on 15-Sep-2018 (Sat)

A decentralised database with minimal trust between nodes would al- low for the creation of a global ledger. Such a ledger would have many useful applications in finance, trade, supply chain tracking and more. We present Corda, a decentralised global database, and describe in detail how it achieves the goal of providing a platform for decentralised app develop- ment. We elaborate on the high level description provided in the paper Corda: An introduction 1 and provide a detailed technical discussion

1 Introduction

In many industries significant effort is needed to keep organisation specific databases in sync with each other. In the financial sector the effort of keeping different databases synchronised, reconciling them to ensure they actually are synchronised and resolving the ‘breaks’ that occur when they are not represents a significant fraction of the total work a bank actually does! Why not just use a shared relational database? This would certainly solve a lot of problems using only existing technology, but it would also raise more questions than answers:

• Who would run this database? Where would we find a sufficient supply of angels to own it?
• In which countries would it be hosted? What would stop that country abusing the mountain of sensitive information it would have?
• What if it were hacked?
• Can you actually scale a relational database to fit the entire financial system?
• What happens if The Financial System™ needs to go down for mainte- nance? • What kind of nightmarish IT bureaucracy would guard changes to the database schemas?
• How would you manage access control

distributed database like BigTable 2 scales to large datasets and transaction volumes by spreading the data over many computers. However it is assumed that the computers in question are all run by a single homogenous organisation and that the nodes comprising the database all trust each other not to misbehave or leak data. In a decentralised database, such as the one underpinning Bitcoin 3 , the nodes make much weaker trust assumptions and actively cross-check each other’s work. Such databases trade performance and usability for security and global acceptance

Corda is a decentralised database platform with the following novel features:
• New transaction types can be defined using JVM 4 bytecode.
• Transactions may execute in parallel, on different nodes, without either node being aware of the other’s transactions

• Nodes are arranged in an authenticated peer to peer network. All com- munication is direct.
• There is no block chain 3 . Transaction races are deconflicted using plug- gable notaries. A single Corda network may contain multiple notaries that provide their guarantees using a variety of different algorithms. Thus Corda is not tied to any particular consensus algorithm. (§7)
• Data is shared on a need-to-know basis. Nodes provide the dependency graph of a transaction they are sending to another node on demand, but there is no global broadcast of all transactions.
• Bytecode-to-bytecode transpilation is used to allow complex, multi-step transaction building protocols called flows to be modelled as blocking code. The code is transformed into an asynchronous state machine, with checkpoints written to the node’s backing database when messages are sent and received. A node may potentially have millions of flows active at once and they may last days, across node restarts and even upgrades. Flows expose progress information to node administrators and users and may interact with people as well as other nodes. A Flow library is provided to enable developers to re-use common Flow types such as notarisation, membership broadcast and so on.

The data model allows for arbitrary object graphs to be stored in the ledger. These graphs are called states and are the atomic unit of data.
• Nodes are backed by a relational database and data placed in the ledger can be queried using SQL as well as joined with private tables, thanks to slots in the state definitions that are reserved for join keys.
• The platform provides a rich type system for the representation of things like dates, currencies, legal entities and financial entities such as cash, issuance, deals and so on.
• States can declare a relational mapping and can be queried using SQL.
• Integration with existing systems is considered from the start. The net- work can support rapid bulk data imports from other database systems without placing load on the network. Events on the ledger are exposed via an embedded JMS compatible message broker.
• States can declare scheduled events. For example a bond state may declare an automatic transition to an “in default” state if it is not repaid in time.

Corda is a platform for the writing of “CorDapps”: applications that extend the global database with new capabilities. Such apps define new data types, new inter-node protocol flows and the “smart contracts” that determine allowed changes.

What is a smart contract? That depends on the model of computation we are talking about. There are two competing computational models used in decen- tralised databases: the virtual computer model and the UTXO model. The virtual computer model is used by Ethereum 5 . It models the database as the in-memory state of a global computer with a single thread of execution deter- mined by the block chain. In the UTXO model, as used in Bitcoin, the database is a set of immutable rows keyed by (hash:output index). Transactions de- fine outputs that append new rows and inputs which consume existing rows. The term “smart contract” has a different meaning in each model. A deeper discussion of the tradeoffs and terminology in the different approaches can be found in the Corda introductory paper

We use the UTXO model and as a result our transactions are structurally sim- ilar to Bitcoin transactions: they have inputs, outputs and signatures. Unlike Bitcoin, Corda database rows can contain arbitrary data, not just a value field. Because the data consumed and added by transactions is not necessarily a set of key/value pairs, we don’t talk about rows but rather states. Like Bitcoin, Corda states are associated with bytecode programs that must accept a transaction for it to be valid, but unlike Bitcoin, a transaction must satisfy the programs for both the input and output states at once. Issuance transactions may append new states to the database without consuming any existing states but unlike in Bitcoin these transactions are not special and may be created at any time, by anyone

In contrast to both Bitcoin and Ethereum, Corda does not order transactions using a block chain and by implication does not use miners or proof-of-work. Instead each state points to a notary, which is a service that guarantees it will sign a transaction only if all the input states are un-consumed. A transaction is not allowed to consume states controlled by multiple notaries and thus there is never any need for two-phase commit between notaries. If a combination of states would cross notaries then a special transaction type is used to move them onto a single notary first. See §7 for more information.

Corda network consists of the following components: • Nodes, communicating using AMQP/1.0 over TLS. Nodes use a relational database for data storage. • A permissioning service that automates the process of provisioning TLS certificates. • A network map service that publishes information about nodes on the network. • One or more notary services. A notary may itself be distributed over multiple nodes. • Zero or more oracle services. An oracle is a well known service that signs transactions if they state a fact and that fact is considered to be true. They may also optionally also provide the facts. This is how the ledger can be connected to the real world, despite being fully deterministic. A purely in-memory implementation of the messaging subsystem is provided which can inject simulated latency between nodes and visualise communica- tions between them. This can be useful for debugging, testing and educational purposes

Unlike Bitcoin and Ethereum, Corda is designed for semi-private networks in which admission requires obtaining an identity signed by a root authority. This assumption is pervasive – the flow API provides messaging in terms of identities, with routing and delivery to underlying nodes being handled automatically. There is no global broadcast at any point

3 The peer to peer network
3.1 Network overview
A
Corda network consists of the following components:

• Nodes, communicating using AMQP/1.0 over TLS. Nodes use a relational database for data storage.
• A permissioning service that automates the process of provisioning TLS certificates.
• A network map service that publishes information about nodes on the network.
• One or more notary services. A notary may itself be distributed over multiple nodes.
• Zero or more oracle services. An oracle is a well known service that signs transactions if they state a fact and that fact is considered to be true.

They may also optionally also provide the facts. This is how the ledger can be connected to the real world, despite being fully deterministic. A purely in-memory implementation of the messaging subsystem is provided which can inject simulated latency between nodes and visualise communica- tions between them. This can be useful for debugging, testing and educational purposes. Oracles and notaries are covered in later sections.

3.2 Identity and the permissioning service

Unlike Bitcoin and Ethereum, Corda is designed for semi-private networks in which admission requires obtaining an identity signed by a root authority. This assumption is pervasive – the flow API provides messaging in terms of identities, with routing and delivery to underlying nodes being handled automatically. There is no global broadcast at any point. This ‘identity’ does not have to be a legal or true identity. In the same way that an email address is a globally unique pseudonym that is ultimately rooted by the top of the DNS hierarchy, so too can a Corda network work with arbitrary self-selected usernames. The permissioning service can implement any policy it likes as long as the identities it signs are globally unique. Thus an entirely anonymous Corda network is possible if a suitable IP obfuscation system like Tor 6 is also used.