WO2023273994A1 - Method, system, and apparatus for executing smart contract, and storage medium - Google Patents

Method, system, and apparatus for executing smart contract, and storage medium Download PDF

Info

Publication number
WO2023273994A1
WO2023273994A1 PCT/CN2022/100522 CN2022100522W WO2023273994A1 WO 2023273994 A1 WO2023273994 A1 WO 2023273994A1 CN 2022100522 W CN2022100522 W CN 2022100522W WO 2023273994 A1 WO2023273994 A1 WO 2023273994A1
Authority
WO
WIPO (PCT)
Prior art keywords
container
contract
smart contract
execution
secure container
Prior art date
Application number
PCT/CN2022/100522
Other languages
French (fr)
Chinese (zh)
Inventor
林志平
Original Assignee
支付宝(杭州)信息技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 支付宝(杭州)信息技术有限公司 filed Critical 支付宝(杭州)信息技术有限公司
Publication of WO2023273994A1 publication Critical patent/WO2023273994A1/en

Links

Images

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06QINFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00Payment architectures, schemes or protocols
    • G06Q20/38Payment protocols; Details thereof
    • G06Q20/382Payment protocols; Details thereof insuring higher security of transaction
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60Protecting data
    • G06F21/62Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00Arrangements for program control, e.g. control units
    • G06F9/06Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46Multiprogramming arrangements
    • G06F9/54Interprogram communication
    • G06F9/547Remote procedure calls [RPC]; Web services

Definitions

  • This specification relates to the field of information technology, and in particular to a method, system, device and storage medium for executing smart contracts.
  • contracts The development of smart contracts (referred to as contracts) is an important part of blockchain development. At present, most chains in the blockchain industry compile contract source codes written in high-level languages into low-end bytecodes, and then compile them in low-end bytecodes. Run the smart contract in a virtual machine that matches the code (that is, execute the low-end bytecode).
  • the method includes a node process implemented by a blockchain node process running in a host environment, and a contract process implemented by a process running in a secure container, and the secure container is a container that does not share a kernel with the host environment .
  • the node process includes: receiving a blockchain transaction; in response to receiving the blockchain transaction, creating a process in the secure container to execute the native execution code of the smart contract called by the blockchain transaction, so The format of the native execution code corresponds to the high-level language to which the source code of the smart contract belongs; and the execution result of the blockchain transaction is obtained.
  • the contract process includes: executing the native execution code of the smart contract in the secure container.
  • the system includes a blockchain node process running in a host environment and a process running in a secure container, and the secure container is a container that does not share a kernel with the host environment.
  • the block chain node process is used to: receive the block chain transaction, in response to receiving the block chain transaction, create a process in the security container, to execute the native function of the smart contract called by the block chain transaction execution code, the native execution code corresponds to the high-level language to which the source code of the smart contract belongs; and the execution result of the blockchain transaction is obtained.
  • the process in the secure container is used for: executing the native execution code of the smart contract in the secure container.
  • the apparatus includes a processor and a storage device, the storage device is used to store instructions, and when the processor executes the instructions, the smart contract execution method described in any embodiment of this specification is implemented.
  • One of the embodiments of this specification provides a computer storage medium, the storage medium stores instructions, and when the processor executes the instructions, the smart contract execution method as described in any embodiment of this specification is implemented.
  • FIG. 1 is a schematic flowchart of a smart contract execution method according to some embodiments of this specification
  • Fig. 2 is an interactive schematic diagram of a smart contract execution method according to some embodiments of this specification.
  • system means for distinguishing different components, elements, components, parts or assemblies of different levels.
  • the words may be replaced by other expressions if other words can achieve the same purpose.
  • Blockchain transactions can be used to record various events and/or data.
  • the events recorded in the transaction may include one or more of the joining of a new node, the exit of a node, the transfer, and the like.
  • the data of transaction records may include one or more of medical information, electronic contracts, electronic credentials, electronic orders, digital fingerprints, and the like.
  • the expected code can be triggered by the transaction, which can also be called the execution of the transaction, and the blockchain node can be the executor of the transaction.
  • the transaction used to record the transfer behavior can trigger the update of the account balance of both parties to the transfer; Chain data query, etc.
  • execution of a transaction may include invocation of a smart contract.
  • a smart contract (referred to as a contract) can refer to a digital agreement that is distributed and stored in each node in the blockchain system and can be automatically executed under certain conditions.
  • the essence of a smart contract is a piece of code running in the blockchain network to complete the business logic assigned by the user.
  • Contract security includes but is not limited to not allowing the contract to obtain unauthorized data, such as accessing local disk files, accessing network resources, etc. And/or do not allow contract behaviors to damage the security of the host environment (operating system), such as not allowing smart contracts to obtain some call permissions that affect the normal operation of the operating system (such as fork, kill, chmod, ptrace, etc.).
  • the types of high-level languages that support conversion into low-end bytecodes are limited, so that the types of high-level languages available for the above-mentioned contract execution methods are limited, and cannot meet the needs of various high-level language developers to develop smart contracts.
  • the native execution mode is also called traditional/conventional execution mode, which refers to compiling source code written in a high-level language into native execution code (different from low-end bytecode) for execution.
  • the native execution mode refers to compiling the source code written in the Java language into a bytecode in a class format for execution.
  • the native execution method refers to compiling the source code written in the C++ language into a bytecode that matches the target CPU architecture. It can be understood that the target CPU architecture here specifically refers to the CPU architecture used to execute the contract.
  • Each high-level language corresponds to a native executable code, and a limited variety of high-level languages support the conversion of source code into low-level bytecodes in a uniform format.
  • the smart contract code executed according to the native execution method can meet the needs of various high-level language developers to develop smart contracts.
  • native executable code is more debuggable than low-end bytecode.
  • the container in order to support the execution of native smart contracts, can be used as the execution environment of native smart contracts.
  • Containers have the advantages of less resources, fast deployment, easy portability, and isolation.
  • the contract execution of each transaction can establish a one-to-one correspondence with the container instance. It can be understood that the container instance refers to a specific single container. In this way, the isolation of the container can be used to isolate the contract execution of different transactions.
  • kernel is the core of the operating system (Operation System, OS), which is responsible for managing the processes, memory, device drivers, files and network systems of the operating system, and determines the performance and stability of the operating system.
  • OS Operating System
  • the embodiment of this specification provides a method and system for executing native smart contracts through a secure container, which can meet the needs of developers of various languages for developing smart contracts, ensure high code debuggability, and ensure the integrity of smart contracts. safety.
  • a secure container refers to a container that does not share a kernel with the host environment.
  • the security container may include one or more of the kata container developed by the open source community (see https://katacontainers.io/ for specific information), the gVisor container developed by Google, the Firecracker developed by Amazon, etc. .
  • Fig. 1 is a schematic flowchart of a method for executing a smart contract according to some embodiments of this specification.
  • the method may include a node process implemented by a blockchain node process running in a host environment, and a contract process implemented by a process running in a secure container.
  • the blockchain node process may refer to a running blockchain program.
  • the host environment and the security container can be integrated on a single device (host machine), or distributed on multiple devices, for example, the security container can be run on a cloud server.
  • a communication connection can be established between the host environment and the secure container through a network module of the host environment itself.
  • the node process may include: receiving a transaction; in response to receiving the transaction, creating a process in a secure container to execute the native execution code of the smart contract called by the transaction; obtaining the execution result of the transaction (Also known as a "receipt").
  • the contract process may include executing the native execution code of the smart contract in a secure container.
  • the blockchain node process in response to receiving a transaction, may first create a secure container for contract execution, and then create a daemon process in the secure container.
  • the blockchain node process can also create a daemon process in the created secure container.
  • the blockchain node process can also directly use the created daemon process.
  • the daemon process can be used to manage the life cycle of the contract execution process, including being responsible for the creation, destruction, and invocation of the contract execution process.
  • the daemon process can create a contract execution process in the secure container, obtain the native execution code of the smart contract called by the transaction from the blockchain node process, and pass the native execution code to the contract execution process.
  • the contract execution process can be used to execute the native execution code of the smart contract called by the transaction.
  • contract execution may include setting the value of a variable in the smart contract.
  • the contract execution process can obtain the value of the variable in the smart contract from the block chain node process, set the value of the variable, and return the set value of the variable to the block chain node process, In order to enable the blockchain node process to obtain the execution result of the transaction.
  • the name (key) of the variable to be set can be specified in the transaction, and the blockchain node process can query the value (value) of the variable according to the name of the variable. It can be understood that the key and value of the same variable can be stored in the form of key-value pairs for easy query.
  • Fig. 2 is an interactive schematic diagram of a smart contract execution method according to some embodiments of this specification.
  • the blockchain node program process may include a container interface, a database (DB), a container management module and a gRPC client, and the daemon process may include a gRPC server and a contract running module.
  • the container interface can be used to receive transactions.
  • the container management module may be configured to, in response to the container interface receiving a transaction, create a secure container and create a process in the secure container to execute the native execution code of the smart contract invoked by the transaction.
  • Databases can be used to store blockchain data.
  • Blockchain data includes one or more of block data, account status, account storage, contract code (such as native execution code), etc.
  • the gRPC server can communicate with the gRPC client as a communication module for communicating with the blockchain node process, and the communication can include obtaining the native execution code of the smart contract.
  • the gRPC client can actively communicate with the gRPC server. Specifically, in response to the container interface receiving the transaction, the gRPC client can obtain the native execution code of the smart contract invoked by the transaction from the database through the container interface, and send it to the gRPC server.
  • the contract running module obtains the native execution code of the called smart contract from the gRPC server and passes it to the contract execution process.
  • the contract execution process can execute the obtained native execution code.
  • a container proxy can be set between the container interface and the gRPC client, and the container interface can communicate with the daemon process through the container proxy and the gRPC client after receiving the transaction.
  • the communication between the contract execution process and the blockchain node process can also follow the client-server model. That is, the gRPC client in the contract execution process can initiate a request to the gRPC server thread pool (thread collection, thread is a thread) in the blockchain node process, and the gRPC server thread pool responds to the request of the contract execution process accordingly.
  • the request may include obtaining the value of the contract variable to be set, setting the value of the contract variable, and notifying the contract execution result.
  • the gRPC server thread pool can return the execution contract to the contract execution process (gRPC client in it) through the VM (Virtual Machine, virtual machine) thread (such as VM thread1, VM thread2, etc.) and Container (container, such as Container1, Container2, etc.)
  • the required data such as the value of the contract variable to be set.
  • the IO thread/Container in the gRPC server thread pool can access messages through the queue. For example, the IO thread can put the message into the queue through the Msg Put function (operation), and the Container can take the message out of the queue through the Msg Get function (operation), and then put the obtained response data into the queue through the Return function (operation) For the IO thread to take out.
  • Each thread (IO thread/VM thread) can be responsible for the execution of one transaction at a time.
  • the contract execution process notifies the threads in the gRPC server thread pool that after the execution of the native smart contract invoked by a certain transaction is completed, the VM thread responsible for the execution of the transaction can confirm that the transaction has been executed.
  • the container interface can obtain the execution result of the transaction (ie, the receipt).
  • the embodiment of this specification also provides a smart contract execution system, which may include a blockchain node process running in a host environment and a process running in a secure container.
  • the blockchain node process can be used to: receive blockchain transactions, start a process in the secure container according to the received blockchain transactions, to execute the native execution code of the smart contract invoked by the blockchain transactions , the native execution code corresponds to the high-level language to which the source code of the smart contract belongs; and the execution result of the blockchain transaction is obtained.
  • the process in the secure container is used for: executing the native execution code of the smart contract in the secure container.
  • the above smart contract execution system and its modules can be implemented in various ways.
  • the system and its modules may be implemented by hardware, software, or a combination of software and hardware.
  • the hardware part can be implemented by using dedicated logic;
  • the software part can be stored in a memory and executed by an appropriate instruction execution system, such as a microprocessor or specially designed hardware.
  • an appropriate instruction execution system such as a microprocessor or specially designed hardware.
  • processor control code for example on a carrier medium such as a magnetic disk, CD or DVD-ROM, such as a read-only memory (firmware ) or on a data carrier such as an optical or electronic signal carrier.
  • the system and its modules in this specification can not only be realized by hardware circuits such as very large scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, etc., or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc. , can also be realized by software executed by various types of processors, for example, and can also be realized by a combination of the above-mentioned hardware circuits and software (for example, firmware).
  • hardware circuits such as very large scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, etc.
  • programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc.
  • software for example, and can also be realized by a combination of the above-mentioned hardware circuits and software (for example, firmware).
  • the possible beneficial effects of the embodiments of this specification include but are not limited to: (1)
  • the container is used as the execution environment of the native smart contract to support the execution of the native smart contract, and the execution of the smart contract in a native way can satisfy various language developers
  • the requirements of smart contracts ensure high code debuggability and ensure the security of smart contracts;
  • the possible beneficial effects may be any one or a combination of the above, or any other possible beneficial effects.
  • aspects of the embodiments of this specification can be illustrated and described by several patentable categories or situations, including any new and useful process, machine, product or combination of substances, or Any new and useful improvements to them.
  • various aspects of the embodiments of this specification may be completely executed by hardware, may be completely executed by software (including firmware, resident software, microcode, etc.), or may be executed by a combination of hardware and software.
  • the above hardware or software may be referred to as “block”, “module”, “engine”, “unit”, “component” or “system”.
  • aspects of the embodiments of this specification may be embodied as a computer product on one or more computer-readable media, the product including computer-readable program code.
  • a computer storage medium may contain a propagated data signal embodying a computer program code, for example, in baseband or as part of a carrier wave.
  • the propagated signal may have various manifestations, including electromagnetic form, optical form, etc., or a suitable combination.
  • a computer storage medium may be any computer-readable medium, other than a computer-readable storage medium, that can be used to communicate, propagate, or transfer a program for use by being coupled to an instruction execution system, apparatus, or device.
  • Program code residing on a computer storage medium may be transmitted over any suitable medium, including radio, electrical cable, fiber optic cable, RF, or the like, or combinations of any of the foregoing.
  • the computer program codes required for the operation of each part of the embodiments of this specification can be written in any one or more programming languages, including object-oriented programming languages such as Java, Scala, Smalltalk, Eiffel, JADE, Emerald, C++, C#, VB.NET , Python, etc., conventional programming languages such as C language, VisualBasic, Fortran2003, Perl, COBOL2002, PHP, ABAP, dynamic programming languages such as Python, Ruby and Groovy, or other programming languages.
  • the program code may run entirely on the user's computer, or as a stand-alone software package, or run partly on the user's computer and partly on a remote computer, or entirely on the remote computer or processing device.
  • the remote computer can be connected to the user computer through any form of network, such as a local area network (LAN) or wide area network (WAN), or to an external computer (such as through the Internet), or in a cloud computing environment, or as a service Use software as a service (SaaS).
  • LAN local area network
  • WAN wide area network
  • SaaS service Use software as a service

Abstract

Disclosed in embodiments of the present description are a method, system, and apparatus for executing a smart contract, and a storage medium. The method comprises a node flow implemented by a blockchain node process running in a host environment, and a contract flow implemented by a process running in a secure container. The secure container is a container not sharing the kernel with the host environment. The node flow comprises: receiving a blockchain transaction; in response to receiving the blockchain transaction, creating the process in the secure container to execute native execution code of a smart contract called by the blockchain transaction, the format of the native execution code corresponding to high-level language to which source code of the smart contract belongs; and obtaining an execution result of the blockchain transaction. The contract process comprises: executing the native execution code of the smart contract in the secure container.

Description

智能合约执行的方法、系统、装置和存储介质Method, system, device and storage medium for smart contract execution 技术领域technical field
本说明书涉及信息技术领域,特别涉及一种智能合约执行的方法、系统、装置和存储介质。This specification relates to the field of information technology, and in particular to a method, system, device and storage medium for executing smart contracts.
背景技术Background technique
智能合约(简称合约)开发是区块链开发的重要组成部分,当前区块链业界大部分链是将用高级语言编写的合约源代码编译成低端字节码后,在该低端字节码匹配的虚拟机中运行智能合约(即执行该低端字节码)。The development of smart contracts (referred to as contracts) is an important part of blockchain development. At present, most chains in the blockchain industry compile contract source codes written in high-level languages into low-end bytecodes, and then compile them in low-end bytecodes. Run the smart contract in a virtual machine that matches the code (that is, execute the low-end bytecode).
然而,支持转换低端字节码的高级语言种类有限,即采用上述合约执行方式时可供选择的高级语言种类有限,无法满足各类高级语言开发者开发智能合约的需求。However, the types of high-level languages that support the conversion of low-end bytecodes are limited, that is, the types of high-level languages that can be selected when using the above-mentioned contract execution methods are limited, and cannot meet the needs of various high-level language developers to develop smart contracts.
发明内容Contents of the invention
本说明书实施例之一提供一种智能合约执行方法。所述方法包括由运行在宿主环境中的区块链节点进程实现的节点流程,以及由运行在安全容器中的进程实现的合约流程,所述安全容器为与所述宿主环境不共享内核的容器。其中,所述节点流程包括:接收区块链交易;响应于接收到区块链交易,在所述安全容器中创建进程,以执行所述区块链交易调用的智能合约的原生执行代码,所述原生执行代码的格式与所述智能合约的源代码所属的高级语言对应;获得所述区块链交易的执行结果。所述合约流程包括:在所述安全容器中执行所述智能合约的原生执行代码。One of the embodiments of this specification provides a smart contract execution method. The method includes a node process implemented by a blockchain node process running in a host environment, and a contract process implemented by a process running in a secure container, and the secure container is a container that does not share a kernel with the host environment . Wherein, the node process includes: receiving a blockchain transaction; in response to receiving the blockchain transaction, creating a process in the secure container to execute the native execution code of the smart contract called by the blockchain transaction, so The format of the native execution code corresponds to the high-level language to which the source code of the smart contract belongs; and the execution result of the blockchain transaction is obtained. The contract process includes: executing the native execution code of the smart contract in the secure container.
本说明书实施例之一提供一种智能合约执行系统。所述系统包括运行在宿主环境中的区块链节点进程以及运行在安全容器中的进程,所述安全容器为与所述宿主环境不共享内核的容器。其中,所述区块链节点进程用于:接收区块链交易,响应于接收到区块链交易,在所述安全容器中创建进程,以执行所述区块链交易调用的智能合约的原生执行代码,所述原生执行代码与所述智能合约的源代码所属的高级语言对应;获得所述区块链交易的执行结果。所述安全容器中的进程用于:在所述安全容器中执行所述智能合约的原生执行代码。One of the embodiments of this specification provides a smart contract execution system. The system includes a blockchain node process running in a host environment and a process running in a secure container, and the secure container is a container that does not share a kernel with the host environment. Wherein, the block chain node process is used to: receive the block chain transaction, in response to receiving the block chain transaction, create a process in the security container, to execute the native function of the smart contract called by the block chain transaction execution code, the native execution code corresponds to the high-level language to which the source code of the smart contract belongs; and the execution result of the blockchain transaction is obtained. The process in the secure container is used for: executing the native execution code of the smart contract in the secure container.
本说明书实施例之一提供一种智能合约执行装置。所述装置包括处理器和存储设备,所述存储设备用于存储指令,当所述处理器执行指令时,实现如本说明书任一实施例所述的智能合约执行方法。One of the embodiments of this specification provides a smart contract execution device. The apparatus includes a processor and a storage device, the storage device is used to store instructions, and when the processor executes the instructions, the smart contract execution method described in any embodiment of this specification is implemented.
本说明书实施例之一提供一种计算机存储介质,所述存储介质存储有指令,当处理 器执行指令时,实现如本说明书任一实施例所述的智能合约执行方法。One of the embodiments of this specification provides a computer storage medium, the storage medium stores instructions, and when the processor executes the instructions, the smart contract execution method as described in any embodiment of this specification is implemented.
附图说明Description of drawings
本说明书将以示例性实施例的方式进一步说明,这些示例性实施例将通过附图进行详细描述。这些实施例并非限制性的,在这些实施例中,相同的编号表示相同的结构,其中:This specification will be further illustrated by way of exemplary embodiments, which will be described in detail with the accompanying drawings. These examples are non-limiting, and in these examples, the same number indicates the same structure, wherein:
图1是根据本说明书一些实施例所示的智能合约执行方法的流程示意图;FIG. 1 is a schematic flowchart of a smart contract execution method according to some embodiments of this specification;
图2是根据本说明书一些实施例所示的智能合约执行方法的交互示意图。Fig. 2 is an interactive schematic diagram of a smart contract execution method according to some embodiments of this specification.
具体实施方式detailed description
为了更清楚地说明本说明书实施例的技术方案,下面将对实施例描述中所需要使用的附图作简单的介绍。显而易见地,下面描述中的附图仅仅是本说明书的一些示例或实施例,对于本领域的普通技术人员来讲,在不付出创造性劳动的前提下,还可以根据这些附图将本说明书应用于其它类似情景。除非从语言环境中显而易见或另做说明,图中相同标号代表相同结构或操作。In order to more clearly illustrate the technical solutions of the embodiments of the present specification, the following briefly introduces the drawings that need to be used in the description of the embodiments. Apparently, the accompanying drawings in the following description are only some examples or embodiments of this specification, and those skilled in the art can also apply this specification to other similar scenarios. Unless otherwise apparent from context or otherwise indicated, like reference numerals in the figures represent like structures or operations.
应当理解,本文使用的“系统”、“装置”、“单元”和/或“模组”是用于区分不同级别的不同组件、元件、部件、部分或装配的一种方法。然而,如果其他词语可实现相同的目的,则可通过其他表达来替换所述词语。It should be understood that "system", "device", "unit" and/or "module" as used herein is a method for distinguishing different components, elements, components, parts or assemblies of different levels. However, the words may be replaced by other expressions if other words can achieve the same purpose.
如本说明书中所示,除非上下文明确提示例外情形,“一”、“一个”、“一种”和/或“该”等词并非特指单数,也可包括复数。一般说来,术语“包括”与“包含”仅提示包括已明确标识的步骤和元素,而这些步骤和元素不构成一个排它性的罗列,方法或者设备也可能包含其它的步骤或元素。As indicated in this specification, words such as "a", "an", "an" and/or "the" are not specific to the singular and may include the plural unless the context clearly indicates an exception. Generally speaking, the terms "comprising" and "comprising" only suggest the inclusion of clearly identified steps and elements, and these steps and elements do not constitute an exclusive list, and the method or device may also contain other steps or elements.
本说明书中使用了流程图用来说明根据本说明书的实施例的系统所执行的操作。应当理解的是,前面或后面操作不一定按照顺序来精确地执行。相反,可以按照倒序或同时处理各个步骤。同时,也可以将其他操作添加到这些过程中,或从这些过程移除某一步或数步操作。The flowchart is used in this specification to illustrate the operations performed by the system according to the embodiment of this specification. It should be understood that the preceding or following operations are not necessarily performed in the exact order. Instead, various steps may be processed in reverse order or simultaneously. At the same time, other operations can be added to these procedures, or a certain step or steps can be removed from these procedures.
首先介绍本说明书中涉及的一些基本概念。First, some basic concepts involved in this manual are introduced.
区块链交易(简称交易)可以用于记录各类事件和/或数据。在一些实施例中,交易记录的事件可以包括表征新节点的加入、节点的退出、转账等中的一种或多种。在一些实施例中,交易记录的数据可以包括医疗信息、电子合同、电子凭据、电子订单、数字指纹等中的一种或多种。Blockchain transactions (referred to as transactions) can be used to record various events and/or data. In some embodiments, the events recorded in the transaction may include one or more of the joining of a new node, the exit of a node, the transfer, and the like. In some embodiments, the data of transaction records may include one or more of medical information, electronic contracts, electronic credentials, electronic orders, digital fingerprints, and the like.
期望的代码可以通过交易触发执行,也可称作交易的执行,区块链节点可以是交易 的执行者。仅作为示例,用于记录转账行为的交易可以触发对转账双方账户余额的更新,用于存证数据的交易可以触发将数据写入区块链数据,用于查询数据的交易可以触发对区块链数据的查询,等等。The expected code can be triggered by the transaction, which can also be called the execution of the transaction, and the blockchain node can be the executor of the transaction. As an example only, the transaction used to record the transfer behavior can trigger the update of the account balance of both parties to the transfer; Chain data query, etc.
在一些实施例中,交易的执行可包括智能合约的调用。智能合约(简称合约)可以指分布式存储于区块链系统中各节点的可在一定条件下自动执行的数字化协议。智能合约本质是一段运行在区块链网络中的代码,用于完成用户所赋予的业务逻辑。In some embodiments, execution of a transaction may include invocation of a smart contract. A smart contract (referred to as a contract) can refer to a digital agreement that is distributed and stored in each node in the blockchain system and can be automatically executed under certain conditions. The essence of a smart contract is a piece of code running in the blockchain network to complete the business logic assigned by the user.
随着区块链的不断发展,其应用场景不断延伸,越来越多的开发者加入区块链开发。区块链开发中,智能合约开发十分重要。当前区块链业界大部分链是将用高级语言编写的合约源代码编译成低端字节码后,在该低端字节码匹配的虚拟机中运行智能合约(即执行该低端字节码)。例如,以太坊的合约开发者通常选择用Solidity语言编写合约源代码。相应地,将用Solidity语言编写的合约源代码编译成evm格式的字节码(简称evm字节码)后,可在EVM虚拟机中执行该evm字节码。又如,EOS(Enterprise Operating System,企业操作系统)的合约开发者大多选择用C++语言编写合约源代码。相应地,将用C++语言编写的合约源代码编译成wasm格式的字节码(简称wasm字节码)后,可在WASM(Web Assembly)虚拟机中执行该wasm字节码。With the continuous development of the blockchain, its application scenarios continue to expand, and more and more developers join the development of the blockchain. In blockchain development, smart contract development is very important. At present, most chains in the blockchain industry compile the contract source code written in a high-level language into low-end bytecode, and then run the smart contract in a virtual machine that matches the low-end bytecode (that is, execute the low-end bytecode). code). For example, Ethereum contract developers usually choose to write contract source code in Solidity language. Correspondingly, after compiling the contract source code written in Solidity language into evm format bytecode (referred to as evm bytecode), the evm bytecode can be executed in the EVM virtual machine. For another example, most contract developers of EOS (Enterprise Operating System) choose to write contract source code in C++ language. Correspondingly, after compiling the contract source code written in C++ language into wasm format bytecode (wasm bytecode for short), the wasm bytecode can be executed in the WASM (Web Assembly) virtual machine.
虚拟机的一些特性能够在一定程度上保障合约安全(如过滤代码中的不安全语句),合约安全包括但不限于不允许合约获取非授权的数据,如访问本地磁盘文件、访问网络资源等,以及/或者不允许合约行为破坏宿主环境(操作系统)的安全,如不允许智能合约获得一些影响操作系统正常运行的调用权限(比如fork,kill,chmod,ptrace等)。然而,支持转换成低端字节码的高级语言种类有限,使得上述合约执行方式下可供选择的高级语言种类有限,无法满足各类高级语言开发者开发智能合约的需求。Some features of the virtual machine can guarantee contract security to a certain extent (such as filtering unsafe statements in the code). Contract security includes but is not limited to not allowing the contract to obtain unauthorized data, such as accessing local disk files, accessing network resources, etc. And/or do not allow contract behaviors to damage the security of the host environment (operating system), such as not allowing smart contracts to obtain some call permissions that affect the normal operation of the operating system (such as fork, kill, chmod, ptrace, etc.). However, the types of high-level languages that support conversion into low-end bytecodes are limited, so that the types of high-level languages available for the above-mentioned contract execution methods are limited, and cannot meet the needs of various high-level language developers to develop smart contracts.
虽然也有区块链架构(如Fabric)支持以原生执行方式执行智能合约,但却没有对合约的操作权限进行限制以保障合约安全,例如,一些联盟链架构仅依靠授权成员的加入来保障合约安全。在没有对合约的操作权限进行限制的情况下,如果存在一些安全漏洞,同时刚好有“作恶”的智能合约利用安全漏洞,很可能导致隐私数据的泄露、节点的不可靠运行等问题。Although there are also blockchain architectures (such as Fabric) that support the execution of smart contracts in a native execution mode, they do not restrict the operation authority of the contract to ensure contract security. For example, some alliance chain architectures only rely on the addition of authorized members to ensure contract security. . In the absence of restrictions on the operation authority of the contract, if there are some security vulnerabilities, and at the same time there are "evil" smart contracts that take advantage of the security vulnerabilities, it is likely to lead to the leakage of private data, unreliable operation of nodes and other issues.
需要说明的是,原生执行方式也称作传统/常规执行方式,是指将用高级语言编写的源代码编译成原生执行代码(区别于低端字节码)来执行。例如,对于Java语言,原生执行方式是指将用Java语言编写的源代码编译成class格式的字节码来执行。又如,对于C++语言,原生执行方式是指将用C++语言编写的源代码编译成与目标CPU架构匹配的字节码,可以理解,这里的目标CPU架构特指用于执行合约的CPU架构。每种高 级语言对应一种原生执行代码,而有限种类的高级语言支持将源代码转换成统一格式的低端字节码。按照原生执行方式执行的智能合约代码(简称原生智能合约)可以满足各类高级语言开发者开发智能合约的需求。另外,相较于低端字节码,原生执行代码的可调试性更高。It should be noted that the native execution mode is also called traditional/conventional execution mode, which refers to compiling source code written in a high-level language into native execution code (different from low-end bytecode) for execution. For example, for the Java language, the native execution mode refers to compiling the source code written in the Java language into a bytecode in a class format for execution. As another example, for the C++ language, the native execution method refers to compiling the source code written in the C++ language into a bytecode that matches the target CPU architecture. It can be understood that the target CPU architecture here specifically refers to the CPU architecture used to execute the contract. Each high-level language corresponds to a native executable code, and a limited variety of high-level languages support the conversion of source code into low-level bytecodes in a uniform format. The smart contract code executed according to the native execution method (native smart contract for short) can meet the needs of various high-level language developers to develop smart contracts. In addition, native executable code is more debuggable than low-end bytecode.
在一些实施例中,为了支持原生智能合约的执行,可以将容器作为原生智能合约的执行环境。容器具有占用资源少、部署快、易移植、隔离性等优势。每个交易的合约执行可以与容器实例建立一一对应的关系,可以理解,容器实例是指具体的单个容器。如此,可利用容器的隔离性隔离不同交易的合约执行。In some embodiments, in order to support the execution of native smart contracts, the container can be used as the execution environment of native smart contracts. Containers have the advantages of less resources, fast deployment, easy portability, and isolation. The contract execution of each transaction can establish a one-to-one correspondence with the container instance. It can be understood that the container instance refers to a specific single container. In this way, the isolation of the container can be used to isolate the contract execution of different transactions.
然而,普通容器(如Docker,Inc.开发的Docker容器(简称Docker))与宿主环境(操作系统)共享内核(kernel),“作恶”的智能合约可以利用内核漏洞攻击宿主环境,窃取隐私数据甚至破坏操作系统。需要说明的是,内核是操作系统(Operation System,OS)的核心,其可负责管理操作系统的进程、内存、设备驱动程序、文件和网络系统,决定着操作系统的性能和稳定性。However, ordinary containers (such as the Docker container (Docker for short) developed by Docker, Inc.) share the kernel (kernel) with the host environment (operating system), and "evil" smart contracts can use kernel vulnerabilities to attack the host environment, steal private data or even corrupt the operating system. It should be noted that the kernel is the core of the operating system (Operation System, OS), which is responsible for managing the processes, memory, device drivers, files and network systems of the operating system, and determines the performance and stability of the operating system.
有鉴于此,本说明书实施例提供一种通过安全容器执行原生智能合约的方法和系统,可以满足各类语言开发者开发智能合约的需求,保证较高的代码可调试性,且确保智能合约的安全性。In view of this, the embodiment of this specification provides a method and system for executing native smart contracts through a secure container, which can meet the needs of developers of various languages for developing smart contracts, ensure high code debuggability, and ensure the integrity of smart contracts. safety.
可以理解,区别于普通容器(如Docker),安全容器是指与宿主环境不共享内核的容器。仅作为示例,安全容器可以包括由开源社区开发的kata容器(具体信息可参见https://katacontainers.io/)、由谷歌开发的gVisor容器、由亚马逊开发的Firecracker等中的一种或多种。It can be understood that, different from ordinary containers (such as Docker), a secure container refers to a container that does not share a kernel with the host environment. As an example only, the security container may include one or more of the kata container developed by the open source community (see https://katacontainers.io/ for specific information), the gVisor container developed by Google, the Firecracker developed by Amazon, etc. .
图1是根据本说明书一些实施例所示的智能合约执行方法的流程示意图。Fig. 1 is a schematic flowchart of a method for executing a smart contract according to some embodiments of this specification.
所述方法可以包括由运行在宿主环境中的区块链节点进程实现的节点流程,以及由运行在安全容器中的进程实现的合约流程。其中,区块链节点进程可指正在运行的区块链程序。在一些实施例中,宿主环境和安全容器可以集成于单个设备(宿主机),也可以分布在多个设备上,例如可以将安全容器运行在云服务器上。在一些实施例中,宿主环境和安全容器之间可通过宿主环境本身具备的网络模块建立通信连接。The method may include a node process implemented by a blockchain node process running in a host environment, and a contract process implemented by a process running in a secure container. Wherein, the blockchain node process may refer to a running blockchain program. In some embodiments, the host environment and the security container can be integrated on a single device (host machine), or distributed on multiple devices, for example, the security container can be run on a cloud server. In some embodiments, a communication connection can be established between the host environment and the secure container through a network module of the host environment itself.
如图1所示,所述节点流程可以包括:接收交易;响应于接收到交易,在安全容器中创建进程,以执行所述交易调用的智能合约的原生执行代码;获得所述交易的执行结果(也可称作“收据”)。所述合约流程可以包括在安全容器中执行所述智能合约的原生执行代码。As shown in Figure 1, the node process may include: receiving a transaction; in response to receiving the transaction, creating a process in a secure container to execute the native execution code of the smart contract called by the transaction; obtaining the execution result of the transaction (Also known as a "receipt"). The contract process may include executing the native execution code of the smart contract in a secure container.
可以理解,区块链节点进程/安全容器中可运行多个进程以实现相应流程。It can be understood that multiple processes can be run in the blockchain node process/secure container to realize the corresponding process.
在一些实施例中,响应于接收到交易,区块链节点进程可以首先为合约的执行创建一个安全容器,然后在安全容器中创建守护进程。可选地,区块链节点进程也可以在已创建的安全容器中创建守护进程。可选地,区块链节点进程也可以直接使用已创建的守护进程。该守护进程可以用于管理合约执行进程的生命周期,包括负责合约执行进程的创建、销毁、调用等。进而,守护进程可在安全容器中创建合约执行进程,从区块链节点进程获取交易调用的智能合约的原生执行代码,并将所述原生执行代码传递至所述合约执行进程。其中,合约执行进程可用于执行交易调用的智能合约的原生执行代码。在一些实施例中,合约执行可包括设置智能合约中变量的值。具体地,合约执行进程可以从所述区块链节点进程获取智能合约中变量的值,设置所述变量的值,并将设置后的所述变量的值返回给所述区块链节点进程,以使区块链节点进程获得交易的执行结果。其中,交易中可指明要设置的变量的名称(key),区块链节点进程可根据该变量的名称查询该变量的值(value)。可以理解,同一变量的key和value可以键值对形式存储以便查询。In some embodiments, in response to receiving a transaction, the blockchain node process may first create a secure container for contract execution, and then create a daemon process in the secure container. Optionally, the blockchain node process can also create a daemon process in the created secure container. Optionally, the blockchain node process can also directly use the created daemon process. The daemon process can be used to manage the life cycle of the contract execution process, including being responsible for the creation, destruction, and invocation of the contract execution process. Furthermore, the daemon process can create a contract execution process in the secure container, obtain the native execution code of the smart contract called by the transaction from the blockchain node process, and pass the native execution code to the contract execution process. Among them, the contract execution process can be used to execute the native execution code of the smart contract called by the transaction. In some embodiments, contract execution may include setting the value of a variable in the smart contract. Specifically, the contract execution process can obtain the value of the variable in the smart contract from the block chain node process, set the value of the variable, and return the set value of the variable to the block chain node process, In order to enable the blockchain node process to obtain the execution result of the transaction. Among them, the name (key) of the variable to be set can be specified in the transaction, and the blockchain node process can query the value (value) of the variable according to the name of the variable. It can be understood that the key and value of the same variable can be stored in the form of key-value pairs for easy query.
可以理解,本说明书的一个或多个实施例中的某些特征、结构或特点可以进行适当的组合。下面结合图2进行示例。It can be understood that certain features, structures or characteristics in one or more embodiments of this specification can be properly combined. An example is given below in conjunction with FIG. 2 .
图2是根据本说明书一些实施例所示的智能合约执行方法的交互示意图。Fig. 2 is an interactive schematic diagram of a smart contract execution method according to some embodiments of this specification.
如图2所示,区块链节点程序进程可以包括容器接口、数据库(DB)、容器管理模块和gRPC客户端,守护进程可以包括gRPC服务器和合约运行模块。其中,容器接口可用于接收交易。容器管理模块可用于响应于容器接口接收到交易,创建安全容器并在所述安全容器中创建进程,以执行所述交易调用的智能合约的原生执行代码。数据库可用于存储区块链数据。区块链数据包括区块数据、账户状态、账户存储、合约代码(如原生执行代码)等中的一个或多个。As shown in Figure 2, the blockchain node program process may include a container interface, a database (DB), a container management module and a gRPC client, and the daemon process may include a gRPC server and a contract running module. Among them, the container interface can be used to receive transactions. The container management module may be configured to, in response to the container interface receiving a transaction, create a secure container and create a process in the secure container to execute the native execution code of the smart contract invoked by the transaction. Databases can be used to store blockchain data. Blockchain data includes one or more of block data, account status, account storage, contract code (such as native execution code), etc.
gRPC服务器可以与gRPC客户端进行通信,用作用于与区块链节点进程进行通信的通信模块,该通信可以包括获取智能合约的原生执行代码。可选地,gRPC客户端可以主动与gRPC服务器进行通信。具体地,响应于容器接口接收到交易,gRPC客户端可以通过容器接口从数据库中获取交易调用的智能合约的原生执行代码,并将其发送给gRPC服务器。The gRPC server can communicate with the gRPC client as a communication module for communicating with the blockchain node process, and the communication can include obtaining the native execution code of the smart contract. Optionally, the gRPC client can actively communicate with the gRPC server. Specifically, in response to the container interface receiving the transaction, the gRPC client can obtain the native execution code of the smart contract invoked by the transaction from the database through the container interface, and send it to the gRPC server.
合约运行模块从gRPC服务器获取调用的智能合约的原生执行代码并将其传递至合约执行进程。The contract running module obtains the native execution code of the called smart contract from the gRPC server and passes it to the contract execution process.
从而,合约执行进程可执行获得的原生执行代码。Thus, the contract execution process can execute the obtained native execution code.
在一些实施例中,容器接口和gRPC客户端之间可设置容器代理,容器接口接收到 交易后可通过容器代理和gRPC客户端与守护进程进行通信。In some embodiments, a container proxy can be set between the container interface and the gRPC client, and the container interface can communicate with the daemon process through the container proxy and the gRPC client after receiving the transaction.
在一些实施例中,合约执行进程与区块链节点进程之间的通信也可以遵循客户端-服务端模式。即,合约执行进程中的gRPC客户端可以向区块链节点进程中的gRPC服务器线程池(线程集合,thread即线程)发起请求,相应地gRPC服务器线程池对合约执行进程的请求做出响应。具体地,所述请求可以包括获取要设置的合约变量的值,设置合约变量的值以及通知合约执行结果。In some embodiments, the communication between the contract execution process and the blockchain node process can also follow the client-server model. That is, the gRPC client in the contract execution process can initiate a request to the gRPC server thread pool (thread collection, thread is a thread) in the blockchain node process, and the gRPC server thread pool responds to the request of the contract execution process accordingly. Specifically, the request may include obtaining the value of the contract variable to be set, setting the value of the contract variable, and notifying the contract execution result.
gRPC服务器线程池可以通过VM(Virtual Machine,虚拟机)线程(如VM thread1、VM thread2等)和Container(容器,如Container1、Container2等)向合约执行进程(中的gRPC客户端)返回执行合约所需的数据,如要设置的合约变量的值。gRPC服务器线程池中的IO线程/Container可以通过队列存取消息。例如,IO线程可以通过Msg Put函数(操作)将消息放入队列,Container可以通过Msg Get函数(操作)将该消息从队列中取出,进而通过Return函数(操作)将获得的响应数据放入队列以供IO线程取出。The gRPC server thread pool can return the execution contract to the contract execution process (gRPC client in it) through the VM (Virtual Machine, virtual machine) thread (such as VM thread1, VM thread2, etc.) and Container (container, such as Container1, Container2, etc.) The required data, such as the value of the contract variable to be set. The IO thread/Container in the gRPC server thread pool can access messages through the queue. For example, the IO thread can put the message into the queue through the Msg Put function (operation), and the Container can take the message out of the queue through the Msg Get function (operation), and then put the obtained response data into the queue through the Return function (operation) For the IO thread to take out.
每个线程(IO线程/VM线程)每次可负责一笔交易的执行。合约执行进程通知gRPC服务器线程池中的线程某交易调用的原生智能合约执行完毕后,负责该交易的执行的VM线程可确定该交易执行完毕。相应地,容器接口可获得交易的执行结果(即收据)。Each thread (IO thread/VM thread) can be responsible for the execution of one transaction at a time. The contract execution process notifies the threads in the gRPC server thread pool that after the execution of the native smart contract invoked by a certain transaction is completed, the VM thread responsible for the execution of the transaction can confirm that the transaction has been executed. Correspondingly, the container interface can obtain the execution result of the transaction (ie, the receipt).
应当注意的是,上述有关流程的描述仅仅是为了示例和说明,而不限定本说明书的适用范围。对于本领域技术人员来说,在本说明书的指导下可以对流程进行各种修正和改变。然而,这些修正和改变仍在本说明书的范围之内。It should be noted that, the above descriptions about the process are only for illustration and description, and do not limit the scope of application of this specification. For those skilled in the art, various modifications and changes can be made to the flow under the guidance of this specification. However, such modifications and changes are still within the scope of this specification.
参考图2,本说明书实施例还提供一种智能合约执行系统,该系统可以包括运行在宿主环境中的区块链节点进程以及运行在安全容器中的进程。Referring to FIG. 2 , the embodiment of this specification also provides a smart contract execution system, which may include a blockchain node process running in a host environment and a process running in a secure container.
其中,区块链节点进程可以用于:接收区块链交易,根据接收到的区块链交易在所述安全容器中启动进程,以执行所述区块链交易调用的智能合约的原生执行代码,所述原生执行代码与所述智能合约的源代码所属的高级语言对应;获得所述区块链交易的执行结果。Wherein, the blockchain node process can be used to: receive blockchain transactions, start a process in the secure container according to the received blockchain transactions, to execute the native execution code of the smart contract invoked by the blockchain transactions , the native execution code corresponds to the high-level language to which the source code of the smart contract belongs; and the execution result of the blockchain transaction is obtained.
所述安全容器中的进程用于:在所述安全容器中执行所述智能合约的原生执行代码。The process in the secure container is used for: executing the native execution code of the smart contract in the secure container.
应当理解,上述智能合约执行系统及其模块可以利用各种方式来实现。例如,在一些实施例中,系统及其模块可以通过硬件、软件或者软件和硬件的结合来实现。其中,硬件部分可以利用专用逻辑来实现;软件部分则可以存储在存储器中,由适当的指令执行系统,例如微处理器或者专用设计硬件来执行。本领域技术人员可以理解上述的方法和系统可以使用计算机可执行指令和/或包含在处理器控制代码中来实现,例如在诸如磁盘、CD或DVD-ROM的载体介质、诸如只读存储器(固件)的可编程的存储器或者诸 如光学或电子信号载体的数据载体上提供了这样的代码。本说明书的系统及其模块不仅可以有诸如超大规模集成电路或门阵列、诸如逻辑芯片、晶体管等的半导体、或者诸如现场可编程门阵列、可编程逻辑设备等的可编程硬件设备的硬件电路实现,也可以用例如由各种类型的处理器所执行的软件实现,还可以由上述硬件电路和软件的结合(例如,固件)来实现。It should be understood that the above smart contract execution system and its modules can be implemented in various ways. For example, in some embodiments, the system and its modules may be implemented by hardware, software, or a combination of software and hardware. Wherein, the hardware part can be implemented by using dedicated logic; the software part can be stored in a memory and executed by an appropriate instruction execution system, such as a microprocessor or specially designed hardware. Those skilled in the art will appreciate that the methods and systems described above can be implemented using computer-executable instructions and/or contained in processor control code, for example on a carrier medium such as a magnetic disk, CD or DVD-ROM, such as a read-only memory (firmware ) or on a data carrier such as an optical or electronic signal carrier. The system and its modules in this specification can not only be realized by hardware circuits such as very large scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, etc., or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc. , can also be realized by software executed by various types of processors, for example, and can also be realized by a combination of the above-mentioned hardware circuits and software (for example, firmware).
需要注意的是,以上对于系统及其模块的描述,仅为描述方便,并不能把本说明书限制在所举实施例范围之内。可以理解,对于本领域的技术人员来说,在了解系统的原理后,可能在不背离这一原理的情况下,对各个模块进行任意组合,或者构成子系统与其他模块连接。例如,在一些实施例中,如图2所示,安全容器中可运行多个分工不同的进程以共同实现合约流程。诸如此类的变形,均在本说明书的保护范围之内。It should be noted that the above description of the system and its modules is only for convenience of description, and does not limit this description to the scope of the illustrated embodiments. It can be understood that for those skilled in the art, after understanding the principle of the system, it is possible to combine various modules arbitrarily, or form a subsystem to connect with other modules without departing from this principle. For example, in some embodiments, as shown in FIG. 2 , multiple processes with different divisions of labor can be run in the secure container to jointly implement the contract process. Such deformations are within the protection scope of this specification.
本说明书实施例可能带来的有益效果包括但不限于:(1)将容器作为原生智能合约的执行环境,以支持原生智能合约的执行,以原生方式执行智能合约可以满足各类语言开发者开发智能合约的需求,保证较高的代码可调试性,且确保智能合约的安全性;(2)引入不与宿主环境共享内核的安全容器来保障合约安全,防止“作恶”的智能合约通过内核漏洞攻击宿主环境,保护宿主环境的数据安全。需要说明的是,不同实施例可能产生的有益效果不同,在不同的实施例里,可能产生的有益效果可以是以上任意一种或几种的组合,也可以是其他任何可能获得的有益效果。The possible beneficial effects of the embodiments of this specification include but are not limited to: (1) The container is used as the execution environment of the native smart contract to support the execution of the native smart contract, and the execution of the smart contract in a native way can satisfy various language developers The requirements of smart contracts ensure high code debuggability and ensure the security of smart contracts; (2) introduce a security container that does not share the kernel with the host environment to ensure contract security and prevent "evil" smart contracts from passing through kernel vulnerabilities Attack the host environment and protect the data security of the host environment. It should be noted that different embodiments may have different beneficial effects. In different embodiments, the possible beneficial effects may be any one or a combination of the above, or any other possible beneficial effects.
上文已对基本概念做了描述,显然,对于本领域技术人员来说,上述详细披露仅仅作为示例,而并不构成对本说明书实施例的限定。虽然此处并没有明确说明,本领域技术人员可能会对本说明书实施例进行各种修改、改进和修正。该类修改、改进和修正在本说明书实施例中被建议,所以该类修改、改进、修正仍属于本说明书示范实施例的精神和范围。The basic concepts have been described above. Obviously, for those skilled in the art, the above detailed disclosure is only an example, and does not constitute a limitation to the embodiment of this specification. Although not explicitly stated here, those skilled in the art may make various modifications, improvements and amendments to the embodiments of this specification. Such modifications, improvements and corrections are suggested in the embodiments of this specification, so such modifications, improvements and corrections still belong to the spirit and scope of the exemplary embodiments of this specification.
同时,本说明书使用了特定词语来描述本说明书的实施例。如“一个实施例”、“一实施例”、和/或“一些实施例”意指与本说明书至少一个实施例相关的某一特征、结构或特点。因此,应强调并注意的是,本说明书中在不同位置两次或多次提及的“一实施例”或“一个实施例”或“一个替代性实施例”并不一定是指同一实施例。Meanwhile, this specification uses specific words to describe the embodiments of this specification. For example, "one embodiment", "an embodiment", and/or "some embodiments" refer to a certain feature, structure or characteristic related to at least one embodiment of this specification. Therefore, it should be emphasized and noted that two or more references to "an embodiment" or "an embodiment" or "an alternative embodiment" in different places in this specification do not necessarily refer to the same embodiment .
此外,本领域技术人员可以理解,本说明书实施例的各方面可以通过若干具有可专利性的种类或情况进行说明和描述,包括任何新的和有用的工序、机器、产品或物质的组合,或对他们的任何新的和有用的改进。相应地,本说明书实施例的各个方面可以完全由硬件执行、可以完全由软件(包括固件、常驻软件、微码等)执行、也可以由硬件和软件组合执行。以上硬件或软件均可被称为“数据块”、“模块”、“引擎”、“单元”、“组 件”或“系统”。此外,本说明书实施例的各方面可能表现为位于一个或多个计算机可读介质中的计算机产品,该产品包括计算机可读程序编码。In addition, those skilled in the art will understand that all aspects of the embodiments of this specification can be illustrated and described by several patentable categories or situations, including any new and useful process, machine, product or combination of substances, or Any new and useful improvements to them. Correspondingly, various aspects of the embodiments of this specification may be completely executed by hardware, may be completely executed by software (including firmware, resident software, microcode, etc.), or may be executed by a combination of hardware and software. The above hardware or software may be referred to as "block", "module", "engine", "unit", "component" or "system". In addition, aspects of the embodiments of this specification may be embodied as a computer product on one or more computer-readable media, the product including computer-readable program code.
计算机存储介质可能包含一个内含有计算机程序编码的传播数据信号,例如在基带上或作为载波的一部分。该传播信号可能有多种表现形式,包括电磁形式、光形式等,或合适的组合形式。计算机存储介质可以是除计算机可读存储介质之外的任何计算机可读介质,该介质可以通过连接至一个指令执行系统、装置或设备以实现通讯、传播或传输供使用的程序。位于计算机存储介质上的程序编码可以通过任何合适的介质进行传播,包括无线电、电缆、光纤电缆、RF、或类似介质,或任何上述介质的组合。A computer storage medium may contain a propagated data signal embodying a computer program code, for example, in baseband or as part of a carrier wave. The propagated signal may have various manifestations, including electromagnetic form, optical form, etc., or a suitable combination. A computer storage medium may be any computer-readable medium, other than a computer-readable storage medium, that can be used to communicate, propagate, or transfer a program for use by being coupled to an instruction execution system, apparatus, or device. Program code residing on a computer storage medium may be transmitted over any suitable medium, including radio, electrical cable, fiber optic cable, RF, or the like, or combinations of any of the foregoing.
本说明书实施例各部分操作所需的计算机程序编码可以用任意一种或多种程序语言编写,包括面向对象编程语言如Java、Scala、Smalltalk、Eiffel、JADE、Emerald、C++、C#、VB.NET、Python等,常规程序化编程语言如C语言、VisualBasic、Fortran2003、Perl、COBOL2002、PHP、ABAP,动态编程语言如Python、Ruby和Groovy,或其他编程语言等。该程序编码可以完全在用户计算机上运行、或作为独立的软件包在用户计算机上运行、或部分在用户计算机上运行部分在远程计算机运行、或完全在远程计算机或处理设备上运行。在后种情况下,远程计算机可以通过任何网络形式与用户计算机连接,比如局域网(LAN)或广域网(WAN),或连接至外部计算机(例如通过因特网),或在云计算环境中,或作为服务使用如软件即服务(SaaS)。The computer program codes required for the operation of each part of the embodiments of this specification can be written in any one or more programming languages, including object-oriented programming languages such as Java, Scala, Smalltalk, Eiffel, JADE, Emerald, C++, C#, VB.NET , Python, etc., conventional programming languages such as C language, VisualBasic, Fortran2003, Perl, COBOL2002, PHP, ABAP, dynamic programming languages such as Python, Ruby and Groovy, or other programming languages. The program code may run entirely on the user's computer, or as a stand-alone software package, or run partly on the user's computer and partly on a remote computer, or entirely on the remote computer or processing device. In the latter case, the remote computer can be connected to the user computer through any form of network, such as a local area network (LAN) or wide area network (WAN), or to an external computer (such as through the Internet), or in a cloud computing environment, or as a service Use software as a service (SaaS).
此外,除非权利要求中明确说明,本说明书实施例所述处理元素和序列的顺序、数字字母的使用、或其他名称的使用,并非用于限定本说明书实施例流程和方法的顺序。尽管上述披露中通过各种示例讨论了一些目前认为有用的发明实施例,但应当理解的是,该类细节仅起到说明的目的,附加的权利要求并不仅限于披露的实施例,相反,权利要求旨在覆盖所有符合本说明书实施例实质和范围的修正和等价组合。例如,虽然以上所描述的系统组件可以通过硬件设备实现,但是也可以只通过软件的解决方案得以实现,如在现有的处理设备或移动设备上安装所描述的系统。In addition, unless clearly stated in the claims, the sequence of processing elements and sequences, the use of numbers and letters, or the use of other names in the embodiments of this specification are not used to limit the sequence of the processes and methods of the embodiments of this specification. While the foregoing disclosure has discussed by way of various examples some embodiments of the invention that are presently believed to be useful, it should be understood that such detail is for illustrative purposes only and that the appended claims are not limited to the disclosed embodiments, but rather, the claims The claims are intended to cover all modifications and equivalent combinations that fall within the spirit and scope of the embodiments of this specification. For example, while the system components described above may be implemented as hardware devices, they may also be implemented as a software-only solution, such as installing the described system on an existing processing device or mobile device.
同理,应当注意的是,为了简化本说明书实施例披露的表述,从而帮助对一个或多个发明实施例的理解,前文对本说明书实施例的描述中,有时会将多种特征归并至一个实施例、附图或对其的描述中。但是,这种披露方法并不意味着本说明书实施例对象所需要的特征比权利要求中提及的特征多。实际上,实施例的特征要少于上述披露的单个实施例的全部特征。Similarly, it should be noted that, in order to simplify the description of the disclosure of the embodiments of this specification, so as to facilitate the understanding of one or more embodiments of the invention, in the foregoing descriptions of the embodiments of this specification, sometimes multiple features are combined into one implementation examples, drawings or descriptions thereof. However, this method of disclosure does not imply that the embodiments of the present specification require more features than those recited in the claims. Indeed, embodiment features are less than all features of a single foregoing disclosed embodiment.
针对本说明书引用的每个专利、专利申请、专利申请公开物和其他材料,如文章、书籍、说明书、出版物、文档等,特此将其全部内容并入本说明书作为参考。与本说明 书内容不一致或产生冲突的申请历史文件除外,对本说明书权利要求最广范围有限制的文件(当前或之后附加于本说明书中的)也除外。需要说明的是,如果本说明书附属材料中的描述、定义、和/或术语的使用与本说明书所述内容有不一致或冲突的地方,以本说明书的描述、定义和/或术语的使用为准。Each patent, patent application, patent application publication, and other material, such as article, book, specification, publication, document, etc., cited in this specification is hereby incorporated by reference in its entirety. Application history documents that are inconsistent with or conflict with the content of this specification are excluded, and documents (currently or later appended to this specification) that limit the broadest scope of the claims of this specification are excluded. It should be noted that if there is any inconsistency or conflict between the descriptions, definitions, and/or terms used in the accompanying materials of this manual and the contents of this manual, the descriptions, definitions and/or terms used in this manual shall prevail .
最后,应当理解的是,本说明书中所述实施例仅用以说明本说明书实施例的原则。其他的变形也可能属于本说明书实施例的范围。因此,作为示例而非限制,本说明书实施例的替代配置可视为与本说明书的教导一致。相应地,本说明书的实施例不仅限于本说明书明确介绍和描述的实施例。Finally, it should be understood that the embodiments described in this specification are only used to illustrate the principles of the embodiments of this specification. Other modifications may also fall within the scope of the embodiments of this specification. Therefore, by way of example and not limitation, alternative configurations of the embodiments of this specification may be considered consistent with the teachings of this specification. Accordingly, the embodiments of this specification are not limited to the embodiments explicitly introduced and described in this specification.

Claims (10)

  1. 一种智能合约执行方法,其中,所述方法包括由运行在宿主环境中的区块链节点进程实现的节点流程,以及由运行在安全容器中的进程实现的合约流程,所述安全容器为与所述宿主环境不共享内核的容器;A smart contract execution method, wherein the method includes a node process implemented by a block chain node process running in a host environment, and a contract process implemented by a process running in a secure container, and the secure container is connected to said host environment does not share a kernel container;
    其中,所述节点流程包括:接收区块链交易;响应于接收到区块链交易,在所述安全容器中创建进程,以执行所述区块链交易调用的智能合约的原生执行代码,所述原生执行代码的格式与所述智能合约的源代码所属的高级语言对应;获得所述区块链交易的执行结果;Wherein, the node process includes: receiving a blockchain transaction; in response to receiving the blockchain transaction, creating a process in the secure container to execute the native execution code of the smart contract called by the blockchain transaction, so The format of the native execution code corresponds to the high-level language to which the source code of the smart contract belongs; the execution result of the blockchain transaction is obtained;
    所述合约流程包括:在所述安全容器中执行所述智能合约的原生执行代码。The contract process includes: executing the native execution code of the smart contract in the secure container.
  2. 如权利要求1所述的方法,其中,所述响应于接收到区块链交易,在所述安全容器中创建进程,包括:The method of claim 1, wherein said creating a process in said secure container in response to receiving a blockchain transaction comprises:
    响应于接收到区块链交易,在所述安全容器中创建守护进程;所述守护进程用于:在所述安全容器中创建用于执行所述智能合约的原生执行代码的合约执行进程,从所述区块链节点进程获取所述智能合约的原生执行代码,并将所述原生执行代码传递至所述合约执行进程。In response to receiving a blockchain transaction, create a daemon process in the secure container; the daemon process is used to: create a contract execution process for executing the native execution code of the smart contract in the secure container, from The block chain node process obtains the native execution code of the smart contract, and transmits the native execution code to the contract execution process.
  3. 如权利要求2所述的方法,其中,所述守护进程包括通信模块和合约运行模块;其中,所述通信模块用于与所述区块链节点进程进行通信,所述通信包括获取所述智能合约的原生执行代码;所述合约运行模块用于从所述通信模块获取所述智能合约的原生执行代码,并将其传递至所述合约执行进程。The method according to claim 2, wherein the daemon process includes a communication module and a contract running module; wherein the communication module is used to communicate with the block chain node process, and the communication includes obtaining the intelligent The native execution code of the contract; the contract running module is used to obtain the native execution code of the smart contract from the communication module, and deliver it to the contract execution process.
  4. 如权利要求2所述的方法,其中,所述执行所述智能合约的原生执行代码,包括:The method according to claim 2, wherein said executing the native execution code of said smart contract comprises:
    从所述区块链节点进程获取所述智能合约中变量的值,设置所述变量的值,并将设置后的所述变量的值返回给所述区块链节点进程,以使所述区块链节点进程获得所述区块链交易的执行结果。Obtain the value of the variable in the smart contract from the block chain node process, set the value of the variable, and return the set value of the variable to the block chain node process, so that the block The block chain node process obtains the execution result of the block chain transaction.
  5. 如权利要求1所述的方法,其中,所述区块链节点进程包括用于接收区块链交易的容器接口,所述区块链节点进程还包括容器管理模块,所述容器管理模块用于:响应于所述容器接口接收到区块链交易,创建安全容器并在所述安全容器中创建进程,以执行所述区块链交易调用的智能合约的原生执行代码。The method according to claim 1, wherein the block chain node process includes a container interface for receiving block chain transactions, the block chain node process also includes a container management module, and the container management module is used for : In response to the container interface receiving a blockchain transaction, creating a secure container and creating a process in the secure container to execute the native execution code of the smart contract invoked by the blockchain transaction.
  6. 如权利要求2所述的方法,其中,所述区块链节点进程包括容器接口、数据库、容器管理模块和gRPC客户端;所述守护进程包括gRPC服务端和合约运行模块;The method according to claim 2, wherein the block chain node process includes a container interface, a database, a container management module and a gRPC client; the daemon process includes a gRPC server and a contract running module;
    其中,所述容器接口用于接收区块链交易;所述数据库用于存储区块链数据,所述 区块链数据包括智能合约的原生执行代码;所述容器管理模块用于响应于所述容器接口接收到区块链交易,创建所述安全容器并在所述安全容器中创建所述守护进程,以执行所述区块链交易调用的智能合约的原生执行代码;所述gRPC客户端用于响应于所述容器接口接收到区块链交易,通过所述容器接口从所述数据库中获取所述区块链交易调用的智能合约的原生执行代码,并将其发送给所述gRPC服务器;Wherein, the container interface is used to receive blockchain transactions; the database is used to store blockchain data, and the blockchain data includes native execution codes of smart contracts; the container management module is used to respond to the The container interface receives the blockchain transaction, creates the secure container and creates the daemon process in the secure container to execute the native execution code of the smart contract called by the blockchain transaction; the gRPC client uses Responding to receiving a blockchain transaction in response to the container interface, obtaining the native execution code of the smart contract invoked by the blockchain transaction from the database through the container interface, and sending it to the gRPC server;
    所述合约运行模块用于从所述gRPC服务器获取调用的智能合约的原生执行代码并将其传递至所述合约执行进程。The contract running module is used to obtain the native execution code of the called smart contract from the gRPC server and deliver it to the contract execution process.
  7. 如权利要求1所述的方法,其中,所述安全容器包括kata容器、gVisor容器、Firecracker容器中的一种或多种。The method according to claim 1, wherein the secure container comprises one or more of a kata container, a gVisor container, and a Firecracker container.
  8. 一种智能合约执行系统,其中,所述系统包括运行在宿主环境中的区块链节点进程以及运行在安全容器中的进程,所述安全容器为与所述宿主环境不共享内核的容器;A smart contract execution system, wherein the system includes a blockchain node process running in a host environment and a process running in a secure container, the secure container is a container that does not share a kernel with the host environment;
    其中,所述区块链节点进程用于:接收区块链交易;响应于接收到区块链交易,在所述安全容器中创建进程,以执行所述区块链交易调用的智能合约的原生执行代码,所述原生执行代码与所述智能合约的源代码所属的高级语言对应;获得所述区块链交易的执行结果;Wherein, the block chain node process is used to: receive block chain transactions; in response to receiving block chain transactions, create a process in the security container to execute the native execution code, the native execution code corresponds to the high-level language to which the source code of the smart contract belongs; obtain the execution result of the blockchain transaction;
    所述安全容器中的进程用于:在所述安全容器中执行所述智能合约的原生执行代码。The process in the secure container is used for: executing the native execution code of the smart contract in the secure container.
  9. 一种智能合约执行装置,其中,包括处理器和存储设备,所述存储设备用于存储指令,当所述处理器执行指令时,实现如权利要求1~7中任一项所述的方法。A smart contract execution device, including a processor and a storage device, the storage device is used to store instructions, and when the processor executes the instructions, the method according to any one of claims 1-7 is implemented.
  10. 一种计算机存储介质,其中,所述存储介质存储有指令,当处理器执行指令时,实现如权利要求1~7中任一项所述的方法。A computer storage medium, wherein the storage medium stores instructions, and when the processor executes the instructions, the method according to any one of claims 1-7 is implemented.
PCT/CN2022/100522 2021-07-01 2022-06-22 Method, system, and apparatus for executing smart contract, and storage medium WO2023273994A1 (en)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110739999.1 2021-07-01
CN202110739999.1A CN113256296B (en) 2021-07-01 2021-07-01 Intelligent contract execution method, system, device and storage medium

Publications (1)

Publication Number Publication Date
WO2023273994A1 true WO2023273994A1 (en) 2023-01-05

Family

ID=77190531

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/100522 WO2023273994A1 (en) 2021-07-01 2022-06-22 Method, system, and apparatus for executing smart contract, and storage medium

Country Status (2)

Country Link
CN (1) CN113256296B (en)
WO (1) WO2023273994A1 (en)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113256296B (en) * 2021-07-01 2021-10-08 支付宝(杭州)信息技术有限公司 Intelligent contract execution method, system, device and storage medium
CN114327776A (en) * 2021-12-30 2022-04-12 支付宝(杭州)信息技术有限公司 Debugging method, debugging equipment and debugging system for intelligent contract
CN115437682B (en) * 2022-09-15 2023-03-21 中国安全生产科学研究院 Application development management system under ABAP development environment

Citations (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108881440A (en) * 2018-06-19 2018-11-23 北京连琪科技有限公司 A kind of block chain contract method for building up and system for taking into account safety and performance
US20190149321A1 (en) * 2017-11-15 2019-05-16 International Business Machines Corporation Authenticating chaincode to chaincode invocations of a blockchain
CN110008263A (en) * 2019-02-20 2019-07-12 顺丰科技有限公司 Dynamic organization's extended method and system under Hyperledger fabric cluster mode
CN111459573A (en) * 2020-04-01 2020-07-28 济南浪潮高新科技投资发展有限公司 Method and device for starting intelligent contract execution environment
CN111651169A (en) * 2020-05-19 2020-09-11 鼎链数字科技(深圳)有限公司 Block chain intelligent contract operation method and system based on web container
CN112035090A (en) * 2020-07-13 2020-12-04 翼帆数字科技(苏州)有限公司 Intelligent contract management system and method based on containerization technology
CN112367194A (en) * 2020-10-27 2021-02-12 四川长虹电器股份有限公司 Method for updating channel configuration of Fabric intelligent contract
WO2021098140A1 (en) * 2019-11-21 2021-05-27 深圳壹账通智能科技有限公司 Blockchain network deployment method, electronic device, and computer-readable storage medium
CN113256296A (en) * 2021-07-01 2021-08-13 支付宝(杭州)信息技术有限公司 Intelligent contract execution method, system, device and storage medium

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108765158B (en) * 2018-05-31 2020-11-24 杭州溪塔科技有限公司 Intelligent contract engine system based on block chain and contract execution method thereof
US11086847B2 (en) * 2018-12-29 2021-08-10 Advanced New Technologies Co., Ltd. System and method for implementing native contract on blockchain
CN109800056A (en) * 2019-01-16 2019-05-24 杭州趣链科技有限公司 A kind of block chain dispositions method based on container
CN110782251B (en) * 2019-09-18 2023-05-12 江苏电力信息技术有限公司 Method for automatically deploying blockchain network based on intelligent contracts
CN111258725B (en) * 2020-01-17 2023-07-25 北京百度网讯科技有限公司 Data processing method, device, equipment and medium based on block chain
CN111752574B (en) * 2020-05-08 2021-03-30 北京科技大学 Intelligent executable contract construction and execution method and system of legal contract

Patent Citations (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190149321A1 (en) * 2017-11-15 2019-05-16 International Business Machines Corporation Authenticating chaincode to chaincode invocations of a blockchain
CN108881440A (en) * 2018-06-19 2018-11-23 北京连琪科技有限公司 A kind of block chain contract method for building up and system for taking into account safety and performance
CN110008263A (en) * 2019-02-20 2019-07-12 顺丰科技有限公司 Dynamic organization's extended method and system under Hyperledger fabric cluster mode
WO2021098140A1 (en) * 2019-11-21 2021-05-27 深圳壹账通智能科技有限公司 Blockchain network deployment method, electronic device, and computer-readable storage medium
CN111459573A (en) * 2020-04-01 2020-07-28 济南浪潮高新科技投资发展有限公司 Method and device for starting intelligent contract execution environment
CN111651169A (en) * 2020-05-19 2020-09-11 鼎链数字科技(深圳)有限公司 Block chain intelligent contract operation method and system based on web container
CN112035090A (en) * 2020-07-13 2020-12-04 翼帆数字科技(苏州)有限公司 Intelligent contract management system and method based on containerization technology
CN112367194A (en) * 2020-10-27 2021-02-12 四川长虹电器股份有限公司 Method for updating channel configuration of Fabric intelligent contract
CN113256296A (en) * 2021-07-01 2021-08-13 支付宝(杭州)信息技术有限公司 Intelligent contract execution method, system, device and storage medium

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
ANONYMOUS: "Dry goods | Understanding kata-containers", 23 December 2022 (2022-12-23), XP093021689, Retrieved from the Internet <URL:https://www.likecs.com/show-203738342.html#sc=333.3333435058594> [retrieved on 20230207] *
ANONYMOUS: "Hyperledger Fabric (4) chain code ChainCode", 1 November 2019 (2019-11-01), XP093021687, Retrieved from the Internet <URL:https://www.cnblogs.com/xdyixia/p/11726987.html> [retrieved on 20230207] *

Also Published As

Publication number Publication date
CN113256296B (en) 2021-10-08
CN113256296A (en) 2021-08-13

Similar Documents

Publication Publication Date Title
WO2023273994A1 (en) Method, system, and apparatus for executing smart contract, and storage medium
US20230376576A1 (en) Secure deployment of a software package
US10146635B1 (en) Virtual machine backup
Hedin et al. JSFlow: Tracking information flow in JavaScript and its APIs
KR102419574B1 (en) Systems and methods for correcting memory corruption in computer applications
US9229881B2 (en) Security in virtualized computer programs
US9996374B2 (en) Deployment and installation of updates in a virtual environment
US9832226B2 (en) Automatic curation and modification of virtualized computer programs
US8893222B2 (en) Security system and method for the android operating system
US9152796B2 (en) Dynamic analysis interpreter modification for application dataflow
US8396846B2 (en) Database trigger modification system and method
Armando et al. Securing the" bring your own device" paradigm
US9871800B2 (en) System and method for providing application security in a cloud computing environment
US20170124320A1 (en) Enabling resource access for secure application containers
BR112014031586B1 (en) SYSTEM TO EMULATE A RELIABLE EXECUTION ENVIRONMENT AND COMPUTER STORAGE MEDIA
CN110945504A (en) Delivering configuration-based workflows
WO2024021577A1 (en) Tamper-proof data protection method and system
US11170108B2 (en) Blockchain technique for immutable source control
Vaz et al. MIRES: Intrusion Recovery for Applications based on Backend-as-a-Service
CN109254856A (en) Intelligent POS server-side provides interface to the method for client
US8635331B2 (en) Distributed workflow framework
US9672083B2 (en) Operating a program code object in conjunction with an application context
KR101049916B1 (en) Virtualization Security System and Methods
Belyaev et al. On the formalization, design, and implementation of component-oriented access control in lightweight virtualized server environments
Piras TPM 2.0-based Attestation of a Kubernetes Cluster

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22831810

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE