Decentralized Privacy-Preserving Netting Protocol on Blockchain for Payment Systems

Abstract

This paper proposes a decentralized netting protocol that guarantees the privacy of the participants. Namely, it leverages the blockchain and its security properties to relax the trust assumptions and get rid of trusted central parties. We prove the protocol to be optimal and we analyze its performance using a proof-of-concept implemented on top of Hyperledger Fabric.

Appendices

A Proof of Optimality

We first prove for $f_i=T_i(\mathbf {x})$, then we show the result is invariant to the choice of $f_i$. Without loss of generality, we also assume $d_i=0, \forall i$ to simplify proof notation. Let $\mathbf {m} = [m_1^{}, m_2^{}, \dots , m_n^{}]^\top$ and $\mathbf {T} = [T_1^{}, T_2^{}, \dots , T_n^{}]^\top \in \mathbb {R}^n$. The problem defined by Eqs. (7) to (12) can be rewritten as

$$\begin{aligned} \max _{\mathbf {0} \le \mathbf {T} \le \mathbf {m}}&~ \sum _{i=1}^n T_i^{} \end{aligned}$$

(17)

(18)

(19)

(20)

where $\mathbf {0} \le \mathbf {T} \le \mathbf {m}$ stands for $0 \le T_i \le m_i, \forall 1 \le i \le n$. Note that the definitions of $S_i(T_i^{})$ and $R_i(\mathbf {T})$ above implicitly model the constraints defined in (12) for each participant i. In other words, if there are $T_i^{}$ payments settled for participant i, $S_i(T_i^{})$ imply that they must be the first $T_i^{}$ payments in $\mathcal {Q}_i$. Let $\mathbf {T}^t$ denote the value of $\mathbf {T}$ at the tth iteration of Algorithm 1. In addition, $\mathbf {T}^0$ is set to $\mathbf {m}$ for initialization. Then Algorithm 1 essentially becomes

• Initialization:

• Repeat following steps

  • Calculate $R_i(\mathbf {T}^t), \forall i \in [n]$

  • $\forall i \in [n]$ find

    $$\begin{aligned} T_i^{t+1} = \text {argmax}_{T} \Big \{ T \in [m_i]\Big \} \end{aligned}$$

    (21)
    $$\begin{aligned} \text {such that} \nonumber \\ \hat{B}_i - S_i(T_i^{t+1}) + R_i(\mathbf {T}^t) \ge 0 \end{aligned}$$

    (22)
    $$\begin{aligned} x_{i,k+1}\le x_{i,k}, \forall k\in [m_i^{}-1] \end{aligned}$$

    (23)

  • If $\mathbf {T}^{t+1} = \mathbf {T}^t$, stop. Otherwise, continue the loop.

The decentralized netting protocol is guaranteed to find the optimal solution. To prove this, we first prove that line 6–12 in Algorithm 1 is equivalent to Eqs. 21–23 above.

By the exit condition, we have $\tilde{B}^{t+1}_i \ge 0$. Therefore we could construct the following case, where

$$\begin{aligned} \tilde{B}^{t+1}_i = 0 \implies \hat{B}_i - S_i(T_i^{t+1}) + R_i(\mathbf {T}^t) = 0 \end{aligned}$$

(24)

Suppose there exists another optimal solution $\mathcal {T}_i > T_i^{t+1}$ and

$$\begin{aligned} \tilde{B}^{\mathcal {T}}_i = \hat{B}_i - S_i(\mathcal {T}_i) + R_i(\mathbf {T}^t) \end{aligned}$$

(25)

Since

$$\begin{aligned} S_i(\mathcal {T}_i) = \sum _{k=1}^{\mathcal {T}_i} \text {Amt}_{i,k}^{} > S_i(T_i^{t+1}) = \sum _{k=1}^{T_i^{t+1}} \text {Amt}_{i,k}^{} \end{aligned}$$

(26)

it implies that

$$\begin{aligned} \tilde{B}^{\mathcal {T}}_i < \tilde{B}^{t+1}_i = 0 \end{aligned}$$

(27)

Equation 27 clearly violates the non-overdraft condition. Therefore such $\mathcal {T}$ does not exist and $T_i^{t+1}$ is the maximum value that can be achieved at $t+1$th iteration. Furthermore, we have

$$\begin{aligned} h(\mathbf {x}_i^{t+1})= \max _k (I(x_{i,k}^{t+1})=1) \end{aligned}$$

(28)

$$\begin{aligned} h(\mathbf {x}_i^t)= \max _k (I(x_{i,k}^t)=1) \end{aligned}$$

(29)

In view of line 12 in Algorithm 1, the above two equations imply that

$$\begin{aligned} h(\mathbf {x}_i^{t+1})< h(\mathbf {x}_i^t)&\implies x_{i,k}^{t+1} < x_{i,k}^{t} \end{aligned}$$

(30)

$$\begin{aligned}&\implies T_i^{t+1} < T_i^t \end{aligned}$$

(31)

We note that the decentralized netting protocol starts with all the payment in queue and removes current invalid payments for each deficient participant. The optimality of $T_i$ at each iteration plus the monotonicity of $T_i$ over iterations guarantee that the first feasible solution will also be the optimal solution and it is unique.

Next, we show its invariance. If there is only one feasible solution, then it also achieves the maximum total value and number of payments. If there are two or more feasible solutions, the monotone decreasing of $T_i$ imply that any other feasible solution after the first one contains same or fewer payments for each participant and thus less value. This completes the proof.

B Functions of the Smart Contract

In Table 2, we describe the detailed functions of our implemented smart contract.

Table 2. Functions and logic of smart contract