CN112836217B - SGX-based block chain virtual machine method and system for dynamically reducing TCB - Google Patents
SGX-based block chain virtual machine method and system for dynamically reducing TCB Download PDFInfo
- Publication number
- CN112836217B CN112836217B CN202110036603.7A CN202110036603A CN112836217B CN 112836217 B CN112836217 B CN 112836217B CN 202110036603 A CN202110036603 A CN 202110036603A CN 112836217 B CN112836217 B CN 112836217B
- Authority
- CN
- China
- Prior art keywords
- sensitive
- virtual machine
- sgx
- function
- intelligent contract
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 47
- 238000004458 analytical method Methods 0.000 claims abstract description 34
- 230000006870 function Effects 0.000 claims description 79
- 230000008569 process Effects 0.000 claims description 18
- 230000014509 gene expression Effects 0.000 claims description 12
- 230000009467 reduction Effects 0.000 claims description 3
- 239000007787 solid Substances 0.000 claims description 3
- 238000012546 transfer Methods 0.000 claims description 3
- 230000001419 dependent effect Effects 0.000 claims description 2
- 238000005516 engineering process Methods 0.000 abstract description 12
- RTZKZFJDLAIYFH-UHFFFAOYSA-N Diethyl ether Chemical compound CCOCC RTZKZFJDLAIYFH-UHFFFAOYSA-N 0.000 description 4
- 238000012545 processing Methods 0.000 description 4
- 230000005540 biological transmission Effects 0.000 description 3
- 238000013459 approach Methods 0.000 description 2
- 238000007405 data analysis Methods 0.000 description 2
- 238000010586 diagram Methods 0.000 description 2
- 238000003032 molecular docking Methods 0.000 description 2
- 238000011160 research Methods 0.000 description 2
- 238000013500 data storage Methods 0.000 description 1
- 230000007547 defect Effects 0.000 description 1
- 238000013461 design Methods 0.000 description 1
- 238000001514 detection method Methods 0.000 description 1
- 239000000284 extract Substances 0.000 description 1
- 230000036541 health Effects 0.000 description 1
- 230000002452 interceptive effect Effects 0.000 description 1
- 230000007246 mechanism Effects 0.000 description 1
- 238000005457 optimization Methods 0.000 description 1
- 230000000644 propagated effect Effects 0.000 description 1
- 238000012552 review Methods 0.000 description 1
- 230000003068 static effect Effects 0.000 description 1
- 239000000126 substance Substances 0.000 description 1
- 238000012795 verification Methods 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
- G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F8/00—Arrangements for software engineering
- G06F8/40—Transformation of program code
- G06F8/41—Compilation
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Software Systems (AREA)
- General Engineering & Computer Science (AREA)
- Computer Hardware Design (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Stored Programmes (AREA)
Abstract
The invention discloses a block chain virtual machine method and a block chain virtual machine system for dynamically reducing TCB based on SGX, which are used for dynamically reducing TCB and reducing code risk by combining a taint analysis technology, integrating taint analysis into a scheme, automatically positioning sensitive code sentences related to sensitive data in an intelligent contract according to intelligent contract source codes, and acquiring virtual machine operation codes corresponding to the sensitive code sentences. After the sensitive and non-sensitive virtual machine operation codes are obtained, the selection module selects the corresponding C + + function running in the virtual machine according to the sensitive/non-sensitive operation codes. The virtual machine module executes the user request according to the byte code compiled by the intelligent contract, and for the operation code related to the sensitive data, the operation code related to the sensitive data is executed in the trusted execution environment Enclave provided by the SGX, and the operation code not related to the sensitive data is executed outside the Enclave, so that the TCB is reduced.
Description
Technical Field
The invention relates to the technical field, in particular to a block chain virtual machine method and a block chain virtual machine system for dynamically reducing TCB based on SGX.
Background
The Blockchain (Blockchain) originated in Bitcoin (Bitcoin), and as early as 2008, 11.1.s.. This is an open, peer-to-peer distributed network that has not developed in the past decade. The block chain is an application system with computer technologies such as a distributed data storage technology, a point-to-point transmission technology, a consensus mechanism and an encryption algorithm. The individual data blocks are linked together by cryptographic methods to form a chain and form information which can be used for protection against forgery (verification of validity). Each block of data, called a block, contains transactions that have been validated over a period of time, and the chain of blocks is called a block chain.
Within 5 years from 2008 to 2013, the bitcoin network fully proves the feasibility and the safety. However, the bitcoin network still has some limitations, and the user can only use the transaction function of the bitcoin network, but cannot define other contents. Therefore, vialik Buterin published an EtherFang white paper, "A Next-Generation Smart Contract and Decentralized Application Platform", which proposed EtherFang networks to apply block chaining to fields other than currency. Etherum not only has its own virtual currency, etherum, but also allows users to write programs themselves to achieve diversified functions. A user-written program is called an intelligent contract, which is a computer contract implemented in a programmed manner, and the contract will execute correctly according to the written program logic. Therefore, the intelligent contract realizes the functions that the two parties of the user agree to reach an agreement and correctly execute the agreement without a third party. In recent years, ethernet is one of the most commonly used block chain systems because it is a graphics-complete system that can run intelligent contracts. The Etherhouse node executes the intelligent contracts through a simple stack-based architecture, the Etherhouse Virtual Machine (EVM). However, all nodes in the ether house have a full backup of blockchain data, meaning that the data is public, but contains some sensitive data (e.g., financial transactions, personal data, health records). This therefore leads to a leakage of user privacy. The execution of intelligent contracts also lacks privacy because the intelligent contracts running on the etherhouses involve data of the blockchain.
A Trusted Execution Environment (TEE) is a suitable solution, such as the Enclave runtime Environment created by Intel Software Guard Extensions (SGX) provided by Intel. SGX is commonly referred to as Intel Software Guard Extensions, a set of instructions provided by Intel to enhance application code and data security. The envelope in SGX is a specific Trusted Execution Environment (TEE) that provides CPU-based protection for developers to prevent tampering or leakage of data. SGX may prevent external applications or operating systems from interfering with programs running in Enclave. The intelligent contract is operated in the envelope, namely the operation process and the data generated in the operation process can be protected. However, if running the entire intelligent contract program in Enclave would result in a large Trusted Computing Base (TCB), the potential security vulnerabilities would increase as the amount of code increases. Therefore, only code that is related to sensitive data can run in Enclave.
In the prior art, the scheme described in patent CN111010398A provides a block chain data transmission system based on SGX encryption. According to the scheme, the block chain data is encrypted through the SGX, and the confidentiality of the encryption process is guaranteed. The data receiving unit receives user block chain data, the data encryption unit encrypts the data in a trusted execution environment provided by the SGX, the redundancy coding unit performs redundancy coding on the data, and the main control unit transmits the data to the background terminal. According to the scheme, the data is encrypted in the trusted execution environment provided by the SGX, so that the encryption process is protected, and the security of the data is protected. However, execution of the smart contract still runs outside of the trusted execution environment provided by the SGX. This scheme does not guarantee confidentiality of the execution of the intelligent contract. The solution described in CN109660358A proposes a data circulation method based on block chains and secure execution environment. Aiming at the field of data processing, the method ensures the privacy of the data processing process by using a trusted computing environment provided by SGX. The data requiring party provides an intelligent contract using data according to the intelligent contract template; the data provider extracts self data according to the demand file to generate a standard data file; the data executive checks contract feasibility and deploys the contract; the parties sign the contract. The data providing side provides data to the computing nodes protected by the SGX, and the data requiring side executes the deployed intelligent contract to obtain an execution result. The method protects the privacy of intelligent contract execution through the SGX trusted execution environment. However, since this method can only be applied to the data processing domain, it is not possible to run other intelligent contracts written by users in the SGX. There are limitations to this approach. The solution described in patent CN111932249A proposes a data transaction ecosystem based on a block chain. The method constructs a secure data transaction platform, and protects the execution process of the intelligent contract through the SGX. The buyer deploys a data analysis intelligent contract on the platform, the seller sends data through the platform, and the trusted node protected by the SGX analyzes the data provided by the seller by using the intelligent contract deployed by the buyer and returns the result to the buyer. In addition, the scheme also provides a reward module which gives certain reward to the operation of the third party trusted node to execute the intelligent contract. The scheme not only provides an execution process of the SGX protection intelligent contract, but also protects the data privacy of the seller, so that the buyer only obtains the data analysis result and does not obtain the data. However, since in this scheme the intelligent contracts running on trusted nodes protected by SGX can only be used to analyze data, no other intelligent contracts written by the user can be run. This solution has limitations. The patent CN111160905A proposes a method and a device for processing and protecting a user request of a block link node. The method uses an internal private key to verify an access key in a security area provided by the SGX, and processes data requested by a user. This means includes a requester contract, a docking contract, a relay zone and a security zone. The requester contract constructs a request data packet according to a user request; generating a data packet ID according to the data packet content by the docking contract; the relay area verifies the data packet and sends the access key and the data packet to the security area; the secure area uses the internal private key to verify the access key and invokes the data and methods to process the user's request. The scheme ensures that the intelligent contract is executed in the SGX, ensures the confidentiality of execution and can run any legal intelligent contract written by a user. However, running the entire program in SGX may create a large Trusted Computing Base (TCB), and the potential security vulnerabilities may increase as the amount of code increases. This scheme results in a larger TCB, resulting in increased code risk. The patent CN111709745A proposes a block chain transaction security protection system based on SGX and a method thereof. The method protects the confidentiality of the user request of the lightweight client through the SGX execution environment of all nodes. Establishing a trusted encryption channel between the lightweight client and the full-node server; constructing a request by the lightweight client according to the user requirement; the lightweight client sends an encrypted user request to the full-node server; the full-node service side decrypts and processes the user request in a trusted execution environment provided by the SGX. The scheme ensures the confidentiality of the intelligent contract executed by the lightweight client and simultaneously supports any legal intelligent contract written by a user. However, running the entire smart contract in the trusted execution environment provided by SGX results in a larger TCB, and the potential code risk increases as TCBs increase. This approach can result in larger TCBs, thereby increasing code risk.
In a blockchain network, the execution of intelligent contracts requires the disclosure of user data, which results in the disclosure of user privacy. In the existing partial scheme, the intelligent contract of a specific function can only be operated in a trusted execution environment protected by SGX, and the universality is poor. In other prior art schemes, the entire intelligent contract is placed in the trusted execution environment provided by the SGX, which in turn creates a larger TCB, increasing the risk of code.
Disclosure of Invention
The invention aims to make up for the defects of the prior art, and provides a block chain virtual machine method and a block chain virtual machine system for dynamically reducing TCB (traffic channel bus) based on SGX (secure gateway X), aiming at the problems that the confidentiality of an intelligent contract executed by a block chain is poor and the code risk is caused by placing the whole intelligent contract in the SGX. The invention fully utilizes the content of the SGX technology, combines the taint analysis technology, dynamically analyzes the intelligent contract, and only places the code related to the sensitive data in the Enclave for operation.
The invention is realized by the following technical scheme:
a block chain virtual machine method for dynamically reducing TCB based on SGX specifically comprises the following steps:
s1, inputting an intelligent contract source code;
s2, compiling the intelligent contract source code to obtain a byte code sequence;
s3, constructing function sets corresponding to all the virtual machine operation codes;
s4, performing taint analysis on the intelligent contract source code by adopting a taint analysis method to obtain a sensitive operation code set and a non-sensitive operation code set;
s5, selecting corresponding execution functions from the constructed function sets corresponding to all the virtual machine operation codes according to the sensitive operation code set and the non-sensitive operation code set, and sending the execution functions to the virtual machine module;
s6, the virtual machine module runs an execution function corresponding to the sensitive operation code set in the trusted execution environment Enclave provided by the SGX, and executes an execution function corresponding to the non-sensitive operation code set outside the trusted execution environment Enclave.
And S2, compiling the intelligent contract source code by a solid compiler to obtain a byte code sequence.
The function set corresponding to all the virtual machine operation codes in step S3 includes two versions of C + + function sets, that is, the C + + function set running inside the Enclave corresponding to all the virtual machine operation codes
And a set of C + + functions running outside Enclave
Step S4, performing taint analysis on the intelligent contract source code by adopting a taint analysis method to obtain a sensitive operation code set and a non-sensitive operation code set, wherein the taint analysis method specifically comprises the following steps:
marking parameters of each function of the intelligent contract as sensitive, and tracking the transfer process of the sensitive variables by adopting an open source tool Slither; variables dependent on the sensitive variables are also marked as sensitive, an expression using sensitive data is also marked as a sensitive expression, and an operation code of a Solidity compiler expression is given by using an open source tool Slither, so that a sensitive operation code set of the sensitive expression is extracted; since the number of opcodes is fixed, the set of insensitive opcodes is removed to obtain the set of insensitive opcodes.
The specific process of step S5 is as follows:
from the set according to the set of sensitive opcodes
Corresponding C + + function is selected to obtain the selected C + + function set
From the set according to the non-sensitive opcode set
Corresponding C + + function is selected to obtain a selected C + + function set
Respectively assemble
And collections
And transmitting the data to the virtual machine module.
The specific process of step S6 is as follows:
for sensitive operation codes, the virtual machine module runs a C + + function set in an Enclave trusted execution environment provided by SGX
The function of (1); for non-sensitive operation codes, running a C + + function set outside an Enclave trusted execution environment provided by SGX
The function of (1).
A block chain virtual machine system for dynamically reducing TCB based on SGX comprises a identity compiler, a taint analysis module, a selection module in an execution environment and a virtual machine module;
the Solidity compiler compiles an intelligent contract source code to obtain a byte code sequence;
the taint analysis module carries out taint analysis on the intelligent contract source code to obtain a sensitive operation code set and a non-sensitive operation code set;
the selection module selects corresponding execution functions from the constructed function sets corresponding to all the virtual machine operation codes according to the sensitive operation code set and the non-sensitive operation code set and sends the execution functions to the virtual machine module;
the virtual machine module runs an execution function corresponding to the sensitive opcode set inside a trusted execution environment Enclave provided by the SGX, and executes an execution function corresponding to the non-sensitive opcode set outside the trusted execution environment Enclave.
And the execution environment is also provided with a loading and storing module.
The loading and storing module is used for loading the intelligent contract state and storing the intelligent contract new state.
The invention has the advantages that: the invention provides a novel block chain virtual machine technology based on SGX, combines a taint analysis technology, dynamically reduces TCB (trusted security bus), reduces code risk, integrates taint analysis into a scheme, automatically positions sensitive code sentences related to sensitive data in an intelligent contract according to intelligent contract source codes, and obtains virtual machine operation codes corresponding to the sensitive code sentences.
After the sensitive and non-sensitive virtual machine operation codes are obtained, the selection module selects the corresponding C + + function running in the virtual machine according to the sensitive/non-sensitive operation codes. The virtual machine module executes the user request according to the byte code sequence compiled by the intelligent contract, and for the operation code related to the sensitive data, the operation code is executed in the trusted execution environment Enclave provided by the SGX, and the operation code not related to the sensitive data is executed outside the Enclave, so that the TCB is reduced.
Drawings
Fig. 1 is a working principle diagram of the present invention.
Fig. 2 is a general flow diagram of the present invention.
Detailed Description
The invention is mainly divided into three aspects, the first is that the invention integrates the taint analysis technology, analyzes the intelligent contract code and searches the code related to the sensitive data. The operation code related to the sensitive data is dynamically obtained according to the intelligent contract. The second is that the selection module in this scheme selects a function executed by the corresponding virtual machine according to the operation code, that is, selects a sensitive function running in the security area according to the sensitive operation code, and selects a non-sensitive function not running in the security area according to the non-sensitive operation code. The third is that the invention constructs the execution environment of the intelligent contract, namely the virtual machine, and runs the code related to the sensitive data in the trusted execution environment Enclave provided by the SGX, and executes the code not related to the sensitive data outside the Enclave. Therefore, the invention can only place the code related to sensitive data in the trusted execution environment of SGX to run according to the intelligent contract code logic, thereby ensuring the confidentiality of execution and dynamically reducing TCB.
As shown in fig. 1 and 2. Wherein the content of the first and second substances,
and
and the function sets respectively represent the C + + function set which runs inside the Enclave and the C + + function set which runs outside the Enclave and corresponds to all the virtual machine operation codes.
And
and the C + + function sets represent the C + + function sets divided by the selection module, and respectively correspond to the C + + function sets running inside the Enclave and the C + + function sets running outside the Enclave.
Taint analysis is the first part of the protocol. We developed the taint analysis program with the Python API provided by the third-party open source tool Slither. Slither is an intelligent contract static analysis framework proposed in 2019 and can be used for vulnerability detection, code optimization suggestion, code understanding and code review.
The method takes the source code of the intelligent contract as input, and each parameter of each function of the contract depends on a variable controlled by a user and represents the privacy of the user, so that the parameter of each function of the contract is marked as sensitive, and Slither tracks the transfer process of the sensitive variable. Variables that depend on sensitive variables are also marked as sensitive, and expressions that use sensitive data are also marked as sensitive. Thus, this step can obtain all sensitive expressions. Since Slither can give the operation code of the solid expression, the sensitive operation code of the sensitive expression can be extracted. Since the number of opcodes is fixed, this step can also result in insensitive opcodes. Sensitive opcodes and non-sensitive opcodes will be used for the next part of the invention.
A selection module: because the SDKs related to the SGX are all based on the C + + language, the C + + language is also adopted for designing the virtual machine. Therefore, the virtual machine running bytecode is equivalent to the C + + function corresponding to the program execution bytecode. Because of the design principle of SGX, some common C + + Standard libraries (STLs) cannot be used inside Enclave, so that the C + + function running inside Enclave and the C + + function running outside Enclave corresponding to the same bytecode have the same logic, and the code implementation is different. Therefore, for each bytecode, two versions of C + + functions need to be implemented, namely a function version running inside Enclave and a function version running outside Enclave.
The invention realizes two versions of C + + function libraries for all the virtual machine operation codes:
and
respectively representing all virtual machine operation codes corresponding to and running in the EnclaveA set of C + + functions and a set of C + + functions running outside Enclave. The selection module in the execution environment respectively selects the sensitive operation code and the non-sensitive operation code generated according to the taint analysis
And
c + + functions corresponding to virtual machine operation codes are extracted from the operation codes to generate
And
the function set is used in the next part of the invention.
The load and store module in the execution environment is primarily responsible for loading intelligent contract state and storing new state. The virtual machine will execute the user's request according to the byte code compiled by the smart contract. For sensitive operation codes, the method runs in an Enable execution environment (Enable) provided by SGX
The function of (1); for non-sensitive opcodes, it will run outside Enclave
The function of (1).
The specific implementation method comprises the following steps:
(1) A user inputs an intelligent contract source code;
(2) A Solidity compiler compiles a source code to obtain a byte code sequence and transmits the byte code sequence to an execution environment;
(3) The taint analysis module carries out taint analysis on the intelligent contract source code to obtain a sensitive operation code set and a non-sensitive operation code set;
(4) The selection module selects from the sensitive/non-sensitive opcode set
Selecting corresponding C + + function to obtain
Transmitting to the virtual machine module;
(5) The loading and storing module reads the state of the intelligent contract;
(6) The virtual machine module executes the intelligent contract byte codes, and the loading and storing module stores the new state of the intelligent contract.
1. Taint analysis technology for searching intelligent contract sensitive virtual machine operation code
Taint analysis techniques are commonly used to analyze whether data introduced by taint sources in a program is propagated directly to taint gathering points, creating privacy data leakage problems. The traditional taint analysis is used for analyzing the transmission of sensitive variables (taint variables), and the taint analysis technology provided by the invention further searches sensitive sentences related to the sensitive variables and sensitive virtual machine operation codes corresponding to the sensitive sentences on the basis of searching the sensitive variables. No research has been considered to search intelligent contract sensitive virtual machine opcodes via taint analysis techniques, nor to combine taint analysis with SGX-based intelligent contract security execution.
2. Secure execution environment for dynamic TCB reduction based on SGX
In some existing researches, although the operating process of the intelligent contract is protected by combining the trusted execution environment provided by the SGX and the virtual machine, the whole degree of operation in the trusted environment causes a larger TCB, and the code risk and the security hole increase with the increase of the TCB. In the invention, on the basis of combining the SGX and the intelligent contract virtual machine, the sensitive and non-sensitive virtual machine operation codes obtained by searching through the taint analysis technology are dynamically operated in a trusted execution environment Enclave provided by the SGX, and the non-sensitive operation codes are operated outside the Enclave, so that the aim of dynamically reducing the TCB according to the intelligent contract is fulfilled.
Claims (9)
1. A block chain virtual machine method for dynamically reducing TCB based on SGX is characterized by comprising the following steps: the method specifically comprises the following steps:
s1, inputting an intelligent contract source code;
s2, compiling the intelligent contract source code to obtain a byte code sequence;
s3, constructing function sets corresponding to all the virtual machine operation codes;
s4, performing taint analysis on the intelligent contract source code by adopting a taint analysis method to obtain a sensitive operation code set and a non-sensitive operation code set;
s5, selecting corresponding execution functions from the constructed function sets corresponding to all the virtual machine operation codes according to the sensitive operation code set and the non-sensitive operation code set, and sending the execution functions to the virtual machine module;
s6, the virtual machine module runs an execution function corresponding to the sensitive operation code set in a trusted execution environment Enclave provided by the SGX, and executes an execution function corresponding to the non-sensitive operation code set outside the trusted execution environment Enclave.
2. The SGX based dynamic reduce TCB blockchain virtual machine method of claim 1 wherein: and S2, compiling the intelligent contract source code by a solid compiler to obtain a byte code sequence.
3. The SGX based dynamic reduce TCB blockchain virtual machine method of claim 2 wherein: the function sets corresponding to all the virtual machine operation codes comprise two versions of C + + function sets, that is, all the virtual machine operation codes correspond to C + + function sets running inside Enclave
And a set of C + + functions running outside the Enclave
4. The SGX-based block chain virtual machine method for dynamically reducing TCBs according to claim 3, wherein: step S4, performing taint analysis on the intelligent contract source code by adopting a taint analysis method to obtain a sensitive operation code set and a non-sensitive operation code set, wherein the taint analysis method specifically comprises the following steps:
marking the variable of each function of the intelligent contract as sensitive, and tracking the transfer process of the sensitive variable by adopting an open source tool Slither; variables dependent on the sensitive variables are also marked as sensitive, expressions using sensitive data are also marked as sensitive expressions, and operation codes of the Solidity compiler expressions are given by using an open source tool Slither, so that a sensitive operation code set of the sensitive expressions is extracted; since the number of opcodes is fixed, removing the sensitive opcode set results in a non-sensitive opcode set.
5. The SGX-based block chain virtual machine method for dynamically reducing TCBs according to claim 4, wherein: the specific process of step S5 is as follows:
from the set according to the set of sensitive opcodes
Corresponding C + + function is selected to obtain a selected C + + function set
From the set according to the non-sensitive opcode set
Corresponding C + + function is selected to obtain a selected C + + function set
Respectively assemble
And set
And transmitting the data to the virtual machine module.
6. The SGX based dynamic reduce TCB blockchain virtual machine method of claim 5 wherein: the specific process of step S6 is as follows:
for sensitive operation codes, the virtual machine module runs a C + + function set in an Enclave trusted execution environment provided by SGX
The function of (1); for non-sensitive operation codes, running a C + + function set outside an Enclave trusted execution environment provided by SGX
The function of (1).
7. A block chain virtual machine system for SGX-based dynamic TCB reduction, comprising: the system comprises a identity compiler, a taint analysis module, a selection module and a virtual machine module;
the Solidity compiler compiles an intelligent contract source code to obtain a byte code sequence;
the taint analysis module carries out taint analysis on the intelligent contract source code to obtain a sensitive operation code set and a non-sensitive operation code set;
the selection module selects corresponding execution functions from the constructed function sets corresponding to all the virtual machine operation codes according to the sensitive operation code set and the non-sensitive operation code set and sends the execution functions to the virtual machine module;
the virtual machine module runs an execution function corresponding to the sensitive opcode set inside a trusted execution environment Enclave provided by the SGX, and executes an execution function corresponding to the non-sensitive opcode set outside the trusted execution environment Enclave.
8. The SGX based dynamic reduce TCB blockchain virtual machine system of claim 7 wherein: and the execution environment is also provided with a loading and storing module.
9. The SGX-based block chain virtual machine system for dynamic reduction of TCB of claim 8, wherein: the loading and storing module is used for loading the intelligent contract state and storing the intelligent contract new state.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110036603.7A CN112836217B (en) | 2021-01-12 | 2021-01-12 | SGX-based block chain virtual machine method and system for dynamically reducing TCB |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110036603.7A CN112836217B (en) | 2021-01-12 | 2021-01-12 | SGX-based block chain virtual machine method and system for dynamically reducing TCB |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN112836217A CN112836217A (en) | 2021-05-25 |
| CN112836217B true CN112836217B (en) | 2023-02-10 |
Family
ID=75927811
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202110036603.7A Active CN112836217B (en) | 2021-01-12 | 2021-01-12 | SGX-based block chain virtual machine method and system for dynamically reducing TCB |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112836217B (en) |
Families Citing this family (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113609481B (en) * | 2021-06-02 | 2024-01-30 | 西安四叶草信息技术有限公司 | PHP (phase-shift register) taint analysis method and device based on byte codes |
| CN115098866A (en) * | 2022-06-29 | 2022-09-23 | 蚂蚁区块链科技(上海)有限公司 | Method for detecting private data leakage |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109063471A (en) * | 2018-07-17 | 2018-12-21 | 广州大学 | A kind of guard method of SGX operation |
| CN110032884A (en) * | 2019-01-31 | 2019-07-19 | 阿里巴巴集团控股有限公司 | The method and node, storage medium of secret protection are realized in block chain |
| CN111770206A (en) * | 2020-08-31 | 2020-10-13 | 支付宝(杭州)信息技术有限公司 | Method for deploying intelligent contract, block chain node and storage medium |
Family Cites Families (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105389513B (en) * | 2015-11-26 | 2018-10-12 | 华为技术有限公司 | A kind of credible execution method and apparatus of virtual credible platform module vTPM |
| US11829998B2 (en) * | 2016-06-07 | 2023-11-28 | Cornell University | Authenticated data feed for blockchains |
| CA3061427C (en) * | 2019-04-03 | 2021-04-20 | Alibaba Group Holding Limited | Processing blockchain data based on smart contract operations executed in a trusted execution environment |
-
2021
- 2021-01-12 CN CN202110036603.7A patent/CN112836217B/en active Active
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109063471A (en) * | 2018-07-17 | 2018-12-21 | 广州大学 | A kind of guard method of SGX operation |
| CN110032884A (en) * | 2019-01-31 | 2019-07-19 | 阿里巴巴集团控股有限公司 | The method and node, storage medium of secret protection are realized in block chain |
| CN111770206A (en) * | 2020-08-31 | 2020-10-13 | 支付宝(杭州)信息技术有限公司 | Method for deploying intelligent contract, block chain node and storage medium |
Non-Patent Citations (2)
| Title |
|---|
| Blockchain and Trusted Computing: Problems, Pitfalls, and a Solution for Hyperledger Fabric;Marcus Brandenburger,et al;《arxiv:1805.08541v1》;20180522;全文 * |
| SGX技术应用研究综述;王进文等;《网络新媒体技术》;20170915(第05期);全文 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN112836217A (en) | 2021-05-25 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Arden et al. | Sharing mobile code securely with information flow control | |
| US9208319B2 (en) | Code base partitioning system | |
| CN111770206A (en) | Method for deploying intelligent contract, block chain node and storage medium | |
| CN112836217B (en) | SGX-based block chain virtual machine method and system for dynamically reducing TCB | |
| CN112948810A (en) | Trusted computing program calling method and device, electronic equipment and storage medium | |
| CN109829013A (en) | For running the method for intelligent contract in block chain network, storage medium, calculating equipment | |
| CN115208665B (en) | Germplasm resource data safe sharing method and system based on blockchain | |
| Kieseberg et al. | Witnesses for the doctor in the loop | |
| Ameur-Boulifa et al. | Sysml model transformation for safety and security analysis | |
| Gupta et al. | An insecurity study of ethereum smart contracts | |
| CN115580413A (en) | Zero-trust multi-party data fusion calculation method and device | |
| US20150195083A1 (en) | Homomorphic cryptography modeling in support of privacy policies | |
| Dai et al. | Trustzone-based secure lightweight wallet for hyperledger fabric | |
| Goel et al. | A blockchain-based Aadhar system: distributed authentication system | |
| Desnitsky et al. | Automated design, verification and testing of secure systems with embedded devices based on elicitation of expert knowledge | |
| Ismail et al. | Edge IoT-cloud framework based on blockchain | |
| Ahila et al. | Overview of mobile agent security issues—Solutions | |
| Lee et al. | Classification and analysis of security techniques for the user terminal area in the internet banking service | |
| Bello et al. | On the application of financial security standards in blockchain platforms | |
| Ménétrey et al. | A Comprehensive Trusted Runtime for WebAssembly with Intel SGX | |
| Aziz | A static analysis framework for security properties in mobile and cryptographic systems | |
| Arulprakash et al. | Enhanced data privacy preservation model for mobile crowdsensing system using blockchain technology | |
| Nielson et al. | Secure guarded commands | |
| Lemes | Information Security Management of Web Portals Based On Joomla CMS | |
| Baez | Evaluating SGX’s Remote Attestation Security Through the Analysis of Copland Phrases |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |