DFINITY Patented Cloud Engines in 2019. I Read All 21 Filings to Be Sure.

The core mechanics behind ICP’s cloud engines, the product DFINITY is betting its 2026 tokenomics on, were filed as patents in 2019 and 2020. The patents describe the technology as “routine load balancing”. They never once use the words enterprise, sovereign, or jurisdiction, which are canon terms for cloud engines today.

The filings are public, so I sat down and went over the 21 patents I could find. The full documents rather than just the summaries. I went in expecting one of two things: either a wall of protection around the network, or nothing much at all. What I found was more unexpected than either of those.

Here is what the patents actually show:

A cloud engine, in DFINITY’s 2026 pitch, is a private slice of the network that an enterprise rents and configures: pick your nodes, pick your countries, keep the same application running on top. The whole thing depends on one technical trick. The identity of a subnet has to be independent of the specific machines running it, so you can swap the hardware underneath without breaking what is deployed.

That trick is US patent 12,388,628, filed June 2020.

“each of the plurality of subnets has an individual, i.e. its own static verification key which remains constant over time... While the static verification key remains constant, the corresponding secret key shares may change over time. Furthermore, the set of nodes which form or represent a subnet may change over time.”

A subnet keeps one fixed public identity while the machines behind it come and go. That is the exact property a rent-your-own-infrastructure product needs, described in full, in mid-2020.

Its companion is a patent filed the same day, WO 2022/002427. It covers moving a running program, with its live state intact, onto an entirely different set of machines:

“These additional nodes are fresh nodes which may catch up with the states of the migrant computational unit... the migrant computational unit has been completely migrated from the nodes of the first subnet to another new set of nodes.”

The same patent even handles the security problem that arises when you move a workload between machines run by different operators. It calls this crossing "two different trust domains" and certifies the transfer with a joint signature so the destination can trust what it receives.

So by September 2020, roughly five years before cloud engines were announced, DFINITY had patented a subnet whose identity survives a total change of hardware, and a way to move a live workload onto fresh nodes across a trust boundary. If you were designing the plumbing for “choose your own node providers, keep your app running,” this is what you would file.

The cloud-engine business model routes through associations of node providers who sell capacity and keep the revenue, minus a cut the network burns. The idea that you could rent out your infrastructure to a paying customer and share the proceeds, rather than run it yourself, is the commercial heart of the pitch.

That idea appears, as an aside, in US patent 12,063,308, filed March 2019. The patent is about node privacy. Buried in the description is this:

“such a separation of the permanent node identities from the stake identities allows stake holders to ‘rent out’ their stake e.g. to a data center... This allows the stake owner and the data center to share rewards for the stake, without having to hand over the stake.”

Rent out your position, share the rewards, keep control. That is the cloud-engine revenue concept in embryo, written down in 2019 as a throwaway line in a cryptography patent.

The patents do not say any of this was built for cloud engines. Read them cold and the stated purpose is always internal. The migration patent moves workloads "for load balancing reasons," and migration is triggered by the network itself, not by a customer. The vocabulary of the actual product is completely absent. Across all patents, the words enterprise, sovereign, jurisdiction, geography, tenant, and compliance appear zero times. The word cloud appears eight times, every one of them boilerplate from a generic computer-systems template.

DFINITY built and patented the core mechanics of cloud engines years before they productized them, and described those mechanics as ordinary network housekeeping. Whether the foresight was deliberate or the pieces simply turned out to fit, the documents do not say. But the pieces were there, and that’s very interesting, regardless.

One more piece of the current network shows up early. ICP’s headline economic feature is that developers can pay for computation so users do not have to, the so-called reverse-gas model. US patent 12,572,963, filed October 2019, describes a two-currency system where "gas" is:

“a complementary accounting unit that is used by the distributed network to charge for the use of its resources and is separate from the native currency of the network.”

Stable-priced, burned on use, with the conversion rate set by governance. That is the cycles model, roughly 19 months before mainnet.

The reverse-gas part is more nuanced than the marketing suggests. The patent’s default is actually that users hold gas accounts. But it then makes the payer a choice the developer declares in code:

“the respective payment method for the respective application may be specified in an interface description language (IDL)... and can hence be specified by the respective programmer/developer.”

So “the app pays, the user holds nothing” is one option inside the 2019 patent, not the headline design. If you have read that DFINITY patented reverse gas in 2019, that overstates it. What they patented was a metering system flexible enough to let the developer decide who pays, including the case that later became the selling point.

Here is the thing that changes how I read the whole patent portfolio.

Their patents cover the hard cryptographic and consensus core: distributed key generation, threshold signatures, the consensus protocol, the random beacon, secret resharing. Seven of the 21 patents are threshold cryptography alone. This is the genuinely difficult mathematics, and it is protected.

But almost nothing DFINITY has shipped since 2021 appears anywhere. There is no patent family directed at the NNS or on-chain governance. None for chain-key Bitcoin or Ethereum. None for HTTPS outcalls, the Wasm execution environment, Motoko, or the boundary nodes. None for the AI and self-writing-cloud direction the company now talks about constantly.

And the filing itself stopped. Measured by priority date, which is when an invention is actually claimed, the program runs from 2016 to September 2021 and then halts. One lone family has been filed since, in April 2024. Patents kept publishing and granting well into 2026, but that is the pipeline draining. The last time DFINITY filed a wave of patents was over four years ago.

The obvious explanation is that the R&D was simply done, so there was nothing left to patent. I can rule that out from the documents themselves.

DFINITY’s cryptographers published at least four substantial new results from 2023 onward. vetKeys, a way for a blockchain to hold secrets, in April 2023. A new threshold Schnorr toolkit. Lightweight asynchronous verifiable secret sharing. Fast batched asynchronous distributed key generation. vetKeys in particular rests on identity-based encryption, a primitive that does not appear anywhere in the entire patent portfolio.

I checked that directly. Across all patents, “identity-based encryption,” “IBE,” and “vetKD” appear zero times. The research was novel, but none of it was patented.

Before September 2021, DFINITY’s major cryptography papers each had a matching patent, usually filed within weeks. After 2023, the papers kept coming and the patents did not.

There is a second piece of evidence for the open posture, and it draws the same line the patents do. DFINITY’s code is public, but not under one license. Most of it is Apache 2.0, a permissive open-source license. A minority sits under a restrictive source-available license that the project’s own README says exists “to protect the Intellectual Property of the DFINITY Foundation”. The restrictive license clusters on the consensus protocol, the certification and state machinery, and the threshold-signature cryptography. The permissive license covers the product surface: the NNS, chain-key Bitcoin and Ethereum, HTTPS outcalls, Motoko. That is the same boundary the patents draw. Protect the hard cryptographic core, give away the product layer, in two separate instruments that happen to agree exactly.

vetKeys sits on the giveaway side, and that is the tell. Its implementation is public under the permissive license, and the source file cites the 2023 paper directly. It sits one directory away from threshold-signature code that is under the restrictive license. They had the option to protect it, and they chose not to.

That leaves a real question I cannot answer from patents alone. The most likely reading is a deliberate shift toward publishing over patenting, which fits a project that always published its research anyway. It could also be budget, or a change in legal strategy, or something else entirely, I can’t know for sure.

DFINITY patented the part of the Internet Computer that is genuinely hard to reproduce, the threshold cryptography and consensus core, and left the rest to be protected by difficulty and by being given away in the open. The product surface, the governance, the cross-chain integration, the developer tools, they all sit behind no patents at all. And the mechanics of cloud engines, the thing the whole 2026 economic plan depends on, were quietly filed years early and labeled as routine.

If you are trying to judge whether ICP’s technology is defensible, the patents give a genuinely mixed answer. The products are not, and the company appears to have decided, sometime around 2021, that patenting them was not worth doing. Whether that is confidence, principle, or retreat is the one thing 21 patents cannot tell you.

What they can tell you is that the cloud-engine bet is not a pivot. The pieces have been sitting in DFINITY’s filing cabinet since 2019.

EDIT: Bjorn Tackmann from DFINITY replied to say they have not stopped filing, but the process simply takes a long time, and that there are "still some real gems waiting to be discovered." That is a fair correction. I measured priority dates, which is when an invention is actually claimed, and those only become visible when a filing publishes roughly 18 months later. So anything filed in the last year or so would not appear in my data no matter what it contained. What happens next is genuinely not visible yet, and by his account there is more coming.

Every quote above is word for word from the patent filings, which are public. I have the full text of all 21 families and I am glad to point anyone to the specific document. If this was useful, please consider subscribing.