WO2024001028A1 - Procédé et appareil de gestion de données de chaîne de blocs, et dispositif électronique et support d'informations - Google Patents

Procédé et appareil de gestion de données de chaîne de blocs, et dispositif électronique et support d'informations Download PDF

Info

Publication number
WO2024001028A1
WO2024001028A1 PCT/CN2022/135413 CN2022135413W WO2024001028A1 WO 2024001028 A1 WO2024001028 A1 WO 2024001028A1 CN 2022135413 W CN2022135413 W CN 2022135413W WO 2024001028 A1 WO2024001028 A1 WO 2024001028A1
Authority
WO
WIPO (PCT)
Prior art keywords
blockchain
data
ciphertext
relational database
execution environment
Prior art date
Application number
PCT/CN2022/135413
Other languages
English (en)
Chinese (zh)
Inventor
闫莺
魏长征
Original Assignee
蚂蚁区块链科技(上海)有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 蚂蚁区块链科技(上海)有限公司 filed Critical 蚂蚁区块链科技(上海)有限公司
Publication of WO2024001028A1 publication Critical patent/WO2024001028A1/fr

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/27—Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/14—Error detection or correction of the data by redundancy in operation
    • G06F11/1402—Saving, restoring, recovering or retrying
    • G06F11/1446—Point-in-time backing up or restoration of persistent data
    • G06F11/1448—Management of the data involved in backup or backup restore
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures

Definitions

  • the embodiments of this specification belong to the field of blockchain technology, and particularly relate to a method, device, electronic device and storage medium for maintaining blockchain data.
  • Blockchain is a new application model of computer technology such as distributed data storage, point-to-point transmission, consensus mechanism, and encryption algorithm.
  • data blocks are combined into a chained data structure in a chronological manner and are cryptographically guaranteed to be an untamperable and unforgeable distributed ledger.
  • non-relational databases In traditional blockchain technology, in order to meet the storage needs of blockchain nodes for large amounts of data when running blockchain services, blockchain nodes usually use non-relational databases with efficient access efficiency for data storage.
  • non-relational databases lack transaction relationships, lack connections between data and are not standardized, which is not conducive to data analysis. Relational databases have complete transaction relationships, connections between data and a strict standardized structure. If the non-relational database in traditional blockchain technology is replaced by a relational database, although it is beneficial to data analysis, it will not be used in the block chain.
  • the direct use of relational databases in the chain's underlying system will bring huge challenges to the online read and write performance of blockchain nodes when running blockchain services. Therefore, how to implement convenient data analysis services while ensuring that the blockchain service execution process has high access efficiency is an urgent problem in this field that needs to be solved.
  • the purpose of the present invention is to provide a method, device, electronic device and storage medium for maintaining blockchain data.
  • a method for maintaining blockchain data is proposed, which is applied to a node device deployed with a blockchain node and a first trusted execution environment, and the node device maintains There are blockchain non-relational databases and blockchain relational databases.
  • the blockchain non-relational database is used to maintain ciphertext data.
  • the ciphertext data is stored in the second trusted database by the blockchain node.
  • the blockchain data generated when running the blockchain service in the execution environment is encrypted by the first key corresponding to the second trusted execution environment; the method includes:
  • the ciphertext data is decrypted into the blockchain data through the first key, and the blockchain data is converted into a database corresponding to the blockchain relational database.
  • the ciphertext standard data is maintained in the blockchain relational database, and the blockchain relational database is used to provide data analysis services running in the first trusted execution environment to the analysis requester.
  • a device for maintaining blockchain data which is applied to a node device deployed with a blockchain node and a first trusted execution environment, and the node device maintains There are blockchain non-relational databases and blockchain relational databases.
  • the blockchain non-relational database is used to maintain ciphertext data.
  • the ciphertext data is stored in the second trusted database by the blockchain node.
  • the blockchain data generated when running the blockchain service in the execution environment is encrypted by the first key corresponding to the second trusted execution environment; the device includes:
  • a blockchain data acquisition unit configured to acquire the ciphertext maintained in the blockchain non-relational database when the blockchain node passes the remote certification verification corresponding to the first trusted execution environment. data
  • a blockchain data acquisition unit configured to decrypt the ciphertext data into the blockchain data through the first key in the first trusted execution environment, and convert the blockchain data into the blockchain data.
  • Standard data defined by the database schema information corresponding to the blockchain relational database, and encrypting the standard data into ciphertext standard data through the second key corresponding to the first trusted execution environment;
  • a standard data maintenance unit used to maintain the ciphertext standard data in the blockchain relational database, and the blockchain relational database is used to provide the analysis requester with information running in the first trusted execution environment. data analysis services.
  • an electronic device including:
  • Memory used to store instructions executable by the processor
  • the processor implements the method described in the first aspect by running the executable instructions.
  • a computer-readable storage medium on which computer instructions are stored, and when the instructions are executed by a processor, the steps of the method described in the first aspect are implemented.
  • the embodiment of this specification separately deploys a blockchain non-relational database and a blockchain relational database on node devices.
  • the blockchain non-relational database is used to maintain and run blockchain services on blockchain nodes.
  • the ciphertext data obtained by encrypting the blockchain data generated at the time enables the blockchain node to efficiently store the encrypted blockchain data and efficiently read the ciphertext data when running the blockchain service; on the other hand, , by decrypting, converting and encrypting the ciphertext data maintained in the blockchain non-relational database into ciphertext standard data to be simultaneously maintained in the blockchain relational database, thereby using the blockchain relational database to achieve convenient Data analysis services.
  • the blockchain node is providing the ciphertext.
  • the remote certificate corresponding to the first trusted execution environment needs to be verified in advance before data is sent, thereby ensuring system-level data security in data processing, data transmission and data storage.
  • the method for maintaining blockchain data involved in the embodiments of this specification realizes the backup of one data in two places, objectively improves the disaster recovery capability, and realizes convenient data access while ensuring efficient access efficiency during the execution of the blockchain service.
  • Analysis services at the same time, due to the combination of trusted execution environment technology, it realizes the entire process of trusted data transfer and trusted data processing from on-chain blockchain services to off-chain data conversion and data analysis services. The risk of data leakage is reduced as much as possible.
  • Figure 1 is a flow chart of a method for maintaining blockchain data provided by an exemplary embodiment.
  • Figure 2 is a system architecture diagram for maintaining blockchain data provided by an exemplary embodiment.
  • Figure 3 is a schematic structural diagram of a device provided by an exemplary embodiment.
  • Figure 4 is a block diagram of a device for maintaining blockchain data provided in an exemplary embodiment.
  • Figure 1 is a flow chart of a method for maintaining blockchain data provided by an exemplary embodiment. This method is applied to a node device deployed with a blockchain node and a first trusted execution environment.
  • the node device maintains a blockchain non-relational database and a blockchain relational database.
  • the blockchain non-relational database The database is used to maintain ciphertext data.
  • the ciphertext data is generated by the blockchain node when running the blockchain service in the second trusted execution environment through the corresponding second trusted execution environment.
  • the first key is obtained through encryption; the method includes:
  • FIG. 2 is a system architecture diagram for maintaining blockchain data provided by an exemplary embodiment.
  • each blockchain node in the blockchain network is deployed on the corresponding node device.
  • Each node device maintains both a blockchain non-relational database and a blockchain relational database.
  • the node device is also deployed with a first trusted execution environment (Trusted execution environment, TEE) and a second trusted execution environment.
  • TEE trusted execution environment
  • the blockchain non-relational database is a non-relational database
  • the blockchain relational database is a relational database.
  • the second trusted execution environment is used to undertake the blockchain node to run the block. chain service
  • the first trusted execution environment is used to undertake the data analysis service of the node device.
  • the first trusted execution environment is also used to undertake the process of decrypting, converting and re-encrypting the ciphertext data by the node device.
  • a data conversion engine and a data analysis engine running in the first trusted execution environment are deployed under the node device chain.
  • the data conversion engine is used to perform the process of decrypting, converting and re-encrypting ciphertext data
  • the data analysis engine The engine is used to run data analysis services.
  • the data inside the trusted execution environment needs to be in the clear text state.
  • the trusted execution environment maintains a corresponding key to encrypt internal data and output it to the outside, or to read ciphertext from the outside and decrypt it into plaintext internally.
  • the key corresponding to the trusted execution environment belongs to Symmetric key.
  • the first trusted execution environment maintains a second key for encryption and decryption in the process of accessing data from the blockchain non-relational database
  • the second trusted execution environment maintains a second key.
  • the first key is used for encryption and decryption during the process of accessing data from the blockchain relational database.
  • the blockchain non-relational database serves as the native database for blockchain nodes to run blockchain services, that is, as part of the infrastructure of the underlying system of the blockchain, it is used to run blockchain services on blockchain nodes.
  • the blockchain data generated during the process is efficiently accessed.
  • the blockchain node uses it as a substitute for directly storing the blockchain data when it needs to store the blockchain data in the blockchain non-relational database.
  • the blockchain node can first encrypt the blockchain data in the second trusted execution environment to obtain the ciphertext data (through the first key corresponding to the second trusted execution environment), and then store the ciphertext data in the zone
  • the blockchain non-relational database avoids the risk of data leakage caused by directly storing plain text data.
  • Blockchain non-relational databases can specifically use Key-Value databases (key-value databases, a typical non-relational database, referred to as K-V database). Unlike relational databases, K-V databases do not know the value of the stored data. And there is no concept of schema (database schema information) like in MySQL (relational database management system) and PostgreSQL (a free software object-relational database management system with very complete features).
  • the blockchain underlying system including blockchain nodes and corresponding blockchain databases
  • a non-relational database with efficient access speed i.e., blockchain non-relational type database
  • the blockchain node can efficiently access data from the blockchain non-relational database when running the blockchain service, thereby ensuring the efficient operation of the blockchain service.
  • the stored Blockchain data is encrypted to obtain ciphertext data, so it can also avoid security risks caused by data leakage.
  • the node devices involved in the embodiments of this specification also maintain an additional blockchain relational database as a native database for providing data analysis services to users, that is, as part of the infrastructure of the data analysis system, used to provide analysis services to users.
  • the demander provides data analysis services.
  • blockchain non-relational databases can specifically use relational databases such as Oracle database and MySQL.
  • a relational database refers to a database that uses a relational model to organize data. It stores data in the form of rows and columns to facilitate user understanding. The series of rows and columns in a relational database are called tables, and a set of tables consists of database. Users retrieve data from a database through queries, which are executable codes that limit certain areas of the database.
  • the relational model can be simply understood as a two-dimensional table model, and a relational database is a data organization composed of two-dimensional tables and the relationships between them.
  • a relational database needs to define the table structure, table relationships, and standardized Database schema information such as data structure is then stored in data based on the database schema information. It supports SQL and has strong data analysis capabilities.
  • relational databases place great emphasis on data consistency, they pay a huge price for reducing read and write performance.
  • the reliability of relational database for storing and processing data is very good, the efficiency will become very poor once faced with the processing of massive data, especially when encountering high concurrent reading and writing, the performance will drop very much. sharp.
  • relational databases have powerful data analysis capabilities but poor access speed and read and write performance, and are not suitable for large-scale concurrent read and write application scenarios.
  • the data analysis system deployed under the node device chain (including the data analysis engine and corresponding database not shown in Figure 2) adopts a non-relational database (i.e., block database) with efficient access speed, chain relational database), thus enabling node devices to utilize the powerful data analysis capabilities of blockchain non-relational databases when running data analysis services by calling the data analysis engine, thereby ensuring that convenient data analysis is provided to analysis demand parties.
  • a non-relational database i.e., block database
  • the data maintained in the blockchain relational database involved in the embodiments of this specification is obtained through data conversion and migration in the blockchain non-relational database.
  • the process of data conversion and migration will be introduced in detail below.
  • the node device can obtain all the information maintained in the blockchain non-relational database. Describe the ciphertext data. For the blockchain node, it needs to verify the access rights to any data requester requesting data from the non-relational database in the blockchain, so that the data requester is allowed to request the data only if the data requester has access rights. The party provides data.
  • the node device (specifically, the data conversion engine deployed by the node device) belongs to the data demander. Therefore, the blockchain node needs to verify whether the node device has access to the blockchain non-relational database.
  • the embodiment of this specification determines whether the node device has access permissions to the blockchain non-relational database by verifying whether the remote certificate corresponding to the first trusted execution environment deployed by the node device is valid.
  • the remote certificate corresponding to the first trusted execution environment includes the first trusted execution environment using the CPU private key corresponding to the first trusted execution environment to all the programs running in its environment (the hash values corresponding to these programs)
  • the blockchain node can verify the digital signature contained in the remote certificate through the CPU public key corresponding to the locally maintained first trusted execution environment.
  • the blockchain node may not have the CPU public key corresponding to the first trusted execution environment, so it can also send the remote certificate to the holder of the first trusted execution environment.
  • the authentication third party of the corresponding CPU public key will return the corresponding remote authentication report to the blockchain node after verifying that the remote certificate is passed.
  • the blockchain node will verify the corresponding public key through the authentication third party.
  • the remote authentication report is valid and the remote authentication report is used to indicate that the remote certification is valid, it can be confirmed that the node device indeed runs the first trusted execution environment and that the program running in the first trusted execution environment is legal and trustworthy. It has not been tampered with, so it can be judged that the node device has access rights to the blockchain non-relational database.
  • obtaining the ciphertext data maintained in the blockchain non-relational database includes: receiving the ciphertext data actively pushed by the blockchain node; and/or, Send a blockchain data request to the blockchain node, and receive the ciphertext data returned by the blockchain node in response to the blockchain data request.
  • the method for maintaining blockchain data involved in the embodiments of this specification is applied to node devices, specifically to the data conversion engine deployed under the node device chain.
  • the node device can obtain the ciphertext data maintained in the non-relational database of the blockchain through at least one of two methods.
  • the two methods include: first, by receiving the ciphertext data actively pushed by the blockchain node, For example, every time a blockchain node adds or modifies ciphertext data to the blockchain non-relational database while running the blockchain service in the second trusted execution environment, the blockchain node will send a message to the chain.
  • the data conversion engine under the system actively pushes data update messages carrying the latest newly added or modified ciphertext data.
  • This method can timely convert and synchronize the data in the blockchain non-relational database to the blockchain relational database. Thereby ensuring the symmetry and timeliness of data in the blockchain relational database; secondly, sending a blockchain data request to the blockchain node through the node device to obtain the response of the blockchain node to the blockchain data Request the returned ciphertext data.
  • This method obtains the ciphertext data through the request-response mode, which can effectively control the range of the requested ciphertext data and thus shield some data that does not need to be maintained in the blockchain relational database.
  • the remote certificate is included in the blockchain data request; or, the remote certificate is maintained in the blockchain node in advance.
  • remote certification is included in the blockchain data request, it is equivalent to the blockchain node verifying the latest remote certification corresponding to the first trusted execution environment, thereby ensuring the timeliness of the remote certification.
  • the remote certification is pre-maintained on the blockchain node, it is equivalent to the blockchain node being able to determine whether the node device has access rights to the blockchain non-relational database through the remote certification maintained on the blockchain node in advance. Therefore, the intermediate links in the process of node devices obtaining ciphertext data can be reduced, and the efficiency of obtaining ciphertext data can be increased.
  • sending a blockchain data request to the blockchain node includes: initiating to the smart contract deployed by the blockchain node a non-relational database maintained in the blockchain for the smart contract.
  • the blockchain data involved in the embodiments of this specification includes block data, status data and event data.
  • block data refers to the blockchain ledger maintained by each blockchain node in the blockchain network.
  • the blockchain ledger and/or the ciphertext data corresponding to the blockchain ledger are essentially maintained in the non-blockchain database.
  • the blockchain ledger is a special data structure, it is composed of multiple blocks connected end to end through hash anchoring and cannot be tampered with.
  • Each block consists of a block header and a block
  • the block header of any block contains information such as the status tree root, transaction number root, receipt tree root, block height and the hash value of the corresponding parent block of the block, while the block body Contains the transaction data (transaction hash) contained in the block.
  • the block data involved in the embodiments of this specification refers to the data contained in the blockchain ledger.
  • the status data and event data involved in the embodiments of this specification are maintained by various smart contracts deployed by the blockchain nodes.
  • the status data, event data and/or the ciphertext data corresponding to the status data and event data are maintained in The contract storage space corresponding to each smart contract in the blockchain non-relational database.
  • the blockchain node is deployed with several smart contracts, and each smart contract maintains corresponding status data. These status data are encrypted with the first key in the second trusted execution environment as The form of ciphertext data is maintained in the contract storage space corresponding to any of the smart contracts in the blockchain non-relational database.
  • the node device can initiate a blockchain data request to the smart contract deployed by the blockchain node (in fact, any smart contract is deployed on each blockchain node in the blockchain network).
  • the blockchain data request is Formally it is a blockchain transaction. After the blockchain transaction is received by the blockchain node, the blockchain node will further call the smart contract instructed by the blockchain transaction to execute the blockchain transaction.
  • the smart contract When the smart contract executes the blockchain transaction, it searches for and obtains the ciphertext data indicated by the blockchain transaction from the contract storage space corresponding to the smart contract in the blockchain non-relational database, and uses the ciphertext data as The response message corresponding to the blockchain data request (such as in the form of a blockchain event) is called back to the node device, thereby achieving the method of calling a smart contract to obtain the ciphertext data maintained in the blockchain non-relational database.
  • the node device can directly initiate a blockchain data request to the blockchain node, for example, initiate a blockchain data request through the data query interface of the blockchain node.
  • the blockchain data request is used to make the district
  • the blockchain node retrieves the ciphertext data indicated by the blockchain data request from the blockchain non-relational database (obtained from the block data encrypted by the first key in the second trusted execution environment) and calls back to Node device.
  • the node device can directly initiate a blockchain data request to the blockchain non-relational database, for example, through the database interface of the blockchain non-relational database, which is equivalent to the node.
  • the blockchain non-relational database directly responds to the received blockchain data request and returns the ciphertext data indicated by the blockchain data request.
  • a blockchain data request is in the same form as a blockchain transaction, it does not necessarily have all the properties of a blockchain transaction.
  • a blockchain node may not necessarily Instead of consensus in the blockchain network, it is processed as a local call request.
  • This kind of blockchain transaction that will only be executed within the local blockchain node without consensus is called a local transaction; of course, the blockchain Data requests can also have all the properties of a blockchain transaction, that is, after completing consensus in the blockchain network as a consensus transaction, they are executed separately by each blockchain node in the blockchain network.
  • S104 In the first trusted execution environment, decrypt the ciphertext data into the blockchain data using the first key, and convert the blockchain data into the blockchain relational database corresponding The standard data defined by the database schema information, and the standard data is encrypted into ciphertext standard data through the second key corresponding to the first trusted execution environment.
  • the node device After the node device obtains the ciphertext data, it will read it into the first trusted execution environment, and at the same time call the data conversion engine running in the first trusted execution environment to execute the relevant ciphertext in the first trusted execution environment. Data decryption, transformation and encryption tasks. Specifically, the node device first decrypts the ciphertext data into plaintext data, that is, the aforementioned blockchain data, through the first key, and then converts the blockchain data into the blockchain relationship. The standard data defined by the database schema information corresponding to the database is finally encrypted into ciphertext standard data through the second key corresponding to the first trusted execution environment. Since the above processes are all implemented in the first trusted execution environment, data leakage issues can be effectively avoided and system security improved.
  • the first key is provided to the first trusted execution environment deployed by the node device when the blockchain node passes the verification of the remote certificate; or, the first key is pre- Maintained in the first trusted execution environment.
  • the first key can be provided by the blockchain node to the third node in the node device in a timely manner under the condition of verifying the remote attestation (that is, the blockchain node confirms that the node device has access rights to the blockchain non-relational database).
  • Schema is an abstract collection of metadata, including a set of schema components: mainly the declaration of elements and attributes, and the definition of complex and simple data types. , specifically including: defining the elements that can appear in the document; defining the attributes that can appear in the document; defining which element is a sub-element; defining the order of sub-elements; defining the number of sub-elements; defining whether the element is empty or whether it can Contains text; defines data types for elements and attributes; defines default and fixed values for elements and attributes.
  • schema is the organization and structure of the database.
  • Database schema information contains schema objects, which can be tables, columns, data types, views, stored procedures, relationships, and primary keys. , foreign key, etc.
  • Database schema information can be represented by a visual diagram that shows database objects and their relationships to each other. Since the database schema information is used to describe the structure of the database and can be used as a blueprint for creating a database, by specifying the database schema information corresponding to a database, it can guide how the data in the database is stored.
  • the node device After the node device decrypts the blockchain data, it will convert the blockchain data into standard data defined by the database schema information based on the database schema information corresponding to the blockchain relational database in the first trusted execution environment.
  • the conversion process of blockchain data to standard data includes but is not limited to the conversion of data tables, rows, and columns.
  • the block is implemented through the ETL (Extract-Transform-Load, data warehouse technology based on data extraction, conversion, and loading) mechanism.
  • ETL Extract-Transform-Load, data warehouse technology based on data extraction, conversion, and loading
  • the ciphertext standard data is obtained by encrypting the standard data, it is only numerically desensitized, but it still retains the structure of the standard data state and the relationship between the standard data state and other data, that is,
  • the ciphertext standard data like the standard data before encryption, can be maintained in the blockchain relational database according to certain rules.
  • the method further includes:
  • the database schema information corresponding to the blockchain relational database can be maintained at the node device in advance (for example, set by the administrator user of the node device), or can be obtained by requesting a smart contract.
  • each smart contract deployed by the blockchain node has a corresponding contract storage space in the blockchain non-relational database, and each smart contract has different characteristics when processing data, organizing data, and storing data. characteristics, so the corresponding contract storage spaces of different smart contracts in the non-relational blockchain have different data organization forms, and this data organization form includes the format, relationship and connotation of the data organization, etc. It is also based on database schema information The form is maintained in the smart contract.
  • the embodiment of this specification obtains the ciphertext data maintained in the smart contract corresponding to the smart contract by requesting the corresponding smart contract.
  • the first database schema information of the ciphertext data maintained in the non-relational database is used to decrypt, convert and encrypt the ciphertext data involved in maintaining the smart contract in the blockchain relational database (decryption can also be used in this specification) , the process of conversion and encryption is referred to as conversion), so that the ciphertext standard data involved in the smart contract can be correctly maintained in the blockchain relational database.
  • the database schema information corresponding to each smart contract can be obtained through the embodiments of this specification, and the database schema information corresponding to the smart contract can be obtained according to the corresponding smart contract.
  • the database schema information is used as the database schema information corresponding to the blockchain relational database to realize the conversion of the ciphertext data involved in the corresponding smart contract into the ciphertext standard data, and finally according to the respective database schema information of different smart contracts, Realize the correct maintenance of ciphertext standard data involved in multiple smart contracts in the blockchain relational database.
  • the database schema information corresponding to any smart contract only supports the maintenance of the ciphertext standard data involved in any smart contract (that is, from any The ciphertext standard data obtained by decrypting, converting and encrypting the ciphertext data in the smart contract), thereby supporting multiple smart contracts using different data organization forms to correctly convert the ciphertext data maintained in the blockchain non-relational database into ciphertext data. After documenting the standard data, it is finally migrated to the blockchain relational database for maintenance in the form of ciphertext standard data.
  • S106 Maintain the ciphertext standard data in the blockchain relational database.
  • the blockchain relational database is used to provide data analysis services running in the first trusted execution environment to the analysis requester.
  • the node device After the node device encrypts the ciphertext standard data in the first trusted environment, it can store the ciphertext standard data in the blockchain relational database according to the blockchain mode information corresponding to the blockchain relational database to achieve Conversion and migration of ciphertext data in the blockchain non-relational database to ciphertext standard data in the blockchain relational database. Since the blockchain relational database supports a variety of SQL and has powerful data analysis capabilities (such as data query capabilities based on various conditions, indexes, and relationships), the blockchain relational database can easily provide analysis needs to parties. Data analysis service, and because the data analysis service runs in the first trusted execution environment, it actually decrypts the ciphertext standard data in the first trusted execution environment and then analyzes it to obtain the analysis results.
  • Analyzing data can ensure the efficiency of analysis, and running data analysis services in TEE can also ensure data security.
  • the data analysis engine running in the first trusted execution environment deployed on and off the chain of the node device provides a data analysis interface to the outside world, so as to provide analysis requesters that call the analysis interface externally for the blockchain relational database. Data analysis services.
  • the embodiment of this specification separately deploys a blockchain non-relational database and a blockchain relational database on node devices.
  • the blockchain non-relational database is used to maintain and run blockchain services on blockchain nodes.
  • the ciphertext data obtained by encrypting the blockchain data generated at the time enables the blockchain node to efficiently store the encrypted blockchain data and efficiently read the ciphertext data when running the blockchain service; on the other hand, , by decrypting, converting and encrypting the ciphertext data maintained in the blockchain non-relational database into ciphertext standard data to be simultaneously maintained in the blockchain relational database, thereby using the blockchain relational database to achieve convenient Data analysis services.
  • the blockchain node is providing the ciphertext.
  • the remote certificate corresponding to the first trusted execution environment needs to be verified in advance before data is sent, thereby ensuring system-level data security in data processing, data transmission and data storage.
  • the method for maintaining blockchain data involved in the embodiments of this specification realizes the backup of one data in two places, objectively improves the disaster recovery capability, and realizes convenient data access while ensuring efficient access efficiency during the execution of the blockchain service.
  • Analysis services at the same time, due to the combination of trusted execution environment technology, it realizes the entire process of trusted data transfer and trusted data processing from on-chain blockchain services to off-chain data conversion and data analysis services. The risk of data leakage is reduced as much as possible.
  • Optional also includes:
  • the analysis result obtained by analyzing the at least one standard data based on the data analysis request is returned to the analysis requester.
  • the data analysis engine deployed on and off-chain on the node device can also be used to receive data analysis requests sent by the analysis requester, and then retrieve the blockchain relational database based on the data analysis engine.
  • At least one ciphertext standard data corresponding to the data analysis request maintained in the first trusted execution environment is read into the first trusted execution environment, and the at least one ciphertext standard data is decrypted into at least one standard data using the second key, and in the first Build a memory database based on at least one standard data (plain text state) in a trusted execution environment, analyze the memory database based on the data analysis request, and return the analysis results obtained by the analysis to the analysis requester, and the analysis results It can be encrypted by the second key and then returned to the analysis requester, or it can be directly returned to the analysis requester in plain text.
  • This instruction does not impose any restrictions on this, and a complete data analysis service can be achieved at this point.
  • the data analysis request is a data query request that satisfies both condition A and condition B
  • the data analysis engine will query the ciphertext standard data that satisfies both condition A and condition B in the blockchain relational database, and convert these ciphertext standard data into the blockchain relational database.
  • the text standard data is read into the first trusted execution environment and decrypted into standard data through the second key, and then returned to the analysis requester as an analysis result.
  • reading at least one ciphertext standard data corresponding to the data analysis request maintained in the blockchain relational database into the first trusted execution environment includes:
  • the at least one ciphertext standard data corresponding to the data analysis request maintained in the blockchain relational database is read into the third A trusted execution environment.
  • the node device needs to first verify the analysis permission of the analysis requester, and only after confirming that the analysis requester has the analysis permission will it respond to the data analysis request sent by the analysis requester and perform subsequent steps.
  • the node device maintains a legal user list corresponding to the data analysis service in the first trusted execution environment.
  • the node device specifically the data analysis engine, can verify the identity of the analysis requester (for example, through the first analysis requester corresponding to the first
  • the public key is used to verify the digital signature contained in the data analysis request.
  • the signature verification passes, it is confirmed that the data analysis request does come from the first analysis requester corresponding to the first public key), by checking that the digital signature included in the legal user list If the identification information of the analysis requester is included, it is determined that the analysis requester has the analysis authority. If the legal user list does not contain the identification information of the analysis requester, it is determined that the analysis requester does not have the analysis authority.
  • the first user list ciphertext corresponding to the legal user is maintained in the blockchain relational database, and the first user list ciphertext is passed by the node device in the first trusted execution environment through the second
  • the first user list is obtained by encrypting the first user list with the key.
  • the first user list is decrypted by the node device in the first trusted execution environment using the first key to decrypt the second user list ciphertext and based on the database schema information. Obtained after conversion, wherein the second user list ciphertext is maintained in the blockchain non-relational database by the user authorization contract deployed by the blockchain node.
  • the legal user list corresponding to the legal user is obtained by the node device reading the first user list ciphertext from the blockchain relational database and using the second key in the first trusted execution environment. Decryption is obtained, and the ciphertext of the first user list maintained in the blockchain relational database is also obtained from the second user list in the blockchain non-relational database through the method of maintaining blockchain data involved in the embodiment of this specification.
  • the ciphertext is migrated. Specifically, the legal user list corresponding to the legal user is actually maintained in the user authorization contract deployed by the blockchain node, which can be modified, updated, added, etc. through blockchain transactions, as mentioned above.
  • the legal user list maintained by the user authorization contract is actually encrypted by the blockchain node through the second key into the second user list ciphertext, and then maintained in the blockchain non-relational database corresponding to the user authorization.
  • the second user list ciphertext can be used as the ciphertext data involved in the embodiments of this specification, and is deployed on the node device through the method of maintaining blockchain data involved in the embodiments of this specification.
  • the legal user list obtained by the data conversion engine is decrypted by the second key in the first trusted execution environment into a clear text state, and the legal user list is further converted into a database schema information definition corresponding to the blockchain relational database.
  • the standard legal user list (the data connotation contained in it is consistent with the legal user list), so that the standard legal user list is finally encrypted by the first key to the second user list ciphertext backup and maintained in the blockchain relational database.
  • the data analysis engine running in the first trusted execution environment needs to obtain the legal user list, it can read the first user list ciphertext from the blockchain relational database and use the second key to decrypt it to obtain the standard legal user list.
  • the legal user list corresponding to the legal user is essentially maintained by the user authorization contract deployed on the blockchain node, and the node device can use the method of maintaining blockchain data involved in the embodiment of this specification to maintain the area.
  • the legal user list stored in the blockchain non-relational database in the form of the second user list ciphertext is synchronously maintained in the blockchain relational database in the form of the first user list ciphertext, so that the node device does not need to call the user authorization on the chain.
  • the contract can obtain the list of legal users through off-chain methods.
  • Figure 3 is a schematic structural diagram of a device provided by an exemplary embodiment.
  • the device includes a processor 302, an internal bus 303, a network interface 306, a memory 308 and a non-volatile memory 310.
  • the processor 302 reads the corresponding computer program from the non-volatile memory 310 into the memory 308 and then runs it.
  • the execution subject of the following processing flow is not limited to each A logic unit can also be a hardware or logic device.
  • FIG 4 is a block diagram of a device for maintaining blockchain data provided in this specification according to an exemplary embodiment.
  • This device can be applied to the equipment shown in Figure 3 to implement the instructions of this specification.
  • Technical solution: This device is applied to node equipment deployed with blockchain nodes and a first trusted execution environment.
  • the node equipment maintains a blockchain non-relational database and a blockchain relational database.
  • the blockchain The non-relational database is used to maintain ciphertext data.
  • the ciphertext data is generated by the blockchain node when running the blockchain service in the second trusted execution environment through the second trusted execution environment.
  • the first key corresponding to the environment is encrypted and obtained; the device includes:
  • the ciphertext data acquisition unit 401 is configured to acquire the ciphertext maintained in the blockchain non-relational database when the blockchain node passes the remote certification verification corresponding to the first trusted execution environment. data;
  • Data conversion unit 402 configured to decrypt the ciphertext data into the blockchain data through the first key in the first trusted execution environment, and convert the blockchain data into the block Link the standard data defined by the database schema information corresponding to the relational database, and encrypt the standard data into ciphertext standard data through the second key corresponding to the first trusted execution environment;
  • the ciphertext standard data maintenance unit 403 is used to maintain the ciphertext standard data in the blockchain relational database, and the blockchain relational database is used to provide analysis demanders with information running on the first trusted Data analysis services in the execution environment.
  • the ciphertext data acquisition unit 401 is specifically used to:
  • the ciphertext data acquisition unit 401 is further used to:
  • the device further includes:
  • the mode information query request sending unit 404 is configured to initiate a mode information query request to the smart contract, and determine the first database mode information recorded in the smart contract returned by the smart contract in response to the mode information query request. It is the database schema information corresponding to the blockchain relational database.
  • the remote certificate is included in the blockchain data request; or,
  • the remote certificate is maintained in the blockchain node in advance.
  • the blockchain data includes block data, status data and event data.
  • the first key is provided to the first trusted execution environment deployed by the node device when the blockchain node passes the verification of the remote certificate; or, the first key is maintained in advance in the first trusted execution environment.
  • a trusted execution environment is provided to the first trusted execution environment deployed by the node device when the blockchain node passes the verification of the remote certificate; or, the first key is maintained in advance in the first trusted execution environment.
  • Optional also includes:
  • the data analysis request receiving unit 405 is used to receive the data analysis request sent by the analysis requester;
  • the analysis result return unit 406 is configured to read at least one ciphertext standard data corresponding to the data analysis request maintained in the blockchain relational database into the first trusted execution environment, and use the second key to return the ciphertext standard data to the first trusted execution environment. At least one ciphertext standard data is respectively decrypted into at least one standard data, and the analysis result obtained by analyzing the at least one standard data based on the data analysis request is returned to the analysis requester.
  • analysis result return unit 406 is further used to:
  • the at least one ciphertext standard data corresponding to the data analysis request maintained in the blockchain relational database is read into the third A trusted execution environment.
  • the first user list ciphertext corresponding to the legal user is maintained in the blockchain relational database, and the first user list ciphertext is passed by the node device in the first trusted execution environment through the second
  • the first user list is obtained by encrypting the first user list with the key.
  • the first user list is decrypted by the node device in the first trusted execution environment using the first key to decrypt the second user list ciphertext and based on the database schema information. Obtained after conversion, wherein the second user list ciphertext is maintained in the blockchain non-relational database by the user authorization contract deployed by the blockchain node.
  • PLD Programmable Logic Device
  • FPGA Field Programmable Gate Array
  • HDL Hardware Description Language
  • the controller may be implemented in any suitable manner, for example, the controller may take the form of, for example, a microprocessor or processor and a computer readable medium storing computer readable program code (eg, software or firmware) executable by the (micro)processor. , logic gates, switches, Application Specific Integrated Circuit (ASIC), programmable logic controllers and embedded microcontrollers.
  • controllers include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, For Microchip PIC18F26K20 and Silicone Labs C8051F320, the memory controller can also be implemented as part of the memory's control logic.
  • the controller in addition to implementing the controller in the form of pure computer-readable program code, the controller can be completely programmed with logic gates, switches, application-specific integrated circuits, programmable logic controllers and embedded logic by logically programming the method steps. Microcontroller, etc. to achieve the same function. Therefore, this controller can be considered as a hardware component, and the devices included therein for implementing various functions can also be considered as structures within the hardware component. Or even, the means for implementing various functions can be considered as structures within hardware components as well as software modules implementing the methods.
  • the systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions.
  • a typical implementation device is a server system.
  • the computer that implements the functions of the above embodiments may be, for example, a personal computer, a laptop computer, a vehicle-mounted human-computer interaction device, a cellular phone, a camera phone, a smart phone, or a personal digital assistant. , media player, navigation device, email device, game console, tablet, wearable device, or a combination of any of these devices.
  • the functions are divided into various modules and described separately.
  • the functions of each module can be implemented in the same or multiple software and/or hardware, or the modules that implement the same function can be implemented by a combination of multiple sub-modules or sub-units, etc. .
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined or integrated. to another system, or some features can be ignored, or not implemented.
  • the coupling or direct coupling or communication connection between each other shown or discussed may be through some interfaces, and the indirect coupling or communication connection of the devices or units may be in electrical, mechanical or other forms.
  • These computer program instructions may also be stored in a computer-readable memory that causes a computer or other programmable data processing apparatus to operate in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction means, the instructions
  • the device implements the functions specified in a process or processes of the flowchart and/or a block or blocks of the block diagram.
  • These computer program instructions may also be loaded onto a computer or other programmable data processing device, causing a series of operating steps to be performed on the computer or other programmable device to produce computer-implemented processing, thereby executing on the computer or other programmable device.
  • Instructions provide steps for implementing the functions specified in a process or processes of a flowchart diagram and/or a block or blocks of a block diagram.
  • a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.
  • processors CPUs
  • input/output interfaces network interfaces
  • memory volatile and non-volatile memory
  • Memory may include non-permanent storage in computer-readable media, random access memory (RAM) and/or non-volatile memory in the form of read-only memory (ROM) or flash memory (flash RAM). Memory is an example of computer-readable media.
  • RAM random access memory
  • ROM read-only memory
  • flash RAM flash random access memory
  • Computer-readable media includes both persistent and non-volatile, removable and non-removable media that can be implemented by any method or technology for storage of information.
  • Information may be computer-readable instructions, data structures, modules of programs, or other data.
  • Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), and read-only memory.
  • PRAM phase change memory
  • SRAM static random access memory
  • DRAM dynamic random access memory
  • RAM random access memory
  • read-only memory read-only memory
  • ROM read-only memory
  • EEPROM electrically erasable programmable read-only memory
  • flash memory or other memory technology
  • compact disc read-only memory CD-ROM
  • DVD digital versatile disc
  • Magnetic tape magnetic tape storage, graphene storage or other magnetic storage devices or any other non-transmission medium can be used to store information that can be accessed by a computing device.
  • computer-readable media does not include transitory media, such as modulated data signals and carrier waves.
  • one or more embodiments of the present description may be provided as a method, system, or computer program product. Accordingly, one or more embodiments of the present description may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment that combines software and hardware aspects. Furthermore, one or more embodiments of the present description may employ a computer program implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein. Product form.
  • computer-usable storage media including, but not limited to, disk storage, CD-ROM, optical storage, etc.
  • program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types.
  • program modules may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communications network.
  • program modules may be located in both local and remote computer storage media including storage devices.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Computer Security & Cryptography (AREA)
  • Databases & Information Systems (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • Data Mining & Analysis (AREA)
  • Computing Systems (AREA)
  • Quality & Reliability (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
  • Storage Device Security (AREA)

Abstract

La présente invention concerne un procédé et un appareil permettant de gérer des données de chaîne de blocs, ainsi qu'un dispositif électronique et un support de stockage. Le procédé est appliqué à un dispositif de nœud qui est déployé avec un nœud de chaîne de blocs et un premier environnement d'exécution de confiance, le dispositif de nœud gère une base de données non relationnelle de chaîne de blocs et une base de données relationnelle de chaîne de blocs, la base de données non relationnelle de chaîne de blocs servant à gérer des données de cryptogramme, et les données de cryptogramme étant obtenues par le nœud de chaîne de blocs qui chiffre, au moyen d'une première clé correspondant à un second environnement d'exécution de confiance, des données de chaîne de blocs qui sont générées lorsqu'un service de chaîne de blocs est exécuté dans le second environnement d'exécution de confiance. Le procédé comprend les étapes suivantes : lorsqu'une attestation à distance correspondant à un premier environnement d'exécution de confiance réussit la vérification d'un nœud de chaîne de blocs, acquérir des données de cryptogramme qui sont conservées dans une base de données non relationnelle de chaîne de blocs ; dans le premier environnement d'exécution de confiance, déchiffrer, convertir et chiffrer les données de cryptogramme en données standard de cryptogramme ; et gérer les données standard de cryptogramme dans une base de données relationnelle de chaîne de blocs, la base de données relationnelle de chaîne de blocs servant à fournir un service d'analyse de données pour un demandeur d'analyse.
PCT/CN2022/135413 2022-06-29 2022-11-30 Procédé et appareil de gestion de données de chaîne de blocs, et dispositif électronique et support d'informations WO2024001028A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210761451.1 2022-06-29
CN202210761451.1A CN115129785A (zh) 2022-06-29 2022-06-29 一种维护区块链数据的方法、装置、电子设备和存储介质

Publications (1)

Publication Number Publication Date
WO2024001028A1 true WO2024001028A1 (fr) 2024-01-04

Family

ID=83381667

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/135413 WO2024001028A1 (fr) 2022-06-29 2022-11-30 Procédé et appareil de gestion de données de chaîne de blocs, et dispositif électronique et support d'informations

Country Status (2)

Country Link
CN (1) CN115129785A (fr)
WO (1) WO2024001028A1 (fr)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115129785A (zh) * 2022-06-29 2022-09-30 蚂蚁区块链科技(上海)有限公司 一种维护区块链数据的方法、装置、电子设备和存储介质
CN115344647A (zh) * 2022-10-20 2022-11-15 中国信息通信研究院 区块链数据的处理方法、装置、设备和介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110880972A (zh) * 2019-11-26 2020-03-13 复旦大学 一种基于安全多方计算的区块链密钥管理系统
US20200134209A1 (en) * 2018-10-31 2020-04-30 Alibaba Group Holding Limited Method, apparatus, and electronic device for blockchain-based recordkeeping
CN111899017A (zh) * 2019-01-31 2020-11-06 创新先进技术有限公司 区块链中实现隐私保护的方法、节点、存储介质
CN113742370A (zh) * 2021-11-02 2021-12-03 阿里云计算有限公司 全加密数据库的数据查询方法、统计信息密文生成方法
CN115129785A (zh) * 2022-06-29 2022-09-30 蚂蚁区块链科技(上海)有限公司 一种维护区块链数据的方法、装置、电子设备和存储介质

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20200134209A1 (en) * 2018-10-31 2020-04-30 Alibaba Group Holding Limited Method, apparatus, and electronic device for blockchain-based recordkeeping
CN111899017A (zh) * 2019-01-31 2020-11-06 创新先进技术有限公司 区块链中实现隐私保护的方法、节点、存储介质
CN110880972A (zh) * 2019-11-26 2020-03-13 复旦大学 一种基于安全多方计算的区块链密钥管理系统
CN113742370A (zh) * 2021-11-02 2021-12-03 阿里云计算有限公司 全加密数据库的数据查询方法、统计信息密文生成方法
CN115129785A (zh) * 2022-06-29 2022-09-30 蚂蚁区块链科技(上海)有限公司 一种维护区块链数据的方法、装置、电子设备和存储介质

Also Published As

Publication number Publication date
CN115129785A (zh) 2022-09-30

Similar Documents

Publication Publication Date Title
WO2024001028A1 (fr) Procédé et appareil de gestion de données de chaîne de blocs, et dispositif électronique et support d'informations
US10474835B2 (en) Zero-knowledge databases
CN109614823B (zh) 一种数据的处理方法、装置及设备
CN106127075B (zh) 一种云存储环境下基于隐私保护的可搜索加密方法
US10541983B1 (en) Secure storage and searching of information maintained on search systems
US20190173859A1 (en) Systems and methods for implementing modular digital encryption key management solutions
US20230014599A1 (en) Data processing method and apparatus for blockchain system
US11546348B2 (en) Data service system
CN111540449B (zh) 一种基于区块链的电子病历共享方法、电子病历接口及系统
US11924185B2 (en) Method and system for general data protection compliance via blockchain
US8769302B2 (en) Encrypting data and characterization data that describes valid contents of a column
CN111737720B (zh) 数据处理方法、装置及电子设备
CN115618321A (zh) 访问控制方法及装置、电子设备、存储介质
CN112307501A (zh) 基于区块链技术的大数据系统及存储方法和使用方法
JP2022544484A (ja) 暗号化されたナレッジ・グラフ
WO2024001029A1 (fr) Procédé et appareil de gestion de données de chaîne de blocs, dispositif électronique et support de stockage
US11410173B1 (en) Tokenization web services
CN112788151B (zh) 数据同步的方法、装置和系统
WO2024001039A1 (fr) Procédé et appareil de gestion de données de chaîne de blocs, dispositif électronique et support de stockage
CN112181983A (zh) 一种数据处理方法、装置、设备和介质
Pleskach et al. Mechanisms for Encrypting Big Unstructured Data: Technical and Legal Aspects
WO2024087313A1 (fr) Procédé et appareil d'accès à une base de données
Yan et al. Research on database encryption technology of industrial network monitoring system
Hasija et al. Compression & Security in MongoDB without affecting Efficiency
CN115037548B (zh) 基于区块链的数据安全多方计算的系统、方法、装置、介质及设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22949108

Country of ref document: EP

Kind code of ref document: A1