# US 12,008,136 B2 · Systems and methods for privacy-preserving inventory matching with security against malicious adversaries > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,008,136 B2 - Document ID: US12008136B2 - Status: Granted - Kind: B2 - Application number: 17/649,115 - Filed: 2022-01-27 - Published: 2022-07-28 - Granted: 2024-06-11 - Earliest claimed: 2021-01-28 - Assignees: JPMorgan Chase Bank, N.A. - Applicants: Jpmorgan Chase Bank, N.A. - Inventors: Tucker Richard Balch; Benjamin E Diamond; Antigoni Ourania Polychroniadou - Web page: https://patentgrep.com/patent/US12008136B2 ## CPC - G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes} - H04L 9/085: {Secret sharing or secret splitting, e.g. threshold schemes} - H04L 9/3066: {involving algebraic varieties, e.g. elliptic or hyper-elliptic curves} - H04L 9/3247: {involving digital signatures} - H04L 2209/42: Anonymization, e.g. involving pseudonyms - H04L 2209/46: Secure multiparty computation, e.g. millionaire problem - H04L 2209/56: Financial cryptography, e.g. electronic payment or e-cash - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method for privacy-preserving inventory matching may include: (1) receiving a plurality of axe submissions; (2) arranging the parties into data structures based on a direction in the party's axe submission; (3) sending each party's commitment to the other party; (4) receiving, from each party, output secret-shares of an arithmetized comparison circuit; (5) verifying that the output secret-shares of the arithmetized comparison circuit received from the parties match commitments to the output secret-shares sent by the respective opposite party; (6) identifying a minimal party based on the outputs of the arithmetized comparison circuit; (7) generating and sending a proof of the minimal party identification to the minimal party; (8) receiving a minimal quantity integer from the minimal party; (9) revealing the minimal quantity integer to the first party and the second party; and (10) executing the trade for the minimal quantity integer. ## Claims ### Claim 1 A method for privacy-preserving inventory matching, comprising: at a server comprising at least one computer processor: receiving a plurality of axe submissions, each axe submission from a party and comprising a direction and a quantity commitment to a quantity integer, wherein the quantity integer is not revealed in the quantity commitment; arranging the parties into data structures based on the direction in the party's axe submission; for a first party and a second party, the first party and the second party being in different data structures, sending each party's quantity commitment to the other party; receiving, from the first party and the second party, output secret-shares of an arithmetized comparison circuit; verifying that the output secret-shares of the arithmetized comparison circuit received from the first party and the second party match quantity commitments to the output secret-shares sent by the respective opposite party; identifying a minimal party based on the outputs of the arithmetized comparison circuit; generating and sending a minimal party identification proof of the minimal party identification to the minimal party; receiving a minimal quantity integer from the minimal party, wherein the minimal quantity integer is the quantity integer for the minimal party; revealing the minimal quantity integer to the first party and the second party; and executing a trade for the minimal quantity integer. ### Claim 2 (depends on 1) The method of claim 1, wherein the quantity commitment is generated using a Pedersen scheme over an elliptic curve of prime order. ### Claim 3 (depends on 1) The method of claim 1, wherein, within each data structure, the parties are arranged based on an order of receipt of each party's axe submission. ### Claim 4 (depends on 1) The method of claim 1, further comprising: receiving, from the first party and the second party, a signed quantity commitment; and sending, to the other party, the signed quantity commitment. ### Claim 5 (depends on 1) The method of claim 1, wherein the minimal party identification proof is a one-out-of-many proof. ### Claim 6 (depends on 1) The method of claim 1, wherein the minimal party verifies the minimal party identification proof in response to receiving the minimal party identification proof. ### Claim 7 (depends on 1) The method of claim 1, wherein the server sends the minimal party identification proof to the first party and the second party in response to the arithmetized comparison circuit outputs indicating that the first party and the second party have the same quantity integer. ### Claim 8 (depends on 1) The method of claim 1, wherein the data structure comprises a queue. ### Claim 9 A method for privacy-preserving inventory matching, comprising: at a first party electronic device comprising at least one computer processor: submitting, to a server, an axe submission comprising a direction and a first party quantity commitment to a first party quantity integer, wherein the first party quantity integer is not revealed in the first party quantity commitment; sending, via the server, the first party quantity commitment to a second party and receiving a second party quantity commitment to a second party quantity integer from the second party, wherein the second party quantity integer is not revealed in the second party quantity commitment; decomposing the first party quantity integer into a plurality of bits; performing a bit-commitment protocol process on the plurality of bits comprising two first party secret-shares; sending the second party one of the first party secret-shares; receiving a second party secret share from the second party; executing an arithmetized comparison circuit on the first party secret-share that was not sent to the second party and the second party secret-share received from the second party; sending outputs of the arithmetized comparison circuit to the server, wherein the server verifies that the outputs received from the first party and outputs received from the second party match commitments to the output secret-shares sent by the second party and the first party, respectively; receiving, from the server, a minimal party identification proof of that the first party is a minimal party; and verifying the minimal party identification and sending the first party quantity integer to the server, wherein the first party quantity integer is a minimal quantity integer; wherein a transaction is executed for the minimal quantity integer. ### Claim 10 (depends on 9) The method of claim 9, wherein the first party quantity commitment and/or the second party quantity commitment is generated using a Pedersen scheme over an elliptic curve of prime order. ### Claim 11 (depends on 9) The method of claim 9, wherein the minimal party identification proof is a one-out-of-many proof. ### Claim 12 (depends on 9) The method of claim 9, further comprising: verifying the minimal party identification proof in response to receiving the minimal party identification proof. ### Claim 13 (depends on 9) The method of claim 9, wherein the two first party secret-shares are based on a first random scalar modulo p and a selecting a second scalar which sums with the first random scalar modulo p to the bit. ### Claim 14 (depends on 9) The method of claim 9, further comprising: generating a sum proof that a sum of the commitment to the first party secret-share and the commitment to the second party secret-share is a bit commitment; sending the sum proof to the second party; generating a matching proof that the sum of the commitment to the first party secret-share and the commitment to the second party secret-share match bits in the decomposed first party quantity integer; and sending the matching proof to the second party. ### Claim 15 (depends on 9) The method of claim 9, wherein the arithmetized comparison circuit evaluates the first party secret-share that was not sent to the second party and the second party secret-share received from the second party. ### Claim 16 A method for privacy-preserving inventory matching, comprising: at a first party electronic device comprising at least one computer processor: submitting, to a server, an axe submission comprising a direction and a first party quantity commitment to a first party quantity integer, wherein the first party quantity integer is not revealed in the first party quantity commitment; sending, via the server, the first party quantity commitment to a second party and receiving a second party quantity commitment to a second party quantity integer from the second party, wherein the second party quantity integer is not revealed in the second party quantity commitment; decomposing the first party quantity integer into a plurality of bits; performing a bit-commitment protocol process on the plurality of bits comprising two first party secret-shares; sending the second party one of the first party secret-shares; receiving a second party secret share from the second party; executing an arithmetized comparison circuit on the first party secret-share that was not sent to the second party and the second party secret-share received from the second party; sending outputs of the arithmetized comparison circuit to the server, wherein the server verifies that the outputs received from the first party and outputs received from the second party match commitments to the output secret-shares sent by the second party and the first party, respectively; and receiving, from the server, an identification of a minimal quantity integer, wherein the minimal quantity integer is the second party quantity integer; wherein a transaction is executed for the minimal quantity integer. ### Claim 17 (depends on 16) The method of claim 16, wherein the first party quantity commitment and/or the second party quantity commitment is generated using a Pedersen scheme over an elliptic curve of prime order. ### Claim 18 (depends on 16) The method of claim 16, wherein the two first party secret-shares are based on a first random scalar modulo p and a selecting a second scalar which sums with the first random scalar modulo p to the bit. ### Claim 19 (depends on 16) The method of claim 16, further comprising: generating a sum proof that a sum of the commitment to the first party secret-share and the commitment to the second party secret-share is a bit commitment; sending the sum proof to the second party; generating a matching proof that the sum of the commitment to the first party secret-share and the commitment to the second party secret-share match bits in the decomposed first party quantity integer; and sending the matching proof to the second party. ### Claim 20 (depends on 16) The method of claim 16, wherein the arithmetized comparison circuit evaluates the first party secret-share that was not sent to the second party and the second party secret-share received from the second party.