WO2022237123A1 - Procédé et appareil d'acquisition de données de chaîne de blocs, dispositif électronique et support de stockage - Google Patents

Procédé et appareil d'acquisition de données de chaîne de blocs, dispositif électronique et support de stockage Download PDF

Info

Publication number
WO2022237123A1
WO2022237123A1 PCT/CN2021/133167 CN2021133167W WO2022237123A1 WO 2022237123 A1 WO2022237123 A1 WO 2022237123A1 CN 2021133167 W CN2021133167 W CN 2021133167W WO 2022237123 A1 WO2022237123 A1 WO 2022237123A1
Authority
WO
WIPO (PCT)
Prior art keywords
service program
blockchain
oracle
data
block
Prior art date
Application number
PCT/CN2021/133167
Other languages
English (en)
Chinese (zh)
Inventor
吴行行
余逸荣
邱鸿霖
陈辰
Original Assignee
蚂蚁区块链科技(上海)有限公司
支付宝(杭州)信息技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 蚂蚁区块链科技(上海)有限公司, 支付宝(杭州)信息技术有限公司 filed Critical 蚂蚁区块链科技(上海)有限公司
Publication of WO2022237123A1 publication Critical patent/WO2022237123A1/fr

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/44—Program or device authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/604—Tools and structures for managing or administering access control systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures

Definitions

  • One or more embodiments of this specification relate to the field of blockchain technology, and in particular to a method, device, electronic device, and storage medium for acquiring blockchain data.
  • TEE Trusted Execution Environment
  • TEE Trusted Execution Environment
  • system call interfaces such as network call interfaces are generally not provided, which leads to Trusted applications in TEE cannot securely access and obtain relevant data on the blockchain.
  • one or more embodiments of this specification provide a method, device, electronic device, and storage medium for acquiring blockchain data.
  • a method for acquiring blockchain data is proposed, and the method is applied to the first A trusted computing node, where a trusted application runs in a first trusted execution environment deployed by the first trusted computing node, the method includes: obtaining a remote authentication report for an oracle service program, and the oracle service The program runs in the second trusted execution environment; when the oracle service program is determined to be credible according to the remote authentication report, send the blockchain data query request obtained from the trusted application to the oracle machine service program, so that the oracle machine service program responds to the block chain data query request, and obtains the block data on the target block chain; receives the block data and the block data returned by the oracle machine service program If the digital signature corresponding to the block data is successfully verified through the public key corresponding to the oracle service program, the block data is returned to the trusted application.
  • a device for acquiring blockchain data is proposed, the device is applied to a first trusted computing node, and the first trusted computing node deployed by the first
  • a trusted application running in the trusted execution environment
  • the device includes: a report obtaining unit, configured to obtain a remote authentication report for the oracle service program, and the oracle service program runs in the second trusted execution environment; request to send A unit, configured to send a blockchain data query request obtained from the trusted application to the oracle service program when it is determined that the oracle service program is credible according to the remote authentication report, so that The oracle service program obtains the block data on the target block chain in response to the block chain data query request; the data receiving unit is used to receive the block data and the block data returned by the oracle service program. If the digital signature corresponding to the block data is successfully verified through the public key corresponding to the oracle service program, the block data is returned to the trusted application.
  • an electronic device including: a processor; a memory for storing processor-executable instructions; wherein, the processor executes the executable instructions In order to realize the above steps of the method for obtaining blockchain data.
  • a computer-readable storage medium on which executable instructions are stored; wherein, when the instructions are executed by a processor, the above-mentioned acquisition of blockchain data is realized. method steps.
  • Fig. 1 is a schematic diagram of a blockchain-related network environment provided in this specification.
  • Fig. 2 is a network architecture diagram provided in this specification according to an exemplary embodiment.
  • Fig. 3 is a flow chart of a method for acquiring blockchain data provided in this specification according to an exemplary embodiment.
  • Fig. 4 is an interaction flowchart of a method for acquiring blockchain data according to an exemplary embodiment provided in this specification.
  • Fig. 5 is a schematic structural diagram of a device provided by an exemplary embodiment.
  • Fig. 6 is a block diagram of a device for acquiring blockchain data according to an exemplary embodiment provided in this specification.
  • the steps of the corresponding methods are not necessarily performed in the order shown and described in this specification.
  • the method may include more or less steps than those described in this specification.
  • a single step described in this specification may be decomposed into multiple steps for description in other embodiments; multiple steps described in this specification may also be combined into a single step in other embodiments describe.
  • FIG. 1 is a schematic diagram of a blockchain-related network environment shown in this specification.
  • it may include a client-side computing device 101, a server-side 102, and at least one blockchain system; for example, a blockchain system 103, a blockchain system 104, and a blockchain system 105.
  • a blockchain system 103 for example, a blockchain system 103, a blockchain system 104, and a blockchain system 105.
  • the client-side computing device 101 may include various types of client-side computing devices; for example, the client-side terminal device may include PC terminal devices, mobile terminal devices, Internet of Things devices, and Other forms of smart devices with some computing power, and so on.
  • the client-side terminal device may include PC terminal devices, mobile terminal devices, Internet of Things devices, and Other forms of smart devices with some computing power, and so on.
  • At least part of the computing devices in the client terminal device 101 can be connected to the server end 102 through various communication networks; for example, the device 1 and device 2 shown in FIG. connected.
  • terminal devices in the client-side terminal device 101 may not be connected to the server 102, but directly connected to the blockchain system as a blockchain node through various communication networks; for example, Fig. 1
  • the device 4 shown in can be connected to the blockchain system as a blockchain node.
  • the above-mentioned communication network may include a wired and/or wireless communication network; for example, it may be a local area network (Local Area Network, LAN) implemented based on a wired access network or a wireless access network (such as a mobile cellular network) provided by an operator, Wide Area Network (Wide Area Network, WAN), the Internet, or a combination thereof.
  • LAN Local Area Network
  • WAN Wide Area Network
  • the client-side computing device 101 may further include one or more user-side servers; for example, the device 5 shown in FIG. 1 . At least part of the computing devices in the client-side terminal device 101 can be connected to the user-side server, and the user-side server can be further connected to the above-mentioned server 102; for example, the connection between device 1 and device 2 shown in FIG. 1 To the device 5, the device 5 is further connected to the server end 102.
  • the above-mentioned user-side server may be implemented by a service entity that has established a user account system; the above-mentioned service entity may include an operating entity that provides various online and/or offline service carriers for users;
  • the above-mentioned service carrier may include a service carrier in the form of software, and may also include a service carrier in the form of hardware.
  • the above-mentioned service carrier may include various client softwares that provide online Internet services; for example, websites, webpages, APPs, and the like.
  • the above-mentioned service carrier may also include various smart devices deployed offline and capable of providing offline services; for example, smart express cabinets deployed in residential areas, office areas, and public places.
  • the above-mentioned operating entity may include the operator corresponding to the above-mentioned service carrier; for example, the above-mentioned operating entity may include individuals, organizations, companies, enterprises, etc. that operate and manage the above-mentioned service carrier.
  • the server end 102 can also be connected to one or more blockchain systems through various communication networks; for example, the server end 102 shown in FIG. Block chain system 104 and block chain system 105, and so on.
  • each blockchain system can maintain one or more blockchains (for example, public blockchains, private blockchains, consortium blockchains, etc.), and includes a or multiple blockchain nodes of multiple blockchains; for example, blockchain node 1, blockchain node 2, blockchain node 3, blockchain node 4, blockchain Node i, etc. can jointly host one or more blockchains.
  • Cross-chain data access can also be performed between the blockchains contained in each blockchain system and between each blockchain system.
  • blockchain nodes may include full nodes and light nodes.
  • the full node can fully download the blockchain transactions contained in each block in the blockchain, and can perform consensus verification on the blockchain transactions contained in each blockchain according to the blockchain consensus algorithm carried .
  • the light node does not need to download the complete blockchain, but can only download the block header data of each block in the blockchain, and use the data contained in the block header as the verification root to verify the blockchain authenticity of the transaction.
  • Light nodes can attach to full nodes to access more functions of the blockchain.
  • each blockchain node in the blockchain system 103 shown in Figure 1 can be used as a full node; and the device 4 directly connected to the blockchain system shown in Figure 1 can be used as a light node, Attached to each full node in the blockchain system 103.
  • the blockchain node can be a physical device, or a virtual device implemented in a server or a server cluster; for example, a blockchain node device can be a physical host in a server cluster, or it can be It is a virtual machine created after virtualizing the hardware resources carried by a server or server cluster based on virtualization technology.
  • Each blockchain node can be connected together through various types of communication methods (such as TCP/IP) to form a network to carry one or more blockchains.
  • the server end 102 may include a BaaS platform (also referred to as a BaaS cloud) for providing Blockchain as a Service (BaaS, Blockchain as a Service).
  • the BaaS platform can provide a simple way for client-side computing devices connected to the BaaS platform by providing pre-written software for activities that occur on the blockchain (such as subscriptions and notifications, user verification, database management, and remote updates). Easy to use, one-click deployment, fast verification, flexible and customizable blockchain services, which can accelerate the development, testing, and launch of blockchain business applications, and help the implementation of blockchain business application scenarios in various industries.
  • the BaaS platform can provide software such as MQ (Message Queue, message queue) service; the client-side computing device connected to the BaaS platform can subscribe to a block chain system connected to the BaaS platform.
  • MQ Message Queue, message queue
  • a smart contract deployed on a block chain generates contract events on the block chain after the execution is triggered; and the BaaS platform can monitor the events generated by the smart contract on the block chain after the execution is triggered, and then based on the MQ service related
  • the software of the contract adds the contract event to the message queue in the form of a notification message, so that the client side computing device subscribed to the message queue can get the notification related to the above contract event.
  • the BaaS platform can also provide enterprise-level platform services based on blockchain technology to help enterprise-level customers build a safe and stable blockchain environment and easily manage the deployment, operation, and maintenance of blockchain and development.
  • the BaaS platform can implement rich security policies and a multi-tenant isolation environment based on cloud technology, provide advanced security protection based on chip encryption technology, and provide rapid expansion based on highly reliable data storage. End-to-end high-availability services that will not be interrupted; in another example, enhanced management capabilities can be provided to help customers build enterprise-level blockchain network environments; and local Support, support mainstream open source blockchain technologies such as Hyperledger Fabric and Enterprise Ethereum-Quorum to build an open and inclusive technology ecosystem.
  • the device 5 as the client-side computing device 101 provides trusted computing services, and its deployed TEE runs trusted applications that can provide users with trusted computing services, while the server-side 102 includes BaaS
  • the oracle service is provided on the platform, and the oracle service program corresponding to the oracle service runs in the TEE deployed on the server side 102. From another perspective, this is equivalent to the client-side computing device 101 shown in FIG. 1
  • the device 5 directly connected to the server 102 can be regarded as the first trusted computing node involved in this specification, and the server 102 can be regarded as the second trusted computing node running the oracle service program involved in this specification.
  • Fig. 2 is a network architecture diagram shown in this specification according to an exemplary embodiment, the network architecture includes a first trusted computing node, a second trusted computing node and a target block chain, wherein the first trusted computing node may be The second trusted computing node, or the first trusted computing node is different from the second trusted computing node, the first trusted computing node is deployed with a first trusted execution environment, and the first trusted execution environment runs a trusted application, a second trusted execution environment is deployed in the second trusted computing node, and an oracle service program runs in the second trusted execution environment.
  • the target blockchain refers to the blockchain data query request sent by the trusted application. Indicates the blockchain system where the acquired block data is located, including several blockchain nodes.
  • the oracle service program can establish a network with the blockchain node corresponding to a blockchain system (the target blockchain shown in Figure 2)
  • the connection realizes information interaction, and it is also possible to establish network connections with multiple blockchain nodes corresponding to different blockchain systems at the same time to realize information interaction.
  • a communication service program is also running in the first trusted execution environment.
  • the first trusted computing node can realize information interaction through the local call between the communication service program and the trusted application;
  • the oracle service program establishes a network connection to realize information interaction, and when the first trusted computing node and the second trusted computing node are the same hardware node, it can be considered that the first trusted execution environment and the second trusted
  • the execution environment is deployed on the first trusted computing node, that is, the communication service program and the oracle service program run on the same hardware node, so the communication service program and the oracle service program can be directly called locally to realize information interaction without Establishing a network connection, of course, communication can also be performed in the form of establishing a network connection.
  • the second trusted execution environment and the first trusted execution environment may be the same trusted execution environment, or The second trusted execution environment is different from the first trusted execution environment, which is not limited in this specification.
  • the trusted execution environment (TEE) involved in the embodiments of this specification can provide a secure execution environment for software.
  • the TEE is a secure extension based on CPU hardware and is a trusted execution environment completely isolated from the outside.
  • TEE was first proposed by Global Platform to solve the security isolation of resources on mobile devices, and parallel to the operating system to provide applications with a trusted and secure execution environment.
  • Global Platform Global Platform to solve the security isolation of resources on mobile devices, and parallel to the operating system to provide applications with a trusted and secure execution environment.
  • TEE was very concerned about TEE solutions. Almost all mainstream chip and software alliances have their own TEE solutions, such as TPM (Trusted Platform Module) in software and Intel SGX and ARM Trustzone (Trusted Platform Module) in hardware. Trust Zone) and AMD PSP (Platform Security Processor, Platform Security Processor), etc.
  • Trusted computing nodes can create enclaves (enclaves or enclaves) based on SGX technology as TEEs for executing blockchain transactions.
  • the blockchain node uses the newly added processor instructions in the CPU to allocate a part of the EPC (Enclave Page Cache, enclave page cache or enclave page cache) in the memory to reside in the above enclave.
  • the memory area corresponding to the above EPC is encrypted by the memory encryption engine MEE (Memory Encryption Engine) inside the CPU.
  • MEE Memory Encryption Engine
  • the content in the memory area can only be decrypted in the CPU core and is used for encryption and decryption.
  • the key is only generated and stored in the CPU when the EPC starts up.
  • the security boundary of the enclave only includes itself and the CPU, and neither privileged nor non-privileged software can access the enclave, even the operating system administrator and VMM (virtual machine monitor, virtual machine monitor; or called, Hypervisor). It cannot affect the code and data in the enclave, so it has extremely high security, and under the premise of the above security guarantee, the CPU can process the blockchain transactions in plain text in the enclave, which has extremely high computing efficiency. Thus taking into account the data security and computing efficiency.
  • the trusted application involved in the embodiment of this specification refers to the application that runs in the TEE and is implemented using verifiable computing technology.
  • WASM WebAssembly, web page assembly
  • the bytecode is uploaded to the TEE, and the WASM code is invoked by the WASM virtual machine to form a trusted application.
  • the WASM virtual machine further executes the trusted application and obtains the execution result. Since the trusted application runs in the TEE, it can be proved to anyone through the remote authentication process that the trusted application is indeed running in the TEE, and the internal code has not been tampered with, and it is indeed executed according to the user's expectations.
  • Fig. 3 is a flowchart of a method for invoking a trusted computing program shown in this specification according to an exemplary embodiment, the method is applied to the first trusted computing node shown in Fig. 2 , where the first trusted computing node A trusted application runs in the deployed first trusted execution environment, and the method includes the following steps:
  • S301 Obtain a remote authentication report for an oracle service program, where the oracle service program runs in a second trusted execution environment.
  • the communication service program is a trusted application in the first trusted execution environment. Provide a local call interface to realize information interaction with trusted applications.
  • it provides a network interface to the outside world to realize external information interaction.
  • the communication service program and the oracle service program can be realized through this network interface. network communication.
  • the communication service program can also call other programs in the first trusted execution environment, such as a remote authentication report verification program, a digital signature verification program, etc., to realize corresponding functions.
  • the first trusted computing node before the first trusted computing node sends a blockchain data query request to the oracle service program running in the second trusted execution environment, it needs to obtain the remote authentication report for the oracle service program, To ensure that the oracle service program runs in the second trusted execution environment and the corresponding program code has not been tampered with, that is, to ensure that the oracle service program is credible.
  • the first trusted computing node can obtain the remote authentication report for the oracle service program through multiple ways, for example, by sending a remote authentication challenge for the oracle service program to the oracle service program to obtain the remote authentication report, in this
  • the first trusted computing node may receive the remote authentication report sent by the oracle service program and returned by the authentication server after completing the authentication of the self-recommendation information, and the self-recommendation information includes The first hash value corresponding to the program code, and the second hash value corresponding to the public key of the oracle service program; or,
  • the remote authentication report involved in the embodiment of this specification is generated in the remote authentication process for the oracle service program in the second trusted execution environment.
  • the oracle service program receives the remote authentication challenge sent by the first trusted computing node, it responds to the remote authentication challenge and invokes the remote authentication service in the oracle service program to execute the remote authentication process.
  • the oracle service program First, all program codes contained in the oracle service program running in the second trusted execution environment will be extracted. These programs include the network interface program, blockchain interface program, blockchain verification program, etc. in the oracle service program.
  • these program codes are hashed to obtain a program hash value (the first hash value), and similarly, the public key maintained by the oracle service program to indicate the identity of the oracle service program is also obtained by hashing A public key hash value (the second hash value), and finally encapsulate the program hash value and the public key hash value to obtain self-recommendation information.
  • the oracle service program When the self-recommendation information passes the verification of the authentication server, the oracle service program will receive To the remote authentication report provided by the authentication server for the self-recommendation information, the remote authentication report is used to indicate that the oracle service program running in the second trusted execution environment is credible, and the self-recommendation information can further include the public key of the program developer The hash value of the program version number, etc., this manual does not make any restrictions on this.
  • the second trusted execution environment is an enclave created on the second trusted computing node to run the oracle service program, and the remote authentication process also involves another A special enclave, namely quoting enclave (QE for short), QE is an architectural enclave (Architectural Enclave) provided and signed by Intel.
  • QE quoting enclave
  • Intel architectural Enclave
  • the enclave running the oracle service program first needs to generate a REPORT (report) structure for local authentication, and QE verifies whether the enclave is on the same platform as itself based on the REPORT structure, and then QE combines the REPORT structure with the program
  • the hash value and the public key hash value are encapsulated into a structure QUOTE (that is, self-recommended information), and signed using the EPID (enhanced privacy identification) key.
  • the EPID key not only represents the platform of private computing nodes under the chain, but also represents the credibility of the underlying hardware of the second trusted computing node. It can also bind information such as the version of the processor firmware, and only QE can access the EPID key.
  • the above-mentioned authentication server can be an IAS (Intel Attestation Service) server provided by Intel Corporation.
  • the oracle service program sends the signed QUOTE structure to the IAS server, so that the IAS server can verify the signature and send The oracle service program returns the corresponding remote authentication report.
  • the oracle service program After the oracle service program obtains the remote authentication report, it can directly send the remote authentication report to the first trusted computing node, thereby assisting the first trusted computing node to obtain the remote authentication report.
  • the first trusted computing node initiates The remote authentication challenge is used to perform remote authentication, thereby assisting the first trusted computing node to obtain the remote authentication report, so as to prove to the first trusted computing node that the oracle service program has not been tampered with and is running in a trusted execution environment, and the oracle service
  • the callee public key maintained by the program is authentic, thereby anchoring trust in the oracle service program to the first trusted computing node, and using the remote authentication report for the oracle service program as a corresponding trust certificate.
  • the oracle service program after obtaining the remote authentication challenge, will only calculate the self-recommendation information in the above manner without sending the self-recommendation information to the authentication server, but first send the self-recommendation information to the first trusted computer node, so that the first trusted computing node completes the subsequent remote authentication process, sends self-recommendation information to the authentication server, and receives the remote authentication report returned by the authentication server after completing the authentication of the self-recommendation information.
  • the first trusted computing node can actively initiate a remote authentication process for the self-recommendation information, so that the first trusted computing node can obtain the latest remote authentication report, thereby enhancing the validity of the proof and the security of the system.
  • the first trusted computing node can also query the remote The authentication report library thus obtains the remote authentication report for the oracle service program.
  • the remote authentication report of the oracle service program and the corresponding update time are pre-stored in the remote authentication report library. Every time the first trusted computing node passes the remote authentication When obtaining the latest remote verification report in a challenge or other form, the remote verification report corresponding to the oracle service program in the remote verification report library will be updated, so that the remote verification report of each oracle service program in the remote verification report library can be obtained in time updated, thereby enhancing the validity of the proof.
  • the determination of the authenticity of the oracle service program according to the remote authentication report involved in the embodiment of this specification specifically includes: after the first trusted computing node obtains the remote authentication report, it authenticates the signature of the remote authentication report with the public key of the authentication server and then confirms that the remote The authentication report is issued by the authentication server, and then read out the program hash value and public key hash value recorded in the authentication report, and compare it with the program standard hash value and public key stored in the first trusted computing node. Compared with the standard hash value, if the program hash value is consistent with the program standard hash value, it can be proved that the oracle service program in the trusted computing node has not been tampered with and is running in the second trusted execution environment.
  • the public key If the public key If the hash value is consistent with the standard hash value of the public key, it can prove that the public key corresponding to the oracle service program held by the first trusted computing node is indeed a public key that can indicate the true identity of the oracle service program. If the comparisons are consistent, it can be determined that the oracle service program is credible.
  • the standard hash value of the program is obtained by hashing all the program codes in the public oracle service program, and the standard hash value of the public key is obtained through the It is considered that the public key corresponding to the oracle service program is obtained after hashing.
  • the hashing function for calculating the standard hash value of the program is consistent with the hashing function for calculating the hash value of the program.
  • the hash operation function of the standard hash value of the public key is consistent with the hash operation function used to calculate the hash value of the public key.
  • the first trusted computing node locally pre-stores the remote authentication report for the oracle service program, so the first trusted computing node can execute the corresponding remote authentication report verification in the first trusted execution environment at any time program to verify whether the remote authentication report indicates that the oracle service program is credible. For example, the first trusted computing node can verify the remote authentication report in advance so as to save the verification result.
  • a trusted application When a trusted application generates a blockchain data query requirement, it will actively initiate a blockchain data query request to the communication service program.
  • the request includes the blockchain domain name, block hash and transaction hash, etc.
  • the description information of the block data is required.
  • the communication service program After receiving the request, the communication service program will first check whether there is a remote authentication report for the oracle service program locally. In the case of a remote authentication report, the remote authentication report verification program will be called to verify the remote authentication report. If the verification result is untrustworthy, the blockchain data query request sent by the trusted application will be temporarily cached. And continue to search whether there are remote authentication reports of other oracle service programs locally.
  • the first trusted computing node It will use the communication service program to initiate a remote authentication report to the trusted computing node where one or more oracle service programs with public IP addresses are located to obtain the relevant remote authentication report, and then continue to verify it through the remote authentication report verification program. Verification, until the verification result of a certain remote certification report is credible, it can be determined that the oracle service program corresponding to the remote certification report is credible, and at this time the first trusted computing node can send the blockchain data The query request is sent to the trusted oracle service program through the communication service program.
  • the first node device does not find any trusted oracle service program after going through the above process, it will return the blockchain data query request sent by the trusted application through the communication service program, and inform the trusted application
  • the corresponding error code is used to remind the user corresponding to the trusted application that currently lacks a trusted agency (oracle service program), so the blockchain data query service cannot be completed.
  • the oracle service program When the oracle service program receives the blockchain data query request sent by the first trusted computing node, it will parse the blockchain domain name, block hash and transaction hash from the request to point to the specific required The description information of the block data, and then determine the address of the block data according to the above description information.
  • the oracle service program may maintain a network connection with the corresponding block chain nodes in one or more block chain systems, so as to Different blockchain systems are labeled with different blockchain domain names, and maintain the corresponding relationship between the blockchain domain name and the network address such as the IP address and port number of the blockchain node corresponding to the corresponding blockchain system, so the oracle service
  • the program can determine which blockchain system the required block data is in through the blockchain domain name, and use the determined blockchain system as the target blockchain, that is, the target blockchain involved in this manual refers specifically to The blockchain system pointed to by the blockchain domain name contained in the blockchain data query request.
  • the block hash can be used to determine which block the required block data is in on the target blockchain, and the determined block can be used as the target block, and finally the required block can be determined through the transaction hash
  • the data specifically corresponds to which transaction data on the target block.
  • the block data involved in this specification may include transaction data on the block, or other data on the block such as transaction receipt data, block header data, etc. This specification does not make any restrictions on this.
  • the oracle service program involved in this manual has the ability to access the blockchain system. Therefore, the oracle server can continuously access multiple blockchain systems to obtain block data on each blockchain system in advance. After the block chain system generates a new block, it will trigger the proxy block chain node in any block chain system that has established a network connection with the oracle service program to provide the updated information of the block to the oracle service program, and then , the oracle service program can obtain the latest added block by calling the blockchain data access interface provided by the proxy blockchain node, so that the complete area of any blockchain system can be maintained locally in the oracle service program block data.
  • the oracle service program when the oracle service program receives the blockchain data query request and determines that the target blockchain is obtained, it will check whether each block on the local pre-stored corresponding to the target blockchain contains a block The block data corresponding to the block hash in the chain data query request and the transaction hash, the block data is obtained under the condition that the block data is pre-stored locally.
  • the oracle service program can pass The complete block data on the target block chain is stored in advance, so that when a block chain data query request is received, the block data corresponding to the block chain data query request can be directly obtained without accessing the target block chain.
  • the oracle service program when the oracle service program receives the block chain data query request and determines to obtain the target block chain, it will access the target block chain in real time to obtain the corresponding block data.
  • the oracle service program does not need to pre-store the complete block data of the target blockchain, thus reducing the storage burden on the device, and even if the oracle service program pre-stores the complete block data of the target blockchain, Since the oracle service program may not be able to update the blocks of the target blockchain in a timely manner, there may be block data corresponding to the blockchain data query request that cannot be queried locally but is indeed in the latest block of the target blockchain Therefore, when receiving the blockchain data query request, accessing the target blockchain in real time can also ensure that the latest block data on the target blockchain can be obtained, avoiding the oracle service program due to Failure to update the complete block data on the local pre-stored target blockchain in time may lead to the possibility of failure to obtain block data.
  • the oracle service program can obtain the block data by calling the blockchain data access interface provided by the blockchain node corresponding to the target blockchain, wherein the oracle service program is established with
  • the blockchain node corresponding to any blockchain system that is connected to the network and can be accessed by the oracle service program is used as the proxy blockchain node corresponding to the target blockchain, and will have a trust relationship with the oracle service program in advance. That is, the proxy blockchain node obtains and verifies the remote authentication report for the oracle service program in advance to confirm that the oracle service program is credible.
  • the corresponding verification process is the same as the verification method for the remote authentication report described above, and will not be repeated here. .
  • the proxy blockchain node can provide a blockchain data access interface that only allows the oracle service program to access when it is determined that the oracle service program is credible, and the oracle service program can access the proxy area safely and barrier-free through this interface
  • the database information on the blockchain node includes all the blocks stored and maintained on the proxy blockchain node, the contract code and contract status of each smart contract, etc.
  • the oracle service program can also initiate a block data acquisition transaction to the oracle contract on the target blockchain, and monitor the block data acquisition transaction generated by the oracle contract.
  • the block data acquisition event contained in the receipt acquires the block data.
  • the corresponding block data can be obtained by initiating a cross-chain transaction to the target blockchain and monitoring events.
  • the oracle service program can pass the proxy blockchain node on the target blockchain Initiate a block data acquisition transaction to the oracle contract on the target blockchain, the transaction contains block hash and transaction hash, so that the oracle contract executes the transaction, and obtains the block hash contained in the transaction
  • the transaction data pointed to by Xihe transaction hash is written into the block data acquisition event contained in the transaction receipt, and the oracle service program obtains the block by further listening to the proxy block chain node on the target block chain
  • the data captures the receipt of the transaction and reads the required transaction data from the receipt.
  • the behavior of accessing block data can be stored on the target block chain to ensure the process of obtaining block data Transparent and traceable, the subsequent first trusted computing node can also verify whether the block data acquisition transaction is executed on the target block chain through a third party, so as to ensure that the obtained block data does come from the target block chain and improve the system security.
  • S303 Receive the block data returned by the oracle service program and the digital signature corresponding to the block data, and if the digital signature is successfully verified by the public key corresponding to the oracle service program , returning the block data to the trusted application.
  • the oracle service program After the oracle service program obtains the block data on the target blockchain in response to the blockchain data query request, it will first perform a hash operation on the block data to obtain the block data hash, and then use the oracle service
  • the private key maintained by the program itself to indicate the true identity of the oracle service program signs the hash of the block data to obtain the digital signature corresponding to the block data, and finally returns the obtained block data and the corresponding digital signature To the communication service program in the first trusted computing node.
  • the communication service program After the communication service program receives the block data returned by the oracle service program and the digital signature corresponding to the block data, it will call the digital signature verification program in the first trusted execution environment to verify the digital signature, specifically
  • the communication service program takes the block data and the corresponding digital signature as input parameters to the digital signature verification program, and the digital signature verification program performs hash operation on the received block data to obtain the standard block data hash, and then uses The previously verified public key that can indicate the true identity of the oracle service program decrypts the digital signature to obtain the block data hash to be verified, and compares the block data hash to be verified with the standard block data hash.
  • the communication service program determines that the block data is indeed from the verified
  • the trusted oracle service program returns the block data, and returns the block data to the trusted application as the callback result of the previous blockchain data query request sent by the trusted application.
  • the first trusted computing node anchors the trust in the oracle service program by obtaining the remote authentication report for the oracle service program
  • the trusted application running in the first trusted execution environment deployed by the first trusted computing node can securely access and acquire block data on the blockchain by means of a trusted oracle service program.
  • the block data and the digital signature corresponding to the block data are returned by the oracle service program when the authenticity verification of the block data is successful.
  • the oracle service program After the oracle service program obtains the block data, it will further verify the authenticity of the block data, and only when the authenticity verification is successful will the block data be signed, and the block data and the corresponding The digital signature is returned to the communication service program in the first trusted computing node.
  • the oracle service program needs to verify the authenticity of the obtained block data, and will return to the first trusted computing node only when the verification is successful, so that the block data obtained by the oracle service program can be guaranteed
  • the source of the block data is credible and has not been tampered with, so that the first trusted computing node does not need to repeatedly verify the authenticity of the block data at the block level (because the first trusted computing node is verifying In the remote authentication report, it can be determined that the oracle service program contains the code segment of the block chain verification program that verifies the block data), and only needs to verify the digital signature corresponding to the block data, and after the verification is successful, due to It can ensure that the block data comes from a trusted oracle service program, so it can be directly sent back to the trusted application for user use.
  • the verification of the authenticity of the block data is successful, including: the verification result corresponding to the target blockchain locally maintained by the oracle service program indicates that all blocks on the target blockchain are legal And if the verification of the corresponding Merkle roots is successful, it is determined that the authenticity verification of the block data is successful.
  • the oracle service program needs to verify the authenticity of the block data obtained in real time, Specifically, the oracle service program will not only obtain the block data pointed to by the blockchain data query request, but also obtain all the blocks of the target blockchain, so as to maintain all the blocks of the target blockchain locally , and verify the Merkle root and block hash of each block in block order from the genesis block, perform hash operations on all transactions contained in any block to obtain multiple transaction hashes, and follow Recalculate the Merkle root by finding the Merkle root, compare the recalculated Merkle root with the Merkle root recorded in the block header of any block, and explain the transaction on any block if the comparison is consistent It has not been tampered with, so any block is credible, so it is determined that the Merkle root verification of any block is successful, and in the case of inconsistency, it means that the transaction on any block has been tampered with, so any block is not
  • the block is legal, and if the comparison is inconsistent, it means that the block and the blocks after the block are not legal.
  • a verification result will be generated to record the credible part in all the blocks of the target blockchain (at the same time through Merkle root and block hash verification to prove credible and legal block) as the verification result of the target blockchain, the verification result shows that all blocks on the target blockchain are legal and the corresponding Merkle root is If the verification is successful, it is determined that the authenticity verification of the block data is successful.
  • the oracle service program has pre-stored the complete block data corresponding to the target blockchain locally. Block data, so all blocks on the target blockchain can be verified in advance with Merkle root and block hash.
  • the oracle service program can The Merkle root verification of the block is performed in a timely manner, and the block is also used to prove the legitimacy of its corresponding parent block (using the block hash for verification, the method is the same as the above), so that there is a timely update in the local maintenance
  • the verification result of the target blockchain the verification result records the credible part of all blocks in the target blockchain, that is, the oracle service program does not need to verify all the blocks on the target blockchain every time Instead, only newly added blocks are verified each time, which enables the oracle service program to determine whether all blocks on the target blockchain are legal by reading the verification results of the locally maintained target blockchain at any time. And whether the verification of the corresponding Merkle root is successful.
  • the latest block received by the oracle service program proves that its parent block is not legal, it will no longer receive subsequent updated blocks of the blockchain system where the block is located. .
  • the oracle service program can also only pre-store the block headers of all blocks on the target blockchain locally, so that the legitimacy of the block can be pre-proved while retaining the Merkle root verification process.
  • the oracle After the service program determines the block data on the target blockchain according to the blockchain data query request, it needs to request the block data from the target blockchain.
  • the target blockchain can only request the target blockchain to obtain the block (according to the block hash carried in the block chain data query request) instead of all blocks on the target block chain, after obtaining the block, determine the block data as transaction data according to the transaction hash,
  • Merkle root verification is performed on the acquired block, and the Merkle root obtained by recalculation is not only compared with the Merkle root recorded on the block header of the acquired block, but also with the block header of the block where the locally maintained block data is located. Compare the Merkle root recorded above, and if the comparison is consistent, it is determined that the obtained block data conforms to the block header of the target blockchain maintained locally as a trust certificate, that is, it can be determined that the block data has not been tampered with.
  • the oracle service program can also pre-store the transaction hashes of all blocks on the target blockchain. Specifically, after obtaining the complete block data corresponding to the target blockchain, each of them The transaction hash calculated by the transaction is saved according to the order between the blocks and the order in the block (that is, the execution order of the transaction). After the verification of the Merkle root and the block hash is completed and the verification result is maintained locally , the block body part of all blocks can be deleted locally, so that after the oracle service program determines the block data on the target blockchain according to the blockchain data query request, it only sends Just request the block data itself. This is because all the verification processes at the block level have been completed in advance and the verification results maintained locally are used as certificates.
  • the oracle service program only needs to check the verification results and the obtained block data. Perform a hash operation, and the verification result can show that all blocks on the target blockchain are legal and the corresponding Merkle roots are verified successfully, and the received block data provided by the target blockchain is obtained by hashing
  • the hash value of the block chain data query request is consistent with the transaction hash contained in the block chain data query request, it can be determined that the authenticity verification of the block data is successful.
  • the verification of the authenticity of the block data must be confirmed only when all blocks on the target block chain are legal and the corresponding Merkle roots are successfully verified.
  • This strict verification method can maximize This guarantees the legitimacy and credibility of the block data source.
  • the verification result corresponding to the target blockchain maintained locally by the oracle service program indicates that the block where the block data is located is legal and the corresponding Merkle root verification is successful
  • Quantitative verification methods can reduce the calculation cost and time cost of verifying all blocks as much as possible on the premise of ensuring the legitimacy and credibility of block data sources, improve verification efficiency and obtain block data. Success rate.
  • the sending the blockchain data query request to the oracle service program includes: using the public key corresponding to the oracle service program to encrypt the blockchain data query request to obtain a blockchain A data query request ciphertext; sending the block chain data query request ciphertext to the oracle service program.
  • the encrypted channel between the first trusted computing node and the oracle service program is realized by using asymmetric encryption, so that only the oracle service program can decrypt and obtain the zone sent by the first trusted computing node.
  • Block chain data query request so as to ensure the privacy of the process of obtaining block chain data.
  • the public key corresponding to the oracle service program used here can be the public key that has been verified through the remote authentication report and can indicate the real identity of the oracle service program, or it can be other public keys used to indicate the real identity of the oracle service program. It is necessary to ensure that the private key corresponding to the public key used to encrypt the blockchain data query request is indeed held by the oracle service program. Therefore, when the oracle service program receives the blockchain data query request key After the text, you can use the private key you maintain to decrypt the ciphertext of the blockchain data query request to get the corresponding blockchain data query request.
  • the blockchain data query request includes a public key corresponding to the first trusted computing node, and receiving the block data returned by the oracle service program and the digital signature corresponding to the block data , including: receiving the block data ciphertext and the digital signature ciphertext returned by the oracle service program, and using the private key of the first trusted computing node to decrypt the block data ciphertext and the digital signature ciphertext respectively Obtain the block data and the digital signature corresponding to the block data; wherein, the block data ciphertext and the digital signature ciphertext are respectively used by the oracle service program using the public key of the first trusted computing node Obtained after encrypting the block data and the digital signature corresponding to the block data.
  • the encrypted channel between the first trusted computing node and the oracle service program is realized by using asymmetric encryption, so that only the communication service program on the first trusted computing node can decrypt to obtain the oracle The block data sent by the service program and the corresponding digital signature, thus ensuring the privacy of the process of obtaining the block chain data.
  • the subsequent oracle service program prepares to return the block to the first trusted computing node
  • the public key contained in the blockchain data query request can be used to encrypt, so that the encrypted block data ciphertext and digital signature ciphertext are sent to the communication service program on the first trusted computing node , so that the communication service program uses the private key maintained by itself to decrypt and obtain the corresponding block data and digital signature.
  • the first trusted computing node maintains parsing plug-ins corresponding to each blockchain type, and the returning the block data to the trusted application includes: according to the zone of the target blockchain
  • the parsing plug-in corresponding to the block chain type parses the block data, and returns the parsed block data to the trusted application. Since the data structure and form definitions of the blocks corresponding to different types of blockchains are quite different, for example, the transaction format of the blockchain based on UXTO (Unspent Transaction Output) is different from that of the blockchain based on Ethereum. are not the same, so different parsing methods need to be adopted according to different versions and types of obtained blocks to obtain the available data in the data part.
  • UXTO Unspent Transaction Output
  • the analysis plug-ins corresponding to various blockchain types are maintained on the first trusted computing node, the obtained block data corresponding to each blockchain type can be correctly analyzed and processed. In this way, the parsed block data that can be recognized by trusted applications is obtained, so that optional applications running off-chain can access the on-chain data on various heterogeneous chains in a credible and compatible manner.
  • the trusted application runs in a virtual machine encapsulated in the first trusted execution environment, and the virtual machine includes: a virtual machine based on a stack structure of binary operation instructions.
  • the trusted application running in the first trusted execution environment actually runs in a virtual machine encapsulated in the first trusted execution environment, and the virtual machine includes a WASM virtual machine.
  • the WASM virtual machine involved in the embodiment of this specification is a virtual machine with a stack structure based on binary operation instructions, and only supports running program code written in WASM language.
  • WASM language is another language other than JavaScript that can run on web pages.
  • WASM can run in modern web browsers. It belongs to a low-level assembly-like code with a compact binary format and can directly operate CPU instruction codes, such as x86 instructions.
  • the assembly code on the set has instruction sets, registers, stacks, etc., so it can run with near-native performance, and provides a compilation target for high-level languages such as C/C+, so that these high-level languages can run on browsers.
  • the WASM language is designed to coexist with JavaScript, so the two can run concurrently and are compatible with each other.
  • Fig. 4 is an interactive flowchart of a method for obtaining blockchain data provided by this specification according to an exemplary embodiment. Please refer to Fig. 4.
  • the scheme for obtaining blockchain data involved in this specification can be based on the first trusted computing Nodes, the second trusted computing node and the blockchain node are realized through cooperation, wherein the blockchain node belongs to the target blockchain, and the method may include the following steps: S401: the trusted computing node in the first trusted computing node
  • the letter application constructs a blockchain data query request, wherein the blockchain domain name, block hash and transaction hash contained in the blockchain data query request.
  • the trusted application sends a blockchain data query request to the communication service program in the first trusted computing node, and the communication service program caches the received blockchain data query request, and sends the request to the oracle machine in the second trusted computing node
  • the server program issues a remote authentication challenge.
  • S403 The oracle service program randomly generates and maintains a public-private key pair in response to the remote authentication challenge, and performs hash operations on its own program code and the generated public key to obtain the program hash value and public key hash value Then use your own CPU private key to sign to get the program hash signature and public key hash signature. Finally, the program hash value, public key hash value, program hash signature and public key hash signature are encapsulated to get self-recommendation information and sent to IAS server, so that the IAS server can receive the remote authentication report returned by the IAS server after the authentication is completed.
  • S404 The oracle service program returns the obtained remote authentication report for the oracle service program and the generated public key to the communication service program in the first trusted computing node.
  • the communication service program invokes the remote authentication report verification program in the first trusted execution environment to verify the received verification report, and first uses the public key of the IAS server to verify the signature of the remote authentication report, and then confirms the remote authentication report If it is indeed issued by the IAS server, check the authentication result recorded by it.
  • the authentication result shows that the oracle service program is indeed running in the second trusted execution environment, then continue to parse the program hash from the self-recommendation information contained in the remote authentication report Value and public key hash value, the hash value calculated in real time by all the program codes of the oracle service program in the public second trusted computing node stored in the database, or directly searched from the network to obtain the second trusted computing node
  • the hash value corresponding to all program codes of the oracle service program in the letter computing node is compared with the program hash value, and at the same time, the hash value calculated from the public key received from the oracle service program is compared with the public key hash If the two comparison results are consistent, it can be proved that the program code of the oracle service program has not been tampered with and the obtained public key corresponding to the oracle service program is authentic, that is, Prove that the oracle service program is trustworthy.
  • S406 The communication service program in the first trusted computing node sends the cached blockchain data query request to the oracle service program in the second trusted computing node.
  • the oracle service program responds to the blockchain data query request, and parses it to obtain the corresponding blockchain domain name, block hash and transaction hash, and determines the block where the required transaction data is located through the blockchain domain name
  • the chain system is the target blockchain, so as to call the blockchain data access interface of the corresponding blockchain node in the target blockchain known in advance, and initiate a blockchain data access request to the blockchain node.
  • S409 The oracle service program determines and obtains the corresponding blockchain data query request required by the application from all blocks on the target blockchain according to the block hash and transaction hash in the blockchain data query request At the same time, all the blocks received on the target blockchain are verified one by one by Merkle root and block hash, and the verification results corresponding to the target blockchain are generated and maintained locally.
  • S411 The oracle service program returns the transaction data and the digital signature corresponding to the transaction data to the communication service program in the first trusted computing node.
  • the communication service program After the communication service program receives the transaction data returned by the oracle service program and the digital signature corresponding to the transaction data, it will call the digital signature verification program in the first trusted execution environment to verify the digital signature.
  • the digital signature verification program will first The received transaction data is hashed to obtain the standard transaction data hash, and then the digital signature is decrypted using the public key corresponding to the oracle service program that has been proved through the remote authentication report to obtain the transaction data hash to be verified. Verify that the transaction data hash is compared with the standard transaction data hash. If the comparison is consistent, it is determined that the digital signature verification is successful. After receiving the callback result of successful signature verification, the communication service program determines that the transaction data is indeed It is returned from the verified oracle service program, thus trusting the transaction data.
  • the communication service program uses the corresponding parsing plug-in to parse the transaction data according to the block chain type to obtain the parsed transaction data, and returns the parsed transaction data to the trusted application as the area sent by the trusted application.
  • the first trusted computing node anchors the trust relationship of the oracle service program by obtaining the remote authentication report for the oracle service program, so that the first trusted computing node obtains the remote authentication report through the oracle service program.
  • this specification also provides embodiments of apparatuses, electronic equipment, and storage media.
  • Fig. 5 is a schematic structural diagram of a device provided by an exemplary embodiment.
  • the device includes a processor 502 , an internal bus 504 , a network interface 506 , a memory 508 and a non-volatile memory 510 , and of course it may also include hardware required by other services.
  • the processor 502 reads a corresponding computer program from the non-volatile memory 510 into the memory 508 and executes it.
  • one or more embodiments of this specification do not exclude other implementations, such as logic devices or a combination of software and hardware, etc., that is to say, the execution subject of the following processing flow is not limited to each A logic unit, which can also be a hardware or logic device.
  • Figure 6 is a block diagram of a device for acquiring blockchain data according to an exemplary embodiment of this specification, which can be applied to the device shown in Figure 5 to implement the technology of this specification solution, the device is applied to a first trusted computing node, and a trusted application runs in the first trusted execution environment deployed by the first trusted computing node, and the device includes: a report obtaining unit 601, configured to obtain the The remote authentication report of the oracle service program, the oracle service program runs in the second trusted execution environment; the request sending unit 602 is configured to determine that the oracle service program is credible according to the remote authentication report, Sending the block chain data query request obtained from the trusted application to the oracle service program, so that the oracle service program responds to the block chain data query request to obtain the data on the target block chain block data; a data receiving unit 603, configured to receive the block data returned by the oracle service program and the digital signature corresponding to the block data, and pass the public key corresponding to the oracle service program to the If the verification
  • the blockchain data query request includes a blockchain domain name and a transaction hash
  • the target blockchain is determined by the blockchain domain name in the blockchain data query request
  • the Block data on the target blockchain is determined by the transaction hash in the blockchain data query request.
  • the block data on the target block chain is obtained from the target block chain in real time by the oracle service program, or the block data is obtained from the target block chain in advance by the oracle service program Obtain.
  • the oracle service program in the request sending unit 602 to obtain the block data includes:
  • the oracle service program obtains the block data by calling the blockchain data access interface provided by the blockchain node corresponding to the target blockchain;
  • the oracle contract on the block chain initiates a block data acquisition transaction, and monitors the block data acquisition event contained in the receipt of the block data acquisition transaction generated by the oracle contract to acquire the block data.
  • the block data and the digital signature corresponding to the block data are returned by the oracle service program when the authenticity verification of the block data is successful.
  • the verification of the authenticity of the block data is successful, including: the verification result corresponding to the target blockchain locally maintained by the oracle service program indicates that all blocks on the target blockchain are legal And if the verification of the corresponding Merkle roots is successful, it is determined that the authenticity verification of the block data is successful.
  • the request sending unit 602 sends the blockchain data query request to the oracle service program, including: using the public key corresponding to the oracle service program to encrypt the blockchain data query request Obtaining the ciphertext of the blockchain data query request; sending the ciphertext of the blockchain data query request to the oracle service program.
  • the blockchain data query request includes a public key corresponding to the first trusted computing node
  • the data receiving unit 603 receives the block data returned by the oracle service program and the block data
  • the corresponding digital signature includes: receiving the block data ciphertext and the digital signature ciphertext returned by the oracle service program, and using the private key of the first trusted computing node to respectively write the block data ciphertext and the digital signature Decrypting the signature ciphertext to obtain the block data and the digital signature corresponding to the block data; wherein, the block data ciphertext and the digital signature ciphertext are used by the oracle service program using the first trusted computing
  • the node public key is obtained after encrypting the block data and the digital signature corresponding to the block data respectively.
  • the first trusted computing node maintains parsing plug-ins corresponding to each blockchain type, and the data receiving unit 603 returns the block data to the trusted application, including: The parsing plug-in corresponding to the block chain type of the block chain parses the block data, and returns the parsed block data to the trusted application.
  • the trusted application runs in a virtual machine encapsulated in the first trusted execution environment, and the virtual machine includes: a virtual machine based on a stack structure of binary operation instructions.
  • the second trusted execution environment is deployed on a second trusted computing node; or, the second trusted execution environment is deployed on a first trusted computing node; wherein, the second trusted execution environment The same trusted execution environment as the first trusted execution environment, or the second trusted execution environment is different from the first trusted execution environment.
  • the report obtaining unit 601 is specifically configured to: receive the remote authentication report for the oracle service program sent by the oracle service program and returned by the authentication server after completing the authentication of the self-recommendation information,
  • the self-recommendation information includes the first hash value corresponding to the program code of the oracle service program, and the second hash value corresponding to the public key of the oracle service program; or, receiving the message sent by the oracle service program the self-recommendation information, send the self-recommendation information to the authentication server, and receive the remote authentication report for the oracle service program returned by the authentication server after completing the authentication of the self-recommendation information.
  • the request sending unit 602 can determine that the oracle service program is credible:
  • the first hash value in the self-recommendation information is consistent with the third hash value
  • the second hash value in the self-recommendation information is consistent with the fourth hash value
  • the third hash value It is obtained by performing a hash operation on the program code contained in the disclosed oracle service program
  • the fourth hash value is obtained by the corresponding to the oracle currently held by the first trusted computing node
  • the public key of the service program is obtained after performing a hash operation.
  • this specification also provides a device, the device includes a processor; a memory for storing processor-executable instructions; wherein the processor is configured to implement the credible implementation provided by all the above method embodiments. Calculation method steps.
  • this specification also provides a computer-readable storage medium on which executable instructions are stored; wherein, when the instructions are executed by a processor, the steps for implementing the trusted computing method provided by all the above method embodiments are implemented.
  • the device embodiment since it basically corresponds to the method embodiment, for related parts, please refer to the part description of the method embodiment.
  • the device embodiments described above are only illustrative, and the modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical modules, that is, they may be located in One place, or it can be distributed to multiple network modules. Part or all of the modules can be selected according to actual needs to achieve the purpose of the solution in this specification. It can be understood and implemented by those skilled in the art without creative effort.
  • a typical implementing device is a computer, which may take the form of a personal computer, laptop computer, cellular phone, camera phone, smart phone, personal digital assistant, media player, navigation device, e-mail device, game control device, etc. desktops, tablets, wearables, or any combination of these.
  • a computer includes one or more processors (CPUs), input/output interfaces, network interfaces and memory.
  • processors CPUs
  • input/output interfaces network interfaces
  • memory volatile and non-volatile memory
  • Memory may include non-permanent storage in computer-readable media, in the form of random access memory (RAM) and/or nonvolatile memory such as read-only memory (ROM) or flash RAM. Memory is an example of computer readable media.
  • RAM random access memory
  • ROM read-only memory
  • flash RAM flash random access memory
  • Computer-readable media including both permanent and non-permanent, removable and non-removable media, can be implemented by any method or technology for storage of information.
  • Information may be computer readable instructions, data structures, modules of a program, or other data.
  • Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory (ROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Flash memory or other memory technology, Compact Disc Read-Only Memory (CD-ROM), Digital Versatile Disc (DVD) or other optical storage, Magnetic cassettes, disk storage, quantum memory, graphene-based storage media or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by computing devices.
  • computer-readable media excludes transitory computer-readable media, such as modulated data signals and carrier waves.
  • first, second, third, etc. may be used in one or more embodiments of the present specification to describe various information, the information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of one or more embodiments of this specification, first information may also be called second information, and similarly, second information may also be called first information. Depending on the context, the word “if” as used herein may be interpreted as “at” or "when” or "in response to a determination.”

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • General Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • Health & Medical Sciences (AREA)
  • Automation & Control Theory (AREA)
  • Databases & Information Systems (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

Un ou plusieurs des modes de réalisation de la présente invention concernent un procédé et un appareil d'acquisition de données de chaîne de blocs, un dispositif électronique et un support de stockage. Le procédé est appliqué à un premier nœud informatique de confiance, et une application de confiance s'exécute dans un premier environnement d'exécution de confiance (TEE) déployé par le premier nœud informatique de confiance. Le procédé consiste : à acquérir un bilan d'authentification à distance d'un programme de service automatique Oracle, le programme de service automatique Oracle s'exécutant dans un second TEE ; lorsqu'il est déterminé en fonction du bilan d'authentification à distance que le programme de service automatique Oracle est digne de confiance, à envoyer une requête d'interrogation de données de chaîne de blocs acquise d'une application de confiance au programme de service automatique Oracle, de telle sorte que le programme de service automatique Oracle acquière des données de bloc sur une chaîne de blocs cible en réponse à la requête d'interrogation des données de chaîne de blocs ; et à recevoir des données de bloc renvoyées par le programme de service automatique Oracle et une signature numérique correspondant aux données de bloc, et à renvoyer les données de bloc à l'application de confiance lorsque la signature numérique est vérifiée avec succès au moyen d'une clé publique correspondant au programme de service automatique Oracle.
PCT/CN2021/133167 2021-05-11 2021-11-25 Procédé et appareil d'acquisition de données de chaîne de blocs, dispositif électronique et support de stockage WO2022237123A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110513055.2 2021-05-11
CN202110513055.2A CN113221166A (zh) 2021-05-11 2021-05-11 一种获取区块链数据的方法、装置、电子设备及存储介质

Publications (1)

Publication Number Publication Date
WO2022237123A1 true WO2022237123A1 (fr) 2022-11-17

Family

ID=77094741

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/133167 WO2022237123A1 (fr) 2021-05-11 2021-11-25 Procédé et appareil d'acquisition de données de chaîne de blocs, dispositif électronique et support de stockage

Country Status (2)

Country Link
CN (1) CN113221166A (fr)
WO (1) WO2022237123A1 (fr)

Families Citing this family (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113221166A (zh) * 2021-05-11 2021-08-06 支付宝(杭州)信息技术有限公司 一种获取区块链数据的方法、装置、电子设备及存储介质
CN113472544B (zh) * 2021-08-31 2021-12-14 北京微芯感知科技有限公司 一种数字身份验证方法、装置、计算机设备和存储介质
CN113901498B (zh) * 2021-10-15 2023-12-26 北京智融云河科技有限公司 一种数据共享方法、装置、设备及存储介质
CN114172689B (zh) * 2021-11-11 2023-11-28 卓尔智联(武汉)研究院有限公司 一种信息处理方法及设备
CN113836147A (zh) * 2021-11-26 2021-12-24 广东辰宜信息科技有限公司 链标识生成方法及装置、链集群管理方法、***、介质
CN114422215B (zh) * 2021-12-31 2024-06-25 国网安徽省电力有限公司合肥供电公司 一种基于区块链的跨平台和可信能源数据共享***及方法
CN114338054B (zh) * 2022-03-17 2022-06-07 北京笔新互联网科技有限公司 区块链可信数据传输、验证和获取方法及装置
US20230421570A1 (en) * 2022-06-27 2023-12-28 Unstoppable Domains, Inc. Accessing data on a blockchain with proof of data verification
CN117251883B (zh) * 2023-11-02 2024-06-04 中国南方电网有限责任公司 数据可靠性验证方法、装置、计算机设备和存储介质
CN117579331A (zh) * 2023-11-15 2024-02-20 北京火山引擎科技有限公司 远程证明方法、装置、电子设备及存储介质
CN117728961B (zh) * 2024-02-07 2024-05-28 成都信息工程大学 一种区块链中可信时间服务预言机的方法和***

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109670335A (zh) * 2018-12-20 2019-04-23 众安信息技术服务有限公司 用于在区块链与链外数据之间进行交互的方法及装置
CN109981679A (zh) * 2019-04-08 2019-07-05 上海点融信息科技有限责任公司 在区块链网络中执行事务的方法和装置
CN110598469A (zh) * 2019-09-11 2019-12-20 腾讯科技（深圳）有限公司 一种信息处理方法、装置以及计算机存储介质
CN111429254A (zh) * 2020-03-19 2020-07-17 腾讯科技（深圳）有限公司 一种业务数据处理方法、设备以及可读存储介质
CN113221166A (zh) * 2021-05-11 2021-08-06 支付宝(杭州)信息技术有限公司 一种获取区块链数据的方法、装置、电子设备及存储介质

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
AU2019204707B2 (en) * 2019-03-26 2020-10-01 Advanced New Technologies Co., Ltd. Program execution and data proof scheme using multiple key pair signatures
CN112329041B (zh) * 2020-03-18 2024-01-23 支付宝(杭州)信息技术有限公司 部署合约的方法及装置
CN111090874B (zh) * 2020-03-18 2020-09-01 支付宝(杭州)信息技术有限公司 调用合约的方法及装置
CN111047450A (zh) * 2020-03-18 2020-04-21 支付宝(杭州)信息技术有限公司 链上数据的链下隐私计算方法及装置
CN111092914B (zh) * 2020-03-18 2020-06-26 支付宝(杭州)信息技术有限公司 访问外部数据的方法及装置
CN112711774B (zh) * 2021-03-25 2023-01-10 腾讯科技（深圳）有限公司 数据处理方法、装置、设备及存储介质

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109670335A (zh) * 2018-12-20 2019-04-23 众安信息技术服务有限公司 用于在区块链与链外数据之间进行交互的方法及装置
CN109981679A (zh) * 2019-04-08 2019-07-05 上海点融信息科技有限责任公司 在区块链网络中执行事务的方法和装置
CN110598469A (zh) * 2019-09-11 2019-12-20 腾讯科技（深圳）有限公司 一种信息处理方法、装置以及计算机存储介质
CN111429254A (zh) * 2020-03-19 2020-07-17 腾讯科技（深圳）有限公司 一种业务数据处理方法、设备以及可读存储介质
CN113221166A (zh) * 2021-05-11 2021-08-06 支付宝(杭州)信息技术有限公司 一种获取区块链数据的方法、装置、电子设备及存储介质

Also Published As

Publication number Publication date
CN113221166A (zh) 2021-08-06

Similar Documents

Publication Publication Date Title
WO2022237123A1 (fr) Procédé et appareil d'acquisition de données de chaîne de blocs, dispositif électronique et support de stockage
US11520912B2 (en) Methods, media, apparatuses and computing devices of user data authorization based on blockchain
US20210328791A1 (en) Blockchain data processing methods and apparatuses based on cloud computing
US10055607B2 (en) Security layer and methods for protecting tenant data in a cloud-mediated computing network
CN108369622B (zh) 软件容器注册表服务
CN112948810B (zh) 一种可信计算程序调用方法、装置、电子设备及存储介质
US10116645B1 (en) Controlling use of encryption keys
US9584517B1 (en) Transforms within secure execution environments
US8837734B2 (en) Managing encrypted data and encryption keys
US20180020008A1 (en) Secure asynchronous communications
CN112989319B (zh) 一种实现可信计算的方法、装置、电子设备及存储介质
US11496302B2 (en) Securely processing secret values in application configurations
US11509636B2 (en) User and device onboarding
US10255089B2 (en) Self-deleting virtual machines
US11489660B2 (en) Re-encrypting data on a hash chain
GB2514550A (en) System and method for providing access to a resource for a computer from within a restricted network and storage medium storing same
US11455388B1 (en) System and method for end-to-end data trust management with real-time attestation
US12010249B1 (en) Method and device for zero-trust fusion computation of multi-party data
US9948632B2 (en) Sharing data between sandboxed applications with certificates
US20230403138A1 (en) Agentless single sign-on techniques
US12010227B1 (en) System and methods for securing role credentials
CN113849558A (zh) 一种部署数据共享服务的方法和装置
CN114386073A (zh) 创建安全证书方法、装置、电子设备及存储介质
CN114553570A (zh) 生成令牌的方法、装置、电子设备及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21941687

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21941687

Country of ref document: EP

Kind code of ref document: A1