WO2022237123A1

WO2022237123A1 - Method and apparatus for acquiring blockchain data, electronic device, and storage medium

Info

Publication number: WO2022237123A1
Application number: PCT/CN2021/133167
Authority: WO
Inventors: 吴行行; 余逸荣; 邱鸿霖; 陈辰
Original assignee: 蚂蚁区块链科技(上海)有限公司; 支付宝(杭州)信息技术有限公司
Priority date: 2021-05-11
Filing date: 2021-11-25
Publication date: 2022-11-17
Also published as: CN113221166A

Abstract

One or more of the embodiments of the present description provides a method and apparatus for acquiring blockchain data, an electronic device, and a storage medium. The method is applied to a first trusted computing node, and a trusted application runs in a first trusted execution environment (TEE) deployed by the first trusted computing node. The method comprises: acquiring a remote authentication report for an oracle machine service program, the oracle machine service program running in a second TEE; when determined according to the remote authentication report that the oracle machine service program is trustworthy, sending a blockchain data query request acquired from a trusted application to the oracle machine service program, so that the oracle machine service program acquires block data on a target blockchain in response to the blockchain data query request; and receiving block data returned by the oracle machine service program and a digital signature corresponding to the block data, and returning the block data to the trusted application when the digital signature is successfully verified by means of a public key corresponding to the oracle machine service program.

Description

A method, device, electronic device and storage medium for acquiring blockchain data

technical field

One or more embodiments of this specification relate to the field of blockchain technology, and in particular to a method, device, electronic device, and storage medium for acquiring blockchain data.

Background technique

In related technologies, in order to ensure the security of trusted applications running in TEE (Trusted Execution Environment, Trusted Execution Environment) at the operating system level, system call interfaces such as network call interfaces are generally not provided, which leads to Trusted applications in TEE cannot securely access and obtain relevant data on the blockchain.

Contents of the invention

In view of this, one or more embodiments of this specification provide a method, device, electronic device, and storage medium for acquiring blockchain data.

In order to achieve the above purpose, one or more embodiments of this specification provide technical solutions as follows: According to the first aspect of one or more embodiments of this specification, a method for acquiring blockchain data is proposed, and the method is applied to the first A trusted computing node, where a trusted application runs in a first trusted execution environment deployed by the first trusted computing node, the method includes: obtaining a remote authentication report for an oracle service program, and the oracle service The program runs in the second trusted execution environment; when the oracle service program is determined to be credible according to the remote authentication report, send the blockchain data query request obtained from the trusted application to the oracle machine service program, so that the oracle machine service program responds to the block chain data query request, and obtains the block data on the target block chain; receives the block data and the block data returned by the oracle machine service program If the digital signature corresponding to the block data is successfully verified through the public key corresponding to the oracle service program, the block data is returned to the trusted application.

According to the second aspect of one or more embodiments of this specification, a device for acquiring blockchain data is proposed, the device is applied to a first trusted computing node, and the first trusted computing node deployed by the first There is a trusted application running in the trusted execution environment, and the device includes: a report obtaining unit, configured to obtain a remote authentication report for the oracle service program, and the oracle service program runs in the second trusted execution environment; request to send A unit, configured to send a blockchain data query request obtained from the trusted application to the oracle service program when it is determined that the oracle service program is credible according to the remote authentication report, so that The oracle service program obtains the block data on the target block chain in response to the block chain data query request; the data receiving unit is used to receive the block data and the block data returned by the oracle service program. If the digital signature corresponding to the block data is successfully verified through the public key corresponding to the oracle service program, the block data is returned to the trusted application.

According to a third aspect of one or more embodiments of the present specification, an electronic device is provided, including: a processor; a memory for storing processor-executable instructions; wherein, the processor executes the executable instructions In order to realize the above steps of the method for obtaining blockchain data.

According to a fourth aspect of one or more embodiments of the present specification, a computer-readable storage medium is provided, on which executable instructions are stored; wherein, when the instructions are executed by a processor, the above-mentioned acquisition of blockchain data is realized. method steps.

It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the specification.

Description of drawings

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the specification and together with the description serve to explain the principles of the specification.

Fig. 1 is a schematic diagram of a blockchain-related network environment provided in this specification.

Fig. 2 is a network architecture diagram provided in this specification according to an exemplary embodiment.

Fig. 3 is a flow chart of a method for acquiring blockchain data provided in this specification according to an exemplary embodiment.

Fig. 4 is an interaction flowchart of a method for acquiring blockchain data according to an exemplary embodiment provided in this specification.

Fig. 5 is a schematic structural diagram of a device provided by an exemplary embodiment.

Fig. 6 is a block diagram of a device for acquiring blockchain data according to an exemplary embodiment provided in this specification.

Detailed ways

Reference will now be made in detail to the exemplary embodiments, examples of which are illustrated in the accompanying drawings. When the following description refers to the accompanying drawings, the same numerals in different drawings refer to the same or similar elements unless otherwise indicated. Implementations described in the following exemplary embodiments do not represent all implementations consistent with one or more embodiments of this specification. Rather, they are merely examples of apparatuses and methods consistent with aspects of one or more embodiments of the present specification as recited in the appended claims.

It should be noted that in other embodiments, the steps of the corresponding methods are not necessarily performed in the order shown and described in this specification. In some other embodiments, the method may include more or less steps than those described in this specification. In addition, a single step described in this specification may be decomposed into multiple steps for description in other embodiments; multiple steps described in this specification may also be combined into a single step in other embodiments describe.

Please refer to FIG. 1, which is a schematic diagram of a blockchain-related network environment shown in this specification.

In the network environment shown in Figure 1, it may include a client-side computing device 101, a server-side 102, and at least one blockchain system; for example, a blockchain system 103, a blockchain system 104, and a blockchain system 105.

In one embodiment, the client-side computing device 101 may include various types of client-side computing devices; for example, the client-side terminal device may include PC terminal devices, mobile terminal devices, Internet of Things devices, and Other forms of smart devices with some computing power, and so on.

In one embodiment, at least part of the computing devices in the client terminal device 101 can be connected to the server end 102 through various communication networks; for example, the device 1 and device 2 shown in FIG. connected.

It is not difficult to understand that some of the terminal devices in the client-side terminal device 101 may not be connected to the server 102, but directly connected to the blockchain system as a blockchain node through various communication networks; for example, Fig. 1 The device 4 shown in , can be connected to the blockchain system as a blockchain node.

Wherein, the above-mentioned communication network may include a wired and/or wireless communication network; for example, it may be a local area network (Local Area Network, LAN) implemented based on a wired access network or a wireless access network (such as a mobile cellular network) provided by an operator, Wide Area Network (Wide Area Network, WAN), the Internet, or a combination thereof.

In one embodiment, the client-side computing device 101 may further include one or more user-side servers; for example, the device 5 shown in FIG. 1 . At least part of the computing devices in the client-side terminal device 101 can be connected to the user-side server, and the user-side server can be further connected to the above-mentioned server 102; for example, the connection between device 1 and device 2 shown in FIG. 1 To the device 5, the device 5 is further connected to the server end 102.

In one embodiment, the above-mentioned user-side server may be implemented by a service entity that has established a user account system; the above-mentioned service entity may include an operating entity that provides various online and/or offline service carriers for users;

Wherein, the above-mentioned service carrier may include a service carrier in the form of software, and may also include a service carrier in the form of hardware.

In one embodiment, the above-mentioned service carrier may include various client softwares that provide online Internet services; for example, websites, webpages, APPs, and the like.

In one embodiment, the above-mentioned service carrier may also include various smart devices deployed offline and capable of providing offline services; for example, smart express cabinets deployed in residential areas, office areas, and public places.

Correspondingly, the above-mentioned operating entity may include the operator corresponding to the above-mentioned service carrier; for example, the above-mentioned operating entity may include individuals, organizations, companies, enterprises, etc. that operate and manage the above-mentioned service carrier.

In one embodiment, the server end 102 can also be connected to one or more blockchain systems through various communication networks; for example, the server end 102 shown in FIG. Block chain system 104 and block chain system 105, and so on.

In one embodiment, each blockchain system can maintain one or more blockchains (for example, public blockchains, private blockchains, consortium blockchains, etc.), and includes a or multiple blockchain nodes of multiple blockchains; for example, blockchain node 1, blockchain node 2, blockchain node 3, blockchain node 4, blockchain Node i, etc. can jointly host one or more blockchains. Cross-chain data access can also be performed between the blockchains contained in each blockchain system and between each blockchain system.

In one embodiment, blockchain nodes may include full nodes and light nodes. The full node can fully download the blockchain transactions contained in each block in the blockchain, and can perform consensus verification on the blockchain transactions contained in each blockchain according to the blockchain consensus algorithm carried .

The light node does not need to download the complete blockchain, but can only download the block header data of each block in the blockchain, and use the data contained in the block header as the verification root to verify the blockchain authenticity of the transaction. Light nodes can attach to full nodes to access more functions of the blockchain.

For example, each blockchain node in the blockchain system 103 shown in Figure 1 can be used as a full node; and the device 4 directly connected to the blockchain system shown in Figure 1 can be used as a light node, Attached to each full node in the blockchain system 103.

In one embodiment, the blockchain node can be a physical device, or a virtual device implemented in a server or a server cluster; for example, a blockchain node device can be a physical host in a server cluster, or it can be It is a virtual machine created after virtualizing the hardware resources carried by a server or server cluster based on virtualization technology. Each blockchain node can be connected together through various types of communication methods (such as TCP/IP) to form a network to carry one or more blockchains.

In one embodiment, the server end 102 may include a BaaS platform (also referred to as a BaaS cloud) for providing Blockchain as a Service (BaaS, Blockchain as a Service). The BaaS platform can provide a simple way for client-side computing devices connected to the BaaS platform by providing pre-written software for activities that occur on the blockchain (such as subscriptions and notifications, user verification, database management, and remote updates). Easy to use, one-click deployment, fast verification, flexible and customizable blockchain services, which can accelerate the development, testing, and launch of blockchain business applications, and help the implementation of blockchain business application scenarios in various industries.

For example, in one example, the BaaS platform can provide software such as MQ (Message Queue, message queue) service; the client-side computing device connected to the BaaS platform can subscribe to a block chain system connected to the BaaS platform. A smart contract deployed on a block chain generates contract events on the block chain after the execution is triggered; and the BaaS platform can monitor the events generated by the smart contract on the block chain after the execution is triggered, and then based on the MQ service related The software of the contract adds the contract event to the message queue in the form of a notification message, so that the client side computing device subscribed to the message queue can get the notification related to the above contract event.

In one implementation, the BaaS platform can also provide enterprise-level platform services based on blockchain technology to help enterprise-level customers build a safe and stable blockchain environment and easily manage the deployment, operation, and maintenance of blockchain and development.

For example, in one example, the BaaS platform can implement rich security policies and a multi-tenant isolation environment based on cloud technology, provide advanced security protection based on chip encryption technology, and provide rapid expansion based on highly reliable data storage. End-to-end high-availability services that will not be interrupted; in another example, enhanced management capabilities can be provided to help customers build enterprise-level blockchain network environments; and local Support, support mainstream open source blockchain technologies such as Hyperledger Fabric and Enterprise Ethereum-Quorum to build an open and inclusive technology ecosystem.

In the embodiment of this specification, the device 5 as the client-side computing device 101 provides trusted computing services, and its deployed TEE runs trusted applications that can provide users with trusted computing services, while the server-side 102 includes BaaS The oracle service is provided on the platform, and the oracle service program corresponding to the oracle service runs in the TEE deployed on the server side 102. From another perspective, this is equivalent to the client-side computing device 101 shown in FIG. 1 The device 5 directly connected to the server 102 can be regarded as the first trusted computing node involved in this specification, and the server 102 can be regarded as the second trusted computing node running the oracle service program involved in this specification.

Fig. 2 is a network architecture diagram shown in this specification according to an exemplary embodiment, the network architecture includes a first trusted computing node, a second trusted computing node and a target block chain, wherein the first trusted computing node may be The second trusted computing node, or the first trusted computing node is different from the second trusted computing node, the first trusted computing node is deployed with a first trusted execution environment, and the first trusted execution environment runs a trusted application, a second trusted execution environment is deployed in the second trusted computing node, and an oracle service program runs in the second trusted execution environment. The target blockchain refers to the blockchain data query request sent by the trusted application. Indicates the blockchain system where the acquired block data is located, including several blockchain nodes. The oracle service program can establish a network with the blockchain node corresponding to a blockchain system (the target blockchain shown in Figure 2) The connection realizes information interaction, and it is also possible to establish network connections with multiple blockchain nodes corresponding to different blockchain systems at the same time to realize information interaction.

A communication service program is also running in the first trusted execution environment. On the one hand, the first trusted computing node can realize information interaction through the local call between the communication service program and the trusted application; The oracle service program establishes a network connection to realize information interaction, and when the first trusted computing node and the second trusted computing node are the same hardware node, it can be considered that the first trusted execution environment and the second trusted The execution environment is deployed on the first trusted computing node, that is, the communication service program and the oracle service program run on the same hardware node, so the communication service program and the oracle service program can be directly called locally to realize information interaction without Establishing a network connection, of course, communication can also be performed in the form of establishing a network connection. In addition, it should be pointed out that when the first trusted computing node and the second trusted computing node are the same hardware node, the second trusted execution environment and the first trusted execution environment may be the same trusted execution environment, or The second trusted execution environment is different from the first trusted execution environment, which is not limited in this specification.

The trusted execution environment (TEE) involved in the embodiments of this specification can provide a secure execution environment for software. The TEE is a secure extension based on CPU hardware and is a trusted execution environment completely isolated from the outside. TEE was first proposed by Global Platform to solve the security isolation of resources on mobile devices, and parallel to the operating system to provide applications with a trusted and secure execution environment. At present, the industry is very concerned about TEE solutions. Almost all mainstream chip and software alliances have their own TEE solutions, such as TPM (Trusted Platform Module) in software and Intel SGX and ARM Trustzone (Trusted Platform Module) in hardware. Trust Zone) and AMD PSP (Platform Security Processor, Platform Security Processor), etc.

Take Intel SGX (hereinafter referred to as SGX) technology as an example. Trusted computing nodes can create enclaves (enclaves or enclaves) based on SGX technology as TEEs for executing blockchain transactions. Among them, the blockchain node uses the newly added processor instructions in the CPU to allocate a part of the EPC (Enclave Page Cache, enclave page cache or enclave page cache) in the memory to reside in the above enclave. The memory area corresponding to the above EPC is encrypted by the memory encryption engine MEE (Memory Encryption Engine) inside the CPU. The content in the memory area (code and data in the enclave) can only be decrypted in the CPU core and is used for encryption and decryption. The key is only generated and stored in the CPU when the EPC starts up. It can be seen that the security boundary of the enclave only includes itself and the CPU, and neither privileged nor non-privileged software can access the enclave, even the operating system administrator and VMM (virtual machine monitor, virtual machine monitor; or called, Hypervisor). It cannot affect the code and data in the enclave, so it has extremely high security, and under the premise of the above security guarantee, the CPU can process the blockchain transactions in plain text in the enclave, which has extremely high computing efficiency. Thus taking into account the data security and computing efficiency.

The trusted application involved in the embodiment of this specification refers to the application that runs in the TEE and is implemented using verifiable computing technology. When the trusted application runs in the WASM (WebAssembly, web page assembly) virtual machine, anyone can use the WASM The bytecode is uploaded to the TEE, and the WASM code is invoked by the WASM virtual machine to form a trusted application. The WASM virtual machine further executes the trusted application and obtains the execution result. Since the trusted application runs in the TEE, it can be proved to anyone through the remote authentication process that the trusted application is indeed running in the TEE, and the internal code has not been tampered with, and it is indeed executed according to the user's expectations.

Fig. 3 is a flowchart of a method for invoking a trusted computing program shown in this specification according to an exemplary embodiment, the method is applied to the first trusted computing node shown in Fig. 2 , where the first trusted computing node A trusted application runs in the deployed first trusted execution environment, and the method includes the following steps:

S301: Obtain a remote authentication report for an oracle service program, where the oracle service program runs in a second trusted execution environment.

The method involved in the embodiment of this specification is specifically applied to the communication service program running in the first trusted execution environment deployed by the first trusted computing node. On the one hand, the communication service program is a trusted application in the first trusted execution environment. Provide a local call interface to realize information interaction with trusted applications. On the other hand, it provides a network interface to the outside world to realize external information interaction. For example, the communication service program and the oracle service program can be realized through this network interface. network communication. In addition, the communication service program can also call other programs in the first trusted execution environment, such as a remote authentication report verification program, a digital signature verification program, etc., to realize corresponding functions.

In the embodiment of this specification, before the first trusted computing node sends a blockchain data query request to the oracle service program running in the second trusted execution environment, it needs to obtain the remote authentication report for the oracle service program, To ensure that the oracle service program runs in the second trusted execution environment and the corresponding program code has not been tampered with, that is, to ensure that the oracle service program is credible.

The first trusted computing node can obtain the remote authentication report for the oracle service program through multiple ways, for example, by sending a remote authentication challenge for the oracle service program to the oracle service program to obtain the remote authentication report, in this In this case, the first trusted computing node may receive the remote authentication report sent by the oracle service program and returned by the authentication server after completing the authentication of the self-recommendation information, and the self-recommendation information includes The first hash value corresponding to the program code, and the second hash value corresponding to the public key of the oracle service program; or,

receiving the self-recommendation information sent by the oracle service program, sending the self-recommendation information to the authentication server, and receiving the service for the oracle machine returned by the authentication server after completing the authentication of the self-recommendation information Program the Remote Attestation Report.

Specifically, the remote authentication report involved in the embodiment of this specification is generated in the remote authentication process for the oracle service program in the second trusted execution environment. After the oracle service program receives the remote authentication challenge sent by the first trusted computing node, it responds to the remote authentication challenge and invokes the remote authentication service in the oracle service program to execute the remote authentication process. Specifically, the oracle service program First, all program codes contained in the oracle service program running in the second trusted execution environment will be extracted. These programs include the network interface program, blockchain interface program, blockchain verification program, etc. in the oracle service program. , these program codes are hashed to obtain a program hash value (the first hash value), and similarly, the public key maintained by the oracle service program to indicate the identity of the oracle service program is also obtained by hashing A public key hash value (the second hash value), and finally encapsulate the program hash value and the public key hash value to obtain self-recommendation information. When the self-recommendation information passes the verification of the authentication server, the oracle service program will receive To the remote authentication report provided by the authentication server for the self-recommendation information, the remote authentication report is used to indicate that the oracle service program running in the second trusted execution environment is credible, and the self-recommendation information can further include the public key of the program developer The hash value of the program version number, etc., this manual does not make any restrictions on this.

For example, taking Intel SGX technology as an example, the second trusted execution environment is an enclave created on the second trusted computing node to run the oracle service program, and the remote authentication process also involves another A special enclave, namely quoting enclave (QE for short), QE is an architectural enclave (Architectural Enclave) provided and signed by Intel. The enclave running the oracle service program first needs to generate a REPORT (report) structure for local authentication, and QE verifies whether the enclave is on the same platform as itself based on the REPORT structure, and then QE combines the REPORT structure with the program The hash value and the public key hash value are encapsulated into a structure QUOTE (that is, self-recommended information), and signed using the EPID (enhanced privacy identification) key. The EPID key not only represents the platform of private computing nodes under the chain, but also represents the credibility of the underlying hardware of the second trusted computing node. It can also bind information such as the version of the processor firmware, and only QE can access the EPID key. The key used to sign the above structure QUOTE. In SGX technology, the above-mentioned authentication server can be an IAS (Intel Attestation Service) server provided by Intel Corporation. The oracle service program sends the signed QUOTE structure to the IAS server, so that the IAS server can verify the signature and send The oracle service program returns the corresponding remote authentication report.

After the oracle service program obtains the remote authentication report, it can directly send the remote authentication report to the first trusted computing node, thereby assisting the first trusted computing node to obtain the remote authentication report. In this embodiment, the first trusted computing node initiates The remote authentication challenge is used to perform remote authentication, thereby assisting the first trusted computing node to obtain the remote authentication report, so as to prove to the first trusted computing node that the oracle service program has not been tampered with and is running in a trusted execution environment, and the oracle service The callee public key maintained by the program is authentic, thereby anchoring trust in the oracle service program to the first trusted computing node, and using the remote authentication report for the oracle service program as a corresponding trust certificate.

In one embodiment, after obtaining the remote authentication challenge, the oracle service program will only calculate the self-recommendation information in the above manner without sending the self-recommendation information to the authentication server, but first send the self-recommendation information to the first trusted computer node, so that the first trusted computing node completes the subsequent remote authentication process, sends self-recommendation information to the authentication server, and receives the remote authentication report returned by the authentication server after completing the authentication of the self-recommendation information. In the embodiment, the first trusted computing node can actively initiate a remote authentication process for the self-recommendation information, so that the first trusted computing node can obtain the latest remote authentication report, thereby enhancing the validity of the proof and the security of the system.

In addition to sending a remote authentication challenge for the oracle service program to the oracle service program in the oracle service program, in an embodiment, the first trusted computing node can also query the remote The authentication report library thus obtains the remote authentication report for the oracle service program. The remote authentication report of the oracle service program and the corresponding update time are pre-stored in the remote authentication report library. Every time the first trusted computing node passes the remote authentication When obtaining the latest remote verification report in a challenge or other form, the remote verification report corresponding to the oracle service program in the remote verification report library will be updated, so that the remote verification report of each oracle service program in the remote verification report library can be obtained in time updated, thereby enhancing the validity of the proof.

S302: When it is determined according to the remote authentication report that the oracle service program is credible, send a blockchain data query request obtained from the trusted application to the oracle service program, so that the The oracle service program acquires block data on the target blockchain in response to the blockchain data query request.

The determination of the authenticity of the oracle service program according to the remote authentication report involved in the embodiment of this specification specifically includes: after the first trusted computing node obtains the remote authentication report, it authenticates the signature of the remote authentication report with the public key of the authentication server and then confirms that the remote The authentication report is issued by the authentication server, and then read out the program hash value and public key hash value recorded in the authentication report, and compare it with the program standard hash value and public key stored in the first trusted computing node. Compared with the standard hash value, if the program hash value is consistent with the program standard hash value, it can be proved that the oracle service program in the trusted computing node has not been tampered with and is running in the second trusted execution environment. If the public key If the hash value is consistent with the standard hash value of the public key, it can prove that the public key corresponding to the oracle service program held by the first trusted computing node is indeed a public key that can indicate the true identity of the oracle service program. If the comparisons are consistent, it can be determined that the oracle service program is credible. Among them, the standard hash value of the program is obtained by hashing all the program codes in the public oracle service program, and the standard hash value of the public key is obtained through the It is considered that the public key corresponding to the oracle service program is obtained after hashing. It should be pointed out that the hashing function for calculating the standard hash value of the program is consistent with the hashing function for calculating the hash value of the program. The hash operation function of the standard hash value of the public key is consistent with the hash operation function used to calculate the hash value of the public key.

In one embodiment, the first trusted computing node locally pre-stores the remote authentication report for the oracle service program, so the first trusted computing node can execute the corresponding remote authentication report verification in the first trusted execution environment at any time program to verify whether the remote authentication report indicates that the oracle service program is credible. For example, the first trusted computing node can verify the remote authentication report in advance so as to save the verification result. When it is necessary to determine whether the oracle service program is credible When required, there is no need to repeat the verification work, but only need to check the pre-saved verification results, and when the verification results are credible, it can be determined that the oracle service program is credible, which is equivalent to the first node device anchoring the prediction The trust of the oracle service program, and directly use the verification result of the remote authentication report for the oracle service program as the corresponding trust certificate; of course, when it is necessary to determine whether the oracle service program is credible, the remote authentication report can also be verified Verify the work to obtain the verification results in real time.

When a trusted application generates a blockchain data query requirement, it will actively initiate a blockchain data query request to the communication service program. The request includes the blockchain domain name, block hash and transaction hash, etc. The description information of the block data is required. After receiving the request, the communication service program will first check whether there is a remote authentication report for the oracle service program locally. In the case of a remote authentication report, the remote authentication report verification program will be called to verify the remote authentication report. If the verification result is untrustworthy, the blockchain data query request sent by the trusted application will be temporarily cached. And continue to search whether there are remote authentication reports of other oracle service programs locally. If there is no remote authentication report of the oracle service program locally or the corresponding remote authentication reports are untrustworthy, the first trusted computing node It will use the communication service program to initiate a remote authentication report to the trusted computing node where one or more oracle service programs with public IP addresses are located to obtain the relevant remote authentication report, and then continue to verify it through the remote authentication report verification program. Verification, until the verification result of a certain remote certification report is credible, it can be determined that the oracle service program corresponding to the remote certification report is credible, and at this time the first trusted computing node can send the blockchain data The query request is sent to the trusted oracle service program through the communication service program. Of course, if the first node device does not find any trusted oracle service program after going through the above process, it will return the blockchain data query request sent by the trusted application through the communication service program, and inform the trusted application The corresponding error code is used to remind the user corresponding to the trusted application that currently lacks a trusted agency (oracle service program), so the blockchain data query service cannot be completed.

When the oracle service program receives the blockchain data query request sent by the first trusted computing node, it will parse the blockchain domain name, block hash and transaction hash from the request to point to the specific required The description information of the block data, and then determine the address of the block data according to the above description information. Specifically, the oracle service program may maintain a network connection with the corresponding block chain nodes in one or more block chain systems, so as to Different blockchain systems are labeled with different blockchain domain names, and maintain the corresponding relationship between the blockchain domain name and the network address such as the IP address and port number of the blockchain node corresponding to the corresponding blockchain system, so the oracle service The program can determine which blockchain system the required block data is in through the blockchain domain name, and use the determined blockchain system as the target blockchain, that is, the target blockchain involved in this manual refers specifically to The blockchain system pointed to by the blockchain domain name contained in the blockchain data query request. And, the block hash can be used to determine which block the required block data is in on the target blockchain, and the determined block can be used as the target block, and finally the required block can be determined through the transaction hash The data specifically corresponds to which transaction data on the target block. The block data involved in this specification may include transaction data on the block, or other data on the block such as transaction receipt data, block header data, etc. This specification does not make any restrictions on this.

The oracle service program involved in this manual has the ability to access the blockchain system. Therefore, the oracle server can continuously access multiple blockchain systems to obtain block data on each blockchain system in advance. After the block chain system generates a new block, it will trigger the proxy block chain node in any block chain system that has established a network connection with the oracle service program to provide the updated information of the block to the oracle service program, and then , the oracle service program can obtain the latest added block by calling the blockchain data access interface provided by the proxy blockchain node, so that the complete area of any blockchain system can be maintained locally in the oracle service program block data.

In one embodiment, when the oracle service program receives the blockchain data query request and determines that the target blockchain is obtained, it will check whether each block on the local pre-stored corresponding to the target blockchain contains a block The block data corresponding to the block hash in the chain data query request and the transaction hash, the block data is obtained under the condition that the block data is pre-stored locally. In this embodiment, the oracle service program can pass The complete block data on the target block chain is stored in advance, so that when a block chain data query request is received, the block data corresponding to the block chain data query request can be directly obtained without accessing the target block chain.

In another embodiment, when the oracle service program receives the block chain data query request and determines to obtain the target block chain, it will access the target block chain in real time to obtain the corresponding block data. In this example, the oracle service program does not need to pre-store the complete block data of the target blockchain, thus reducing the storage burden on the device, and even if the oracle service program pre-stores the complete block data of the target blockchain, Since the oracle service program may not be able to update the blocks of the target blockchain in a timely manner, there may be block data corresponding to the blockchain data query request that cannot be queried locally but is indeed in the latest block of the target blockchain Therefore, when receiving the blockchain data query request, accessing the target blockchain in real time can also ensure that the latest block data on the target blockchain can be obtained, avoiding the oracle service program due to Failure to update the complete block data on the local pre-stored target blockchain in time may lead to the possibility of failure to obtain block data.

In an embodiment, the oracle service program can obtain the block data by calling the blockchain data access interface provided by the blockchain node corresponding to the target blockchain, wherein the oracle service program is established with The blockchain node corresponding to any blockchain system that is connected to the network and can be accessed by the oracle service program is used as the proxy blockchain node corresponding to the target blockchain, and will have a trust relationship with the oracle service program in advance. That is, the proxy blockchain node obtains and verifies the remote authentication report for the oracle service program in advance to confirm that the oracle service program is credible. The corresponding verification process is the same as the verification method for the remote authentication report described above, and will not be repeated here. . The proxy blockchain node can provide a blockchain data access interface that only allows the oracle service program to access when it is determined that the oracle service program is credible, and the oracle service program can access the proxy area safely and barrier-free through this interface The database information on the blockchain node includes all the blocks stored and maintained on the proxy blockchain node, the contract code and contract status of each smart contract, etc.

In another embodiment, the oracle service program can also initiate a block data acquisition transaction to the oracle contract on the target blockchain, and monitor the block data acquisition transaction generated by the oracle contract. The block data acquisition event contained in the receipt acquires the block data. In this embodiment, the corresponding block data can be obtained by initiating a cross-chain transaction to the target blockchain and monitoring events. Specifically, the oracle service program can pass the proxy blockchain node on the target blockchain Initiate a block data acquisition transaction to the oracle contract on the target blockchain, the transaction contains block hash and transaction hash, so that the oracle contract executes the transaction, and obtains the block hash contained in the transaction The transaction data pointed to by Xihe transaction hash is written into the block data acquisition event contained in the transaction receipt, and the oracle service program obtains the block by further listening to the proxy block chain node on the target block chain The data captures the receipt of the transaction and reads the required transaction data from the receipt. In this embodiment, since the relevant block data is obtained through cross-chain transactions, the behavior of accessing block data can be stored on the target block chain to ensure the process of obtaining block data Transparent and traceable, the subsequent first trusted computing node can also verify whether the block data acquisition transaction is executed on the target block chain through a third party, so as to ensure that the obtained block data does come from the target block chain and improve the system security.

S303: Receive the block data returned by the oracle service program and the digital signature corresponding to the block data, and if the digital signature is successfully verified by the public key corresponding to the oracle service program , returning the block data to the trusted application.

After the oracle service program obtains the block data on the target blockchain in response to the blockchain data query request, it will first perform a hash operation on the block data to obtain the block data hash, and then use the oracle service The private key maintained by the program itself to indicate the true identity of the oracle service program signs the hash of the block data to obtain the digital signature corresponding to the block data, and finally returns the obtained block data and the corresponding digital signature To the communication service program in the first trusted computing node. After the communication service program receives the block data returned by the oracle service program and the digital signature corresponding to the block data, it will call the digital signature verification program in the first trusted execution environment to verify the digital signature, specifically In other words, the communication service program takes the block data and the corresponding digital signature as input parameters to the digital signature verification program, and the digital signature verification program performs hash operation on the received block data to obtain the standard block data hash, and then uses The previously verified public key that can indicate the true identity of the oracle service program decrypts the digital signature to obtain the block data hash to be verified, and compares the block data hash to be verified with the standard block data hash. Under the same situation, it is determined that the digital signature verification is successful, and the callback result of successful signature verification is returned to the communication service program. After receiving the callback result of successful signature verification, the communication service program determines that the block data is indeed from the verified The trusted oracle service program returns the block data, and returns the block data to the trusted application as the callback result of the previous blockchain data query request sent by the trusted application.

The technical solutions provided by the embodiments of this specification may include the following beneficial effects: In the embodiments of this specification, the first trusted computing node anchors the trust in the oracle service program by obtaining the remote authentication report for the oracle service program, The trusted application running in the first trusted execution environment deployed by the first trusted computing node can securely access and acquire block data on the blockchain by means of a trusted oracle service program.

Optionally, the block data and the digital signature corresponding to the block data are returned by the oracle service program when the authenticity verification of the block data is successful. After the oracle service program obtains the block data, it will further verify the authenticity of the block data, and only when the authenticity verification is successful will the block data be signed, and the block data and the corresponding The digital signature is returned to the communication service program in the first trusted computing node.

In the embodiment of this specification, the oracle service program needs to verify the authenticity of the obtained block data, and will return to the first trusted computing node only when the verification is successful, so that the block data obtained by the oracle service program can be guaranteed The source of the block data is credible and has not been tampered with, so that the first trusted computing node does not need to repeatedly verify the authenticity of the block data at the block level (because the first trusted computing node is verifying In the remote authentication report, it can be determined that the oracle service program contains the code segment of the block chain verification program that verifies the block data), and only needs to verify the digital signature corresponding to the block data, and after the verification is successful, due to It can ensure that the block data comes from a trusted oracle service program, so it can be directly sent back to the trusted application for user use.

Optionally, the verification of the authenticity of the block data is successful, including: the verification result corresponding to the target blockchain locally maintained by the oracle service program indicates that all blocks on the target blockchain are legal And if the verification of the corresponding Merkle roots is successful, it is determined that the authenticity verification of the block data is successful.

In the case that the block data on the target block chain is obtained from the target block chain in real time by the oracle service program, the oracle service program needs to verify the authenticity of the block data obtained in real time, Specifically, the oracle service program will not only obtain the block data pointed to by the blockchain data query request, but also obtain all the blocks of the target blockchain, so as to maintain all the blocks of the target blockchain locally , and verify the Merkle root and block hash of each block in block order from the genesis block, perform hash operations on all transactions contained in any block to obtain multiple transaction hashes, and follow Recalculate the Merkle root by finding the Merkle root, compare the recalculated Merkle root with the Merkle root recorded in the block header of any block, and explain the transaction on any block if the comparison is consistent It has not been tampered with, so any block is credible, so it is determined that the Merkle root verification of any block is successful, and in the case of inconsistency, it means that the transaction on any block has been tampered with, so any block is not credible , so as to determine that the Merkle root verification of any block has failed; at the same time, it is also necessary to verify the block hash to prove the legitimacy of the block itself, specifically, the block of each block except the genesis block The block header is encapsulated with the block hash of its corresponding parent block, so it is necessary to verify whether all the blocks of the target blockchain are arranged according to the order of the blocks defined by them, and whether they come from the same blockchain, for example, except For any block other than the latest block, if you want to verify whether the block has been tampered with, you need to merge the block header of the block to calculate the block hash corresponding to the block, and combine it with the block Compared with the block hash of the parent block recorded in the block header of the sub-block corresponding to the block, it can be proved that the block belongs to the same block chain as the previously verified block in the case of a consistent comparison. The block is legal, and if the comparison is inconsistent, it means that the block and the blocks after the block are not legal. After completing the verification of the above-mentioned Merkle root and block hash for all the blocks of the target blockchain maintained locally, a verification result will be generated to record the credible part in all the blocks of the target blockchain (at the same time through Merkle root and block hash verification to prove credible and legal block) as the verification result of the target blockchain, the verification result shows that all blocks on the target blockchain are legal and the corresponding Merkle root is If the verification is successful, it is determined that the authenticity verification of the block data is successful.

In the case that the block data on the target blockchain is pre-acquired from the target blockchain by the oracle service program, the oracle service program has pre-stored the complete block data corresponding to the target blockchain locally. Block data, so all blocks on the target blockchain can be verified in advance with Merkle root and block hash. For example, the oracle service program can The Merkle root verification of the block is performed in a timely manner, and the block is also used to prove the legitimacy of its corresponding parent block (using the block hash for verification, the method is the same as the above), so that there is a timely update in the local maintenance The verification result of the target blockchain, the verification result records the credible part of all blocks in the target blockchain, that is, the oracle service program does not need to verify all the blocks on the target blockchain every time Instead, only newly added blocks are verified each time, which enables the oracle service program to determine whether all blocks on the target blockchain are legal by reading the verification results of the locally maintained target blockchain at any time. And whether the verification of the corresponding Merkle root is successful. As a special case, if the latest block received by the oracle service program proves that its parent block is not legal, it will no longer receive subsequent updated blocks of the blockchain system where the block is located. .

In fact, the oracle service program can also only pre-store the block headers of all blocks on the target blockchain locally, so that the legitimacy of the block can be pre-proved while retaining the Merkle root verification process. In this case, the oracle After the service program determines the block data on the target blockchain according to the blockchain data query request, it needs to request the block data from the target blockchain. At this time, it can only request the target blockchain to obtain the block (according to the block hash carried in the block chain data query request) instead of all blocks on the target block chain, after obtaining the block, determine the block data as transaction data according to the transaction hash, At the same time, Merkle root verification is performed on the acquired block, and the Merkle root obtained by recalculation is not only compared with the Merkle root recorded on the block header of the acquired block, but also with the block header of the block where the locally maintained block data is located. Compare the Merkle root recorded above, and if the comparison is consistent, it is determined that the obtained block data conforms to the block header of the target blockchain maintained locally as a trust certificate, that is, it can be determined that the block data has not been tampered with.

In addition, the oracle service program can also pre-store the transaction hashes of all blocks on the target blockchain. Specifically, after obtaining the complete block data corresponding to the target blockchain, each of them The transaction hash calculated by the transaction is saved according to the order between the blocks and the order in the block (that is, the execution order of the transaction). After the verification of the Merkle root and the block hash is completed and the verification result is maintained locally , the block body part of all blocks can be deleted locally, so that after the oracle service program determines the block data on the target blockchain according to the blockchain data query request, it only sends Just request the block data itself. This is because all the verification processes at the block level have been completed in advance and the verification results maintained locally are used as certificates. Therefore, the oracle service program only needs to check the verification results and the obtained block data. Perform a hash operation, and the verification result can show that all blocks on the target blockchain are legal and the corresponding Merkle roots are verified successfully, and the received block data provided by the target blockchain is obtained by hashing When the hash value of the block chain data query request is consistent with the transaction hash contained in the block chain data query request, it can be determined that the authenticity verification of the block data is successful.

In this embodiment, the verification of the authenticity of the block data must be confirmed only when all blocks on the target block chain are legal and the corresponding Merkle roots are successfully verified. This strict verification method can maximize This guarantees the legitimacy and credibility of the block data source.

In another embodiment, when the verification result corresponding to the target blockchain maintained locally by the oracle service program indicates that the block where the block data is located is legal and the corresponding Merkle root verification is successful, It is determined that the authenticity verification of the block data is successful. In this embodiment, it can be determined that the authenticity verification of the block data is successful only when the block where the block data is located is verified to be credible. Quantitative verification methods can reduce the calculation cost and time cost of verifying all blocks as much as possible on the premise of ensuring the legitimacy and credibility of block data sources, improve verification efficiency and obtain block data. Success rate.

Optionally, the sending the blockchain data query request to the oracle service program includes: using the public key corresponding to the oracle service program to encrypt the blockchain data query request to obtain a blockchain A data query request ciphertext; sending the block chain data query request ciphertext to the oracle service program.

In the embodiment of this specification, the encrypted channel between the first trusted computing node and the oracle service program is realized by using asymmetric encryption, so that only the oracle service program can decrypt and obtain the zone sent by the first trusted computing node. Block chain data query request, so as to ensure the privacy of the process of obtaining block chain data. The public key corresponding to the oracle service program used here can be the public key that has been verified through the remote authentication report and can indicate the real identity of the oracle service program, or it can be other public keys used to indicate the real identity of the oracle service program. It is necessary to ensure that the private key corresponding to the public key used to encrypt the blockchain data query request is indeed held by the oracle service program. Therefore, when the oracle service program receives the blockchain data query request key After the text, you can use the private key you maintain to decrypt the ciphertext of the blockchain data query request to get the corresponding blockchain data query request.

Optionally, the blockchain data query request includes a public key corresponding to the first trusted computing node, and receiving the block data returned by the oracle service program and the digital signature corresponding to the block data , including: receiving the block data ciphertext and the digital signature ciphertext returned by the oracle service program, and using the private key of the first trusted computing node to decrypt the block data ciphertext and the digital signature ciphertext respectively Obtain the block data and the digital signature corresponding to the block data; wherein, the block data ciphertext and the digital signature ciphertext are respectively used by the oracle service program using the public key of the first trusted computing node Obtained after encrypting the block data and the digital signature corresponding to the block data.

In the embodiment of this specification, the encrypted channel between the first trusted computing node and the oracle service program is realized by using asymmetric encryption, so that only the communication service program on the first trusted computing node can decrypt to obtain the oracle The block data sent by the service program and the corresponding digital signature, thus ensuring the privacy of the process of obtaining the block chain data. Since the public key used to indicate the true identity of the first trusted computing node is carried in the blockchain data query request sent to the oracle service program, the subsequent oracle service program prepares to return the block to the first trusted computing node When data and digital signatures are used, the public key contained in the blockchain data query request can be used to encrypt, so that the encrypted block data ciphertext and digital signature ciphertext are sent to the communication service program on the first trusted computing node , so that the communication service program uses the private key maintained by itself to decrypt and obtain the corresponding block data and digital signature.

Optionally, the first trusted computing node maintains parsing plug-ins corresponding to each blockchain type, and the returning the block data to the trusted application includes: according to the zone of the target blockchain The parsing plug-in corresponding to the block chain type parses the block data, and returns the parsed block data to the trusted application. Since the data structure and form definitions of the blocks corresponding to different types of blockchains are quite different, for example, the transaction format of the blockchain based on UXTO (Unspent Transaction Output) is different from that of the blockchain based on Ethereum. are not the same, so different parsing methods need to be adopted according to different versions and types of obtained blocks to obtain the available data in the data part.

In the embodiment of this specification, since the analysis plug-ins corresponding to various blockchain types are maintained on the first trusted computing node, the obtained block data corresponding to each blockchain type can be correctly analyzed and processed. In this way, the parsed block data that can be recognized by trusted applications is obtained, so that optional applications running off-chain can access the on-chain data on various heterogeneous chains in a credible and compatible manner.

Optionally, the trusted application runs in a virtual machine encapsulated in the first trusted execution environment, and the virtual machine includes: a virtual machine based on a stack structure of binary operation instructions. Taking FIG. 1 as an example, the trusted application running in the first trusted execution environment actually runs in a virtual machine encapsulated in the first trusted execution environment, and the virtual machine includes a WASM virtual machine.

The WASM virtual machine involved in the embodiment of this specification is a virtual machine with a stack structure based on binary operation instructions, and only supports running program code written in WASM language. WASM language is another language other than JavaScript that can run on web pages. As a new coding method, WASM can run in modern web browsers. It belongs to a low-level assembly-like code with a compact binary format and can directly operate CPU instruction codes, such as x86 instructions. The assembly code on the set has instruction sets, registers, stacks, etc., so it can run with near-native performance, and provides a compilation target for high-level languages such as C/C+, so that these high-level languages can run on browsers. The WASM language is designed to coexist with JavaScript, so the two can run concurrently and are compatible with each other.

In the embodiment of this specification, since the virtual machine program theoretically satisfies Turing completeness and supports the execution of arbitrary programs, it is possible to meet the trusted computing requirements for various programs by running the WASM virtual machine in the TEE.

Taking the trusted application request in the first trusted computing node in Figure 2 to obtain the transaction data on the target blockchain through the oracle service program on the second trusted computing node as an example, the description of how to obtain blockchain data in this manual The plan is described in detail. Fig. 4 is an interactive flowchart of a method for obtaining blockchain data provided by this specification according to an exemplary embodiment. Please refer to Fig. 4. The scheme for obtaining blockchain data involved in this specification can be based on the first trusted computing Nodes, the second trusted computing node and the blockchain node are realized through cooperation, wherein the blockchain node belongs to the target blockchain, and the method may include the following steps: S401: the trusted computing node in the first trusted computing node The letter application constructs a blockchain data query request, wherein the blockchain domain name, block hash and transaction hash contained in the blockchain data query request.

S402: The trusted application sends a blockchain data query request to the communication service program in the first trusted computing node, and the communication service program caches the received blockchain data query request, and sends the request to the oracle machine in the second trusted computing node The server program issues a remote authentication challenge.

S403: The oracle service program randomly generates and maintains a public-private key pair in response to the remote authentication challenge, and performs hash operations on its own program code and the generated public key to obtain the program hash value and public key hash value Then use your own CPU private key to sign to get the program hash signature and public key hash signature. Finally, the program hash value, public key hash value, program hash signature and public key hash signature are encapsulated to get self-recommendation information and sent to IAS server, so that the IAS server can receive the remote authentication report returned by the IAS server after the authentication is completed.

S404: The oracle service program returns the obtained remote authentication report for the oracle service program and the generated public key to the communication service program in the first trusted computing node.

S405: The communication service program invokes the remote authentication report verification program in the first trusted execution environment to verify the received verification report, and first uses the public key of the IAS server to verify the signature of the remote authentication report, and then confirms the remote authentication report If it is indeed issued by the IAS server, check the authentication result recorded by it. If the authentication result shows that the oracle service program is indeed running in the second trusted execution environment, then continue to parse the program hash from the self-recommendation information contained in the remote authentication report Value and public key hash value, the hash value calculated in real time by all the program codes of the oracle service program in the public second trusted computing node stored in the database, or directly searched from the network to obtain the second trusted computing node The hash value corresponding to all program codes of the oracle service program in the letter computing node is compared with the program hash value, and at the same time, the hash value calculated from the public key received from the oracle service program is compared with the public key hash If the two comparison results are consistent, it can be proved that the program code of the oracle service program has not been tampered with and the obtained public key corresponding to the oracle service program is authentic, that is, Prove that the oracle service program is trustworthy.

S406: The communication service program in the first trusted computing node sends the cached blockchain data query request to the oracle service program in the second trusted computing node.

S407: The oracle service program responds to the blockchain data query request, and parses it to obtain the corresponding blockchain domain name, block hash and transaction hash, and determines the block where the required transaction data is located through the blockchain domain name The chain system is the target blockchain, so as to call the blockchain data access interface of the corresponding blockchain node in the target blockchain known in advance, and initiate a blockchain data access request to the blockchain node.

S408: After the blockchain node receives the blockchain data access request sent by the oracle service program, it determines that the oracle service program is credible through the remote authentication report obtained in advance for the oracle service program, and then responds to the district The block chain data access request returns all blocks on the target block chain to the oracle service program.

S409: The oracle service program determines and obtains the corresponding blockchain data query request required by the application from all blocks on the target blockchain according to the block hash and transaction hash in the blockchain data query request At the same time, all the blocks received on the target blockchain are verified one by one by Merkle root and block hash, and the verification results corresponding to the target blockchain are generated and maintained locally.

S410: When the verification result maintained locally by the oracle service program shows that all blocks on the target blockchain are legal and the corresponding Merkle roots are verified successfully, use the previously generated public-private key pair for the transaction data. Sign with the private key to obtain the digital signature corresponding to the transaction data.

S411: The oracle service program returns the transaction data and the digital signature corresponding to the transaction data to the communication service program in the first trusted computing node.

S412: After the communication service program receives the transaction data returned by the oracle service program and the digital signature corresponding to the transaction data, it will call the digital signature verification program in the first trusted execution environment to verify the digital signature. The digital signature verification program will first The received transaction data is hashed to obtain the standard transaction data hash, and then the digital signature is decrypted using the public key corresponding to the oracle service program that has been proved through the remote authentication report to obtain the transaction data hash to be verified. Verify that the transaction data hash is compared with the standard transaction data hash. If the comparison is consistent, it is determined that the digital signature verification is successful. After receiving the callback result of successful signature verification, the communication service program determines that the transaction data is indeed It is returned from the verified oracle service program, thus trusting the transaction data.

S413: The communication service program uses the corresponding parsing plug-in to parse the transaction data according to the block chain type to obtain the parsed transaction data, and returns the parsed transaction data to the trusted application as the area sent by the trusted application. The request result corresponding to the block chain data query request.

In the embodiment of this specification, the first trusted computing node anchors the trust relationship of the oracle service program by obtaining the remote authentication report for the oracle service program, so that the first trusted computing node obtains the remote authentication report through the oracle service program. After receiving the transaction data on the target blockchain, you only need to verify the digital signature corresponding to the acquired transaction data to ensure that the transaction data does come from a trusted oracle service program, and you can prove the authenticity of the transaction data without requiring The authenticity of transaction data is repeatedly verified at the block level, thereby providing safe and credible blockchain information query services for trusted applications running in the first trusted execution environment.

Corresponding to the foregoing method embodiments, this specification also provides embodiments of apparatuses, electronic equipment, and storage media.

Fig. 5 is a schematic structural diagram of a device provided by an exemplary embodiment. Please refer to FIG. 5 , at the hardware level, the device includes a processor 502 , an internal bus 504 , a network interface 506 , a memory 508 and a non-volatile memory 510 , and of course it may also include hardware required by other services. One or more embodiments of this specification may be implemented based on software, for example, the processor 502 reads a corresponding computer program from the non-volatile memory 510 into the memory 508 and executes it. Of course, in addition to software implementations, one or more embodiments of this specification do not exclude other implementations, such as logic devices or a combination of software and hardware, etc., that is to say, the execution subject of the following processing flow is not limited to each A logic unit, which can also be a hardware or logic device.

As shown in Figure 6, Figure 6 is a block diagram of a device for acquiring blockchain data according to an exemplary embodiment of this specification, which can be applied to the device shown in Figure 5 to implement the technology of this specification solution, the device is applied to a first trusted computing node, and a trusted application runs in the first trusted execution environment deployed by the first trusted computing node, and the device includes: a report obtaining unit 601, configured to obtain the The remote authentication report of the oracle service program, the oracle service program runs in the second trusted execution environment; the request sending unit 602 is configured to determine that the oracle service program is credible according to the remote authentication report, Sending the block chain data query request obtained from the trusted application to the oracle service program, so that the oracle service program responds to the block chain data query request to obtain the data on the target block chain block data; a data receiving unit 603, configured to receive the block data returned by the oracle service program and the digital signature corresponding to the block data, and pass the public key corresponding to the oracle service program to the If the verification of the digital signature is successful, the block data is returned to the trusted application.

Optionally, the blockchain data query request includes a blockchain domain name and a transaction hash, the target blockchain is determined by the blockchain domain name in the blockchain data query request, and the Block data on the target blockchain is determined by the transaction hash in the blockchain data query request.

Optionally, the block data on the target block chain is obtained from the target block chain in real time by the oracle service program, or the block data is obtained from the target block chain in advance by the oracle service program Obtain.

Optionally, the oracle service program in the request sending unit 602 to obtain the block data includes:

The oracle service program obtains the block data by calling the blockchain data access interface provided by the blockchain node corresponding to the target blockchain; The oracle contract on the block chain initiates a block data acquisition transaction, and monitors the block data acquisition event contained in the receipt of the block data acquisition transaction generated by the oracle contract to acquire the block data.

Optionally, the block data and the digital signature corresponding to the block data are returned by the oracle service program when the authenticity verification of the block data is successful.

Optionally, the request sending unit 602 sends the blockchain data query request to the oracle service program, including: using the public key corresponding to the oracle service program to encrypt the blockchain data query request Obtaining the ciphertext of the blockchain data query request; sending the ciphertext of the blockchain data query request to the oracle service program.

Optionally, the blockchain data query request includes a public key corresponding to the first trusted computing node, and the data receiving unit 603 receives the block data returned by the oracle service program and the block data The corresponding digital signature includes: receiving the block data ciphertext and the digital signature ciphertext returned by the oracle service program, and using the private key of the first trusted computing node to respectively write the block data ciphertext and the digital signature Decrypting the signature ciphertext to obtain the block data and the digital signature corresponding to the block data; wherein, the block data ciphertext and the digital signature ciphertext are used by the oracle service program using the first trusted computing The node public key is obtained after encrypting the block data and the digital signature corresponding to the block data respectively.

Optionally, the first trusted computing node maintains parsing plug-ins corresponding to each blockchain type, and the data receiving unit 603 returns the block data to the trusted application, including: The parsing plug-in corresponding to the block chain type of the block chain parses the block data, and returns the parsed block data to the trusted application.

Optionally, the trusted application runs in a virtual machine encapsulated in the first trusted execution environment, and the virtual machine includes: a virtual machine based on a stack structure of binary operation instructions.

Optionally, the second trusted execution environment is deployed on a second trusted computing node; or, the second trusted execution environment is deployed on a first trusted computing node; wherein, the second trusted execution environment The same trusted execution environment as the first trusted execution environment, or the second trusted execution environment is different from the first trusted execution environment.

Optionally, the report obtaining unit 601 is specifically configured to: receive the remote authentication report for the oracle service program sent by the oracle service program and returned by the authentication server after completing the authentication of the self-recommendation information, The self-recommendation information includes the first hash value corresponding to the program code of the oracle service program, and the second hash value corresponding to the public key of the oracle service program; or, receiving the message sent by the oracle service program the self-recommendation information, send the self-recommendation information to the authentication server, and receive the remote authentication report for the oracle service program returned by the authentication server after completing the authentication of the self-recommendation information.

Optionally, when the remote authentication report is signed by the authentication server, and the self-recommendation information in the remote authentication report satisfies the following conditions, the request sending unit 602 can determine that the oracle service program is credible: The first hash value in the self-recommendation information is consistent with the third hash value, and the second hash value in the self-recommendation information is consistent with the fourth hash value; wherein, the third hash value It is obtained by performing a hash operation on the program code contained in the disclosed oracle service program, and the fourth hash value is obtained by the corresponding to the oracle currently held by the first trusted computing node The public key of the service program is obtained after performing a hash operation.

Correspondingly, this specification also provides a device, the device includes a processor; a memory for storing processor-executable instructions; wherein the processor is configured to implement the credible implementation provided by all the above method embodiments. Calculation method steps.

Correspondingly, this specification also provides a computer-readable storage medium on which executable instructions are stored; wherein, when the instructions are executed by a processor, the steps for implementing the trusted computing method provided by all the above method embodiments are implemented.

As for the device embodiment, since it basically corresponds to the method embodiment, for related parts, please refer to the part description of the method embodiment. The device embodiments described above are only illustrative, and the modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical modules, that is, they may be located in One place, or it can be distributed to multiple network modules. Part or all of the modules can be selected according to actual needs to achieve the purpose of the solution in this specification. It can be understood and implemented by those skilled in the art without creative effort.

The systems, devices, modules, or units described in the above embodiments can be specifically implemented by computer chips or entities, or by products with certain functions. A typical implementing device is a computer, which may take the form of a personal computer, laptop computer, cellular phone, camera phone, smart phone, personal digital assistant, media player, navigation device, e-mail device, game control device, etc. desktops, tablets, wearables, or any combination of these.

In a typical configuration, a computer includes one or more processors (CPUs), input/output interfaces, network interfaces and memory.

Memory may include non-permanent storage in computer-readable media, in the form of random access memory (RAM) and/or nonvolatile memory such as read-only memory (ROM) or flash RAM. Memory is an example of computer readable media.

Computer-readable media, including both permanent and non-permanent, removable and non-removable media, can be implemented by any method or technology for storage of information. Information may be computer readable instructions, data structures, modules of a program, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory (ROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Flash memory or other memory technology, Compact Disc Read-Only Memory (CD-ROM), Digital Versatile Disc (DVD) or other optical storage, Magnetic cassettes, disk storage, quantum memory, graphene-based storage media or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by computing devices. As defined herein, computer-readable media excludes transitory computer-readable media, such as modulated data signals and carrier waves.

It should also be noted that the term "comprises", "comprises" or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, article, or apparatus comprising a set of elements includes not only those elements, but also includes Other elements not expressly listed, or elements inherent in the process, method, commodity, or apparatus are also included. Without further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article or apparatus comprising said element.

The foregoing describes specific embodiments of this specification. Other implementations are within the scope of the following claims. In some cases, the actions or steps recited in the claims can be performed in an order different from that in the embodiments and still achieve desirable results. In addition, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results. Multitasking and parallel processing are also possible or may be advantageous in certain embodiments.

Terms used in one or more embodiments of the present specification are for the purpose of describing specific embodiments only, and are not intended to limit the one or more embodiments of the present specification. As used in one or more embodiments of this specification and the appended claims, the singular forms "a", "the", and "the" are also intended to include the plural forms unless the context clearly dictates otherwise. It should also be understood that the term "and/or" as used herein refers to and includes any and all possible combinations of one or more of the associated listed items.

It should be understood that although the terms first, second, third, etc. may be used in one or more embodiments of the present specification to describe various information, the information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of one or more embodiments of this specification, first information may also be called second information, and similarly, second information may also be called first information. Depending on the context, the word "if" as used herein may be interpreted as "at" or "when" or "in response to a determination."

The above descriptions are only preferred embodiments of one or more embodiments of this specification, and are not intended to limit one or more embodiments of this specification. Within the spirit and principles of one or more embodiments of this specification, Any modification, equivalent replacement, improvement, etc. should be included in the scope of protection of one or more embodiments of this specification.

Claims

A method for acquiring blockchain data, the method is applied to a first trusted computing node, and a trusted application runs in a first trusted execution environment deployed by the first trusted computing node, and the method includes:

Obtaining a remote authentication report for the oracle service program, the oracle service program running in the second trusted execution environment;

In the case that the oracle service program is determined to be credible according to the remote authentication report, a query request for blockchain data acquired from the trusted application is sent to the oracle service program, so that the oracle The service program obtains the block data on the target blockchain in response to the blockchain data query request;

Receive the block data returned by the oracle service program and the digital signature corresponding to the block data, and if the digital signature is successfully verified by the public key corresponding to the oracle service program, send The block data is returned to the trusted application.
The method according to claim 1, the blockchain data query request includes a blockchain domain name and a transaction hash, and the target blockchain consists of the blockchain domain name in the blockchain data query request As determined, the block data on the target blockchain is determined by the transaction hash in the blockchain data query request.
According to the method according to claim 1, the block data on the target block chain is acquired from the target block chain in real time by the oracle service program, or the block data is obtained from the target block chain by the oracle service program in advance. Obtained on the target blockchain.
According to the method according to claim 1, the oracle service program obtaining the block data includes:

The oracle service program obtains the block data by calling the blockchain data access interface provided by the blockchain node corresponding to the target blockchain; or,

The oracle service program initiates a block data acquisition transaction to the oracle contract on the target block chain, and monitors the blocks contained in the receipt of the block data acquisition transaction generated by the oracle contract A data acquisition event is used to acquire the block data.
According to the method according to claim 1, the block data and the digital signature corresponding to the block data are returned by the oracle service program when the authenticity verification of the block data is successful.
According to the method according to claim 5, the authenticity verification of the block data succeeds, comprising:

When the verification result corresponding to the target block chain maintained locally by the oracle service program shows that all blocks on the target block chain are legal and the corresponding Merkle roots are verified successfully, determine the block The authenticity verification of the data was successful.
The method according to claim 1, said sending the blockchain data query request to the oracle service program, comprising:

Using the public key corresponding to the oracle service program to encrypt the block chain data query request to obtain the block chain data query request ciphertext;

Send the block chain data query request cipher text to the oracle machine service program.
According to the method according to claim 1, the block chain data query request includes the public key corresponding to the first trusted computing node, and the block data and the block data returned by the oracle service program are received. The digital signature corresponding to the data, including:

receiving the block data ciphertext and the digital signature ciphertext returned by the oracle service program, and using the private key of the first trusted computing node to decrypt the block data ciphertext and the digital signature ciphertext respectively to obtain the Block data and digital signatures corresponding to the block data; wherein, the block data ciphertext and the digital signature ciphertext are respectively processed by the oracle service program using the first trusted computing node public key The block data and the digital signature corresponding to the block data are obtained after encryption.
According to the method according to claim 1, the first trusted computing node maintains a parsing plug-in corresponding to each blockchain type, and the returning the block data to the trusted application includes:

The block data is parsed according to the parsing plug-in corresponding to the block chain type of the target block chain, and the parsed block data is returned to the trusted application.
According to the method according to claim 1, the trusted application runs in a virtual machine encapsulated in the first trusted execution environment, and the virtual machine includes: a virtual machine based on a stack structure of binary operation instructions.
The method according to claim 1,

The second trusted execution environment is deployed on a second trusted computing node; or,

The second trusted execution environment is deployed on the first trusted computing node; wherein, the second trusted execution environment and the first trusted execution environment are the same trusted execution environment, or the second trusted execution environment It is different from the first trusted execution environment.
The method according to claim 1, said obtaining the remote authentication report for the oracle service program, comprising:

receiving the remote authentication report sent by the oracle service program and returned by the authentication server after completing the authentication of the self-recommendation information for the oracle service program, the self-recommendation information including the program code of the oracle service program the corresponding first hash value, and the second hash value corresponding to the public key of the oracle service program; or,

receiving the self-recommendation information sent by the oracle service program, sending the self-recommendation information to the authentication server, and receiving the service for the oracle machine returned by the authentication server after completing the authentication of the self-recommendation information The remote attestation report for the program.
According to the method according to claim 12, when the remote authentication report is signed by the authentication server, and the self-recommendation information in the remote authentication report meets the following conditions, it is determined that the oracle service program is credible:

The first hash value in the self-recommendation information is consistent with the third hash value, and the second hash value in the self-recommendation information is consistent with the fourth hash value; wherein, the third hash value It is obtained by performing a hash operation on the program code contained in the disclosed oracle service program, and the fourth hash value is obtained by the corresponding to the oracle currently held by the first trusted computing node The public key of the service program is obtained after performing a hash operation.
A device for acquiring blockchain data, the device is applied to a first trusted computing node, and a trusted application runs in a first trusted execution environment deployed by the first trusted computing node, and the device includes:

A report acquisition unit, configured to acquire a remote authentication report for the oracle service program, the oracle service program running in the second trusted execution environment;

A request sending unit, configured to send a query request for blockchain data obtained from the trusted application to the oracle service program when it is determined that the oracle service program is credible according to the remote authentication report, To make the oracle service program respond to the blockchain data query request to obtain block data on the target blockchain;

A data receiving unit, configured to receive the block data returned by the oracle service program and the digital signature corresponding to the block data, and verify the digital signature through the public key corresponding to the oracle service program In case of success, the block data is returned to the trusted application.
An electronic device, characterized in that it comprises:

processor;

memory for storing processor-executable instructions;

Wherein, the processor implements the method according to any one of claims 1-13 by running the executable instruction.
A computer-readable storage medium, on which computer instructions are stored, wherein, when the instructions are executed by a processor, the steps of the method according to any one of claims 1-13 are implemented.