WO2022206437A1 - 查询Fabric区块链账本数据的方法和装置 - Google Patents

查询Fabric区块链账本数据的方法和装置 Download PDF

Info

Publication number
WO2022206437A1
WO2022206437A1 PCT/CN2022/081734 CN2022081734W WO2022206437A1 WO 2022206437 A1 WO2022206437 A1 WO 2022206437A1 CN 2022081734 W CN2022081734 W CN 2022081734W WO 2022206437 A1 WO2022206437 A1 WO 2022206437A1
Authority
WO
WIPO (PCT)
Prior art keywords
tee
query
node
ledger data
transaction
Prior art date
Application number
PCT/CN2022/081734
Other languages
English (en)
French (fr)
Inventor
余逸荣
Original Assignee
支付宝(杭州)信息技术有限公司
蚂蚁区块链科技(上海)有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 支付宝(杭州)信息技术有限公司, 蚂蚁区块链科技(上海)有限公司 filed Critical 支付宝(杭州)信息技术有限公司
Publication of WO2022206437A1 publication Critical patent/WO2022206437A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3825—Use of electronic signatures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/24—Querying
    • G06F16/242—Query formulation
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/27—Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/389—Keeping log of transactions for guaranteeing non-repudiation of a transaction

Definitions

  • the embodiments of this specification relate to the field of blockchain technology, and more particularly, to a method and apparatus for querying Fabric blockchain ledger data.
  • Hyperledger Fabric blockchain (hereinafter referred to as Fabric blockchain) is an enterprise-oriented consortium chain.
  • the Fabric blockchain includes the following types of nodes: client nodes, peer nodes, orderer nodes, and so on.
  • the peer nodes further include an endorsement (Endorsor) node, an management (Anchor) node, a commit (Committer) node, and the like.
  • the Fabric blockchain includes multiple channels, and each channel has its own closed ledger data and chaincode, which is the smart contract in the Fabric blockchain. Peers can choose which channels to join, and they can join the channel after being authenticated by peers already in the channel.
  • a client node can initiate a transaction proposal to a channel in the Fabirc blockchain, so that the client node sends a transaction proposal to at least two endorsing nodes in the channel.
  • the endorsement node in the channel has a transaction proposal system interface, so that the endorsement node can pre-execute and digitally sign the transaction proposal received from the client node by calling the system interface, and return the pre-execution result and digital signature after the pre-execution. to the client node.
  • the client node sends the transaction pre-execution result and signature to the ordering node after receiving it from each endorsement node.
  • the sorting node is used to sort transactions, and pack the sorted transactions into blocks at fixed time intervals and send them to the management node.
  • each peer node After receiving the block, the management node broadcasts the block to each submitting node. After the submitting node receives the block, it verifies the execution status of each transaction in the block, marks its execution status in each transaction of the block, and then adds the block to the node's ledger data (ie, submits the block).
  • each peer node is a commit node, that is, each peer node locally includes the ledger data of the channel.
  • the peer node has its own query chaincode (Query System Chaincode, qscc).
  • query System Chaincode qscc
  • the peer node can query the local ledger data by calling the qscc system chaincode, and the ledger data includes transaction data. , block data, etc.
  • FIG. 1 schematically shows a query operation process of a newly started peer node.
  • the top three boxes in Figure 1 represent multiple blocks in the ledger data initially acquired by the peer node, and block 0-block 2 are schematically shown here, where block 0 represents the creation block, and block 0 represents the genesis block. 0.
  • Block 1 and Block 2 are sequentially connected.
  • Each block consists of multiple transactions arranged in sequence (as shown by the pages in each box), and each transaction records the set of reads and writes that the transaction acquired when it was pre-executed.
  • the read-write set is the pre-execution result obtained by the endorsement node when pre-executing the transaction, and the pre-execution result includes the set of read operations for each parameter in the blockchain, and the data for each parameter in the blockchain.
  • the multiple transactions are not all executed successfully, but the initially acquired ledger data does not include the execution status of each transaction.
  • the peer node Since the transactions in each block in the ledger data in the channel need to be successfully executed based on the world state determined by the previous block, the peer node needs to execute after synchronizing the ledger data in the channel From the genesis block to the transactions in all blocks of the block where the target ledger data is located, the execution status of the target transaction can be obtained.
  • the block number) is linearly related, that is, the higher the height of the target block, the more time-consuming.
  • a user wishes to query a certain transaction in block 2
  • step 1 as shown by the arrow marked with 1 in the figure, the execution status of each transaction in block 0 is verified.
  • each transaction in block 0 it is verified whether the read-write set of each transaction can be successfully executed. Based on the ordering of each transaction, it is possible that the execution of the previous transaction has changed the value of a certain parameter, thus causing the subsequent transaction to fail to read and write. This subsequent transaction is marked as "0" to indicate that the transaction was unsuccessfully executed. If the read-write of the transaction does not conflict with the read-write of the previous transaction and can be executed successfully, the peer node marks the transaction as "1" to indicate that the transaction was successfully executed.
  • step 1 After completing step 1, that is, after verifying the execution status of each transaction in block 0, based on each parameter (ie, the world state) determined by the execution of each transaction in block 0, as shown in the figure marked with 2 As shown by the arrow, go to step 2.
  • the peer node sequentially verifies whether each transaction in block 1 can be successfully executed based on the current world state, and marks each transaction with "0" or "1" (such as the arrow marked with 2). pointed to in block 1).
  • the third step is performed.
  • the peer node sequentially verifies whether each transaction in block 2 can be successfully executed based on the current world state, and marks each transaction separately (as shown in block 2 pointed to by the arrow marked with 3). ) until the target transaction in block 2 that the user needs to query is executed.
  • the user's query requirements for the Fabric blockchain are low-frequency requirements. Therefore, after obtaining the execution status of the target transaction, in order not to occupy machine resources, the peer node configuration is usually deleted in the user device. Therefore, when the user needs to query Fabric again When the ledger data of the blockchain is stored, the whole process above still needs to be performed again.
  • the embodiments of this specification aim to provide a more efficient solution for querying the Fabric blockchain ledger data, so as to solve the deficiencies in the prior art.
  • one aspect of this specification provides a method for querying the ledger data of the Fabric blockchain
  • the Fabric blockchain includes a client node and an endorsement node
  • the endorsement node includes a TEE
  • the method is performed by the client.
  • the execution of the end node includes: sending a transaction proposal to the endorsement node, the transaction proposal is used to request the query of the first ledger data; receiving the pre-execution result and TEE signature of the transaction proposal from the endorsement node, wherein the The pre-execution results include query results for the first ledger data.
  • the method further comprises: verifying the TEE signature after receiving the pre-execution result of the transaction proposal and the TEE signature from the endorsing node.
  • the method further comprises: receiving a query for the first ledger data from a user device of a user prior to respectively sending transaction proposals to the endorsing nodes; determining whether the user has access to the first ledger data; the query authority of the first ledger data; the sending a transaction proposal to the endorsement node includes sending a transaction proposal to the endorsement node under the condition that it is determined that the user has the query permission for the first ledger data.
  • the method further includes: after receiving the pre-execution result and the TEE signature for the transaction proposal from the endorsing node, sending the pre-execution result and the TEE signature to the user equipment.
  • the first ledger data is block data or transaction data.
  • Another aspect of this specification provides a method for querying ledger data of a Fabric blockchain, where the Fabric blockchain includes a client node and an endorsement node, the endorsement node includes a TEE, and the method is executed by the endorsement node , including: receiving a transaction proposal from the client node, the transaction proposal is used to request the query of the first ledger data; pre-executing the transaction proposal through the TEE to obtain the pre-execution result of the transaction proposal, wherein the pre-execution result of the transaction proposal is obtained.
  • the execution result includes the query result of the first ledger data; the pre-execution result is signed through the TEE; the pre-execution result and the signature are sent to the client node.
  • pre-executing the transaction proposal through the TEE includes determining, through the TEE, whether the initiating account of the transaction proposal has the query authority for the first ledger data, and after determining that the initiating account has the query authority In this case, the query result is read locally through the TEE.
  • pre-executing the transaction proposal through the TEE includes reading the query result locally through the TEE, and verifying the query result through the TEE.
  • the Fabric blockchain includes a client node and an endorsement node, the endorsement node includes a TEE, and the device is deployed on the client node, It includes: a first sending unit, configured to send a transaction proposal to the endorsement node, where the transaction proposal is used to request a query of the first ledger data; a first receiving unit, configured to receive from the endorsement node a transaction proposal for the transaction The pre-execution result and TEE signature of the proposal, wherein the pre-execution result includes the query result of the first ledger data.
  • the apparatus further includes: a verification unit configured to verify the TEE signature after receiving the pre-execution result of the transaction proposal and the TEE signature from the endorsing node.
  • the apparatus further includes: a second receiving unit, configured to receive a query for the first ledger data from the user equipment of the user before respectively sending the transaction proposal to the endorsing node; determine a unit configured to determine whether the user has the right to query the first ledger data; the first sending unit is further configured to, when it is determined that the user has the right to query the first ledger data Next, send a transaction proposal to the endorsing node.
  • a second receiving unit configured to receive a query for the first ledger data from the user equipment of the user before respectively sending the transaction proposal to the endorsing node
  • determine a unit configured to determine whether the user has the right to query the first ledger data
  • the first sending unit is further configured to, when it is determined that the user has the right to query the first ledger data Next, send a transaction proposal to the endorsing node.
  • the apparatus further includes: a second sending unit configured to, after receiving the pre-execution result and TEE signature on the transaction proposal from the endorsing node, send the pre-execution result and TEE The signature is sent to the user equipment.
  • the Fabric blockchain includes a client node and an endorsement node, the endorsement node includes a TEE, and the device is deployed on the endorsement node , including: a receiving unit, configured to receive a transaction proposal from a client node, the transaction proposal being used to request to query the first ledger data; a pre-execution unit, configured to pre-execute the transaction proposal through the TEE, so as to obtain the relevant The pre-execution result of the transaction proposal, wherein the pre-execution result includes the query result of the first ledger data; the signing unit is configured to sign the pre-execution result through TEE; the sending unit is configured to: Send the pre-execution result and the signature to the client node.
  • a receiving unit configured to receive a transaction proposal from a client node, the transaction proposal being used to request to query the first ledger data
  • a pre-execution unit configured to pre-execute the transaction proposal through the TEE, so as to obtain the relevant The pre-execution result of the transaction proposal, wherein
  • the pre-execution unit includes a determination subunit configured to determine, through TEE, whether the initiating account of the transaction proposal has the right to query the first ledger data, and the first read subunit , and is configured to read the query result locally in the case that it is determined that the initiating account has the query authority.
  • the pre-execution unit includes a second reading subunit configured to read the query result locally through the TEE, and a verification subunit configured to perform the query result on the TEE through the TEE. verify.
  • Another aspect of the present specification provides a computer-readable storage medium on which a computer program is stored, when the computer program is executed in a computer, the computer is made to execute any one of the above methods.
  • Another aspect of the present specification provides a computing device, including a memory and a processor, where executable code is stored in the memory, and when the processor executes the executable code, any one of the foregoing methods is implemented.
  • the query initiator can quickly and efficiently obtain the ledger data on the chain and verify the authenticity of the ledger data without running an independent peer node and waiting for the peer node to synchronize Verifying multiple blocks greatly saves the query time; the query initiator only needs to obtain the data authorization of the target block or transaction to carry out the query, without the need to obtain the full account book authorization; in addition, through the Fabric blockchain Using the TEE node as the endorsement node, the authenticity of the query result of the TEE node can be guaranteed through the TEE hardware and the algorithm in the hardware, without the need to query the ledger data through multiple endorsement nodes at the same time, and based on the multiple endorsement nodes. The consistency of the query results to determine the authenticity of the query results.
  • Fig. 1 schematically shows the query operation process of the newly started peer node
  • FIG. 2 shows a schematic diagram of a Fabric blockchain query system according to an embodiment of the present specification
  • FIG. 3 shows a flowchart of a method for querying Fabric blockchain ledger data according to an embodiment of the present specification
  • FIG. 4 shows a flowchart of a method for querying Fabric blockchain ledger data according to another embodiment of the present specification
  • FIG. 5 shows a device 500 for querying Fabric blockchain ledger data according to an embodiment of the present specification
  • FIG. 6 shows an apparatus 600 for querying Fabric blockchain ledger data according to an embodiment of the present specification.
  • FIG. 2 shows a schematic diagram of a Fabric blockchain query system according to an embodiment of the present specification.
  • the query system includes user equipment 21 , management equipment 22 and Fabric blockchain 23 .
  • the user equipment 21 may be an off-chain device of the Fabric blockchain, which may be a user's device of the Fabric blockchain, a node device of other blockchains, or used to transfer messages between multiple blockchains The repeater equipment, etc., are not limited here.
  • the management device 22 provides the user device 21 with a query service for the ledger data of the Fabric blockchain.
  • the management device 22 itself is a client node of the Fabric blockchain that has the permission to query the ledger data.
  • the Fabric blockchain 23 is shown schematically in Figure 2 as including peer nodes 1-4. Among them, node 2 is an endorsement node in Fabric blockchain 23, which includes a Trusted Execution Environment (TEE).
  • TEE can be, for example, a trusted execution environment generated by technologies such as SGX and Trust Zone.
  • the user equipment 21 Before querying the ledger data of the blockchain 23 through the management device 22, the user equipment 21 can first verify the TEE in the node 2. Specifically, the user equipment 21 may send an authentication request through the middle to the TEE of the management device 22 . After receiving the verification request, the TEE generates authentication information based on its internal mechanism, and forwards the authentication information and the hardware public key of the TEE to the user equipment 21 through the middle of the management device 22 .
  • the authentication information includes, for example, signature information, hardware information, software information, and the like of the TEE.
  • the signature information is generated by, for example, the hardware key of the TEE; the hardware information includes, for example, various hardware indicators, such as CPU frequency, memory capacity, etc.; the software information includes the code hash value of each program , code name, version, run log, etc.
  • a TEE can perform "measurements" of a program running in it through memory hardware, such as obtaining a code hash of the program, a hash of the program's memory occupancy at a particular point of execution, etc.
  • the authentication information includes "measurement" information for the program, which is authentic and credible because the "measurement" information is executed by the TEE's own entity (memory hardware) without involving any software or operating system.
  • the user equipment 21 may send the authentication information to the remote authentication server of the TEE, so as to receive the verification result of the TEE from the server.
  • the verification result includes the identity verification of the TEE, the verification of the internal execution program of the TEE, and the like. Therefore, the user equipment 21 can determine that the TEE is credible based on the verification result, and the query result through the TEE is credible. At the same time, the user equipment 21 locally saves the hardware public key of the TEE for subsequent verification of the signature of the TEE.
  • the user corresponding to the user equipment 21 applies to the management device 22 for the query permission of the ledger data before querying the ledger data (for example, the transaction m in the block n) of the Fabric blockchain 23, and the management device 22 After verifying the application of user 1, authorize the query authority to user 1, and record the authorization to user 1 locally, for example, the account identification of user 1 (such as account 1) and the authorization of user 1 can be recorded. permissions.
  • the user 1 can send a query request to the management device 22 through the user equipment 21, so as to query, for example, the transaction m in the block n and the execution status of the transaction m.
  • the management device 22 first determines whether the user 1 has the query authority for the transaction m. After determining that user 1 has the right to query transaction m based on local records, a transaction proposal (eg transaction A proposal) is sent to node 2 for querying transaction m in block n. After receiving the transaction A proposal, node 2 queries the transaction data of transaction m in block n and the execution status of transaction m in its local ledger data through TEE as the query result, and generates transaction A based on the query result.
  • a transaction proposal eg transaction A proposal
  • the pre-execution result of transaction A is signed by using the TEE private key, and the pre-execution result of transaction A and its TEE signature are sent to the management device 22 .
  • the management device 22 After receiving the pre-execution result and the TEE signature, the management device 22 provides the pre-execution result and the TEE signature to the user equipment 21 .
  • the user equipment 21 After receiving the pre-execution result and the TEE signature, the user equipment 21 can use the pre-obtained TEE public key to verify the TEE signature, thereby verifying the authenticity of the pre-execution result. Get real query results from pre-execution results.
  • FIG. 3 shows a flowchart of a method for querying Fabric blockchain ledger data according to an embodiment of the present specification. As shown in FIG. 3 , the method is jointly executed by the user equipment 21 , the management device 22 and the node 2 in FIG. 2 , where the user equipment 21 is, for example, the equipment of the user 1 .
  • step S302 the user equipment 21 sends a query request to the management device 22, where the query request is used to request to query the ledger data in the Fabric blockchain.
  • the ledger data can be blocks or transactions.
  • the query request is used to query transaction m in block n in the Fabric blockchain.
  • the query request is for example issued by user 1 using his account 1 .
  • step S304 the management device 22 checks the inquiry authority of the account 1 .
  • the user 1 obtains in advance the query authority of the management device 22 for the predetermined account book data, and the management device 22 records the query authority corresponding to the account 1 locally. For example, it is recorded in the management device 22 that the account 1 has the inquiry authority to the transaction m. After receiving the above query request, the management device 22 locally reads the query authority of the account 1 to check whether the account 1 has the query authority for the transaction m.
  • step S306 the management device 22 sends a transaction proposal to the node 2.
  • the transaction proposal (such as the transaction A proposal above) is used to invoke the qscc system chain code of the node to query the specified ledger data, such as querying transaction m in block n.
  • step S308 node 2 obtains the query result through the TEE.
  • the node 2 After receiving the above-mentioned transaction proposal from the management device 22, the node 2 pre-executes the transaction A through the TEE.
  • the pre-execution is to execute the transaction A, but the acquired transaction execution result is not stored in the local ledger.
  • TEE executes the qscc system chain code according to the transaction content of transaction A, and reads transaction m in block n and the execution status of transaction m (that is, whether it is successfully executed) in the local ledger as the query result.
  • node 2 The execution status of each transaction in block n has been verified and recorded in the previous submission of block n, that is, the ledger data recorded in node 2 is shown in the lowermost blocks in Figure 1.
  • the display includes the execution status of each transaction in the block. Therefore, the TEE can directly read the execution status of transaction m locally, without the need to execute each transaction in each block from the genesis block to transaction m as shown in Figure 1, thus greatly saving query time.
  • node 2 may also perform operations based on an integrity check mechanism each time a block is submitted.
  • the TEE in node 2 can use the TEE private key for the block
  • the block is signed and the block and its TEE signature are deposited into the ledger. Therefore, the TEE obtains the data of block n and its TEE signature while obtaining the above query results.
  • the integrity verification mechanism is not limited to signing each block, and other methods can also be used to ensure data integrity.
  • TEE can sign the read-write set of each transaction and its execution status, to ensure the data integrity of each transaction.
  • step S310 node 2 verifies the query result through the TEE.
  • the TEE After the TEE obtains block n and its TEE signature, it uses the TEE public key to verify the TEE signature to ensure that the obtained block n is the real data that has not been tampered with, so as to ensure the transaction m and its state are valid. authenticity. It can be understood that in other forms of integrity transaction mechanisms, the TEE can verify the query results accordingly. For example, when node 2 stores a signature for each transaction in the ledger every time a block is submitted, the TEE can Verify the TEE signature of the previously deposited transaction m to verify the data integrity of the queried transaction m.
  • step S312 the pre-execution result of transaction A and its TEE signature are generated.
  • the TEE After the TEE performs the above verification process, if it is determined that the above query result is the real query result, the real query result is recorded in the pre-execution read-write set of transaction A, thereby generating the pre-execution read-write set of transaction A.
  • the TEE signs the read-write set with its own hardware private key. Specifically, the TEE calculates the hash value of the read-write set, and encrypts the read-write set with its own hardware private key, so as to obtain the read-write set.
  • the signature i.e. digital signature
  • the TEE outputs the read-write set and its TEE signature to node 2.
  • step S314 the node 2 returns the pre-execution result and its TEE signature to the management device 22.
  • step S316 the management device 22 returns the pre-execution result and its TEE signature to the user equipment 21.
  • step S318 the user equipment 21 verifies the TEE signature.
  • the user equipment 21 After receiving the pre-execution result and its TEE signature from the management device 22, the user equipment 21 verifies the TEE signature using the pre-obtained TEE public key. Specifically, the user equipment 21 uses the TEE public key to decrypt the TEE signature, calculates the hash value of the pre-execution result, and compares whether the data obtained by decryption is consistent with the hash value. If they are consistent, the verification of the TEE signature is passed. . After the verification is passed, it can be confirmed that the pre-execution result is indeed the pre-execution result generated by the TEE, so that the query data included therein can be confirmed to be the real query data.
  • step S320 real query data is obtained from the pre-execution result.
  • the user equipment 21 may, based on the predetermined data format of the read-write set in the pre-execution result, find the first ledger data read during the pre-execution of transaction A from the read set therein, and since the embodiments of this specification provide The TEE hardware and the algorithm executed by the TEE hardware can ensure that the first ledger data is the real ledger data.
  • Fig. 4 shows a flowchart of a method for querying Fabric blockchain ledger data according to another embodiment of the present specification.
  • the method shown in FIG. 4 is different from the method shown in FIG. 3 in that the user equipment 21 can obtain the ledger data by directly sending a transaction proposal to the peer node of the Fabric blockchain instead of the management device 22 .
  • the user 1 can apply to the node 2 for the account book data query permission with the account 1, and the node 2 can record in the TEE after authorizing the account book data query permission to the account 1.
  • the user equipment 21 can verify the TEE by sending a TEE verification request to the node 2, and obtain the public key of the TEE in advance.
  • step S402 the user equipment 21 sends a transaction proposal to the node 2, and the transaction proposal is used to call the ledger data provided in the channel to query the chain code.
  • the query chain code calls the qscc system chain code in node 2 to query the specified ledger data, such as querying transaction m in block n.
  • the user equipment 21 sends the transaction proposal, eg, through the account 1 of the user 1 .
  • step S404 node 2 checks the query authority of account 1.
  • node 2 After receiving the transaction proposal, node 2 pre-executes the transaction proposal, that is, pre-executes the ledger data query chain code. In this pre-execution process, node 2 first checks the query authority of account 1 according to the code of the ledger data query chain code. As in the preparation process described above, the node 2 authorizes the query permission to the account 1 and records it in the TEE. For example, the TEE records that the account 1 has the query permission for the transaction m. Thus, the TEE can read the inquiry authority of account 1 to check whether account 1 has inquiry authority for transaction m.
  • step S406 node 2 obtains the query result through the TEE.
  • the TEE determines that account 1 has the query authority to the transaction m, it will query the call to the qscc system chain code in the chain code according to the ledger data, and execute the qscc system chain code, Thus, the transaction content and execution status of transaction m are read from the local ledger as the query result.
  • block n and its TEE signature are also read.
  • FIG. 5 shows an apparatus 500 for querying the ledger data of the Fabric blockchain according to an embodiment of the present specification
  • the Fabric blockchain includes a client node and an endorsement node
  • the endorsement node includes a TEE
  • the device is deployed In the client node, it includes: a first sending unit 51, configured to send a transaction proposal to the endorsing node, where the transaction proposal is used to request to query the first ledger data; a first receiving unit 52, configured to send a transaction proposal from the The endorsement node receives the pre-execution result and TEE signature of the transaction proposal, wherein the pre-execution result includes the query result of the first ledger data.
  • the apparatus 500 further includes: a verification unit 53, configured to verify the TEE signature after receiving the pre-execution result of the transaction proposal and the TEE signature from the endorsing node.
  • the apparatus 500 further includes: a second receiving unit 54, configured to receive a query for the first ledger data from the user equipment of the user before respectively sending the transaction proposal to the endorsing node
  • the determining unit 55 is configured to determine whether the user has the right to query the first ledger data
  • the first sending unit 51 is further configured to, after determining that the user has access to the first ledger data In the case of query permission, a transaction proposal is sent to the endorsing node.
  • the apparatus 500 further includes: a second sending unit 56, configured to, after receiving the pre-execution result and the TEE signature of the transaction proposal from the endorsing node, send the pre-execution result and TEE signature are sent to the user equipment.
  • a second sending unit 56 configured to, after receiving the pre-execution result and the TEE signature of the transaction proposal from the endorsing node, send the pre-execution result and TEE signature are sent to the user equipment.
  • FIG. 6 shows an apparatus 600 for querying ledger data of a Fabric blockchain according to an embodiment of the present specification
  • the Fabric blockchain includes a client node and an endorsement node
  • the endorsement node includes a TEE
  • the device is deployed
  • the endorsement node includes: a receiving unit 61, configured to receive a transaction proposal from a client node, the transaction proposal being used to request to query the first ledger data; a pre-execution unit 62, configured to pre-execute the transaction proposal through the TEE transaction proposal to obtain the pre-execution result of the transaction proposal, wherein the pre-execution result includes the query result of the first ledger data;
  • the signing unit 63 is configured to use TEE to perform the pre-execution result signature;
  • the sending unit 64 is configured to send the pre-execution result and the signature to the client node.
  • the pre-execution unit 62 includes a determination subunit 621 configured to determine, through TEE, whether the initiating account of the transaction proposal has the right to query the first ledger data, the first read
  • the subunit 622 is configured to, in the case of determining that the originating account has the query authority, read the query result locally.
  • the pre-execution unit 62 includes a second reading subunit 623 configured to read the query result locally through the TEE, and a verification subunit 624 configured to read the query result authenticating.
  • Another aspect of the present specification provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed in a computer, causes the computer to execute any one of the above-mentioned methods.
  • Another aspect of the present specification provides a computing device, including a memory and a processor, where executable code is stored in the memory, and when the processor executes the executable code, any one of the foregoing methods is implemented.
  • the query initiator can quickly and efficiently obtain the ledger data on the chain and verify the authenticity of the ledger data without running an independent peer node and waiting for the peer node to synchronize Verifying multiple blocks greatly saves the query time; the query initiator only needs to obtain the data authorization of the target block or transaction to carry out the query, without the need to obtain the full account book authorization; in addition, through the Fabric blockchain Using the TEE node as the endorsement node, the authenticity of the query result of the TEE node can be guaranteed through the TEE hardware and the algorithm in the hardware, without the need to query the ledger data through multiple endorsement nodes at the same time, and based on the multiple endorsement nodes. The consistency of the query results to determine the authenticity of the query results.
  • the software module can be placed in random access memory (RAM), internal memory, read only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disks, removable disks, CD-ROMs, or technical fields in any other form of storage medium known in the art.
  • RAM random access memory
  • ROM read only memory
  • electrically programmable ROM electrically erasable programmable ROM
  • registers hard disks, removable disks, CD-ROMs, or technical fields in any other form of storage medium known in the art.

Landscapes

  • Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Accounting & Taxation (AREA)
  • Databases & Information Systems (AREA)
  • Finance (AREA)
  • General Business, Economics & Management (AREA)
  • Strategic Management (AREA)
  • Data Mining & Analysis (AREA)
  • General Engineering & Computer Science (AREA)
  • Computing Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • Mathematical Physics (AREA)
  • Computational Linguistics (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

本说明书实施例提供了一种查询Fabric区块链账本数据的方法和装置，所述Fabric区块链中包括客户端节点和背书节点，所述背书节点中包括TEE，所述方法由客户端节点执行，包括：向所述背书节点发送交易提案，所述交易提案用于请求查询第一账本数据；从所述背书节点接收对所述交易提案的预执行结果及TEE签名，其中，所述预执行结果中包括对所述第一账本数据的查询结果。

Description

查询Fabric区块链账本数据的方法和装置 技术领域
本说明书实施例涉及区块链技术领域，更具体地，涉及一种查询Fabric区块链账本数据的方法和装置。
背景技术
Hyperledger Fabric区块链(下文简称为Fabric区块链)是一种面向企业的联盟链。Fabric区块链中包括以下多种类型的节点：客户端节点、对等(Peer)节点、排序(orderer)节点等等。所述对等节点中又包括背书(Endorsor)节点、管理(Anchor)节点、提交(Committer)节点等。Fabric区块链中包括多个通道(channel)，每个通道具有自身封闭的账本数据和链码(chaincode)，所述链码即为Fabric区块链中的智能合约。对等节点可选择加入哪些通道，其在经过通道中已有的对等节点的身份验证之后可加入该通道。客户端节点可以向Fabirc区块链中的某个通道发起交易提案，从而，客户端节点向该通道中的至少两个背书节点发送交易提案。通道中的背书节点具有交易提案系统接口，从而背书节点可通过调用该系统接口对从客户端节点接收的交易提案进行预执行并进行数字签名，并在预执行之后将预执行结果和数字签名返回给所述客户端节点。所述客户端节点在从各个背书节点接收到交易预执行结果和签名之后，将其发送给排序节点。排序节点用于对交易进行排序、并将经排序的交易按照固定的时间间隔打包成区块发送给管理节点。管理节点收到区块之后将区块广播给每个提交节点。提交节点收到区块之后验证区块中每个交易的执行状态，在区块的每个交易中标记其执行状态，然后将区块加入本节点的账本数据中(即，提交区块)。其中，每个对等节点都是提交节点，即，每个对等节点本地都包括通道的账本数据。
对等节点具有系统自带的查询链码(Query System Chaincode，qscc)，当对等节点需要查询账本数据时，可通过调用该qscc系统链码，查询本地账本数据，所述账本数据包括交易数据、区块数据等。
然而，当链下用户希望查询通道中的目标账本数据时，所述目标账本数据例如为交易，链下用户通常希望获取该交易的交易内容及该交易的执行状态。现有的方法是，用户获取Fabric区块链的全量账本数据的访问授权，启动一个对等节点，以该对等节点加入所述通道，同步通道中的账本数据。图1示意示出新启动的对等节点的查询操作过程。 图1中最上层的三个方框表示该对等节点初始获取的账本数据中的多个区块，这里示意示出区块0-区块2，其中区块0表示创世块，区块0、区块1和区块2是顺序相连的。每个区块中包括顺序排列的多个交易(如每个方框中的页面所示)，每个交易中记录有该交易在被预执行时获取的读写集。所述读写集即为背书节点在预执行交易时获取的预执行结果，所述预执行结果中包括对区块链中各个参数的读取操作的集合、以及对区块链中各个参数的写操作集合。该多个交易并不是都成功执行，但是在初始获取的账本数据中并不包括各个交易的执行状态。
由于通道中的账本数据中的各个区块中的交易需要基于前序区块确定的世界状态来确定是否能够成功执行，因此，该对等节点在同步所述通道中的账本数据之后，需要执行从创世块开始到目标账本数据所在区块的全部区块中的交易，才可以获取目标交易的执行状态，该执行过程的耗时与目标区块或交易所在区块链高度(即区块编号)线性相关，即，目标区块的高度越高，耗时越多。如图1中所示，假设用户希望查询区块2中的某个交易，其需要通过对等节点执行图1中的①、②、③三个计算步骤。首先，在第①步骤，如图中标注了①的箭头所示，验证区块0中各个交易的执行状态。具体是，按照区块0中的各个交易的顺序分别验证各个交易的读写集是否能成功执行。基于各个交易的排序，有可能前序交易的执行改变了某个参数的值，从而使得后续交易的读写失败，在该情况下，后续交易未能成功执行，该对等节点在验证时就将该后续交易标记为“0”，以指示该交易未能成功执行。如果交易的读写不与前序交易的读写冲突，可以成功执行，该对等节点就将该交易标记为“1”，以指示该交易成功执行。
在完成第①步骤，即，验证了区块0中各个交易的执行状态之后，基于由区块0中的各个交易的执行确定的各个参数(即世界状态)，如图中的以②标注的箭头所示，执行第②步骤。在该第②步骤中，对等节点基于当前的世界状态顺序验证区块1中各个交易是否能成功执行，并以“0”或“1”对各个交易分别进行标记(如以②标注的箭头指向的区块1中所示)。
之后，在完成第②步骤之后，类似地，如图中的以③标注的箭头所示，执行第③步骤。在该第③步骤中，对等节点基于当前的世界状态顺序验证区块2中各个交易是否能成功执行，并对各个交易分别进行标记(如以③标注的箭头指向的区块2中所示)，直到执行到用户需要查询的区块2中的目标交易。
通常，用户对Fabric区块链的查询需求是低频需求，因此，在获取目标交易的执行状态之后，为了不占用机器资源，用户设备中通常删除对等节点配置，从而，当用户再 次需要查询Fabric区块链的账本数据时，仍需要再次执行上述整个过程。
因此，需要一种更有效的查询Fabric区块链中账本数据的方案。
发明内容
本说明书实施例旨在提供一种更有效的查询Fabric区块链账本数据的方案，以解决现有技术中的不足。
为实现上述目的，本说明书一个方面提供一种查询Fabric区块链账本数据的方法，所述Fabric区块链中包括客户端节点和背书节点，所述背书节点中包括TEE，所述方法由客户端节点执行，包括：向所述背书节点发送交易提案，所述交易提案用于请求查询第一账本数据；从所述背书节点接收对所述交易提案的预执行结果及TEE签名，其中，所述预执行结果中包括对所述第一账本数据的查询结果。
在一种实施方式中，所述方法还包括：在从所述背书节点接收对所述交易提案的预执行结果及TEE签名之后，对所述TEE签名进行验证。
在一种实施方式中，所述方法还包括：在向所述背书节点分别发送交易提案之前，从用户的用户设备接收对所述第一账本数据的查询；确定所述用户是否具有对所述第一账本数据的查询权限；所述向所述背书节点发送交易提案包括，在确定所述用户具有对所述第一账本数据的查询权限的情况下，向所述背书节点发送交易提案。
在一种实施方式中，所述方法还包括：在从所述背书节点接收对所述交易提案的预执行结果及TEE签名之后，将所述预执行结果及TEE签名发送给所述用户设备。
在一种实施方式中，所述第一账本数据为区块数据或交易数据。
本说明书另一方面提供一种查询Fabric区块链账本数据的方法，所述Fabric区块链中包括客户端节点和背书节点，所述背书节点中包括TEE，所述方法由所述背书节点执行，包括：从客户端节点接收交易提案，所述交易提案用于请求查询第一账本数据；通过TEE预执行所述交易提案，以获取对所述交易提案的预执行结果，其中，所述预执行结果中包括对所述第一账本数据的查询结果；通过TEE对所述预执行结果签名；将所述预执行结果及所述签名发送给所述客户端节点。
在一种实施方式中，通过TEE预执行所述交易提案包括，通过TEE确定所述交易提案的发起账户是否具有对所述第一账本数据的查询权限，在确定所述发起账户具有查询权限的情况中，通过TEE从本地读取所述查询结果。
在一种实施方式中，通过TEE预执行所述交易提案包括，通过TEE从本地读取所述查询结果，通过TEE对所述查询结果进行验证。
本说明书另一方面提供一种查询Fabric区块链账本数据的装置，所述Fabric区块链中包括客户端节点和背书节点，所述背书节点中包括TEE，所述装置部署于客户端节点，包括：第一发送单元，配置为，向所述背书节点发送交易提案，所述交易提案用于请求查询第一账本数据；第一接收单元，配置为，从所述背书节点接收对所述交易提案的预执行结果及TEE签名，其中，所述预执行结果中包括对所述第一账本数据的查询结果。
在一种实施方式中，所述装置还包括：验证单元，配置为，在从所述背书节点接收对所述交易提案的预执行结果及TEE签名之后，对所述TEE签名进行验证。
在一种实施方式中，所述装置还包括：第二接收单元，配置为，在向所述背书节点分别发送交易提案之前，从用户的用户设备接收对所述第一账本数据的查询；确定单元，配置为，确定所述用户是否具有对所述第一账本数据的查询权限；所述第一发送单元还配置为，在确定所述用户具有对所述第一账本数据的查询权限的情况下，向所述背书节点发送交易提案。
在一种实施方式中，所述装置还包括：第二发送单元，配置为，在从所述背书节点接收对所述交易提案的预执行结果及TEE签名之后，将所述预执行结果及TEE签名发送给所述用户设备。
本说明书另一方面提供一种查询Fabric区块链账本数据的装置，所述Fabric区块链中包括客户端节点和背书节点，所述背书节点中包括TEE，所述装置部署于所述背书节点，包括：接收单元，配置为，从客户端节点接收交易提案，所述交易提案用于请求查询第一账本数据；预执行单元，配置为，通过TEE预执行所述交易提案，以获取对所述交易提案的预执行结果，其中，所述预执行结果中包括对所述第一账本数据的查询结果；签名单元，配置为，通过TEE对所述预执行结果签名；发送单元，配置为，将所述预执行结果及所述签名发送给所述客户端节点。
在一种实施方式中，所述预执行单元包括，确定子单元，配置为，通过TEE确定所述交易提案的发起账户是否具有对所述第一账本数据的查询权限，第一读取子单元，配置为，在确定所述发起账户具有查询权限的情况中，从本地读取所述查询结果。
在一种实施方式中，所述预执行单元包括，第二读取子单元，配置为，通过TEE从本地读取所述查询结果，验证子单元，配置为，通过TEE对所述查询结果进行验证。
本说明书另一方面提供一种计算机可读存储介质，其上存储有计算机程序，当所述计算机程序在计算机中执行时，令计算机执行上述任一项方法。
本说明书另一方面提供一种计算设备，包括存储器和处理器，所述存储器中存储有可执行代码，所述处理器执行所述可执行代码时，实现上述任一项方法。
通过本说明书实施例提供的Fabric区块链查询方案，查询发起方可快速高效地获取链上账本数据并可验证该账本数据的真实性，而无需运行独立的对等节点以及等待对等节点同步验证多个区块，大大节省了查询时间；查询发起方只需要获取目标区块或交易的数据授权即可进行所述查询，而不需要获取全量账本授权；另外，通过在Fabric区块链中使用TEE节点作为背书节点，可通过该TEE硬件和硬件中的算法来保证该TEE节点的查询结果的真实性，而不需要同时通过多个背书节点进行账本数据查询、并基于多个背书节点的查询结果的一致性来确定查询结果的真实性。
附图说明
通过结合附图描述本说明书实施例，可以使得本说明书实施例更加清楚：
图1示意示出新启动的对等节点的查询操作过程；
图2示出根据本说明书实施例的Fabric区块链查询系统的示意图；
图3示出根据本说明书实施例的一种查询Fabric区块链账本数据的方法流程图；
图4示出根据本说明书另一实施例的一种查询Fabric区块链账本数据的方法流程图；
图5示出根据本说明书实施例的一种查询Fabric区块链账本数据的装置500；
图6示出根据本说明书实施例的一种查询Fabric区块链账本数据的装置600。
具体实施方式
下面将结合附图描述本说明书实施例。
图2示出根据本说明书实施例的Fabric区块链查询系统的示意图。如图2中所示，所述查询系统中包括用户设备21、管理设备22和Fabric区块链23。其中，用户设备21可以为Fabric区块链的链下设备，其可以为Fabric区块链的使用用户的设备，其它区块链的节点设备、或者用于在多个区块链之间中转消息的中继器的设备等等，在此不作限定。管理设备22向用户设备21提供对Fabric区块链的账本数据的查询服务。管理 设备22本身是Fabric区块链的具有账本数据查询权限的客户端节点。Fabric区块链23在图2中示意示出为包括对等节点1-4。其中，节点2为Fabric区块链23中的背书节点，其中包括可信执行环境(Trusted Execution Environment，TEE)。所述TEE例如可以为通过SGX、Trust Zone等技术生成的可信执行环境。
用户设备21在通过管理设备22查询区块链23账本数据之前，可首先对节点2中的TEE进行验证。具体是，用户设备21可通过管理设备22的中转向TEE发送验证请求。TEE在接收所述验证请求之后，基于其内部机制生成认证信息，并将该认证信息及TEE的硬件公钥经管理设备22的中转发送给用户设备21。所述认证信息例如包括所述TEE的签名信息、硬件信息和软件信息等。其中，所述签名信息例如通过TEE的硬件密钥生成；所述硬件信息例如包括，各种硬件的指标，比如CPU主频，内存容量等等；所述软件信息包括各个程序的代码哈希值、代码名称、版本、运行日志等。如本领域技术人员所知，TEE可通过内存硬件执行对其中运行程序的“测量”，例如获取该程序的代码哈希值、该程序在特定执行点的内存占有的哈希值等等，并在所述认证信息中包括对所述程序的“测量”信息，由于该“测量”信息由该TEE自身实体(内存硬件)执行，而不涉及任何软件、操作系统，因此是真实可信的。用户设备21在接收到所述认证信息之后，可把所述认证信息发送给TEE的远程认证服务器，从而从所述服务器接收到对所述TEE的验证结果。所述验证结果包括所述TEE的身份验证、及对所述TEE内部执行程序的验证等等。从而，用户设备21基于该验证结果可确定TEE是可信的，通过该TEE的查询结果是可信的。同时，用户设备21在本地保存TEE的硬件公钥，以用于后续对TEE的签名的验证。
用户设备21对应的用户(例如用户1)在进行对Fabric区块链23的账本数据(例如区块n中的交易m)的查询之前，向管理设备22申请对账本数据的查询权限，管理设备22在对用户1的申请进行验证之后，对用户1授权所述查询权限，并在本地记录对用户1的授权，例如，可记录用户1的账户标识(例如账户1)和用户1被授权的权限。
在进行上述准备工作之后，用户1可通过用户设备21向管理设备22发送查询请求，以用于查询例如区块n中的交易m及交易m的执行状态。管理设备22在接收到该查询请求之后，首先确定用户1是否具备对交易m的查询权限。在基于本地的记录确定用户1具有对交易m的查询权限之后，向节点2发送交易提案(例如交易A提案)用于对区块n中的交易m进行查询。节点2在接收到交易A提案之后，通过TEE在其本地的账 本数据中查询到区块n中的交易m的交易数据和该交易m的执行状态作为查询结果，基于该查询结果生成交易A的预执行结果，通过TEE私钥对交易A的预执行结果进行签名，并将交易A的预执行结果及其TEE签名发送给管理设备22。管理设备22在接收到所述预执行结果和TEE签名之后，将该预执行结果和TEE签名提供给用户设备21。用户设备21在接收到预执行结果和TEE签名之后，可使用预先获取的TEE公钥验证所述TEE签名，从而验证所述预执行结果的真实性，在验证通过的情况中，用户设备21可从预执行结果中获取真实查询结果。
下面将对上述区块链账本数据查询过程进行详细描述。
图3示出根据本说明书实施例的一种查询Fabric区块链账本数据的方法流程图。如图3中所示，所述方法由图2中的用户设备21、管理设备22和节点2共同执行，其中用户设备21例如为用户1的设备。
首先在步骤S302，用户设备21向管理设备22发送查询请求，该查询请求用于请求查询Fabric区块链中的账本数据。
如上文所述，所述账本数据可以为区块或者交易。例如，所述查询请求用于查询Fabric区块链中区块n中的交易m。所述查询请求例如由用户1使用其账户1发出。
在步骤S304，管理设备22检查账户1的查询权限。
如上文所述的准备过程，用户1预先获取管理设备22的对预定账本数据的查询权限，并且，管理设备22在本地记录了账户1对应的查询权限。例如，管理设备22中记录了账户1具有对交易m的查询权限。管理设备22在接收到上述查询请求之后，在本地读取账户1的查询权限，以检查账户1是否具有对交易m的查询权限。
在步骤S306，管理设备22向节点2发送交易提案。
所述交易提案(例如上述交易A提案)用于调用节点的qscc系统链码，以查询指定账本数据，例如查询区块n中的交易m。
在步骤S308，节点2通过TEE获取查询结果。
节点2在从管理设备22接收到上述交易提案之后，通过TEE对该交易A进行预执行，所述预执行即执行交易A，但是并不将获取的交易执行结果存入本地账本中。具体是，TEE根据交易A的交易内容执行qscc系统链码，在本地账本中读取区块n中的交易m及交易m的执行状态(即，是否成功执行)作为查询结果，这里，节点2已经在 之前对区块n的提交时验证了区块n中每个交易的执行状态并记录了所述执行状态，即，节点2中记录的账本数据如图1中最下部的各个区块所示包括区块中各个交易的执行状态。因此，TEE可从本地直接读取交易m的执行状态，而不需要如图1中所示从创世块开始执行每个区块中的每个交易直到交易m，从而大大节省了查询时间。
在一种实施方式中，为了保证区块的真实性，节点2可在每次提交区块时还基于完整性校验机制进行操作，例如，节点2中的TEE可使用TEE私钥对该区块进行签名，并将区块及其TEE签名一起存入账本中。因此，TEE在获取上述查询结果的同时还获取区块n的数据及其TEE签名。可以理解，所述完整性校验机制不限于对每个区块进行签名，还可以通过其它方式来保证数据完整性，例如，TEE可对每个交易的读写集及其执行状态进行签名，以保证每个交易的数据完整性。
在步骤S310，节点2通过TEE验证查询结果。
TEE在获取区块n及其TEE签名之后，使用TEE公钥对该TEE签名进行验证，以确保所获取的区块n为未经篡改的真实数据，从而可保证其中的交易m及其状态的真实性。可以理解，在其它形式的完整性交易机制中，TEE中可相应对查询结果进行验证，例如，节点2中在每次提交区块时在账本中存入对每个交易的签名，则TEE可对之前存入的交易m的TEE签名进行验证，以验证查询到的交易m的数据完整性。
在步骤S312，生成对交易A的预执行结果及其TEE签名。
TEE在进行上述验证过程之后，如果确定上述查询结果为真实的查询结果，则将该真实的查询结果记录到对交易A的预执行的读写集中，从而生成交易A的预执行读写集。之后，TEE使用自身的硬件私钥对该读写集进行签名，具体是，TEE计算该读写集的哈希值，并使用自身的硬件私钥对该读写集进行加密，从而获取对该读写集的签名(即数字签名)。TEE在进行签名之后将所述读写集及其TEE签名输出给节点2。
在步骤S314，节点2将所述预执行结果及其TEE签名返回给管理设备22。
在步骤S316，管理设备22将所述预执行结果及其TEE签名返回给用户设备21。
在步骤S318，用户设备21验证所述TEE签名。
用户设备21在从管理设备22接收到所述预执行结果及其TEE签名之后，使用预先获取的TEE公钥对所述TEE签名进行验证。具体是，用户设备21使用TEE公钥对TEE签名进行解密，计算预执行结果的哈希值，并比较解密获取的数据与所述哈希值是否一致，如果一致，则对TEE签名的验证通过。在验证通过之后，可确认该预执行结果确 实是通过TEE生成的预执行结果，从而可确认其中包括的查询数据为真实查询数据。
在步骤S320，从所述预执行结果中获取真实查询数据。
具体是，用户设备21可基于预执行结果中的读写集的预定数据格式，从其中的读集合中找到在预执行交易A时所读取的第一账本数据，并且由于本说明书实施例提供的TEE硬件和该TEE硬件执行的算法，可保证该第一账本数据为真实账本数据。
图4示出根据本说明书另一实施例的一种查询Fabric区块链账本数据的方法流程图。
图4所示方法与图3所示方法不同在于，用户设备21可以不通过管理设备22，而是直接通过向Fabric区块链的对等节点发送交易提案，从而获取账本数据。在执行该方法之前，用户1可以以账户1向节点2申请账本数据查询权限，节点2在对账户1授权账本数据查询权限之后，可在TEE中进行记录。并且用户设备21可通过向节点2发送TEE验证请求对TEE进行验证、并预先获取TEE的公钥。
在进行上述准备工作之后，首先，在步骤S402，用户设备21向节点2发送交易提案，该交易提案用于调用该通道中提供的账本数据查询链码。该查询链码中调用节点2中的qscc系统链码，以查询指定账本数据，例如查询区块n中的交易m。用户设备21例如通过用户1的账户1发送所述交易提案。
在步骤S404，节点2检查账户1的查询权限。
节点2在接收到上述交易提案之后，预执行所述交易提案，即预执行所述账本数据查询链码。在该预执行过程中，节点2根据账本数据查询链码的代码首先检查账户1的查询权限。如上文所述的准备过程，节点2对账户1授权查询权限，会在TEE中进行记录，例如，TEE中记录了账户1具有对交易m的查询权限。从而，TEE可以读取账户1的查询权限，以检查账户1是否具有对交易m的查询权限。
在步骤S406，节点2通过TEE获取查询结果。
接着上文中TEE对账本数据查询链码的预执行过程，如果TEE确定账户1具有对交易m的查询权限，则根据账本数据查询链码中对qscc系统链码的调用，执行qscc系统链码，从而从本地账本中读取交易m的交易内容及执行状态作为查询结果，另外，与上文类似地，还读取区块n及其TEE签名。
步骤S408-S416可参考上文对步骤S310-S320的描述，在此不再赘述。
图5示出根据本说明书实施例的一种查询Fabric区块链账本数据的装置500，所述 Fabric区块链中包括客户端节点和背书节点，所述背书节点中包括TEE，所述装置部署于客户端节点，包括：第一发送单元51，配置为，向所述背书节点发送交易提案，所述交易提案用于请求查询第一账本数据；第一接收单元52，配置为，从所述背书节点接收对所述交易提案的预执行结果及TEE签名，其中，所述预执行结果中包括对所述第一账本数据的查询结果。
在一种实施方式中，所述装置500还包括：验证单元53，配置为，在从所述背书节点接收对所述交易提案的预执行结果及TEE签名之后，对所述TEE签名进行验证。
在一种实施方式中，所述装置500还包括：第二接收单元54，配置为，在向所述背书节点分别发送交易提案之前，从用户的用户设备接收对所述第一账本数据的查询；确定单元55，配置为，确定所述用户是否具有对所述第一账本数据的查询权限；所述第一发送单元51还配置为，在确定所述用户具有对所述第一账本数据的查询权限的情况下，向所述背书节点发送交易提案。
在一种实施方式中，所述装置500还包括：第二发送单元56，配置为，在从所述背书节点接收对所述交易提案的预执行结果及TEE签名之后，将所述预执行结果及TEE签名发送给所述用户设备。
图6示出根据本说明书实施例的一种查询Fabric区块链账本数据的装置600，所述Fabric区块链中包括客户端节点和背书节点，所述背书节点中包括TEE，所述装置部署于所述背书节点，包括：接收单元61，配置为，从客户端节点接收交易提案，所述交易提案用于请求查询第一账本数据；预执行单元62，配置为，通过TEE预执行所述交易提案，以获取对所述交易提案的预执行结果，其中，所述预执行结果中包括对所述第一账本数据的查询结果；签名单元63，配置为，通过TEE对所述预执行结果签名；发送单元64，配置为，将所述预执行结果及所述签名发送给所述客户端节点。
在一种实施方式中，所述预执行单元62包括，确定子单元621，配置为，通过TEE确定所述交易提案的发起账户是否具有对所述第一账本数据的查询权限，第一读取子单元622，配置为，在确定所述发起账户具有查询权限的情况中，从本地读取所述查询结果。
在一种实施方式中，所述预执行单元62包括，第二读取子单元623，配置为，通过TEE从本地读取所述查询结果，验证子单元624，配置为，对所述查询结果进行验证。
本说明书另一方面提供一种计算机可读存储介质，其上存储有计算机程序，当所 述计算机程序在计算机中执行时，令计算机执行上述任一项方法。
本说明书另一方面提供一种计算设备，包括存储器和处理器，所述存储器中存储有可执行代码，所述处理器执行所述可执行代码时，实现上述任一项方法。
通过本说明书实施例提供的Fabric区块链查询方案，查询发起方可快速高效地获取链上账本数据并可验证该账本数据的真实性，而无需运行独立的对等节点以及等待对等节点同步验证多个区块，大大节省了查询时间；查询发起方只需要获取目标区块或交易的数据授权即可进行所述查询，而不需要获取全量账本授权；另外，通过在Fabric区块链中使用TEE节点作为背书节点，可通过该TEE硬件和硬件中的算法来保证该TEE节点的查询结果的真实性，而不需要同时通过多个背书节点进行账本数据查询、并基于多个背书节点的查询结果的一致性来确定查询结果的真实性。
需要理解，本文中的“第一”，“第二”等描述，仅仅为了描述的简单而对相似概念进行区分，并不具有其他限定作用。
本说明书中的各个实施例均采用递进的方式描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。尤其，对于系统实施例而言，由于其基本相似于方法实施例，所以描述的比较简单，相关之处参见方法实施例的部分说明即可。
上述对本说明书特定实施例进行了描述。其它实施例在所附权利要求书的范围内。在一些情况下，在权利要求书中记载的动作或步骤可以按照不同于实施例中的顺序来执行并且仍然可以实现期望的结果。另外，在附图中描绘的过程不一定要求示出的特定顺序或者连续顺序才能实现期望的结果。在某些实施方式中，多任务处理和并行处理也是可以的或者可能是有利的。
本领域普通技术人员应该还可以进一步意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、计算机软件或者二者的结合来实现，为了清楚地说明硬件和软件的可互换性，在上述说明中已经按照功能一般性地描述了各示例的组成及步骤。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。本领域普通技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。其中，软件模块可以置于随机存储器(RAM)、内存、只读存储器(ROM)、电可编程ROM、电可擦除可编程ROM、寄存器、硬盘、可移动磁盘、CD-ROM、或技术领域内所公知的任意其它形式的 存储介质中。
以上所述的具体实施方式，对本发明的目的、技术方案和有益效果进行了进一步详细说明，所应理解的是，以上所述仅为本发明的具体实施方式而已，并不用于限定本发明的保护范围，凡在本发明的精神和原则之内，所做的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。

Claims (18)

  1. 一种查询Fabric区块链账本数据的方法，所述Fabric区块链中包括客户端节点和背书节点，所述背书节点中包括TEE，所述方法由客户端节点执行，包括：
    向所述背书节点发送交易提案，所述交易提案用于请求查询第一账本数据；
    从所述背书节点接收对所述交易提案的预执行结果及TEE签名，其中，所述预执行结果中包括对所述第一账本数据的查询结果。
  2. 根据权利要求1所述的方法，还包括：在从所述背书节点接收对所述交易提案的预执行结果及TEE签名之后，对所述TEE签名进行验证。
  3. 根据权利要求1所述的方法，还包括：
    在向所述背书节点分别发送交易提案之前，从用户的用户设备接收对所述第一账本数据的查询；
    确定所述用户是否具有对所述第一账本数据的查询权限；
    所述向所述背书节点发送交易提案包括，在确定所述用户具有对所述第一账本数据的查询权限的情况下，向所述背书节点发送交易提案。
  4. 根据权利要求3所述的方法，还包括：
    在从所述背书节点接收对所述交易提案的预执行结果及TEE签名之后，将所述预执行结果及TEE签名发送给所述用户设备。
  5. 根据权利要求1所述的方法，其中，所述第一账本数据为区块数据或交易数据。
  6. 一种查询Fabric区块链账本数据的方法，所述Fabric区块链中包括客户端节点和背书节点，所述背书节点中包括TEE，所述方法由所述背书节点执行，包括：
    从客户端节点接收交易提案，所述交易提案用于请求查询第一账本数据；
    通过TEE预执行所述交易提案，以获取对所述交易提案的预执行结果，其中，所述预执行结果中包括对所述第一账本数据的查询结果；
    通过TEE对所述预执行结果签名；
    将所述预执行结果及所述签名发送给所述客户端节点。
  7. 根据权利要求6所述的方法，其中，通过TEE预执行所述交易提案包括，通过TEE确定所述交易提案的发起账户是否具有对所述第一账本数据的查询权限，在确定所述发起账户具有查询权限的情况中，通过TEE从本地读取所述查询结果。
  8. 根据权利要求6所述的方法，其中，通过TEE预执行所述交易提案包括，通过TEE从本地读取所述查询结果，通过TEE对所述查询结果进行验证。
  9. 一种查询Fabric区块链账本数据的装置，所述Fabric区块链中包括客户端节点 和背书节点，所述背书节点中包括TEE，所述装置部署于客户端节点，包括：
    第一发送单元，配置为，向所述背书节点发送交易提案，所述交易提案用于请求查询第一账本数据；
    第一接收单元，配置为，从所述背书节点接收对所述交易提案的预执行结果及TEE签名，其中，所述预执行结果中包括对所述第一账本数据的查询结果。
  10. 根据权利要求9所述的装置，还包括：验证单元，配置为，在从所述背书节点接收对所述交易提案的预执行结果及TEE签名之后，对所述TEE签名进行验证。
  11. 根据权利要求9所述的装置，还包括：
    第二接收单元，配置为，在向所述背书节点分别发送交易提案之前，从用户的用户设备接收对所述第一账本数据的查询；
    确定单元，配置为，确定所述用户是否具有对所述第一账本数据的查询权限；
    所述第一发送单元还配置为，在确定所述用户具有对所述第一账本数据的查询权限的情况下，向所述背书节点发送交易提案。
  12. 根据权利要求11所述的装置，还包括：
    第二发送单元，配置为，在从所述背书节点接收对所述交易提案的预执行结果及TEE签名之后，将所述预执行结果及TEE签名发送给所述用户设备。
  13. 根据权利要求9所述的装置，其中，所述第一账本数据为区块数据或交易数据。
  14. 一种查询Fabric区块链账本数据的装置，所述Fabric区块链中包括客户端节点和背书节点，所述背书节点中包括TEE，所述装置部署于所述背书节点，包括：
    接收单元，配置为，从客户端节点接收交易提案，所述交易提案用于请求查询第一账本数据；
    预执行单元，配置为，通过TEE预执行所述交易提案，以获取对所述交易提案的预执行结果，其中，所述预执行结果中包括对所述第一账本数据的查询结果；
    签名单元，配置为，通过TEE对所述预执行结果签名；
    发送单元，配置为，将所述预执行结果及所述签名发送给所述客户端节点。
  15. 根据权利要求14所述的装置，其中，所述预执行单元包括，确定子单元，配置为，通过TEE确定所述交易提案的发起账户是否具有对所述第一账本数据的查询权限，第一读取子单元，配置为，在确定所述发起账户具有查询权限的情况中，通过TEE从本地读取所述查询结果。
  16. 根据权利要求14所述的装置，其中，所述预执行单元包括，第二读取子单元，配置为，通过TEE从本地读取所述查询结果，验证子单元，配置为，通过TEE对所述 查询结果进行验证。
  17. 一种计算机可读存储介质，其上存储有计算机程序，当所述计算机程序在计算机中执行时，令计算机执行权利要求1-8中任一项的所述的方法。
  18. 一种计算设备，包括存储器和处理器，所述存储器中存储有可执行代码，所述处理器执行所述可执行代码时，实现权利要求1-8中任一项所述的方法。
PCT/CN2022/081734 2021-03-30 2022-03-18 查询Fabric区块链账本数据的方法和装置 WO2022206437A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110340135.2A CN112734431B (zh) 2021-03-30 2021-03-30 查询Fabric区块链账本数据的方法和装置
CN202110340135.2 2021-03-30

Publications (1)

Publication Number Publication Date
WO2022206437A1 true WO2022206437A1 (zh) 2022-10-06

Family

ID=75596197

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/081734 WO2022206437A1 (zh) 2021-03-30 2022-03-18 查询Fabric区块链账本数据的方法和装置

Country Status (2)

Country Link
CN (1) CN112734431B (zh)
WO (1) WO2022206437A1 (zh)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112734431B (zh) * 2021-03-30 2021-06-25 支付宝(杭州)信息技术有限公司 查询Fabric区块链账本数据的方法和装置
CN112732801B (zh) * 2021-03-30 2021-08-20 支付宝(杭州)信息技术有限公司 查询Fabric区块链账本数据的方法和装置
CN115001719B (zh) * 2022-08-04 2023-01-03 树根格致科技(湖南)有限公司 隐私数据处理系统、方法、装置、计算机设备及存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109831298A (zh) * 2019-01-31 2019-05-31 阿里巴巴集团控股有限公司 区块链中安全更新密钥的方法及节点、存储介质
CN110266659A (zh) * 2019-05-31 2019-09-20 联想(北京)有限公司 一种数据处理方法和设备
CN110580414A (zh) * 2019-11-08 2019-12-17 支付宝(杭州)信息技术有限公司 基于区块链账户的隐私数据查询方法及装置
CN111241590A (zh) * 2018-11-29 2020-06-05 华为技术有限公司 一种数据库系统、节点和方法
CN112734431A (zh) * 2021-03-30 2021-04-30 支付宝(杭州)信息技术有限公司 查询Fabric区块链账本数据的方法和装置

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110602138B (zh) * 2019-09-26 2021-06-11 腾讯科技（深圳）有限公司 区块链网络的数据处理方法、装置、电子设备及存储介质
CN111629039B (zh) * 2020-05-20 2023-04-18 中国银联股份有限公司 一种区块链共识方法及客户端、背书节点、排序节点
CN111565204B (zh) * 2020-07-16 2021-06-18 百度在线网络技术（北京）有限公司 区块链运行方法、装置、设备及存储介质

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111241590A (zh) * 2018-11-29 2020-06-05 华为技术有限公司 一种数据库系统、节点和方法
CN109831298A (zh) * 2019-01-31 2019-05-31 阿里巴巴集团控股有限公司 区块链中安全更新密钥的方法及节点、存储介质
CN110266659A (zh) * 2019-05-31 2019-09-20 联想(北京)有限公司 一种数据处理方法和设备
CN110580414A (zh) * 2019-11-08 2019-12-17 支付宝(杭州)信息技术有限公司 基于区块链账户的隐私数据查询方法及装置
CN112734431A (zh) * 2021-03-30 2021-04-30 支付宝(杭州)信息技术有限公司 查询Fabric区块链账本数据的方法和装置

Also Published As

Publication number Publication date
CN112734431A (zh) 2021-04-30
CN112734431B (zh) 2021-06-25

Similar Documents

Publication Publication Date Title
WO2022206437A1 (zh) 查询Fabric区块链账本数据的方法和装置
US11258612B2 (en) Method, apparatus, and electronic device for blockchain-based recordkeeping
CN109961292B (zh) 区块链验证码应用方法、设备和存储介质
US10491396B2 (en) Method and server for providing notary service for file and verifying file recorded by notary service
US10372942B1 (en) Method and server for providing notary service for file and verifying file recorded by notary service
US8006084B2 (en) Apparatus and method for managing plurality of certificates
US11017122B2 (en) Method and server for authenticating and verifying file
CN110677376B (zh) 认证方法、相关设备和系统及计算机可读存储介质
US20090055916A1 (en) Secure delegation using public key authentication
WO2022206431A1 (zh) 查询Fabric区块链账本数据的方法和装置
US20220329446A1 (en) Enhanced asset management using an electronic ledger
WO2022206454A1 (zh) 提供跨链消息的方法和装置
CN112235260B (zh) 一种匿名数据存证方法、装置、设备和存储介质
CN111314066B (zh) 基于区块链的数据转移方法、终端及计算机可读存储介质
CN110910110A (zh) 一种数据处理方法、装置及计算机存储介质
WO2022206432A1 (zh) 查询Fabric区块链账本数据的方法和装置
CN111737766B (zh) 一种在区块链中判断数字证书签名数据合法性的方法
CN112926983A (zh) 一种基于区块链的存证交易加密系统及方法
CN110365492A (zh) 一种鉴权方法、系统、设备及介质
CN109698750A (zh) 区块链的区块生成方法、装置、设备及可读存储介质
WO2016165662A1 (zh) 一种手机准数字证书子系统及其系统及其方法
JP6524556B2 (ja) 認証鍵複製システム
Majd et al. Secure and Cost Effective IoT Authentication and Data Storage Framework using Blockchain NFT
CN115001707B (zh) 基于区块链的设备认证方法和相关设备
US20240143730A1 (en) Multi-factor authentication using blockchain

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22778620

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 22778620

Country of ref document: EP

Kind code of ref document: A1