Private blockchain: what it is and how to build one

On a public blockchain anyone can run a node, read every transaction and send one. On a private blockchain an authority approves who makes blocks, and can also restrict reading and sending. A consortium chain is a private chain run jointly by several organizations.

NIST puts the line at block making: on a permissioned network, the users who publish blocks must be authorized. Reading and sending can then be open to everyone or limited to approved users. That choice is yours to make.

A private chain still keeps an append-only history with every block linked to the one before. What changes is trust: instead of thousands of strangers, a short list of known parties keeps the chain honest.

You may need a blockchain only if several parties write to one shared record, nothing is ever edited or deleted, no personal data goes on it, the writers cannot agree who should run the database, and you want a log nobody can tamper with. Any "no" points to a database instead.

The test below follows a flowchart by the US Department of Homeland Security, reproduced by NIST in its blockchain overview.

Question 5 is the one that decides most cases. If one company will run the system anyway, the blockchain adds cost and gives nothing back.

Today the common routes are Hyperledger Besu with QBFT or IBFT 2.0 proof of authority, Hyperledger Fabric for business ledgers without a coin, or a managed service. Geth, the most used Ethereum client, has not offered proof of authority since version 1.14.

Besu's own tutorial warns that it creates a network that is "isolated, but not protected or secure". The QBFT tutorial tells you to run it behind a properly configured firewall and to keep private keys out of the genesis file. Treat every tutorial as a starting point, not a production setup.

Setting up the first block? The genesis block guide explains each field of the file every Ethereum-style chain starts from.

With QBFT or IBFT 2.0, at least two thirds of validators must be online to make blocks. Four validators is the smallest network that survives one failed or dishonest validator.

Put each validator with a different member, on a different server and, ideally, with a different hosting company. A chain where one company runs every validator is a database with extra steps.

The software is free and open source, so the cost is servers and the time to run them. A managed private chain at Kaleido starts at about $115.20 a month for one small node on its free membership. A HeroRPC proof-of-authority chain is a one-time build of $149, plus monthly hosting per server shown before you pay.

Custom builds by development agencies are quoted in the tens of thousands of dollars. That buys software written for you, which most private chains do not need: the open-source clients already do the hard part.

Count your own hours too. Someone has to apply client updates, watch disk space, rotate validator keys and handle members joining or leaving.

Before launch, agree on the members and validator rules, keep personal data off the chain, lock the network behind a firewall, keep keys out of the genesis file, and plan backups and upgrades.

HeroRPC builds an Ethereum-style or BNB-style chain on proof of authority for $149 one-time. It starts with three validators, and you can add more. You get the logins to every server, so you decide who can connect.

Validators you control yourself can start at three. If they will be run by members who do not fully trust each other, add more so you reach four, the fault-tolerance floor in the Besu docs.

Because you hold the server logins, you can close the network to the public and open it only to your members. We never hold your private keys. The explorer and wallet add-ons are optional: skip them, or keep them for members only.

Choosing the consensus? Proof of work vs proof of stake explains where proof of authority fits.