Digital Vaults

Overview

Digital Vaults are secure, programmable containers that combine TEE-backed execution with MPC key management to provide institutional-grade protection for digital assets while enabling complex licensing logic.

What is a Digital Vault?

A Digital Vault is a cryptographically sealed container that:

  • Stores encrypted assets (audio, video, images, documents)
  • Enforces licensing rules (usage restrictions, royalty calculations)
  • Manages fractional ownership (splits, transfers, inheritance)
  • Provides access control (who can access, when, under what conditions)
  • Maintains audit trails (all access logged immutably)

Key Insight: The asset never leaves the vault in plaintext except inside TEE enclaves when authorized access occurs.

Architecture

┌─────────────────────────────────────────┐
│         Digital Vault                   │
├─────────────────────────────────────────┤
│  Vault Container (TEE-backed)           │
│  ├── Encrypted Asset Storage            │
│  ├── License Engine                     │
│  ├── Ownership Registry                 │
│  ├── Access Control                     │
│  └── Audit Log                          │
├─────────────────────────────────────────┤
│  Key Management (MPC)                   │
│  ├── Key Share 1 (TEE Node A)           │
│  ├── Key Share 2 (TEE Node B)           │
│  ├── Key Share 3 (TEE Node C)           │
│  └── Threshold: 3-of-5                  │
├─────────────────────────────────────────┤
│  On-Chain State (PRVNZ Blockchain)      │
│  ├── Vault ID                           │
│  ├── Content Hash                       │
│  ├── Terms Hash                         │
│  ├── Owner Address                      │
│  └── State Root                         │
└─────────────────────────────────────────┘

Vault Lifecycle

1. Creation

# Pseudocode
async def create_vault(asset, terms, royalties):
    # Generate vault ID
    vault_id = generate_uuid()
    
    # Hash asset for verification
    content_hash = sha256(asset)
    
    # Generate encryption key via MPC
    encryption_key = await mpc_network.generate_key(
        vault_id=vault_id,
        threshold=3,
        total_shares=5
    )
    
    # Encrypt asset
    encrypted_asset = aes_gcm_encrypt(asset, encryption_key)
    
    # Store encrypted asset off-chain
    storage_url = await storage.upload(encrypted_asset)
    
    # Hash licensing terms
    terms_hash = sha256(terms)
    
    # Record on-chain
    vault_record = {
        "vault_id": vault_id,
        "content_hash": content_hash,
        "terms_hash": terms_hash,
        "storage_url": storage_url,
        "owner": msg.sender,
        "created_at": timestamp()
    }
    
    await prvnz_chain.create_vault(vault_record)
    
    return vault_id

2. Access

async def access_vault(vault_id, user_address):
    # Verify license
    license = await prvnz_chain.get_license(vault_id, user_address)
    if not license.is_valid():
        raise PermissionDenied("No valid license")
    
    # Retrieve encrypted asset
    encrypted_asset = await storage.download(vault_id)
    
    # Reconstruct decryption key in TEE
    decryption_key = await mpc_network.reconstruct_key(
        vault_id=vault_id,
        required_shares=3
    )
    
    # Decrypt in TEE enclave
    plaintext_asset = await tee.decrypt_in_enclave(
        encrypted_asset,
        decryption_key
    )
    
    # Log access
    await prvnz_chain.log_access(vault_id, user_address)
    
    return plaintext_asset

Licensing Engine

License Types

1. Exclusive License

{
  "type": "exclusive",
  "territory": ["US", "CA"],
  "duration": "2025-01-01 to 2030-12-31",
  "restrictions": ["no sublicensing"],
  "royalty": {
    "type": "fixed",
    "amount": 10000  // $100 USD equivalent in BTC
  }
}

2. Non-Exclusive License

{
  "type": "non-exclusive",
  "territory": "worldwide",
  "duration": "perpetual",
  "restrictions": ["personal use only"],
  "royalty": {
    "type": "per-use",
    "amount": 100  // $1 per use
  }
}

3. Royalty-Bearing License

{
  "type": "royalty-bearing",
  "territory": "worldwide",
  "duration": "perpetual",
  "royalty": {
    "type": "percentage",
    "rate": 0.05,  // 5% of revenue
    "minimum": 1000,  // $10 minimum
    "payment_schedule": "quarterly"
  }
}

Fractional Ownership

Ownership Registry

class OwnershipRegistry:
    def __init__(self, vault_id):
        self.vault_id = vault_id
        self.owners = {}  # address -> percentage
    
    def add_owner(self, address, percentage):
        if percentage <= 0 or percentage > 1.0:
            raise ValueError("Invalid percentage")
        
        total = sum(self.owners.values()) + percentage
        if total > 1.0:
            raise ValueError("Total ownership exceeds 100%")
        
        self.owners[address] = percentage
    
    def transfer(self, from_address, to_address, percentage):
        if from_address not in self.owners:
            raise KeyError("Not an owner")
        
        if self.owners[from_address] < percentage:
            raise ValueError("Insufficient ownership stake")
        
        # Deduct from sender
        self.owners[from_address] -= percentage
        if self.owners[from_address] == 0:
            del self.owners[from_address]
        
        # Add to receiver
        if to_address in self.owners:
            self.owners[to_address] += percentage
        else:
            self.owners[to_address] = percentage

Royalty Distribution

class RoyaltyDistributor:
    async def distribute_royalties(self, vault_id, revenue):
        # Get ownership registry
        registry = await self.get_registry(vault_id)
        
        # Calculate distributions
        distributions = {}
        for owner, percentage in registry.get_owners().items():
            amount = revenue * percentage
            distributions[owner] = amount
        
        # Execute transfers
        for owner, amount in distributions.items():
            await self.transfer_funds(
                vault_id=vault_id,
                to=owner,
                amount=amount
            )
            
            # Log distribution
            await self.log_royalty_payment(
                vault_id=vault_id,
                recipient=owner,
                amount=amount,
                timestamp=now()
            )

Access Control

Permission Model

class AccessControl:
    PERMISSIONS = [
        "READ",      # View metadata
        "ACCESS",    # Access content
        "TRANSFER",  # Transfer ownership
        "LICENSE",   # Grant licenses
        "UPDATE",    # Modify content
        "DELETE"     # Delete vault (rare)
    ]
    
    def grant_permission(self, address, permission):
        if permission not in self.PERMISSIONS:
            raise ValueError(f"Invalid permission: {permission}")
        
        if address not in self.acl:
            self.acl[address] = []
        
        if permission not in self.acl[address]:
            self.acl[address].append(permission)
    
    def has_permission(self, address, permission):
        return address in self.acl and permission in self.acl[address]

Hash-Based Verification

Content Integrity

class ContentVerifier:
    async def verify_integrity(self, vault_id):
        # Get on-chain hash
        on_chain_hash = await prvnz_chain.get_content_hash(vault_id)
        
        # Download asset
        encrypted_asset = await storage.download(vault_id)
        
        # Decrypt in TEE
        decryption_key = await mpc_network.reconstruct_key(vault_id)
        plaintext_asset = await tee.decrypt_in_enclave(
            encrypted_asset,
            decryption_key
        )
        
        # Compute hash
        computed_hash = sha256(plaintext_asset)
        
        # Compare
        if computed_hash != on_chain_hash:
            raise IntegrityError("Asset hash mismatch")
        
        return True

Storage Options

Off-Chain Storage Backends

  • IPFS: Content-addressed storage
  • Arweave: Permanent storage
  • S3-compatible: AWS, GCP, Azure
  • Self-hosted: For institutional users

Use Cases

Music Production

# Create vault for master recording
vault_id = await create_vault(
    asset=master_audio_file,
    terms={
        "type": "master_recording",
        "artist": "Artist Name",
        "splits": {
            "producer": 0.30,
            "artist": 0.50,
            "label": 0.20
        }
    },
    royalties={
        "streaming": 0.006,  # per stream
        "download": 0.99,    # per download
        "sync": 5000         # sync license fee
    }
)

Film Production

# Create vault for film
vault_id = await create_vault(
    asset=film_file,
    terms={
        "type": "film",
        "title": "Film Title",
        "ownership": {
            "director": 0.25,
            "investors": [
                {"address": "0x123", "stake": 0.40},
                {"address": "0x456", "stake": 0.35}
            ]
        }
    },
    royalties={
        "box_office": 0.50,    # 50% of net revenue
        "streaming": 0.30,     # 30% of streaming revenue
        "merchandise": 0.10    # 10% of merchandise
    }
)

Security Considerations

Threat Model

Protected Against:

  • Unauthorized access (encryption + access control)
  • Content tampering (hash verification)
  • Key extraction (MPC + TEE)
  • Single point of failure (distributed keys)
  • Insider attacks (audit trails + attestation)

Best Practices

  1. Always verify content hash before trusting asset
  2. Use hardware wallets for high-value vaults
  3. Enable audit logging for compliance
  4. Regular key rotation (90-day cycles)
  5. Monitor access patterns for anomalies