Patent Description:
Distributed databases - such as the Blockchain - offer increased security against manipulation of data. Thus, various functionality - e.g., sense and control functionality in industrial environments, control of electrical grids, transport systems, etc. - relies on data stored in a distributed database.

Various functionality relying on data stored in the distributed database can be event driven. , one or more functionalities can be triggered by and/or depend on events external to the distributed database, i.e., based on external data. To this end, measurement nodes, sometimes also referred to as oracles, are known. Oracles can provide measurement datasets indicative of one or more observables of an event. Then, the measurement datasets can be stored in the distributed database. Logic functionality can depend on these measurement datasets.

The validity/integrity of measurement datasets can sometimes be compromised. This can be due, e.g., a malfunctioning oracle or fraud. Such limited validity of the measurement datasets can also compromise the integrity of the data stored in the distributed database or any functionality depending on the measurement dataset.

Document <CIT> discloses methods, systems, and computer program products for storing and validating the integrity of event related information. To facilitate auditing and traceability, raw signals, normalized signals, detected events, event expirations, and event notifications can be stored in a queryable distributed ledger (e.g., a blockchain). Personal information can be stripped (or otherwise rendered inert, for example, unrecognizable, unreproducible, etc.) prior to storage into the distributed ledger minimizing the possibility of a person being identified. Ledger data can be used to verify actual data as well as for forensics purposes, such as, to audit data, recreate events, etc., in view of an error or inconsistency to investigate, diagnose, remediate, etc..

Accordingly, there is a need for techniques of validating measurement datasets. In particular, there is a need for techniques which overcome or mitigate at least some of the above-identified restrictions and drawbacks.

A mining node of an infrastructure of a distributed database includes a control circuitry. The control circuitry is configured as defined in independent claim <NUM>.

A computer-implemented method at a mining node of an infrastructure of a distributed database includes the step defined in independent claim <NUM>.

Unless explicitly stated otherwise the terms "perform", "calculate", "computer-implemented", "calculate", "establish", "generate", "configure", "reconstruct" and the like preferably relate to actions and/or processes and/or processing steps which modify data and/or which generate data and/or which transform data in other data. Data can be represented by physical quantities or be present as physical quantities, e.g., as electrical pulses. In particular, the term "computer" should be interpreted broadly to cover all electronic devices having data processing capabilities. Computers can, thus, be implemented by personal computers, servers, memory programmable controllers, handheld computer systems, pocket PC devices, wireless communication devices and other communication devices that can process data, processors and other electronic devices for processing data.

In the context of the present disclosure "computer-implemented" can relate to an implementation of a method in which a processor performs at least one method step.

A processor in the context of the present disclosure can be a machine or electronic circuit. A processor can be specifically implemented by a central processing unit (CPU) or a microprocessor or a microcontroller, e.g., an application-specific integrated circuit (ASIC) or a digital signal processor, possibly in combination with a memory unit for storing program code, etc. A processor can alternatively or additionally be implemented by an integrated circuit (IC), specifically a field programmable gate array (FPGA), an ASIC or a digital signal processor (DSP) or a graphic processing unit (GPU). Alternatively or additionally, a processor can be implemented by a virtual processor or a virtual machine or a soft CPU. A processor can be implemented by a programmable processor having configuration interfaces that facilitate configuration of various techniques described herein. The programmable processor can be configured to implement method steps as described herein, components, modules, or other aspects of the techniques described herein.

A "memory" or "memory unit" or "memory module" or the like can be implemented by a volatile memory in the form of random access memory (RAM) or a non-volatile memory such as a hard disc or data carrier.

The term "include" - specifically with respect to data and/or information - can relate to a (computer-implemented) storing of respective information or the respective date in a data structure/data set (which, e.g., in turn is also stored in a memory unit) in the context of the present disclosure.

The term "providing" - in particular in regard to data and/or information - can relate to a computer-implemented providing in connection with the present disclosure. Said providing may be implemented by an interface, e.g., a database interface, a network interface, an interface to a memory unit. It is possible that respective data and/or information are communicated and/or transmitted and/or retrieved and/or received when providing via the interface.

The term "providing" can also relate to a loading or saving, e.g., of a transaction together with respective data in the context of the present disclosure. For example, this can be implemented on or by a memory module.

The term "providing" can also relate to communicating (or transmitting or receiving or transfer) of respective data from a node to another node of the distributed database infrastructure (respectively of the corresponding infrastructure) in the context of the present disclosure.

A "smart contract" or a smart-contract process" or "smart-contract functionality" can refer to the execution of program code, e.g., of a control instruction, in a process by means of the distributed database or the respective infrastructure.

A "checksum", e.g., a data-block checksum, a data checksum, a node checksum, a transaction checksum, a chaining checksum or the like can relate to a cryptographic checksum or a cryptographic hash or hash value, in the context of the present disclosure. Such checksums can, in particular, be determined across a data set and/or data and/or one or more transactions and/or a subsection of a data block, e.g., the block header of a block of the blockchain or the data block header of a data block or only a part of the transaction of a data block. A checksum can be specifically implemented by a checksum or checksums or a hash value or hash values of a hash tree, e.g., a Merkle tree, a Patricia tree. Moreover, a "checksum" can also be implemented by a digital signature or a cryptographic message authentication code. By means of checksums, it is possible to implement cryptographic protection/protection against manipulation for transactions and the associated data and datasets on various levels of the distributed database. For example, if there is a need for an increased level of security, it would be possible to create and validate checksums on transaction level. For example, if a reduced level of security is required, then it would be possible to create and validate checksums on block level - e.g., across the entire block or only across a part of the data block and/or a part of the transaction.

A "data-block checksum" can relate to a checksum which is calculated across a part or all transactions of a data block in the context of the present disclosure. A node can validate/determine the integrity/authenticity of the respective part of the data block by means of data-block checksums. Alternatively or additionally, the data-block checksum can also be formed across transactions of a preceding data block/predecessor data block. The data-block checksum can, in particular, be implemented by means of a hash tree, e.g., a Merkle tree [<NUM>] or a Patricia tree. Here, the data-block checksum can be the root checksum of the Merkle tree of the Patricia tree or of another binary hash tree. It would be possible that transactions are saved by means of further checksums from the Merkle tree or the Patricia tree, respectively, e.g., by using the transaction checksums, wherein in particular the further checksums can relate to leaves of the Merkle tree or the Patricia tree, respectively. The data-block checksum can, thereby, protect the transaction by forming the root checksum from the further checksums. The data-block checksum can, in particular, be calculated for the transactions of a specific data block of the data blocks. In particular, such a data-block checksum can be included in a subsequent data block of the given data block, e.g., to chain this subsequent data block with the preceding data blocks and, in particular to make the integrity of the distributed database infrastructure testable. Thereby, the data-block checksum can implement the chaining checksum or, at least, go into the chaining checksum. The header of a data block (e.g., of a new data block or a data block for which the data-block checksum is determined) can include the data-block checksum.

A "transaction checksum" can relate to a checksum which is determined across a transaction of a data block, in connection with the present disclosure. In addition, the calculation of the data-block checksum of a respective data block can be accelerated, because for this already calculated transactions checksums can be readily used as leaves of a Merkle tree.

A "chaining checksum" in the context of the present disclosure can relate to a checksum which for the respective data block of a Blockchain indicates or references to a preceding data block of the Blockchain - which is often referred to as "previous block hash" in literature [<NUM>]. For this, in particular, a respective chaining checksum is determined for the preceding data block. The chaining checksum can be implemented, e.g., by a transaction checksum or a data-block checksum of a data block, i.e., of an existing data block of the Blockchain; to thereby chain a new data block with a (existing) data block of the Blockchain. For example, it would also be possible that a checksum is determined across a header of the preceding data block or across the entire preceding data block to be used as a chaining checksum. For example, this could also be calculated for multiple or all of the preceding data blocks. For example, the chaining checksum could also be implemented by a checksum determined across the header of a data block in the data-block checksum. A respective data block of the Blockchain includes, however, preferably a chaining checksum that has been calculated or relates to a preceding data block, specifically, the next-neighbor preceding data block directly adjacent to the respective data block. For example, it would also be possible that a respective chaining checksum is determined only across a part of the respective data block, e.g., the preceding data block. Thereby, a data block can be implemented which has an integrity protected part and a non-protected part. Thereby, a data block can be implemented that has a non-changeable integrity protected part and that has a non-protected part that can be modified later on. Integrity protected can mean that a change of the integrity protected data can be detected by means of a checksum.

Next, example implementations of a transaction are described.

The data - that is, e.g., stored in or written to a transaction of a data block - can be provided in various manners. Instead of data - e.g., user data such as measurement data or data/ownership structure regarding ASICs - a transaction of a data block can rather include the checksum for such data. The respective checksum can be implemented in various manners. For example, a respective data-block checksum of a data block, e.g., including the respective data, of another database or of the distributed database, a transaction checksum of a data block of the respective data, e.g., of the distributed database or of another database, or a data checksum determined across the data can be used.

In addition, the respective transaction can optionally include a link to or an indication of a memory position - e.g., an address of a file server and indications where the respective data are to be found on the file server, i.e., pertaining to off-chain storage; or an address of another distributed database which includes the data. The respective data could, e.g., also be provided in a further transaction of a further data block of the Blockchain - e.g., if the respective data and the associated checksums are included in different data blocks. It would also be possible that those data are provided via another communication channel - e.g., via another database and/or a cryptographically-secured communication channel.

In this regard, reading a dataset from a distributed database can generally correspond to reading either the entire dataset from the distributed database, or reading a checksum of the dataset from the distributed database and reading a payload data of the dataset from a non-distributed database.

Further, it would be possible that in addition to the checksum an add-on data set - e.g., a link or an indication to a memory position - is provided in the respective transaction. The add-on data set can, in particular, indicate where the data can be retrieved. This can be helpful to limit the amount of data of the blockchain.

The term "security protected" can, specifically, relate to a protection that can be implemented by a cryptographic method. For example, this can be implemented by using a distributed database infrastructure for the providing or communication or transmitting of respective data/transactions. This can be implemented by a combination of the various checksums - e.g., cryptographic - , by appropriate synergetic interaction between the checksums, to, e.g., increase the security or the cryptographic security for the data of the transactions. In other words, "security protected" in the context of the present disclosure can also relate to "cryptographically protected" and/or "protected against manipulation", wherein "protected against manipulation" can also be referred to as "protected integrity".

Insertion of transactions into a distributed database infrastructure can include chaining of data blocks of a Blockchain. The term "chaining of data blocks" in the connection of the present disclosure can relate to the data blocks respectively including information (such as the chaining checksum) which links to another data block or multiple other data blocks [<NUM>], [<NUM>], [<NUM>].

Insertion of transactions into a distributed database can include saving the transactions in one or more data blocks of the Blockchain.

Insertion of transactions can include validating and/or confirming transactions.

The term "insertion of transactions into the distributed database" or "writing of data to the distributed database" and the like can relate to communicating a transaction or transactions or a data block including the transactions to one or more nodes of a distributed database infrastructure. If those transactions are successfully validated, e.g., by means of the one or more nodes, these transactions can be chained as a new data block with at least one existing data block [<NUM>], [<NUM>], [<NUM>]. For this, the respective transactions are stored in a new data block. In particular, this validating and/or chaining can be implemented by a trusted node, e.g., a mining node, a blockchain oracle or a blockchain platform.

In particular, a blockchain can relate to a blockchain as a service, such as has been proposed by Microsoft or IBM. In particular, trusted nodes and/or other nodes can deposit a node checksum, e.g., a digital signature, in a data block, e.g., in a data block that has been validated by the respective node and which is then chained, in particular to facilitate identification of the creator of the data block and/or identification of the node. Here, the node checksum indicates which node has chained the respective data block with at least one other data block of the Blockchain.

A "transaction" or "transactions" in connection with the present disclosure can relate to a smart contract [<NUM>], [<NUM>], a data structure or a transaction data set, which, in particular, respectively include a transaction or multiple transactions. The term "transaction" or "transactions" can also relate to the data of a transaction of a data block of a blockchain, in connection with the present disclosure. A transaction can, e.g., include a program code which, e.g., implements a smart contract. For example, a transaction can also relate to a control transaction and/or a confirmation transaction in the context of the present disclosure. Alternative, a transaction can also be implemented by a data structure which saves the data (e.g., the control instructions and/or the contract data and/or other data such as video data, user data, measurement data etc.).

In particular, the term "saving or writing or storing transactions in data blocks", "saving transaction" and the like can relate to a direct saving or indirect saving. A direct saving can relate to the respective data block of the Blockchain or the respective transaction of the Blockchain including the respective data. An indirect saving can relate to the respective data block or the respective transaction including a checksum and, optionally, an add-on data set, e.g., a link to or an indication of a memory location for respective data; hence, the respective data are not directly saved in the data block (or the transaction). Rather, a checksum is provided for these data in the data block. In particular, these checksums can be validated when saving transactions in data blocks, such as has been explained above with respect to "inserting into the distribute database".

A "program code" - such as a smart contract - can relate to a program instruction or multiple program instructions which are saved in one or more transactions, in connection with the present disclosure. The program code can be executable and can be executed, e.g., by the distributed database. This can be implemented, e.g., by a runtime environment, e.g., of a virtual machine, wherein the runtime environment or the program code are preferably Turing complete. The program code is preferably executed by the infrastructure of the distributed database [<NUM>], [<NUM>]. Here, a virtual machine is implemented by the infrastructure of the distributed database. It is possible to execute the program code when validating a corresponding transaction.

A "smart contract" can relate to an executable program code in connection with the present disclosure [<NUM>], [<NUM>] - see, in particular, explanations with respect to "program code" provided above. The smart contract is preferably saved in a transaction of the distributed database - e.g., a blockchain -, e.g., in a data block. For example, the smart contract can be executed in the same manner as has been described in connection with the definition of "program code", in particular in connection with the subject disclosure.

The term "proof of work" can relate to solving a computationally expensive task, in particular, depending on the content of a data block or the content of a specific transaction, in connection with the present disclosure [<NUM>], [<NUM>], [<NUM>]. Such a computationally expensive task can also be referred to as cryptographic puzzle.

The term "distributed database", can generally relate to a decentralized, distributed database, a blockchain, a distributed ledger, a distributed memory system, a distributed ledger technology (DLT) based system (DLTS), a revision secure database system, a cloud, a cloud-service, a blockchain in a cloud or a peer-to-peer database system, in the context of the present disclosure. Also, various implementations of a blockchain or of a DLTS can be used, e.g., such as a blockchain or a DLTS that is implemented by means of a directed acyclic graph (DAG), a cryptographic puzzle, a hash graph or a combination of these variants [<NUM>], [<NUM>]. It would also be possible to implement different consensus algorithms. For example, a consensus algorithm can be implemented by means of a cryptographic puzzle, a gossip about gossip, a virtual voting or a combination of such techniques (e.g., gossip about gossip combined with virtual voting) [<NUM>], [<NUM>]. For example, if a blockchain is used, then this can, in particular, be implemented by a bitcoin-based implementation or an Ethereum-based implementation [<NUM>], [<NUM>], [<NUM>]. The term "distributed database" can also relate to a distributed database infrastructure that has at least a part of its nodes and/or devices and/or infrastructure implemented by a cloud. For example, the respective components can be implemented as nodes/devices in the cloud (e.g., as virtual nodes in a virtual machine). This can be implemented by WMware, Amazon web services or Microsoft Azure. Due to the increased flexibility of the described implementation scenarios, it is, in particular, possible to combine partial aspects of the described implementation scenarios with each other, e.g., by using a hash graph as blockchain, wherein the blockchain itself can also be a block batch.

For example, if a directed acyclic graph (DAG) is used (e.g., IOTA or Tangle), transactions or blocks or nodes of the graph are connected with each other via directed edges. , (all) edges are (always) having the same direction, e.g., as observed for time. In other words it is, in particular, not possible to propagate through or visit transactions or blocks or nodes of the graph backwards (i.e., opposite to the common unified direction). Acyclic means, in particular, that there are no loops or ring closures when traversing the graph. For example, a distributed database infrastructure can relate to a public distributed database infrastructure (e.g., a public blockchain) or a closed (private) distributed databased system (e.g., a private blockchain).

For example, in the case of a public distributed database infrastructure, the nodes and/or devices can join the distributed database infrastructure without proof of authorization or authentication or login credentials, respectively be accepted by the distributed database infrastructure without such information. In particular, in such a case the operator of the nodes and/or devices can remain anonymous.

For example, in the case of implementation of the distributed database infrastructure by a closed database system, new nodes and/or devices can require a valid proof of authorization and/or valid authentication information and/or valid credentials and/or valid login information to join the distributed database infrastructure or be accepted by the distribute database infrastructure.

A distributed database infrastructure can also be implemented by a distributed communication system for data exchange. For example, this can be a network or a peer-to-peer network.

The term "data block" - that can be, depending on the context and implementation, also be referred to as "constituent" or "block" - can refer to, in the context of the present disclosure, a data block of a distributed database - e.g., a blockchain or a peer-to-peer database -, which are, in particular, implemented as a data structure and, preferably, include one of the transactions or multiple of the transactions. In an implementation, the database or the database system can be a DLT based system (DLTS) or a blockchain and the data block can be a block of the blockchain or of the DLTS.

As a general rule, a data block can, e.g., include indications of the size - e.g., data volume in bytes- of the data block, a data block header (block header), a transaction counter and one or more transactions [<NUM>]. The data block header can include a version, a chaining checksum, a data-block checksum, a timestamp, a proof of work, a Nonce - i.e., a unique value, a random value or a counter which is used for the proof of work [<NUM>], [<NUM>], [<NUM>]. A data block can, e.g., also simply relate to a respective memory range or address range of the overall data that is stored in the distributed database. Thereby, it is possible to implement blockless distributed database infrastructure such as the IOT chain (ITCA), IOTA, Byteball, etc. Here, the functionality of the blocks of a blockchain and of the transactions are combined with each other in such a manner that, e.g., the transactions themselves secure the sequence or chains of transactions of the distribute database, such that they are, in particular, saved in a secured manner. For this the transactions can be chained by means of a chaining checksum, e.g., by using a separate checksum or the transaction checksum of one or more transactions as chaining checksum, which is saved in a new transaction in the distributed database infrastructure when storing the new transaction in the distributed database. In such a scenario, a data block can, e.g., also include one or more transactions, wherein in a simple scenario a data block relates to a single transaction.

The term "Nonce" can relate to, in connection with the present disclosure, a cryptographic nonce - which is an abbreviation for "used only once" [<NUM>] or "number used once" [<NUM>]. In particular, a Nonce indicates individual numbers or a combination of letters that is preferably only used once in the respective context, e.g., transaction, data communication.

The term "preceding data blocks of a (given) data block of the Blockchain" can relate, in connection with the present disclosure, e.g., to the data block of the Blockchain that is a direct predecessor of the (given) data block. Alternatively, the term "preceding data blocks of a (given) data block of the distribute database" can also relate to all data blocks of the Blockchain that precede the given data block. Thereby, the chaining checksum or the transaction checksum can be determined across the direct preceding data block (respectively the transactions thereof) or all data blocks preceding the given data block (respectively the respective transactions).

The terms "blockchain node", "node", "node of an infrastructure of a distributed database", "mining node" and the like can relate, in the context of the present disclosure, to devices - e.g., mobile devices, wireless communication devices, computers, smartphones, clients or participants - that perform operations associated with the distributed database, e.g., a blockchain [<NUM>], [<NUM>], [<NUM>]. Such nodes can, e.g., execute transactions of a distributed database or the respective data blocks or can insert new data blocks including new transactions into the distributed database by means of new data blocks. In particular, this validation and/or chaining can be implemented by a trusted node, e.g., a mining node, or exclusively by trusted nodes. A trusted node is a node that has additional security measures - e.g., firewalls, access restrictions to the node or the like - to avoid manipulation of the node. Alternatively or additionally, a trusted node can, e.g., save a node checksum - e.g., a digital signature or a certificate - in the new data block when chaining the new data block. Thereby, it is possible to provide the proof that indicates that the respective data block has been inserted by a specific node, respectively indicate the originator.

As a general rule, device or the devices can be implemented by devices of a technical system and/or an industrial plant and/or an automation network and/or a fabrication plant, that can also be nodes of the infrastructure of the distribute database. Thereby, the devices can be mobile devices or devices of the Internet of things, that can also be nodes of the infrastructure of the distributed database. Nodes can, e.g., include at least one processor, e.g., to execute their computer-implemented functionality.

The term "blockchain oracle" and the like can relate, in the context of the present disclosure, to nodes, devices or computers that include a security module that has software protection mechanisms - e.g., cryptographic methods - , mechanical protection mechanisms - e.g., a lockable housing - or electric protection measures - e.g., tamper protection or a protection system that deletes data of the security module in the case of unauthorized use/modification of the blockchain oracle. The security module can include, e.g., cryptographic keys that are required for the calculation of checksums - e.g., of transaction checksums or node checksums.

The term "computer" or "device" can relate to a computer (system), a client, a smartphone, a device or a server that are arranged outside of the blockchain, respectively or are not participants of the distributed database infrastructure, i.e., do not execute operations of the distributed database or simply retrieve those without executing transactions, inserting data blocks or calculate proof of works. Alternatively, the term "computer" or "device" can also relate to a node of the infrastructure of the distributed database. In other words, a device can in particular implement a node of the distributed database infrastructure or a device outside of the blockchain and the distributed database, respectively. A device outside of the distributed database infrastructure can, e.g., access the data - e.g., the transactions or the control transactions - of the distributed database. A device outside of the distributed database infrastructure can be controlled by nodes - e.g., by means of smart contracts and/or blockchain oracles. For example, if a control of a device - e.g., a device implemented as a node or a device outside of the distributed database infrastructure - is implemented by a node, then this can occur via a smart contract which, in particular, is saved in a transaction of the distributed database.

Any connection or coupling between functional blocks and/or boxes, devices, components, or other physical or functional units shown in the drawings or described herein may also be implemented by an indirect connection or coupling. Functional blocks and/or boxes may be implemented in hardware, firmware, software, or a combination thereof.

Hereinafter, techniques are described that facilitate validating measurement datasets provided by oracles. As a general rule, oracles can be implemented by hardware oracles and/or software oracles. A hardware oracle can measure - e.g., using a sensor - one or more physical observables of a physical event. Examples would include measurement of electrical characteristics, e.g., electrical current or electrical voltage, fluid flow or fluid volume, pressure, temperature, operational activity of an industrial machine such as oil change, operating mode, switch on/switch off, etc.; logistics such as dispatch, waypoint passing, delivery, etc. Software oracles can provide measurement data indicative of software-defined events, e.g., website updates, data availability, service downtime, etc..

As a general rule, the measurement dataset can be associated with an industrial field device. More specifically, the measurement dataset can be associated with an event - e.g., a hardware and/or software event - of an operation of the industrial field device. Various kinds of industrial field devices can benefit from the techniques described herein. To give a few examples, industrial field devices such as vehicles such as trains or airplanes or ships, turbines, subsea equipment, medical equipment such as magnetic-resonance imaging or computer tomography, robotic assembly lines, robot manipulators, etc. can benefit from the techniques described herein. The particular kind and type of industrial field device is not germane to the operation of the techniques described herein.

Various examples described herein facilitate validating a given measurement dataset based on a consensus between (i) the given measurement dataset associated with a given event, and (ii) a reference dataset. The reference dataset can provide a cross-check for the measurement dataset. As a general rule, there are various options available for implementing the reference dataset. The reference dataset may be embodied or include a further measurement dataset. For example, the reference dataset may include one or more observables of one or more further measurement datasets, also associated with the same given event. Alternatively or additionally, it would be possible that the reference dataset includes one or more predefined constraints. Thereby, independent or largely independent information on one and the same event and/or the context of the event can be obtained and a respective comparison can be triggered. The comparison between the (i) measurement dataset and the (ii) reference dataset checks for the consensus regarding the observed event. Based on the result of the comparison it would then be possible to trigger or to not trigger (selectively trigger) one or more validation measures for the measurement datasets. These one or more validation measures can be implemented at a distributed database.

Such techniques are based on the finding that by using independent or largely independent measures for one and the same given event - i.e., the measurement dataset and the reference dataset -, it becomes possible to identify malfunctioning or fraud associated with an oracle. Thus, the trust level for the measurement datasets can be increased.

As a general rule, various options are available for implementing the validation measures. To give a few examples, the validation measures can include validating or invalidating the measurement datasets. For example, a variable may be stored in the distributed database, wherein the variable is indicative of the positive or negative result of the comparison. It would also be possible that the variable is indicative of the underlying measurement datasets, i.e., it would be possible that the measurement dataset is selectively stored in the distributed database, depending on the result of the comparison. Further, in case of lack of consensus, it would be possible to inform involved stakeholders accordingly, i.e., one or more nodes that would rely on the measurement dataset.

Various examples are based on the finding that a trust level in the validation measures can be increased if the comparison between (i) a given measurement dataset, and (ii) the reference dataset is implemented at a mining node of a Blockchain infrastructure, i.e., if the logic for the comparison resides at least partly at the Blockchain infrastructure. In particular, an increased trust level can be achieved if compared to reference implementations in which such consensus is checked at a node outside of the Blockchain infrastructure. Typically, nodes of the distributed database infrastructure can have an increased security level if compared to nodes outside of the distributed database infrastructure. Alternatively or additionally, processes implemented by logic residing at a mining node of the distributed database structure can be securely tracked to facilitate a later audit. Manipulation to such logic may be difficult or difficult to conceal. For example, it would be possible that in case of a later check of the validity of the measurement dataset, it is possible to check validity of the metric underlying the comparison for validity. According to various examples, it would also be possible to consider the measurement dataset that has been subject to the comparison, or even underlying raw data samples when checking the validity of the comparison.

According to various examples, the measurement dataset - even though being subject to the comparison at a mining node of the infrastructure of the distributed database - can be digitally signed close to the origin of the underlying raw data samples, e.g., close to or at an oracle. More specifically, in various examples, the measurement dataset may include a digital signature that is determined based on the raw data samples (if compared to a digital signature that is determined on the processed raw data samples). Thus, the validity of the underlying raw data samples is tracked. By means of a measurement dataset including a digital signature, subsequent manipulation of the measurement dataset is prevented. For providing the digital signature, it is possible to use a private-public keying material. Then, the digital signature can be checked for validity based on a public key of the private-public keying material, while the digital signature is created using the private key of the public-private keying material.

Various techniques are based on the finding that for various kinds and types of raw data samples it is possible to determine a performance indicator. The event can be indicative of operational characteristics of an industrial field device. It is possible to determine the performance indicator, wherein the performance indicator specifies one or more figures of merit of the operational characteristics. As such, the performance indicator can correspond to processed raw data samples. The figures of merit can summarize the operation of the industrial field device. The figures of merit can describe abnormalities of the operation. The figures of merit can describe average values of the operational characteristics.

As a general rule, the measurement dataset can include or be implemented by the performance indicator. More specifically, the processed raw data samples included in the measurement dataset can correspond to the performance indicator.

As a general rule, the performance indicator can be determined based on raw data samples, taking into consideration one or more operational constraints associated with the industrial field device. For example, depending on the particular type of industrial field device, different operational constraints can govern which information is significant for the performance of the industrial field device. To give an example: for a stereo camera, dead times in the refresh rate with which images are obtained from the image sensors can be a significant performance indicator; while, on the other hand, for a disc brake of a train car a spectral power density within a certain part of a vibrational spectrum can be a significant performance indicator. In other words, and more generally: the performance indicator can be unique to the type of industrial field device and be associated with the operational characteristics of the industrial field device.

The performance indicator can, typically, include human-understandable application-layer data regarding the operational characteristics of the industrial field device. , processed information that can be directly output via a human-machine-interface may be included in the performance indicator.

As a general rule, the performance indicator can be smaller than the raw data samples. The performance indicator could condense or summarize information generally included in the raw data samples. For example, determining the performance indicator can include applying a low-pass filter, identifying a maximum or minimum, detecting events in the raw data samples, etc..

To give a few examples, the performance indicator could include at least one of the following: time-averaged data samples of the measurement dataset; peak data samples of the measurement dataset; event characteristics of the measurement dataset; or time-averaged use characteristics of the industrial field device.

Various techniques employ a distributed database for storing data associated with industrial field devices. The storage of data in a distributed database may generally be referred to as on-chain storage. In particular, various techniques employ a Blockchain for implementing the distributed database. While various techniques will be described in connection with a scenario in which the distributed database is implemented by a Blockchain, similar techniques may be applied for other kinds and types of distributed databases, e.g., blockless databases, a DLTS, etc. The storing in all such kinds of distributed databases is referred to as on-chain storage, for sake of simplicity (but this is not limited to a Blockchain).

According to various examples, it is possible to facilitate on-chain storage - i.e., storage on the Blockchain or another distributed database - of the measurement dataset. According to various examples, it is possible to facilitate off-chain storage of the raw data samples - i.e., storage on a non-distributed database. The measurement dataset and the raw data samples can be stored in a cross-referenced manner. Since typically the raw data samples are comparably large in size, not having to store the raw data samples on-chain helps to relax computational requirements imposed on the Blockchain infrastructure. At the same time, by storing the performance indicator on-chain, a high security against manipulation can be provided. For example, if the raw data samples were manipulated, this manipulation would most likely also result in a change of the measurement dataset (or else the manipulation would be insignificant). This could help to identify the manipulation by comparing the corresponding raw data samples against the measurement dataset stored on-chain. In particular, it would be possible that the measurement dataset includes a performance indicator; this performance indicator can then be stored on-chain - while the raw data samples can be stored off-chain.

<FIG> schematically illustrates a system <NUM>. The system <NUM> - in the example of <FIG> - includes two oracles <NUM>, <NUM>, but could generally include only one oracle or three or more oracles. Each one of the oracles <NUM>, <NUM> includes a respective control circuitry <NUM>. For example, the control circuitry <NUM> could include a processor and a non-volatile memory. The processor could load program code from the non-volatile memory and execute the program code to perform various functionality such as: measuring data for a measurement dataset indicative of one or more physical observables of an event; transmitting the measurement dataset; processing raw data of the measurement dataset; triggering a comparison between the measurement dataset and a reference dataset, to thereby validate the measurement dataset; determine a digital signature of the measurement dataset (e.g., of processed raw data samples such as a performance indicator, or even of the raw data samples), e.g. using a public-private cryptographic keying material, etc..

In further detail, as illustrated in <FIG>, each one of the oracles <NUM>, <NUM> includes an input interface <NUM>, e.g., a sensor device for a hardware oracle or a communication interface for a software-implemented input interface. The input interfaces <NUM> of the oracles <NUM>, <NUM> are configured to measure or determine observables <NUM>, <NUM> of an event <NUM>.

As a general rule, the event <NUM> could be a physical event and the observables <NUM>, <NUM> could be physical observables. It would also be possible that the event <NUM> is a software event, that the observables <NUM>, <NUM> would correspond to software observables <NUM>, <NUM>.

The oracles <NUM>, <NUM> can provide respective measurement dataset <NUM>, <NUM> to a network <NUM>, e.g., the Internet. The measurement dataset <NUM> provided by the oracle <NUM> is indicative of the observable <NUM> of the event <NUM>; while the measurement dataset <NUM> provided by the oracle <NUM> is indicative of the observable <NUM> of the event <NUM>. In particular, it would be possible that the observable <NUM> differs from the observable <NUM>. More generally speaking, different oracles can provide measurement datasets that are indicative of different observables. For example, a first oracle could provide measurement datasets indicative of a temperature; while a second oracle provides measurement datasets indicative of pressure, to give just one example. Thereby, independent information and multiple measures of the event <NUM> can be obtained. This helps to reliably validate the measurement datasets <NUM>, <NUM>.

Sometimes it is not feasible or required to include raw data samples in the measurement datasets <NUM>, <NUM>. Rather, some data compression or data pre-processing may be implemented at the oracles <NUM>, <NUM>, respectively, before transmitting the measurement datasets <NUM>, <NUM> towards the communication network <NUM>. The measurement datasets <NUM>, <NUM> can, hence, include processed raw data samples. To give an example, the measurement datasets <NUM>, <NUM> could include respective performance indicators that are indicative of or correspond to one or more figures of merit of operational characteristics of the event <NUM>.

An advantage of preprocessing the raw data samples - such that the measurement datasets <NUM>, <NUM> output via the interfaces <NUM> include the processed raw data samples - lies in reducing the computational resources required downstream of the data processing pipeline, e.g., required at a mining node <NUM>-<NUM> of the Blockchain infrastructure <NUM> or network resources required at the network <NUM>. For example, fewer computational resources may be required at one of the mining nodes <NUM>-<NUM> to implement a comparison of the respective measurement dataset <NUM>, <NUM> (including the already processed raw data samples, e.g., the performance indicator) with a respective reference dataset. In particular, as mentioned above, it is possible that the pre-processing of the raw data samples reduces the data size of the measurement datasets <NUM>, <NUM> if compared to the raw data samples and, e.g., discards redundant or unnecessary information. Therefore, the amount of data that needs to be processed when implementing a comparison of the measurement dataset <NUM>, <NUM> with a reference dataset is reduced.

As a general rule, raw data samples can correspond to a lower-layer output of a sensor device (in a processing stack including multiple layers); while processed raw data samples can correspond to the raw measurement data after some processing in accordance with a processing algorithm. There can be a tendency that processed raw data samples are smaller if compared to the raw data samples. To give an example: it would be possible that a <NUM>-D stereo camera outputs to 2D images having pixels, each pixel having a certain color or brightness value. Then, the raw data samples can be processed to, e.g., identify objects in the <NUM>-D images using object recognition. The objects could be identified with a bounding box or position label and a category label indicative of the type of the object, e.g., vehicle, person, tree, etc. This can implement the raw data samples. The processed raw data samples could also include distances for the object obtained from a comparison of multiple <NUM>-D images at a given frame. In such a scenario, the processed raw data samples may be significantly smaller if compared to the raw data samples. For example, a list of objects with associated categories and distances may be significantly smaller if compared to the set of pixels (e.g., a few megapixels), each pixel having a n-bit value indicating its brightness, etc. While the examples above have been described in connection with an implementation using a <NUM>-D stereo camera as the source of the measurement dataset, the techniques described herein are not limited to such an example. Various other kinds and types of sources of the measurement dataset are conceivable.

The measurement datasets <NUM>, <NUM> output via the communication interfaces <NUM> of the oracles <NUM>, <NUM> may be digitally signed. The measurement datasets <NUM>, <NUM> may hence include a digital signature. In some examples, the digital signature may be determined based on the raw data samples, so that the measurement dataset includes the digital signature of the raw data samples. For example, the control circuitry <NUM> of the oracles <NUM>, <NUM> may be configured to determine the signature. By determining the signature close to the origin of the raw data samples and/or even based on the raw data samples, e.g., next to the input interface <NUM>, it becomes possible to protect manipulation of the measurement datasets <NUM>, <NUM>. Since the digital signature is determined close to the origin of the raw data samples, i.e., at a point very much upstream of the data processing path, many attack vectors downstream of the data processing path can be mitigated.

In the example of <FIG>, the communication network <NUM> is also connected to the Blockchain infrastructure <NUM>. The Blockchain infrastructure <NUM> includes multiple mining nodes <NUM>-<NUM> that hold and access a Blockchain <NUM>. Each one of the mining nodes <NUM>-<NUM> can attempt to store variables as transactions in the Blockchain <NUM>, i.e., write to the Blockchain <NUM>. For example, a smart contract <NUM> may be implemented on the Blockchain <NUM>. The smart contract <NUM> can define self-executable program code; to this end, the mining nodes <NUM>-<NUM> can provide the host environment to execute such program code.

The inset of <FIG> also illustrates details with respect to the mining nodes <NUM>-<NUM> of the Blockchain infrastructure <NUM> (the inset in <FIG> is illustrated with the dashed lines). Each one of the mining nodes <NUM>-<NUM> includes a processor <NUM>. The processor <NUM> can load program code from a memory <NUM> and can execute the program code. The processor <NUM> can communicate, via an interface <NUM>, e.g., with the network <NUM>. Each one of the mining nodes <NUM>-<NUM> may store a replica of the Blockchain <NUM>. For example, the processor <NUM> - upon loading program code from the memory <NUM> - can be configured to perform one or more of the following: check for consensus between multiple datasets, e.g., by comparing a measurement dataset with a reference dataset; triggering one or more validation measures, e.g., selectively depending on a result of the comparison; check a digital signature of the measurement dataset; process raw data samples to obtain the measurement dataset; etc..

The system <NUM> also includes stakeholder nodes <NUM>, <NUM>. Each stakeholder nodes <NUM>, <NUM> includes a processor <NUM> that can load and execute program code stored by a respective non-volatile memory <NUM>. The stakeholder nodes <NUM>, <NUM> are connected to the networks <NUM> via respective interfaces <NUM>. Each one of the stakeholder nodes <NUM>, <NUM> may be operated by a respective operator. The operators may rely on functionality implemented by, e.g., the smart contract <NUM> of the Blockchain <NUM>. The operators may rely on the validity of the measurement dataset <NUM> and/or measurement dataset <NUM>. Therefore, each one of the stakeholder nodes <NUM>-<NUM> is associated with an operator that has an interest in the validation of the measurement dataset <NUM> and/or the measurement dataset <NUM>.

The system <NUM> also includes a non-distributed database <NUM>. The non-distributed database <NUM> is not replicated across multiple nodes. It is different from the Blockchain <NUM>. It can implement off-chain storage.

Next, details with respect to the functioning of the system <NUM> will be explained in connection with the following FIGs.

<FIG> is a flowchart of a method according to various examples. For example, the method of <FIG> could be executed by the oracle <NUM>, e.g., by the processor of the control circuitry <NUM> loading respective program code from the memory of the control circuitry. It would also be possible that the method according to <FIG> is executed by the mining node <NUM> of the Blockchain infrastructure <NUM>, e.g., by the processor <NUM> upon loading program code from the memory <NUM>. In some examples, parts of the method according to <FIG> could be executed by the oracle <NUM> and other parts could be executed by the mining node <NUM>.

In box <NUM>, raw data samples are obtained. The raw data samples are indicative of one or more operational characteristics of an industrial field device. For example, the raw data samples could be received from one or more sensor devices. At least parts of the raw data samples could be obtained from a software oracle.

Next, at box <NUM>, the raw data samples are processed. As an output of box <NUM>, a measurement dataset is obtained. As a general rule, various options are available for processing. In some examples, a performance indicator is determined based on the raw data samples. The performance indicator can correspond to one or more figures of merit of the one or more operational characteristics of the industrial field device.

As a general rule, various options are available for determining the performance indicator in box <NUM>. To give an example, it would be possible that the performance indicator is determined using a performance metric algorithm. The performance metric algorithm can transform the raw data samples into the performance indicator. For example, the performance metric algorithm can be unique to the particular industrial field device or type of industrial field device. The performance metric algorithm can reduce the amount of data such that the data size of the measurement dataset including performance indicator is smaller than the data size of the raw measurement samples.

In box <NUM>, storage of the measurement dataset including the processed raw data samples, is triggered. The measurement dataset can be stored in a distributed database, e.g., the Blockchain <NUM>. Triggering storage in box <NUM> can include, e.g., transmitting the measurement dataset to the Blockchain infrastructure <NUM>, e.g., to an appropriate mining node and requesting storage in the Blockchain <NUM>.

<FIG> is a flowchart of a method according to various examples. The method of <FIG> may be executed by the processor <NUM> of one of the mining nodes <NUM>-<NUM>, upon loading respective program code from the memory <NUM>.

At box <NUM>, a measurement dataset is obtained. For example, the measurement dataset can be obtained from an oracle such as the oracle <NUM>.

According to some examples, box <NUM> can include (pre-)processing raw data samples. This an correspond to or include techniques as explained with reference to box <NUM> above (cf. The raw data samples may be received from an oracle, e.g., the oracle <NUM>. As a general rule, the processing at box <NUM> could be implemented by a smart contract, e.g., the smart contract <NUM>.

According to various examples, such processing of the raw data samples at box <NUM> could be based on a predefined algorithm. Sometimes, this algorithm can have an associated validity time duration. For instance, the algorithm may be agreed upon by the operators of the stakeholder nodes <NUM>, <NUM>. A corresponding agreement may define the validity time duration. In such a scenario, it would be possible that the processing of the raw data samples, in box <NUM>, is selectively executed, if one or more timestamps of the raw data samples are in accordance with the validity time duration of the predefined algorithm. For example, it can be checked whether the timestamps of the raw data samples are within the validity time duration. This helps to avoid using an outdated algorithm for the processing. This can be of help in scenarios in which over the course of times different algorithms or different parameters of an algorithm are agreed upon by the stakeholders.

Then, the measurement dataset can be associated with a timestamp of the processing at box <NUM>. Alternatively or additionally, it would also be possible to associate the measurement dataset that is obtained from box <NUM> with an indicator indicative of the predefined algorithm and/or the validity time duration of the predefined algorithm. By such techniques, it becomes possible to facilitate a subsequent audit/validity check of the processing at box <NUM>. In particular, it can be checked whether the appropriate algorithm has been used. This can be of help in scenarios in which over the course of times different algorithms or different parameters of an algorithm are agreed upon by the stakeholders.

At box <NUM>, a reference dataset is obtained. For example, a further measurement dataset may be obtained. The further measurement dataset is indicative of one or more further observables of the event, i.e., the same event for which at box <NUM> the measurement data is obtained. The further measurement data is provided by a further oracle. For example, the measurement dataset <NUM> could be obtained from the oracle <NUM>, wherein the measurement dataset <NUM> is indicative of the observable <NUM> of the event <NUM> (cf.

Alternatively or additionally to the further measurement dataset, it would also be possible to obtain one or more constraints associated with the event.

Next, at box <NUM>, a comparison between the measurement dataset - obtained at box <NUM> - and the reference dataset - obtained at box <NUM> - is performed. Box <NUM> could include sending a trigger or request message to execute the comparison. Box <NUM> could also include executing the comparison locally, e.g., at the respective mining node <NUM>-<NUM>. For example, box <NUM> could include invoking a corresponding function of a smart contract of a Blockchain, e.g., invoking a corresponding function of the smart contract <NUM> of the Blockchain <NUM> (cf. In such a scenario, the comparison, in other words, is provided by a smart contract. The comparison checks for consensus between the measurement dataset of box <NUM> and the reference dataset of box <NUM>.

As a general rule, various options are available for implementing the comparison at box <NUM>. The comparison can vary along with the type of measurement dataset and, more specifically, with the type of observables indicated by the measurement datasets obtained in box <NUM>. To give an example, it would be possible that the comparison is based on a predefined agreement indicative of a metric of the comparison. The metric can define a ruleset for comparing the various involved datasets. In particular, using an appropriate metric, it is even possible to compare different observables, e.g., temperature with pressure, or operational statistics of a field device with current consumption, to give just a few examples. In some examples, the comparison could be implemented by a machine-learning algorithm that is trained to detect abnormalities in the behavior of the multiple physical observables. In other examples, a predefined rule set could be analytically defined.

For example, a tolerance range could be defined by the metric. The tolerance range may specify certain acceptable ranges of deviation between the measurement dataset and the reference dataset.

According to various examples, it would be possible that the metric used for implementing the comparison at box <NUM> has a validity time duration. The validity time duration of the metric of the comparison used at box <NUM> can be comparable with the validity time duration of the processing algorithm of the processing at box <NUM>. For example, it would again be possible to check whether one or more timestamps associated with the measurement dataset and/or associated with the reference dataset subject to the comparison are in accordance with the validity time duration of the metric. This prevents an outdated metric to be applied to the measurement dataset and the reference dataset to perform the comparison. For example, the stakeholders may (re-)negotiate or change the metric from time to time. In particular in scenarios in which the comparison in box <NUM> is implemented by a smart contract, it can then be helpful to check whether the timestamp or timestamps of the measurement dataset and/or the reference dataset are in accordance with the validity time duration. For example, the appropriate smart contract or the appropriate function of the smart contract implementing the comparison may be selected in accordance with the timestamp or timestamps and in accordance with the validity time durations associated with the smart contracts or functions of the smart contract. Sometimes, in scenarios in which the comparison is implemented by a smart contract, the smart contract cannot be simply removed from the Blockchain without affecting the integrity of the Blockchain. Thus, by implementing the check for the validity time period, the smart contract (or, more specifically, a transaction or block including the smart contract) can remain in the Blockchain; but cannot be used to perform the comparison after expiry of the validity time period.

Furthermore, a result of the comparison can be stored in the distributed database, along with a timestamp of the comparison and the metric or more specifically the validity time duration of the metric. Then, a subsequent check becomes possible whether the appropriate valid metric has been applied to implement the comparison.

In some examples, a scenario may occur in which it is detected, at box <NUM>, that the validity time duration of the metric has expired. Upon expiry of the validity time duration, it would be possible to trigger a re-negotiation of the metric between the stakeholder nodes <NUM>-<NUM>, e.g., by transmitting to the stakeholder nodes <NUM>-<NUM> a corresponding request. Thereby, it can be continuously ensured that a valid and up-to-date metric is employed for implementing the comparison at box <NUM>.

Next, a few examples are given for example implementations of the reference dataset being indicative of one or more predefined constraints associated with the event. For example, it would be possible that the constraints are a location-based. To give an example, the measurement dataset may include a first geolocation and the one or more predefined constraints may include a second geolocation. Referring to <FIG>: for example, the first geolocation associated with the measurement dataset may define a latitude and longitude of a position of the corresponding oracle. The second geolocation <NUM> may define a geo-fence or geo-area. The comparison at box <NUM> (cf. <FIG>) can then be based on a spatial distance between the first geolocation <NUM> and the second geolocation <NUM>. In the example of <FIG>, the latitude and longitude of the first geolocation <NUM> is within the geo-fence of the second geolocation <NUM>, thereby the spatial distance between the first geolocation <NUM> and the second geolocation <NUM> is zero. Accordingly, the comparison at box <NUM> (cf. <FIG>) can yield a positive result.

In a further example, it would be possible that the comparison considers time domain parameters. Such an example is illustrated in <FIG>. In <FIG>, the measurement dataset includes multiple timestamps <NUM> that are, e.g., associated with the underlying raw data samples. For example, the timestamps could be indicative of a time of occurrence of the event. <FIG> also illustrates that the one or more predefined constraints of the reference dataset may include timing constraints <NUM>. In the example of <FIG>, the timing constraints <NUM> relate to time windows during which an event is allowed / expected to occur, by definition. The comparison in box <NUM> can then be based on the time-domain distance between the one or more timestamps <NUM> and the timing constraints <NUM>. In the scenario of <FIG>, the timestamp <NUM> indicate a time that is within the timing windows of the timing constraints <NUM> and, accordingly, the distance is <NUM>. Accordingly, the comparison at box <NUM> yields a positive result.

Such an implementation of the timing constraint using a time window is illustrated in <FIG> is an example only. Other examples are conceivable. For example, the timing constraint could define a threshold repetition rate. The threshold repetition rate can define an upper limit for the repetitions of the event as indicated by the measurement dataset. In <FIG>, the associated repetition rate <NUM> between the timestamp <NUM> indicative of the occurrence of the event is indicated. For example, this measurement repetition rate <NUM> could then be compared against the threshold repetition rate.

It is not required in all scenarios to use an implementation of the reference dataset that relies on one or more predefined constraints. As mentioned above, it would also be possible to implement the comparison at box <NUM> based on a consensus between multiple measurement datasets <NUM>, <NUM>. Such a scenario is illustrated in <FIG>. In <FIG>, the measurement datasets <NUM>, <NUM> include a time series of data points. The data points can correspond to processed raw data samples, e.g., low-pass filtered raw data samples, etc.. For example, the data samples of the measurement dataset <NUM> could indicate pressure and the data samples of the measurement dataset <NUM> could indicate fluid flow. As illustrated in <FIG>, at some point in time the pressure as indicated by the measurement dataset <NUM> rises above a predefined threshold <NUM>; while the fluid flow of the measurement dataset <NUM> falls below another predefined threshold <NUM>. The comparison can check whether at the associated point in time both criteria are fulfilled (i.e., the pressure indicated by the measurement dataset <NUM> rising above the threshold <NUM> and the fluid flow rate indicated by the measurement dataset <NUM> falling below the threshold <NUM>), to validate the event clogging/occlusion of a fluid flow path of an associated industrial field device. The metric can define a corresponding ruleset, e.g., using Boolean logic, etc.. The metric could define the threshold <NUM>, <NUM>.

As will be appreciated from the description of <FIG>, various options are available for implementing, at box <NUM>, the comparison.

Turning again to <FIG>, at box <NUM>, a result of the comparison of box <NUM> is checked. Depending on the result of the comparison, one or more - positive or negative - validation measures are selectively triggered at boxes <NUM> or <NUM>, respectively. The one or more validation measures pertain to the measurement dataset. In particular, the one or more validation measures can be implemented at the Blockchain, e.g., at the Blockchain <NUM>.

In detail, if at box <NUM> it is judged that the comparison yields a positive result, i.e., a (cross-)validation of the measurement dataset and the reference dataset is positively obtained, then a positive validation measure is taken at box <NUM>; otherwise, a negative validation measure is taken at box <NUM>. The positive validation is measure is thus selectively executed in case the comparison yields a positive result.

As a general rule, various options are available for implementing positive and negative validation measures, e.g., in connection with boxes <NUM> and <NUM>. To give just a few examples, a positive validation measure that could be taken as part of executing box <NUM> could pertain to storing the measurement data in the Blockchain, e.g., in the Blockchain <NUM>. It would also be possible that a flag indicator is appropriately set, the flag indicator being stored in the Blockchain, e.g., the Blockchain <NUM>. The flag indicator could indicate whether a (cross-)validation was successful or not. Yet another validation measure may include transmitting a corresponding report message to at least one of the stakeholder nodes <NUM>, <NUM>. Thereby, parties interested in the validation can be appropriately informed.

In case the comparison yields a negative result, it would be possible to trigger, as part of execution of box <NUM>, a settlement process. The settlement process includes a predefined rule set or workflow for the case of a deviation between the first measurement dataset and the second measurement dataset. The settlement is associated with a trust level of the first oracle providing the first measurement dataset (cf. oracle <NUM> in <FIG>) and/or the trust level of the second oracle providing the second measurement dataset (cf. oracle <NUM> in <FIG>). Then, if there are deviations between the first measurement dataset and the second measurement dataset, the particular measurement dataset may prevail that has the larger associated trust level. The stakeholder nodes <NUM>, <NUM> could be informed as part of box <NUM>.

<FIG> is a functional flowchart illustrating the operation and functions of the system <NUM>. In particular, <FIG> illustrates details with respect to the operation of the mining node <NUM> of the Blockchain infrastructure <NUM>.

At <NUM>, the mining node <NUM> receives - e.g., via the respective interface <NUM> - the first measurement dataset <NUM>. For example, the communication could be via a wide area network or a wired communication line (cf. <FIG>, network <NUM>). It would also be possible that the communication includes wireless transmission. To facilitate the communication, it would be possible that the corresponding oracle <NUM> is registered at the Blockchain infrastructure <NUM>. More specifically, it would be possible that the oracle <NUM> is registered at the mining node <NUM>. Respective unique credentials may be used.

Also, the oracle <NUM> is registered at the mining node <NUM>. Accordingly, at <NUM>, the mining node <NUM> receives the measurement dataset <NUM>.

As illustrated in <FIG>, accordingly, the mining node <NUM> obtains the measurement dataset <NUM> that is indicative of one or more observables <NUM> of an event <NUM> and, furthermore, obtains the measurement dataset <NUM> that is indicative of one or more further observables <NUM> of the event <NUM>. As a general rule, while in the scenario of <FIG> the mining node <NUM> receives the multiple measurement datasets <NUM>, <NUM>, in other examples, it would also be possible that the mining node only receives a single measurement dataset - e.g., the measurement dataset <NUM> - and, furthermore, receives a reference dataset that comprises one or more predefined constraints associated with the event <NUM> (this scenario is not illustrated in <FIG>).

Next, at <NUM>, the measurement dataset <NUM> is fed to a smart contract <NUM> (more specifically, a respective instance of the smart contract <NUM>, e.g., defined by a respective function call) and, at <NUM>, the measurement dataset <NUM> is fed to a further instance of the smart contract <NUM>. Here, a switch point functionality is implemented. In particular, the smart contract <NUM> can check whether the respective measurement dataset <NUM>, <NUM> includes processed raw data samples, or rather includes (non-processed) raw data samples. The raw data samples can be original non-preprocessed outputs of the respective sensor device. Processed data samples, on the other hand, have been processed with a respective processing algorithm, e.g., to condense information to some smaller or larger degree. In the various examples described herein, it would be possible that the processed raw data samples correspond to a performance indicator, the performance indicator including one or more figures of merit of operational characteristics of the associated industrial field device. The event <NUM> can correspond to or be associated with these operational characteristics.

The switch point functionality implemented by the smart contract <NUM> thus check whether the respective measurement dataset <NUM>, <NUM> includes raw data samples or processed raw data samples. In case the measurement dataset <NUM>, <NUM> includes processed raw data samples, these are forwarded to a further smart contract <NUM> at <NUM> and <NUM>, respectively. On the other hand, raw data samples are forwarded, at <NUM> and <NUM> to respective instances of a smart contract <NUM>. The smart contract <NUM> implements the processing of the raw data samples.

As a general rule, each one of the smart contracts <NUM>, <NUM>, <NUM> can be associated with a validity time duration. The validity time duration can be indicative of an expiry time of the respective smart contract <NUM>, <NUM>, <NUM>. This makes it possible to implement a check whether one or more timestamps of the respective input data is in accordance with the validity time duration. If not, there can be a check made whether an updated smart contract is existent that has another validity time duration. Furthermore, it becomes possible to later on check whether the appropriate smart contract has been used in order to implement the various functionality. For example, an identity of the respectively executed smart contract may be stored in the Blockchain <NUM>, to facilitate such audit. The measurement datasets <NUM>, <NUM>, and/or the reference dataset may also include timestamps that can be compared against the validity time duration.

As a general rule, the measurement datasets <NUM> and/or <NUM> may include an identity of the respective sensor device.

As a further general rule, the measurement datasets <NUM> and/or <NUM> may include a geolocation of the respective sensor device, e.g., latitude and longitude.

As a further general rule, it would be possible that the measurement datasets <NUM> and/or <NUM> may include a respective configuration dataset that is indicative of a processing algorithm used for (pre-)processing raw data samples, in case the measurement datasets <NUM>, <NUM> include the already preprocess raw data samples.

As a still further rule, it would be possible that the measurement datasets <NUM> and/or <NUM> include a respective digital signature. For example, the digital signature can be determined based on a private key of a public-private cryptographic keying material. In some examples, the digital signature is determined based on the raw data samples.

Next, the function of the smart contract <NUM> is explained in further detail. The smart contract <NUM> implements logic to process the raw data samples. The smart contract <NUM> also implements logic to trigger storage of the raw data samples in the non-distributed database <NUM>. In particular, at <NUM> and <NUM>, the raw data samples are transmitted to the non-distributed database <NUM>, e.g., with a respective right command. Again, the smart contract <NUM> can implement switch point functionality.

Corresponding functions <NUM>, <NUM> of the smart contract <NUM> can be used to process the raw data samples. This can be in accordance with a predefined algorithm. The predefined algorithm can have an associated validity time duration. The validity time duration can be compared against timestamps of the raw data samples to check whether the appropriate function <NUM>, <NUM> - e.g., as agreed upon by the stakeholders - is used. Such processing implemented at the Blockchain infrastructure <NUM> has the advantage that a higher level of trust can be provided, e.g., in connection with the employed algorithm for processing. On the other hand, certain limitations associated with the required computational resources and/or the communication network <NUM> may have to be observed. In this regard, as will be appreciated from <FIG>, the smart contract <NUM> is only invoked in case raw data samples are included in the measurement datasets <NUM>, <NUM>; otherwise, the execution of the smart contract <NUM> is bypassed at <NUM> and <NUM>. Such bypassing can reduce the required computational resources such as bandwidth and data traffic on the network <NUM> and processing/memory resources at the mining node <NUM>.

According to various examples, it is possible that the validity time duration of any one of the smart contracts <NUM>, <NUM>, <NUM> is defined by two timestamps that define the start time of the validity time duration and the stop time of the validity time duration. Thereby, it can be possible to determine a time domain distance between a respective timestamp of the measurement datasets <NUM>, <NUM> and the validity time duration. It can be checked whether the valid smart contract <NUM>-<NUM>, <NUM> is used. It is also possible to implement a check whether the appropriate smart contract <NUM>-<NUM>, <NUM> has been used at a later point in time.

Next, details with respect to the smart contract <NUM> executed at <NUM> are explained. To create a high degree of trust, the validation of the measurement dataset <NUM> and optionally of the measurement dataset <NUM>, e.g., by executing the appropriate validation measure at box <NUM> (cf. <FIG>), should be based on a consensus between multiple independent data sources. In particular, it would be possible to rely on the measurement datasets <NUM>, <NUM> that are obtained from different oracles <NUM>, <NUM>. According to various examples, it would be possible that the oracles <NUM>, <NUM> are operated by different stakeholders. For example, the observable <NUM> can relate to a variable power input to a pump as industrial field device; the observable <NUM> can relate to the fluid flow rate of the pump. Other examples of observables may include a change of mass or volume of an chemical additive that is added to the fluid handled by the pump. Then, an occlusion/clogging of a fluid flow path of the fluid handled by the pump could be associated with the following observables: the observable <NUM> indicates that the input power exceeds a certain threshold; the observable <NUM> indicates that the fluid flow rate falls below a certain threshold; and a further observable associated with the mass or volume of the chemical additive can indicate that there is no consumption of the chemical additive.

Such correlations etc. can be considered in a metric for comparing the various measurement datasets used at the smart contract <NUM> to implement the comparison. To give an explicit example:
IF "maximum input power" AN "no flow rate" AND "no consumption of chemical additives" AND "timestamps of the various observables having a time domain distance below a threshold", THEN "event equals occlusion/clogging" at time "timestamp".

Based on such consensus between the multiple observables of the same event, an attack vector of manipulating individual oracles is essentially prevented, because a successful attack would have to manipulate all data sources.

While in the example explained above multiple measurement datasets have been used, it is generally possible to implement the comparison between a single measurement dataset and one or more predefined constraints. An example predefined constraint could be defined in time domain. For example, here, only the measurement dataset <NUM> could be obtained. A timing constraint could include a threshold repetition rate. For example, it could be specified that the event "occlusion/clogging" can only occur once a week. Alternatively or additionally, the timing constraint can include timing windows. For example, it could be defined that the event "occlusion/clogging" only occurs in the morning or in the evening. Here, even when operating based on a single measurement dataset, it becomes possible to implement a meaningful comparison.

Instead of such time domain constraints, it would also be possible to use spatial domain constraints. For example, geo-information such as a latitude/longitude from a GPS receiver/GPS device could be used. Here, the oracle <NUM> may provide the measurement dataset <NUM> (optionally, its identity in the timestamp), as well its geolocation. All such information can be included in the digital signature. Then, the mining node <NUM> can implement the comparison based on the geo-location of the oracle <NUM> and a predefined reference geolocation.

As a general rule, the reference dataset, in particular when including the one or more predefined constraints, can be obtained from the non-distributed database <NUM>. Alternatively or additionally, the reference dataset could also be stored in the Blockchain, e.g., associated with a smart contract.

In case of a positive result of the comparison, at <NUM>, the measurement dataset <NUM> and/or the measurement dataset <NUM>, or more specifically the processed raw data samples, can be stored in the Blockchain <NUM> (cf. <FIG>: box <NUM>). As illustrated in <FIG>, the Blockchain <NUM> is then replicated, at <NUM>, between the various mining nodes <NUM>-<NUM> of the Blockchain infrastructure <NUM>. The stakeholder nodes <NUM>-<NUM> can access the respective mining nodes <NUM>-<NUM>.

As mentioned above, the various smart contracts, in particular the smart contract <NUM>, may be associated with a validity time duration. Upon expiry of the validity time duration, it would be possible to trigger a re-negotiation of the metric used for the comparison at the smart contract <NUM> between the various stakeholder nodes <NUM>-<NUM>. For example, such changes in the metric may occur if the stakeholders agree that certain criteria used in the metric for the comparison are to strict or to relaxed. Once the respective smart contract <NUM> has been updated, the corresponding transaction included in the Blockchain <NUM> including the new smart contract <NUM> is synchronized between the various mining nodes <NUM>-<NUM> of the Blockchain infrastructure <NUM>. The validity time duration is updated. Also, it can be possible to update the upstream smart contracts <NUM>, <NUM>, such that they invoke the correct, updated version of the smart contract <NUM>. Also, the smart contract <NUM>, <NUM> may be equipped with logic to autonomously identify the appropriate version of the smart contract <NUM>, e.g., based on a comparison between the timestamps included in the measurement datasets <NUM>, <NUM> and the validity time duration indicated by a variable in the smart contract <NUM>.

<FIG> is a flowchart of a method according to various examples.

At box <NUM>, the oracle <NUM> registers at the mining node <NUM> and the oracle <NUM> registers at the mining node <NUM>.

At box <NUM>, the oracle <NUM> provides the measurement dataset <NUM> to the mining node <NUM>. At box <NUM>, the oracle <NUM> provides the measurement dataset <NUM> to the mining node <NUM>.

Boxes <NUM>-<NUM> are now only illustrated in connection with the measurement dataset <NUM> provided at box <NUM>; but similar boxes could also be executed for the measurement dataset <NUM> provided at <NUM> (not illustrated in <FIG>).

At box <NUM>, it is checked whether the measurement dataset <NUM> obtained at box <NUM> includes raw data samples or processed raw data samples. In case the measurement dataset <NUM> includes raw data samples, then the method continues at box <NUM>. Here, the raw data samples are processed to obtain the processed raw data samples. It is also possible to trigger storage of the raw data samples in the non-distributed database <NUM>.

The processing of the raw data samples in box <NUM> can be based on a predefined algorithm. In particular, the processing can be selectively executed if one or more timestamps of the raw data samples are in accordance with a validity time duration of the predefined algorithm. It would be possible that the predefined algorithm is stored in the Blockchain <NUM>. It would also be possible that an indicator indicative of the validity time duration of the predefined algorithm is stored in the Blockchain <NUM>. Also, the timestamps of the raw data samples or at least a derived timestamp of the measurement dataset can be stored in the Blockchain <NUM>.

At box <NUM>, it is checked whether a predefined agreement positively confirms that the various stakeholders have agreed upon processing the raw data samples at the Blockchain infrastructure <NUM> (i.e., if the box <NUM> has been legitimately executed).

If, at box <NUM> it is determined that the measurement dataset <NUM> includes processed raw data samples (instead of raw data samples), then box <NUM> is executed. At box <NUM> it is checked whether the various stakeholders have agreed upon processing the raw data samples outside of the Blockchain, i.e., upstream in the data processing flow.

In case the check at box <NUM> or the check at box <NUM> is successful, the method commences at box <NUM>.

Box <NUM> obtains, as an input, the various processed raw data samples of the measurement datasets <NUM>, <NUM>. At box <NUM>, a comparison between the multiple measurement datasets - or, more generally, between a measurement dataset and a reference dataset - is implemented.

At box <NUM>, if a positive result of the comparison of box <NUM> is reached - one or more positive validation measures are implemented. For example, one or more measurement datasets may be stored in the Blockchain <NUM>. It would also be possible that the result of the comparison of box <NUM> is stored in the Blockchain <NUM>. Box <NUM> can include writing respective data into a transaction and chaining the transaction in a new block of the Blockchain. The Blockchain can be synchronized and replicated across multiple mining nodes <NUM>-<NUM>.

Summarizing, techniques have been described which facilitate implementing a comparison between a measurement dataset in the reference dataset in a Blockchain infrastructure. This helps to implement a validity check in a manner that can be audited by various stakeholders. The comparison is transparent and can be reconstructed at a later point in time.

Although the invention has been shown and described with respect to certain preferred embodiments, modifications will occur to others skilled in the art upon the reading and understanding of the specification. The present invention includes all such modifications and is limited only by the scope of the appended claims.

Claim 1:
A mining node (<NUM>-<NUM>) of an infrastructure (<NUM>) of a distributed database (<NUM>), the mining node (<NUM>-<NUM>) comprising a control circuitry (<NUM>-<NUM>) configured to:
- obtain (<NUM>) a measurement dataset (<NUM>) provided by a first oracle (<NUM>) indicative of one or more observables (<NUM>) of an event (<NUM>), the measurement dataset (<NUM>) comprising processed raw data samples,
- perform (<NUM>) a comparison between the measurement dataset and a reference dataset, the reference dataset comprising at least one of one or more predefined constraints (<NUM>, <NUM>, <NUM>) associated with the event (<NUM>) or a further measurement dataset (<NUM>) provided by a second oracle (<NUM>) that is indicative of one or more further observables (<NUM>) of the event (<NUM>), and
- depending on a result of the comparison:
if the comparison yields a positive result, triggering one or more positive validation measures (<NUM>) for the measurement dataset (<NUM>),
if the comparison yields a negative result, triggering one or more negative validation measures (<NUM>) for the measurement dataset (<NUM>), wherein triggering the one or more negative validation measures (<NUM>) includes triggering a settlement process, the settlement process being based on a trust level of the first oracle (<NUM>) and on a trust level of the second oracle (<NUM>),
wherein the one or more positive validation measures (<NUM>) and the one or more negative validation measures (<NUM>) are implemented at the distributed database.