blockchain space so I was lucky to be I was lucky to be in Accenture when they first started getting into blockchain so I helped start up their blockchain community of practice they're globally and now moves on to a startup and experiencing start of life so the aims of this talk I want to highlight that blockchain doesn't exist on its own this is especially true in an enterprise context so we always have physical assets in the real world that we're trying to represent on the blockchain and we always have the data side and the data security mainly the private keys which has already come up in today's talk so how I'm going to explain this I'm going to give a supply chain blockchain example just to create a bit of enterprise context then I'm going to go into the physical problem so the moving of items through the supply chain then I'll touch on some of the data problems so what's the new wage way of securing your private keys so when I was working at Accenture large defense company approached us with the problem statement the Ministry of Defense had aircraft carriers that would need to be returned to port because of faulty radar systems these radar systems are breaking because of single diodes that were counterfeit now if you can imagine in a supply chain to create something like an aircraft carrier there are at least 20 tiers as 20 different people building up these components when you only have databases each person only knows what's coming to them and what's gone out of them that means there are two major problems first of all this aircraft carrier was no longer in service second of all it costs a millions of pounds to be out to be able to identify through the supply chain who had originally supplied that counts a fit diode so block Jam is a clear use case here because blockchain allows everybody's to be able to share information specifically we actually use Hyper let you in this case because of the ability to create permission blockchain and create certain channels for example Tallis doesn't want rolls-royce to know how much is just paid for a contract so certain things need to stay confidential however there's a massive advantage if Tallis can quickly identify who's supplying these counterfeit goods and then black listen then somebody like rolls-royce can come and see who's been blacklisted and that's all in an effort to reduce the amounts of counterfeit goods that exist in our aerospace industry so that's the example I'm going to use as I go throughout the talk to give some context you can see here how throughout the supply chain it's all linked through the blockchain so now the physical side of things what do I mean by physical well when supplier a send something to supply it be how does it work at the moment they scan a barcode leaves the warehouse arrives at the next warehouse supply B scans a barcode and then over the blockchain this will be updated so that's great there's a problem with barcodes what does everybody love about blockchain well it's immutable and it's tamper proof barcodes are neither of these and neither QR codes so we're going to create a blockchain solution and we're going to claim that we know with a hundred percent verifiability that something has come from where we say is but we have a physical side of the representation of the blockchain that is weak ie barcodes and QR codes then we have a massive problem so how could we overcome this problem there's a blockchain version of a barcode that's been created by the company chronicled called a crypto seal this has blockchain attributes so first of all it can't be tampered with if you remove a QR code it's basically a sticker if you remove the sticker from this box in the supply chain it destroys the NFC tag inside it so that means it's tamper proof it's cryptographically unique so it's impossible to replicate and the information on it is immutable so some of you might be thinking I don't really care about supply chains but it's just to give an awareness of when we're creating solutions in the blockchain industry especially enterprise space we need to be thinking about all of our claims and the blockchain being backed up by how we're setting up the physical world now we've seen from a simple example it's no longer possible to replace a box and that would make sense if we have a box of diodes worth a thousand pounds talus had a use case where they were shipping FPGA boards their field programmable gate arrays and there were thousands of pounds so we'd have a box where 20,000 pounds I'm sure you're all boss on crypto seals up to now but you can't bypass them if you got 20,000 pounds and you want to replace them with counterfeit goods it's still possible to do you could take the eff it and because of the massive reward in this case you could bypass the crypto seal on the place the whole box people might have seen it in whip war dogs where they replace all the Chinese ammunition they take out of a Chinese box they put it in American bags and say that it's American ammunition that's what happens in our aerospace industry and that could still happen with crypto seals to an extent so how can we make sure that the fpga boards in this case that leave supplier a and eventually reach our aircraft carriers are the same ones again stay with me no one cares about fpga boards but this is more about having the creative mind on identifying an individual object talis have been working on a fingerprinting for fpga boards when an fpga board is made the silicon is folded these ripples on the silicon to create mine use of microscopic details this means that if you want to the FPGA board you're able to get a fingerprint out of it so just like all fingerprints don't affect how we can operate the fingerprints of the FPGA boards don't affect their functionality but you can still use them to individually identify them therefore when we created this end-to-end supply chain solution we were able to secure with crypto seals as a first line of defense and then the second line of defense to enable our block chain we uniquely identified the FPGA boards this is now being rolled out Tallis rolls-royce and BAE Systems are taking this blockchain to production it was actually shown at the farm for Air Show recently so what are some of the ways some of you might be here working with different things let's take another company so De Beers the world's largest supplier of diamonds they wanted to undercut ever ledger ever ledger were one of the first Enterprise blockchain solutions in the world they created a blockchain solution to track diamonds their use case was that they wanted to stop blood diamonds across the world De Beers as a big supplier knew they could come in and muscle out but they needed to make sure that they did things I have alleged didn't like Tallis they have the technology and understanding of their product to add the actual lay of securities of the blockchain they use a combination of machine learning and like pattern recognition to individually identify diamonds this means that even if they have a blockchain somebody could come along and say it's great that you've got a blockchain is immutable but you're not backing it up in the real world now they have they can shine a laser of this and they can say this is the exact diamond that left supply a and ended up in the ring on somebody's finger there are lots of lots of examples of this and I personally believe you can uniquely identify anything and if you're creating an enterprise blockchain solution or you're thinking of investing in an enterprise box change solution make sure they're thinking of these things one last one I'd like to talk about is the digital world so you might be transferring assets that are digital let's say you were a law and we want to start putting our contracts onto the blockchain we want to make sure that the contract that is signed in 2007 isn't fortune 2011 which is a fact in today's day and this happens an enormous amount in law because all you really need to do is pay solicitor certain amount of money and if they're a bad actor they can basically verify that the change of this document happened in the past so there's a massive attack factor there how can we secure that with blockchain well we can create a hash of the documents before we upload it to the blockchain I don't want to go too much into hashing I think most of you be quite familiar but basically creates a fingerprint of a digital asset lines all the ones and zeros up and it creates a fingerprint of that even if one single bond is changed to receiver so even if one letter has changed to a different letter in that digital contract the hash will be completely different this means that you can have hundred-percent verifiability through your blockchain after your physical asset that hasn't changed so we talked about the physical side of things now what are going to the data so it's great if you have a secure physical side but like any security feature it's only as strong as its weakest link and what's the biggest problem in blockchain security it's clearly private keys and it's not surprising that it's private keys because the only part of a blockchain that is trusted to the end-user is the private key and that's the weakest part because humans can't be trusted to look after things so 20 billion pounds worth ecliptic currency has been stolen and 2 billion pounds of cryptocurrency was lost in 2017 alone this cryptocurrency is is lost because they got virus on the hard drive or for example they lose a backup key all these things can just mean you lose everything and because there's no third party to pocket because we love this decentralized world we've lost all our money so calls into question what's the gold standard in the off chain world in the every other course of enterprise banks use hardware security modules to monitor incoming and outgoing transactions and everybody here has their private keys stored on Bank hardware security modules I think the best way to split this up is this is a picture of hardware security module may bite Alice you have hard drives everybody there's a hard drive in this computer it's a piece of hardware this is also hardware but it's not a hard drive the private keys are physically encrypted into this so if we were to take this now in this house I've the keys stored on this Mac the Beast definitely somebody here he'll be able to go home read that hard drive and steal the private keys if I gave a room of a million people hardware security module 100% nobody will be able to take a home and steal the private keys of it and that's why it's a gold standard of security everybody from HSBC to the Bank of England rely on these so how come you need to grate this with a blockchain well if we're deploying our blockchain solution on aetherium or hyper ledge it's actually very easy takes about 15 lines of code on a ledger to deploy your private key to a hardware security module so that means with 15 lines of code on github it's open source you can have world standard enterprise security for your blockchain solutions if I'm talking to a blockchain client and we're talking about blockchain and they haven't got that private key stored on a hardware security module that's the first thing to do get them on hardware security module let's get things safe and then you can start working on use cases after that this however cost 20,000 pounds this particular model and even for the cheapest hardware security module second hand you're looking at 2,000 pounds so that 2,000 pound ones still going to be thousands of times more secure than any hard drive however for me and you if we have cryptocurrency you're not going to want to go and invest in at HSM unless you're doing very well luckily now you can have cloud hardware security module contracts for a pound an hour that means there's literally no excuse not to have Enterprise great security and it's a red flag if a company doesn't have hardware security modules sauna private keys the next step of this and it's a bit more blue sky thinking is where can we take these things on now so I've talked about the supply chain how blockchain can be used to secure a supply chain that there are two major things you need to make sure the physical assets are being secured and are being secured in a blockchain way ie they're immutable and that they're tamper proof we have the data side of things so let's put everything on enterprise-grade security and make sure that we're not cutting any corners what's the next step and I personally think it's hardware security modules are now being put onto SIM cards and this has a potential to integrate edge computing and blockchain and densify as grade security so I suppose if you're not familiar with edge computing basically when everybody got excited about cloud but originally everybody was getting excited about edge computing what cloud ended up taking everything away from being distributed and putting it in one place edge computing is the movement to take everything from one place and start distributing it again so it's interesting we can see power levels between edge computing and blockchain now if you have a hardware security module that is based on a SIM card you have your private keys stored on that SIM card and it's in an edge computer you're starting to create the next level of distributed computing and distributed security how long have I got left or two four ten minutes yeah founder said do a bit more on how I wanted to cover this more anyway so I think the important think a live view be quite interested in like why is that good to have a blockchain on the supply chain as a holistic use case because these bad actors can still do what they want we can't ever stop them doing what they want and the blockchain is never actually solving that and I think that's often where the misconception comes with blockchain and I think Laura that came up from your talks as well it's not a trustless environment it's creating new trust into the environment so this solution we created with Alice all it really does is create transparency throughout the blockchain and throughout the supply chain that means that in the future when somebody is a back there bad actor we can easily blacklist them at the moment because of opacity is impossible to blacklist people it's also very difficult to communicate between different suppliers and different companies bad actors yes that's basic yeah I think that's it so any questions I'll go to the last slide oh yeah that's my if you scan my QR code you can ask me on LinkedIn okay guys so that's that's the first first question man in front here we go hi are you doing just go back to the DeBeers example you gave yeah so I get the supply Tony's on because you've got multiple axes as a lack of opacity between the different supply chain components which sort of lends itself to decentralization I think one of the things you missed out when you talked about blockchain being in musical the fundamental thing is it's decentralized so in the case of De Beers I get the fact that you can fingerprint the diamond that makes a lot of sense why do you need the blockchain why not just have a centralized authority the database idea is that so if the bee is it says that bomb and on your wing is not a Blood Diamond you can trust the bees and that can happen at the moment but it's only when you have DeBeers and you have the other five major suppliers all sharing and verifying the same information that you can really get that accountability so it take it makes it impossible for De Beers to lie and to say yes this diamond isn't a Blood Diamond if you've got five essentially very large companies it's very easy to form a cartel they've done in the past so it's I think it's less like yeah it's not impossible but it's less likely that they use five we're going to get together and convene to do that then is that one of them is just going to say yeah I don't supply blood diamonds because nobody says they supplied blood diamonds at the moment De Beers on saying we're trying to stop blood diamonds because they'd never say that but that's the implication do you know I mean that nobody's ever claiming to supply blood diamonds but blood diamonds are getting into the industry just like know the Tallis would never sell an aircraft carrier to the Ministry of Defence and say yeah 10% of those parts are counterfeit but we know hundred percent ten percent of those past accounts of it so it's it's a bit publicity balance does answer your question so we use don't forget it's not just the suppliers so you've got the shops who actually sell that them you got the mines somebody who's some the shops themselves want to authenticate the diamonds as well so the idea is you have an app and you know the everybody's becoming much more aware of the environment so it's becoming good for customers to be able to see where that diamond come from so that's a great example so yeah we're looking in the UK where it's just based in the UK we can trust in Land Registry if you go to African countries the inline bet you see there it's not trusted and there's a massive problem with that exactly exactly but with the diamond supply chain that does cross countries and continents so you can kind of see like there is mistrust just like this mistrust and the average space supply chain [Music] it doesn't have that because most of the times they are in the clouds I'm sure too lazy to upgrade so therefore my point is a private rock Chinese it's worse well there's a lot of permission blockchains now so you've got gospel Piper ledger quarter I mean they're bft so it's in bit so it's not for the end user to decide like I said yeah they're still in their private keys the private key gets stolen or lost like that's their problem but in terms of consensus that's built by or three high collective in gospel so I don't feel like it's up to the end user to decide how secure great point great point so we had a similar one actually so basic saying it's good for high value items that are infrequent but what about very frequent low value items and I think liquids and waste materials probably the best example of that because liquid can be divided as many times as you need so it's practically infinite one of we actually had a similar use case with creating a decentralized marketplace for waste materials what we actually used to identify the waste materials was not something to stick on but a handheld molecular scanner so say Oh have created the world's first time a molecular scanner basically if I had any waste material or pharmaceutical good here now I could scan that with the molecular scanner and that will give me a fingerprint that be uniquely identifiable for that part of the liquid and it would also give me all the properties of that liquid so I'm going to use me as an example but I don't think milks a good use case probably pharmaceuticals are much better use case but it would give you the protein if you give you the carbohydrates and it would give you a unique identifier and if you scanned a bottle of milk next to it wouldn't match so I agree I don't think you should put crypto seals on milk or low value items I think they cost about 20 pH so they will go down in price but at the moment it's just ridiculous to do that i 100% agree with you but there are other ways to get on that and that's why i wanted to give the example of an fpga and hashing hashing is completely free so other ways to get around those low value items actually seal the container make it in any way secure I can yeah I think yeah that's a great technology and I think if you had that use case and you needed to do that and you could find somebody who could scan a whole bunch of things and create a unique identifier for them that's brilliant that's exactly the type of creativity and thinking you need to be able to create and solutions like as capable as a secure element or could he just say what consumers do now yeah so Amazon secured a paintin's I think three years ago for having this hardware security module enterprise grade level security and migrating it onto a SIM card so even if we have that SIM card we wouldn't be able to read the private keys off it so yet that's how things are going things are becoming smaller as in any industry and it might actually be the case now where we're moving away from hardware security modules being in a cloud infrastructure to a decentralized sim management process and then that brings in to Internet of Things which is one of the clients we work with Vodafone of the world leader and Internet of Things and that's going to maybe even push more into the IOT space rather than the blockchain space so think the further we get down that's the more all these emerging technologies just kind of become one so is it practical can you sign a transaction not a transaction and so as far as I've seen I did be safety before the talk I can't find any people who are using hardware security Mazon sims in any production level solution at the moment so maybe it's happening somewhere in a lab but I can't find any information now it's happening on a a large scale this fish stands one just asked what was it yeah all right so I I guess I agree with the gentleman over there when he said kind of private blockchains are worse than databases or just like databases well my question is why do we keep going to private blockchain I mean I don't know this we've done yet but my question is is why can't we create some kind of like second layer or even something more fundamental where you have the data stored because blockchain is not only about transaction but you could also have data if we have this data encrypted and when you want to lose it which is a big concern for some people you know privacy reason why can't you destroy the private key in a way when you come out on the on the blockchain in this in this scenario you have all the data stored on a very large blockchain it's encrypted you only could read it using your private key and it's also kind of immutable if you need it for your own organization okay so hypo ledger the Hyperlight should have done that where you can destroy private keys and essentially make the blockchain editable and accentuate paints it's at the very inversion of that mainly because of gdpr so that's so I think no two basically questions that the first one is why is a permission blockchain better than a database yeah exactly and so let's take let's take the aerospace we're with the database set who would own the database for the aerospace example who were doing the database who would look after the database for the aerospace example and what this will enable you even if to say the old aetherium network goes down you still your theory you layer two by the nodes that's sorry that's the second question that's just focus on the first one the first one is you can't have a centralized database in the supply chain because you have 100 different actors across every continent in the world who's going to pay for that who's going to pay for who's going to pay for the Oracle cloud services Ministry of Defense they want to do it because they're not interested Tallis aren't going to do it yeah but you only so exactly so you need to create an incentive for people to host their own nodes that's that's right but the intercept the incentive is shirt and the cost assured between all the actors in that permission blockchain so we did have that problem and that was a big one how can we make these permit these people hold their own nodes and for this use cater end up being we have to get the Ministry of Defense to pressurize people and say listen if you're going to start supplying things to us in 2030 we're expecting this level of accountability and transparency so you have to have you have to host your node and it's cheap to host a node but you still need to create incentive and it's not possible in this distributed example to say white like the in lamb registry yeah you look after this because nobody wants to look after a single database that is going to hold all the information yeah exactly there's no trust of their policy which is blockchains enterprises use case and their nutshell Thanks [Applause]