pRuffIoTBlockchainWhitepaper[1]WorkingDraft,October2017, Rev.0.7.1SummaryRuffisa platdesignedtoimprove commerceby combiningtheInternetofThingsandblockchaintechnology. Ruffincorporatesa distributedoperatingsystemwithan openblockchain,usingvirtual businessto businessnetworksanda consensusalgorithmto realizebetterofflinesolutionsforinationflow andproduct sourcing needs.InCAPchoices, thetraditionalblockchainsacrificesusability toenhancetheconsistency anddistributionfaulttolerance.Ruff,througha combination ofedgecomputingandblockchainapplications,enhancesusabilityso astomeetthe InternetofThingsdemandforreal-timeflexibility.Thekeyproblem thatwewanttosolveisabout providingtrustedinteroperabilityandpaidinteroperabilitybetweendifferentIoTdevicesystems, andusingthesedevices’computingpowerto buildanopenRuffecosystem.BackgroundTheInternetofThingsoftenprovesanisolated,closed systemwhereinwideareaIoTandlocal IoTareunableto interact.Privatizedindustrialsystemsand IDC-basedITnetworksaredifficulttoconnect.However, IoTdata oftenrequireshighconsistency andsecurity, whichisaproblem thatnocentralizedtechnology can readilysolve.ModernIoTtechnologiesareoftenaccompaniedbyredundantnodesand mixedupclouds, but blockchain offersthepossibilityofa totalsolutiontoconsistencyandsecurityissues.Unfortunately,blockchaindevelopmentcurrentlysuffersfromlackofinfrastructure,hightechnical threshold,andexcessivetechnicalrisk.So far,thereareno maturesolutionstothescalabilityproblemsthat arefrequentlypointedout. Asaresult, thecurrentdistributedappdevelopmentissparseand remainsat thevirtuallevel,not yethavingrealworldinteractivity.FragmentationFrom itsbeginningthe Internetof Thingshas alwaysbeenfragmented.For instance,itstilltakesaspecificmobileapptoopeneach ofa growingnumber ofbikesharingmodels,whileintelecommunicationsyoucangenerallycallanyoneonanycarrier.WhyistherenosimplersolutionfortransportationoptionsThereisnostandardfor equivalentnodes,and theresultisbreakdown.Moreover,beyond transportationtools,theIoTconnectedthingswehave around ustodaylikedoors, lights, alarms, coffeemachines, andallsoon areon closedisolatednetworks.Thisfragmentationisnotjustprentamong differentproduct typesbut alsoamongproductsbelongingtothesametypesaswell.Thereissimplynot enoughhomogeneityamong IoTconnectedthingsforcurrent modelsto offerthenetworkabilitywealready enjoy inotherwaysthroughcomputersand mobiledevices.DotheseproblemsmeanthereisnopossiblesolutionatpresentTheanswerisnegative.Whatisneededistheintroductionofoperatingsystemandmiddlewareconcepts,compatibility withthe fragmentedspectrumIoThardware devices,andaunifiedprogramminginterface.StandardizationITtechnology isstandardizedoverall.For example,personalcomputers interactwithserversthroughthe httpprotocol presentedonthebrowser, whichisaofstandardization. Thenetworkforexchangesbetweendifferentbitcoinnodesisalsostandardized.Only byconstantlystandardizingfragmentedproductswillitbepossibleto unifycommunication among nodesorcreateaconsensusnetworkamong nodes.TheentireInternetofThingsindustryhasbeenstrivingforstandardizationfor over20 years.Onthephysicallevel,standardsexistfor WiFi,BLE,Zigbeeandsoon, andatthelevelofindustrialnetworksthereareModbus, Profibus, industrialethernet,andsoon, through inindustrialnetworksdifferentstandardscanbeincompatible.Neverthelessstandardizationhasnot beenachievedattheapplicationlevel.Machine A andMachineBmay beabletoconnect,butMachineAdoesnotknowanyinstructionsanipulatingorrequestingdatafrom MachineB.Worsestill,evenwithindevicesdifferentdriversanddifferentsoftwarevendorsfollowdifferentproprietaryprotocols, makingitdifficultforapplicationstointeract.Easeof useSometimescommands willnotbe readable.WIth GPIO_14highlevel-lowleveloperations,serialportcompatibility andswitch rolesmay sometimesbeunknown.Youoftenneedthefollowingdefinition.RCC_APB2PeriphClockRCC_APB2Periph_GPIOB, ENABLE;GPIO_LED.GPIO_Pin GPIO_Pin_1 |GPIO_Pin_11 |GPIO_Pin_14 |GPIO_Pin_15;GPIO_LED.GPIO_Mode GPIO_Mode_Out_PP;GPIO_LED.GPIO_Speed GPIO_Speed_50MHz;GPIO_InitGPIOB, amp;GPIO_LED;However,thisapproach isdifficultto bepromoteintheapplicationengineercommunity, asitsthresholdisconsiderable,itiseasyto writebuggy code,and readabilitycontinuesto remainlow.Engineerspreferthefollowingprogrammings39;led-green39;.on;39;led-red39;.off;Theaboveparagraph uses RuffOS programmingcode, and morecan befound at http//www.ruff.io.AsofDecember2017, 13,521 engineersworldwide haveregisteredwith theRuffcommunity, withmore thanhalfofthem purchasingtheRuffboard anddeployingcode.Whenthereisastandardapplicationlayerprotocol betweennodes, thecommunication betweennodesremainsat theabstractlevelofinteractionsbetween devices,such aspayments,requests,verifications,andsoon.Whenmultipledevicesconnectinteractivelytheabstraction levelwilltendtobevery high.At themostbasiclevel,thisistheinteractionbetween differentapplications.Unifyingstandardsintheapplicationlayeristhemosturgentchallengetosolveforthe InternetofThings.Itisalsoanimportantinfrastructureconsiderationfor theinterconnectivity andinteroperability ofallthingsinthefuture.IoTstandardizationwillnotbeimplementedviaa centralizedcloud. Rather, startingfrom computingattheedgecomputingnodelevel,thetraditionalmodulecloud model willabandoned.Thisapplicationlogicwill aunifiedprogrammingmodelbasedoutsideoffirmware.ReliableinteroperabilitybetweenIoT devicesEverysmart devicehasanaddress,andwhenthedeviceissoldthemerchantentersthisaddressintothehardwareand providesaQR codefor containinga privateaddresskeyinthehardware’spackaging.Thecontrol center, by obtainingtheprivatekey,sendsthedeviceabindcommandsignedwith theprivatekeythat enablescompletecontrol of thehardware. Afterthebinding,thecontrol centercandeletethedevice39;sprivatekeyandsaveit’sownprivatekey. Peer-to-peercontrolThe control center operates the device by initiating a control TX with itsown signature to the device. No chain involvement is required, but control center andequipmentareonlinewhenneeded. Chain-statebasedcontrol Whenthecontrolendcan not establisha point-to-point connectionwiththedevice,thecontrolendcan consumetokensandwritea quot;statechangequot;TXor quot;controlcommandquot; TX on the chain to operate the target device. Each of these TX are equallynecessary. The target device can synchronize its status or control commands directly withthe chain, or through a trusted light node such as a bridge device. Blockchain thus solvesthe problems inherent in cloud operation and the maintenance costs and stability issues ofconnectingall devicestothecloud. Automated control There is no need to use contracts to set the logic of quot;turn off the airconditioner when the temperature is below 15 Cquot;. Such custom control logic can beimplemented using the console app built with traditional development language, reducingequipment support contract costs, but also reduce the likelihood of main chain jammingwhenrunningcontracts.Basedontheimplementationoftheabove, multiplevendorscantogether anopenecosystemonRuff.TimesequencedataMostIoTdataisarrangedintimesequences, makingita naturalfitforthe blockchain.Timestampdatacanbe appliedtopreventreplayattacksandsolveproblems causedby concurrentdeadlocks.Inthe pastthisdatawasnot effectivelycombinedonisolatedcentralizednetworks, withtheultimateissueofdata consistencyincirculation. ERP,MES, WMS andothercentralizedsystemssimplycannot ensureconsistentproduct traceabilityintheproduction, storage,andcirculationprocesses.Ruff39;sedgecomputingnodewillsynchronizethetimestampasthecore datavalue, thuscontrollingthebusinesslogicwithinthelocal area network.Timestampswillbesynchronizedacrosstheentireblockchain network, tracingthebehavior ofallnodesinthenetworkatthesametimetomakethestateofthenetworkrestorableatagivenpoint.ConsensusmechanismToaccount forthecomputingpowerofmasterdevicesintheInternetofThingswechoseDPoSasRuff’sconsensusalgorithm.Accordingto thisalgorithm, peoplewho holdtokensacrossthenetworkcanchooseblock producersthrough avotingsystem.Anyonecan participateinblockproductiononce elected.Thissystemproducesablock every9seconds.At anyonemoment,onlyoneproducer isauthorized toproducea block.Iftheblock isnotsuccessfullydeliveredwithinacertaintimeperioditwillbeskippedover.Any fullnodecan beacandidatefora specifictransaction,andthesystemgenerates105proxy agentsfrom candidatesvia avotingmechanism.Thefollowingfigureshowsthenumberofproxy agentsunderthecircumstancesof5possibleblockdistributionsWebresourcesarenot free,anda rewardwillbeissuedwheneverablock containingIoTcontractsisgenerated.Blockgenerationinoursystemiscountedbasedon105blocksperperiod.Atthebeginningofeachperiod,theprocessofpicking105proxy agentsfrom candidatesiscalleda round.Thereisa fixednumberof105 slotsinaround, andtherewillbe105blocks. Allcandidatescanvote VOTETXtoselectthenextroundofproxy agents.Each block containsitsownround andslotnumbers inadditionto itsown height.Round numbersarecontinuous, whileslotnumbersmay not becontinuous.Candidatesmustinitiateatransactiontype Voteonaturn, andselectagivennumber ofproxyagentsfrom avalidcandidatelist.Ifthetotal numberofcandidatesexceeds318,thenpreviousroundproxieswillnotbeallowedto bere-elected.Whenthecurrentround ofblock slotsreaches 105 If a quorum for a vote cannot be obtained, all current proxies will be reelected by default forthenextround. If a voting quorum is reached, the 105 proxies with the highest vote count will be selectedforthenextround.Basedonthehash ofthelastslotblock ofthepreviousround, adefinitelistof roundproxies’blockorderscanbeobtained.Eachblock, distributedbytheagentresponsiblefortheslot, isdistributedata 9secondintervalfrom theprevious block.Otheragentsnotcurrently responsiblefor blockdistributionwillberesponsiblefortransactioncollection, andwhenitistheirturn todistributemust giveprioritytotransactionsnot yetincluded.Transactioncollection isdeterminedbyround.Iffor exampleitisproxy agentN’sturnbuttheagent’snodeisdropped,thenthenextagentwillautomaticallydistributethenextblockafter 18seconds.A slotvacancy willbereportedfor thepreviousround, andfor thecurrent round thenumber ofblocksstillreach 105.Byanalyzingthe chaindatafor votetransactionsandblock slots,aswellasroundvalue.You canthereforedeterminewhichcandidatesdoanddo notwork well.Duringaround, an agentmayinitiateapollto disqualifycertaincandidates.Ifa proxy agentfailsto delivera blockon time,forexample,theagentwillbeblockedfrom distributionfor thenext24 hours.Thenallcandidateswillvoteonwhether todisqualifythecandidateornot.ChaincontrolInthe typicalstructureabove, thelightnodesandthecontrol nodeareonthesame intranet.Whenalightnodebindsto thecontrol node,thecontrol nodeisallowedtocontrol thelightnodefromthemasterchain.Weusecommandsignaturesto achievechain-basedcontrol. DeviceinitializationThemanufacturer ofthelightnode devicewritesapublic-privatekeypairintothedeviceandthenprintstheprivatekeyonthedevice39;sinstructionsorpackageintheofatwo-dimensionalcode. DevicebindinWhenactivatedthelightnodeisplacedinanetworkenvironmentwhereitcanconnect toandcommunicatewiththecontrol node.Thecontrol nodetheninitiatesabindingcommand, whichcontainsthepublickeyofthecontrol node.Afterthecommand iscreated, thedevice’sprivatekeymustbetedtosignthebindingcommand. Afterthesignatureiscompletethebindingcommandissentto thedevice.Afterreceivingthebindingcommand, thedeviceverifiesthesignature.Theverificationisperedby recordingthecontrol node’spublickey. Thecontrolnodecannolongerstorethelightnode39;sprivatekey. ControlcommandverificationThecommand receivedbythelightnodewillverifyandagreetocutethe commandaslongasithas thesignatureofitsrecordedcontrol node. Loggingcommandhistory ontothemasterchainIfnecessary, thecontrol nodewilllog allcontrol commandsthat havebeenissued,andwhenevercommunicationwiththebackbone isrestored,publishthehistory andcontrol resultrecordsto themasterchain.LightningchaindifferentialmechanismThecontrol nodecan createafixedat contract on themasterchainusinga CreateContracttransaction.Thecontractisgenerally attedinthetermsquot;Ifyou giveme acertainnumber oftokens,I willallowyou touse thefollowingcommand undercertainconditions.quot;Thesuccessfulcreationofthecontract willreturnto savethecontract blockheightandtransactionhashtogetherreferredto astheContractAddress.Theusercan initiatea Calltransactionto acontract address.Aftersavingthetransactiontothemasterchain, thecontrol nodewillcontinuallycheck fortransactionsfrom theinitiatedcontract.Onceatransactionisdetected, thecontrol nodechecks toseeiftheuserhasenoughtokenstocompleteit.Ifso, thetransactionwillbesuccessful,initiatingaReturn transactioncontainingtheresultofthecontract cution anda not-yetcommittedcodefor aReviewtransaction.Reviewisamulti-signed“Seq”signaturetransaction.TheReturntransactionisconfirmedby themasterchainafterthecontract issuccessfullycuted,atwhich timetheuser39;stokenswillbetransferredto thecontrol node39;saccount.Aftersometime, iftheuserfeelsthatthehardware isnothandlingthesubsequentcommandscorrectly, thenhecanextracttheReviewtransaction’spreviouslysignedReturntransaction, signhisowndigitalsignature,and aReviewtransaction tothemasterchain, andthenegativereportwilltakeeffect.Asthissequenceisfixed,userswillhaveto makeregisteredcomplaintsby dueprocess.Ifa particularcontract gathersnumerous such reports,thecontrol appwillinteractivelyprompttheuserthatthecontract hasa largenumber ofnegativereviews.NodeclassificationInternetofThingsnodesare oftenvery smallcomputingunits.Duetotheirpowerconsumptionrequirements,theircomputingpowerisverylow, theirmemory isvery small, andtheMCU cannotexceed512 kb.TheLinuxversionofanodeisattherouter level,andthestorageislikewiseverysmall, withMCU only having1MFlashmemory.It isvery difficultfor sucha nodetoparticipateinconsensusprocesses.Therefore,thestructure oftheInternetofThingsisnecessarilycomposedof multiplenodescomprisinga network.Therewillbeoneormore applicationsinthisnetwork,andapplicationswillgo through theapplicationinterface andinteract ontheblockchain.Thecomputingpowerrequiredforlocal applicationswillbedrawn from theedgecomputingunit,potentiallya gatewayor router.Applicationscan managethe local networkinacentralizedordecentralizedway andinteractwiththechain. Accordingtothis,weclassifythenodesintheRuffecosystemasfollowsLightnodescutorsTheapplicationcontrol interfacewillrequestnetworkauthenticationination,and afterverifyingcorrect implementationwillissueacontract tothe user,suchasthereleaseofpropertyaccessrights.Thelightnoderolecanbeassumedbyasimpledevicewithoutstoragecapacity, andthecostcan beaslowasafewdollars.Fullnodes（ Recorders）Fullnodeswillbeableto record allination, participateineventregistration ormodifybroadcasts,andvoteforother nodes.Moreover, fullnodescan becomerepresentativenodes.Deviceswithhighperance willact havea greaterroleas nodesonthenetwork.Dueto theconsensusalgorithm ofnotusingPoWandthelow computational burdenontheen/p