Cross-platform data transmission method and device, storage medium and electronic device

Abstract

The application discloses a cross-platform data transmission method and device, a storage medium and an electronic device. The method is used for supporting a first user end and a second user end of a trusted execution environment, and includes: the first user end obtains encrypted data by encrypting private data to be transmitted; the first user end sends the encrypted data to a blockchain for on-chain storage; the second user end obtains the encrypted data from the blockchain and transmits the encrypted data into an enclave of the second user end; the encrypted data is decrypted by the enclave of the second user end to obtain the private data to be transmitted and the identity of a target enclave is verified; and the private data to be transmitted is transmitted into the target enclave. The application solves the technical problem that the execution environment of a trusted program and the cross-platform private data transmission are not good in effect and private data is easily leaked. Through the cross-platform private data transmission based on the blockchain, it is ensured that the encrypted data on the chain cannot be cracked.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of cross-platform private data transmission of blockchain, in particular, to a cross-platform data transmission method and device, storage medium and electronic device. BACKGROUND

[0002] If a user wants his program not to be tampered with and the value of the intermediate variable in the program execution process not to be obtained, that is, the program is a trusted program. At the same time, many scenarios require cross-user platform private data transmission.

[0003] For example, when a first user wants to transmit a confidential data to a second user's platform for execution by a trusted program of the second user, the second user cannot obtain the specific value of the confidential data. Further, when the private data to be transmitted is a randomly generated private key, the private key is also invisible to the first user, but the public key of the data needs to be correctly disclosed for signature verification.

[0004] In view of the poor effect of the execution environment of the trusted program and the cross-platform private data transmission in the related art, which easily causes private data leakage, no effective solution has been proposed so far. SUMMARY

[0005] The main purpose of the present application is to provide a cross-platform data transmission method and device, storage medium and electronic device to solve the problem of poor effect of the execution environment of the trusted program and the cross-platform private data transmission, which easily causes private data leakage.

[0006] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a cross-platform data transmission method is provided.

[0007] According to the cross-platform data transmission method of the present application, the first user terminal and the second user terminal for supporting the trusted execution environment include: the first user terminal encrypts the private data to be transmitted to obtain encrypted data; the first user terminal sends the encrypted data to the blockchain for on-chain; the second user terminal obtains the encrypted data from the blockchain and transmits it to the enclave of the second user terminal; the encrypted data is decrypted by the enclave of the second user terminal to obtain the private data to be transmitted and the identity of the target enclave is verified; and the private data to be transmitted is transmitted to the target enclave.

[0008] Further, before the second user terminal obtains the encrypted data from the blockchain and transmits it to the enclave of the second user terminal, it further includes: the public key generated by the enclave of the second user terminal and the authorization of the public key are chained together; and / or, the private key generated by the enclave of the second user terminal is encrypted and saved in the second user terminal.

[0009] Further, in the case that the privacy data comprises a random number, further comprising: generating privacy data according to the enclave of the first user terminal; the first user terminal sending, to the enclave of the first user terminal, a public key generated by the enclave of the second user terminal and an authorization of the public key obtained from the blockchain; in the case that the enclave of the first user verifies that the authorization of the public key is passed, encrypting the privacy data with the public key to obtain encrypted data, and sending the encrypted data to the blockchain for on-chain transmission.

[0010] Further, further comprising: in the case that the first user terminal specifies a hash value of the target enclave, the first user terminal encrypting the hash value and the to-be-transmitted privacy data and sending the encrypted data to the blockchain for on-chain transmission; the second user terminal obtaining the hash value and the encrypted data of the to-be-transmitted privacy data from the blockchain and transmitting the data to the enclave of the second user terminal.

[0011] Further, decrypting the encrypted data according to the private key generated by the enclave of the second user terminal to obtain the to-be-transmitted privacy data and verifying the identity of the target enclave comprises: in the case that the encrypted data comprises a specified hash value of the target enclave, verifying the hash value of the interaction target; according to the verification result, performing hash value matching to determine the target enclave corresponding to the hash value.

[0012] Further, the decrypting the encrypted data according to the enclave of the second user terminal to obtain the to-be-transmitted privacy data and verifying the identity of the target enclave further comprises: verifying that the identity of the target enclave is generated via a third-party signature.

[0013] Further, the enclave of the second user terminal is deployed via a third party and is not linked to an external network and / or a server.

[0014] To achieve the above object, according to another aspect of the present application, a cross-platform data transmission device is provided.

[0015] According to the cross-platform data transmission device of the present application, the device is used for supporting a first user terminal and a second user terminal in a trusted execution environment, and comprises: an encryption module, used for the first user terminal to encrypt to-be-transmitted privacy data to obtain encrypted data; an on-chain module, used for the first user terminal to send the encrypted data to the blockchain for on-chain transmission; an obtaining module, used for the second user terminal to obtain the encrypted data from the blockchain and transmit the data to the enclave of the second user terminal; a verifying module, used for decrypting the encrypted data according to the enclave of the second user terminal to obtain to-be-transmitted privacy data and verifying the identity of a target enclave; and a transmitting module, used for transmitting the to-be-transmitted privacy data to the target enclave.

[0016] According to a third aspect of the embodiments of the present application, a storage medium is provided, and the storage medium stores a computer program, wherein the computer program is configured to execute the steps in any of the method embodiments described above when running.

[0017] According to a fourth aspect of the embodiments of the present application, an electronic device is provided, comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the computer program to execute the steps in any of the method embodiments described above.

[0018] In the cross-platform data transmission method and device, the storage medium and the electronic device, the first user end obtains encrypted data by encrypting the private data to be transmitted, the first user end sends the encrypted data to the blockchain for on-chain, the second user end obtains the encrypted data from the blockchain and transmits the encrypted data to the enclave of the second user end, the encrypted data is decrypted by the enclave of the second user end to obtain the private data to be transmitted, and the identity of the target enclave is verified, so as to achieve the purpose of transmitting the private data to be transmitted to the target enclave, thereby realizing the technical effect of cross-platform private data transmission and identity authentication, and further solving the technical problem that the execution environment of the trusted program and the cross-platform private data transmission effect are not good, and the private data is easily leaked. BRIEF DESCRIPTION OF DRAWINGS

[0019] The accompanying drawings, which form a part of this application, are intended to provide further understanding of the application and are incorporated herein for a purpose of explanations and are not an undue limitation on the application. In the drawings:

[0020] Figure 1 is a hardware structure block diagram of a computer device for cross-platform data transmission according to the embodiments of the present application;

[0021] Figure 2 is a flowchart of a cross-platform data transmission method according to the embodiments of the present application;

[0022] Figure 3 is a structure diagram of a cross-platform data transmission device according to the embodiments of the present application;

[0023] Figure 4 is a principle diagram of a cross-platform data transmission method according to the embodiments of the present application. DETAILED DESCRIPTION

[0024] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0025] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this application described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0026] In this application, the terms "upper," "lower," "left," "right," "front," "rear," "top," "bottom," "inner," "outer," "middle," "vertical," "horizontal," "lateral," and "longitudinal" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. These terms are primarily for the purpose of better describing this application and its embodiments, and are not intended to limit the indicated device, element, or component to having a specific orientation, or to be constructed and operated in a specific orientation.

[0027] Furthermore, in addition to indicating location or positional relationship, some of the aforementioned terms may also have other meanings. For example, the term "above" may also be used in some cases to indicate a certain dependency or connection relationship. Those skilled in the art can understand the specific meaning of these terms in this application based on the specific circumstances.

[0028] Furthermore, the terms "installation," "setup," "equipped with," "connection," "linking," and "socketing" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral structure; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium, or an internal connection between two devices, components, or parts. Those skilled in the art can understand the specific meaning of these terms in this application based on the specific circumstances.

[0029] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0030] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Taking its operation on a computer device as an example, Figure 1 This is a hardware structure block diagram of a computer device for a cross-platform data transmission method according to an embodiment of the present invention.

[0031] This application also provides a computer device. For example... Figure 1 As shown, the computer device 20 may include: at least one processor 201, such as a CPU; at least one network interface 204; a user interface 203; a memory 205; at least one communication bus 202; and optionally, a display screen 206. The communication bus 202 is used to establish communication between these components. The user interface 203 may include a touchscreen, keyboard, or mouse, etc. The network interface 204 may optionally include a standard wired interface or a wireless interface (such as a Wi-Fi interface), through which a communication connection can be established with a server. The memory 205 may be high-speed RAM or non-volatile memory, such as at least one disk storage device. The memory 205 may include flash memory as described in this embodiment. The memory 205 may also optionally be at least one storage system located remotely from the aforementioned processor 201. Figure 1 As shown, the memory 205, which serves as a computer storage medium, may include an operating system, a network communication module, a user interface module, and program instructions.

[0032] It should be noted that the network interface 204 can connect to a receiver, transmitter, or other communication modules. Other communication modules may include, but are not limited to, WiFi modules, Bluetooth modules, etc. It is understood that the computer device in this embodiment of the invention may also include receivers, transmitters, and other communication modules.

[0033] The processor 201 can be used to call program instructions stored in the memory 205 and cause the computer device 20 to perform output transfer operations. Example

[0034] like Figure 2 As shown, the method in this embodiment of the application is used to support a first user terminal and a second user terminal of a trusted execution environment, specifically including the following steps S201 to S205:

[0035] Step S201: The first user terminal obtains encrypted data by encrypting the privacy data to be transmitted;

[0036] Step S202: The first user terminal sends the encrypted data to the blockchain for on-chain processing;

[0037] Step S203: The second user terminal obtains the encrypted data from the blockchain and transmits it to the enclave of the second user terminal;

[0038] Step S204: Decrypt the encrypted data according to the enclave of the second user terminal to obtain the privacy data to be transmitted and verify the identity of the target enclave;

[0039] Step S205: The privacy data to be transmitted is transmitted to the target enclave.

[0040] As can be seen from the above description, this application achieves the following technical effects:

[0041] The method employs a process where the first user terminal encrypts the privacy data to be transmitted to obtain encrypted data, and then sends the encrypted data to the blockchain for on-chain processing. The second user terminal retrieves the encrypted data from the blockchain and transmits it to its designated enclave. The enclave decrypts the encrypted data to obtain the privacy data to be transmitted and verifies the identity of the target enclave, thus achieving the goal of transmitting the privacy data to the target enclave. This enables cross-platform privacy data transmission and identity authentication, thereby solving the technical problem of poor performance in trusted program execution environments and cross-platform privacy data transmission, which easily leads to privacy data leakage.

[0042] In step S201 above, encrypted data is obtained by encrypting the privacy data to be transmitted on the first user terminal.

[0043] In step S202 above, the encrypted data obtained in the above steps is sent to the blockchain for on-chain processing at the first user terminal.

[0044] In some alternative embodiments, the blockchain is used as a decentralized ledger, characterized by immutability, security, and trustworthiness.

[0045] In some optional embodiments, the blockchain includes two types based on the node permissions of the blockchain network: public blockchains and consortium blockchains. Consortium blockchains typically refer to blockchains where users are a specific group and have entry barriers. Compared to public blockchains, consortium blockchains can be deployed in a local area network, allowing users to use them in an environment without external network access.

[0046] In some preferred embodiments, the blockchain is a consortium blockchain.

[0047] After being uploaded to the blockchain in step S203 above, the second user terminal obtains the encrypted data from the blockchain and transmits it to the enclave of the second user terminal.

[0048] In some alternative embodiments, the enclave of the second user terminal is used as an instance of a trusted execution environment with hardware-guaranteed isolation.

[0049] In step S204 above, the encrypted data is decrypted based on the enclave of the second user terminal to obtain the privacy data to be transmitted and the identity of the target enclave is verified.

[0050] In step S205 above, the decrypted privacy data to be transmitted is transmitted to the target enclave.

[0051] As a feasible implementation of this application, before the second user terminal obtains the encrypted data from the blockchain and transmits it to the enclave of the second user terminal, the process includes: uploading the public key generated by the enclave of the second user terminal and the authorization of the public key to the blockchain together; and / or, encrypting and storing the private key generated by the enclave of the second user terminal in the second user terminal.

[0052] In practice, a trusted third party installs an open-source enclave (enclave B) on the second user's platform. Enclave B uses SGX's built-in methods to generate a public-private key pair, denoted as pkb and skb. The private key skb is then encrypted, exported, and stored locally on user B. The public key pkb is directly exported, signed by a third party to authorize it, and then sent to the blockchain along with the authorization—that is, put on-chain.

[0053] In some alternative embodiments, Enclave B is based on Intel's Trusted Execution Environment (SGX).

[0054] In some alternative embodiments, a third party provides an interface for statically checking and signing the enclave. This interface is implemented by deploying another open-source enclave. Each access does not require an internet connection, does not require interaction with a third party, and does not cause any privacy breaches of the third party.

[0055] In some alternative embodiments, "open source" means that the enclave code is completely hard-coded and made public, has a definite hash value, and cannot be tampered with by anyone.

[0056] In some alternative embodiments, the Trusted Execution Environment (SGX) generates public and private keys using the method sgx_create_key_pair_ECC_256. The principle is that the CPU randomly generates a private key by obtaining circuit information and calculates the public key according to the corresponding rule.

[0057] In some alternative embodiments, the key used to encrypt and export the skb is a symmetric key inherent to enclave B, related to the hash value of enclave B. This symmetric key value is private to the outside world, provided that enclave B does not contain any methods to reveal privacy. Therefore, after the skb is encrypted with this symmetric key, only enclave B can decrypt the ciphertext and recover the skb. Afterwards, enclave B can read the encrypted skb locally at any time, decrypt it internally, and use it.

[0058] In some alternative embodiments, the authorization involves a third party signing the information to be authorized using a preset private key, while the corresponding authorization public key is publicly available on the blockchain, allowing anyone to verify the signature. The third party ensures that all authorized public keys are generated from the open-source enclave, and that the open-source enclave does not leak privacy. Therefore, encrypting private data and uploading it to the blockchain using authorized public keys is secure.

[0059] In some alternative embodiments, the installation process for the enclave on the second user terminal only needs to be performed once. Once installed, the second user can receive privacy data from any user to enclave B as many times as possible, without relying on a third party.

[0060] As a feasible implementation of this application, when the privacy data includes random numbers, it further includes: generating privacy data based on the enclave of the first user terminal; the first user terminal sends the public key generated by obtaining the enclave of the second user terminal on the blockchain and the authorization of the public key to the enclave of the first user terminal; if the authorization of the public key is verified by the enclave of the first user terminal, the privacy data is encrypted using the public key to obtain encrypted data, and then sent to the blockchain for on-chain processing.

[0061] In practice, it's desirable that the first user client doesn't know the specific value of `m`, but this applies to scenarios where `m` is a random number. If it's desired that the first user client doesn't know the value of `m`, then `m` is randomly generated through the first user client's enclave A. User A then passes the pkb obtained on-chain and its authorization to enclave A. Enclave A verifies the authorization's validity; if successful, it encrypts `m` using pkb to obtain `pkb[m]`, which is then exported and added to the chain. Furthermore, if the randomly generated `m` is used as a private key, enclave A also exports and adds its corresponding public key to the chain for future verification.

[0062] As a possible implementation of this application, it further includes: when the first user terminal specifies the hash value of the target enclave, the first user terminal encrypts the hash value and sends it to the blockchain for on-chain processing; the second user terminal obtains the encrypted hash value data from the blockchain and transmits it to the enclave of the second user terminal.

[0063] In practice, if the first client wants to specify the hash value of the target enclave, the hash value is also encrypted and uploaded to the blockchain, resulting in pkb[m||hash]. The second client then retrieves pkb[m||hash] from the blockchain and passes it to enclave B.

[0064] As a feasible implementation of this application, decrypting the encrypted data to obtain the privacy data to be transmitted and verifying the identity of the target enclave based on the enclave of the second user terminal includes: when the encrypted data includes the hash value of the specified target enclave, verifying the hash value of the interaction target; performing hash value matching based on the verification result to determine the target enclave corresponding to the hash value.

[0065] In practice, Enclave B decrypts pkb[m] using skb to obtain m. If a specified hash value is provided, it is also decrypted. Enclave B authentication requires accepting the identity of the target enclave containing m. If a hash value is specified, it includes a process of verifying the hash value of the target enclave matches the specified hash. Upon successful verification, a local attestation is established, and m is passed to the target enclave.

[0066] As a feasible implementation of this application, the step of decrypting the encrypted data to obtain the privacy data to be transmitted based on the enclave of the second user terminal and verifying the identity of the target enclave further includes: verifying that the identity of the target enclave is generated by a third-party signature.

[0067] In practice, authenticating the identity of the target enclave includes verifying that the enclave was generated through a signature from a trusted third party to ensure that its privacy is not compromised.

[0068] As one possible implementation of this application, the enclave of the second user terminal is deployed by a third party and is not connected to the external network and / or server.

[0069] In practice, local attestation is a built-in Intel feature used for authentication and interaction between enclaves on the same platform, and does not require an external network connection.

[0070] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0071] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present invention. Example

[0072] This embodiment also provides a cross-platform data transmission device for implementing the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can refer to a combination of software and / or hardware that performs a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0073] Figure 3 This is a structural block diagram of a cross-platform data transmission device according to an embodiment of the present invention, such as... Figure 3 As shown, the device, used to support a first user terminal and a second user terminal of a trusted execution environment, includes:

[0074] The encryption module 31 is used by the first user terminal to obtain encrypted data by encrypting the privacy data to be transmitted;

[0075] The on-chain module 32 is used by the first user terminal to send the encrypted data to the blockchain for on-chain processing;

[0076] The acquisition module 33 is used for the second user terminal to obtain the encrypted data from the blockchain and transmit it to the enclave of the second user terminal;

[0077] The verification module 34 is used to decrypt the encrypted data according to the enclave of the second user terminal to obtain the privacy data to be transmitted and to verify the identity of the target enclave;

[0078] The input module 35 is used to input the privacy data to be transmitted into the target enclave.

[0079] In the encryption module 31, encrypted data is obtained by encrypting the privacy data to be transmitted at the first user terminal.

[0080] In the on-chain module 32, the encrypted data obtained in the above steps is sent to the blockchain for on-chain processing at the first user terminal.

[0081] In some alternative embodiments, the blockchain is used as a decentralized ledger, characterized by immutability, security, and trustworthiness.

[0082] In some optional embodiments, the blockchain includes two types based on the node permissions of the blockchain network: public blockchains and consortium blockchains. Consortium blockchains typically refer to blockchains where users are a specific group and have entry barriers. Compared to public blockchains, consortium blockchains can be deployed in a local area network, allowing users to use them in an environment without external network access.

[0083] In some preferred embodiments, the blockchain is a consortium blockchain.

[0084] After the acquisition module 33 uploads the data to the blockchain, the second user terminal obtains the encrypted data from the blockchain and transmits it to the enclave of the second user terminal.

[0085] In some alternative embodiments, the enclave of the second user terminal is used as an instance of a trusted execution environment with hardware-guaranteed isolation.

[0086] After being uploaded to the blockchain, the second user terminal obtains the encrypted data from the blockchain and transmits it to the enclave of the second user terminal.

[0087] In some alternative embodiments, the enclave of the second user terminal is used as an instance of a trusted execution environment with hardware-guaranteed isolation.

[0088] In the verification module 34, the encrypted data is decrypted according to the enclave of the second user terminal to obtain the privacy data to be transmitted and the identity of the target enclave is verified.

[0089] In the input module 35, the decrypted privacy data to be transmitted is transmitted to the target enclave.

[0090] Obviously, those skilled in the art should understand that the modules or steps of this application described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. Optionally, they can be implemented using computer-executable program code, thereby storing them in a storage device for execution by a computing device, or fabricating them separately as individual integrated circuit modules, or fabricating multiple modules or steps as a single integrated circuit module. Thus, this application is not limited to any particular combination of hardware and software.

[0091] To better understand the above cross-platform data transmission method and process, the following explanation of the above technical solution is provided in conjunction with preferred embodiments, but it is not intended to limit the technical solution of the embodiments of the present invention.

[0092] The method in this application is based on Intel's SGX implementation, but its core ideas are also applicable to trusted execution environments using other platforms.

[0093] Specifically, there is a series of hardware-based solutions called Trusted Execution Environments (TEEs), including Intel's SGX and AMD's SEV. The core idea is to isolate and protect data through hardware technology. Therefore, when a program runs in a Trusted Execution Environment, it can achieve two basic goals: code cannot be tampered with and intermediate variables cannot be accessed. Its design principle involves adding permission checks for protected memory access at the CPU circuit level. The memory address range protected by the TEE cannot be accessed from the outside, but during the design phase, certain methods of the trusted program can be specified as being callable from the outside.

[0094] A trusted program running on Intel's SGX is called an enclave. To enable data exchange between trusted programs, Intel provides functions for data exchange between two enclaves, called local attestation and remote attestation. The former is used for authentication and data exchange between two enclaves on the same platform, while the latter is used for authentication and data exchange across platforms. However, a major drawback of remote attestation is that each use requires both parties to connect to the internet and interact with an Intel server, which creates significant limitations. For example, for highly secure government agencies and enterprises, their production environments may only provide local area network (LAN) connections.

[0095] This application implements a new cross-platform interaction algorithm based on consortium blockchain, which can realize cross-platform privacy data transmission and identity authentication, and achieve the same security and standards as Intel's Remote Attestation, without needing to connect to the external network or interact with Intel's official system.

[0096] The method described in this application does not rely on connecting to the external network or Intel's official servers, thus achieving cross-platform privacy data transfer between enclaves. It can be applied to various scenarios such as privacy data trading and privacy data analysis. Figure 4 As shown, the specific steps include the following:

[0097] Step 1: User A encrypts m using pkb (ciphertext denoted as pkb[m]), then exports and uploads it to the blockchain. If User A wants to specify the hash value of the target enclave, the hash value is also encrypted and uploaded to the blockchain (ciphertext becomes pkb[m||hash]). User B retrieves pkb[m] (or pkb[m||hash]) from the blockchain and passes it to enclave B.

[0098] Step 2: Enclave B uses skb to decrypt pkb[m] to obtain m. If a specified hash value is specified, it is also decrypted.

[0099] Step 3: Enclave B authentication requires the identity of the target enclave (m). If a hash value is specified, it includes a process of verifying that the hash value of the interaction target matches the specified hash. Upon successful verification, a local attestation is established, and m is passed to the target enclave.

[0100] Step 4, optionally, if it is desired that user A is also unaware of the value of m, then m is randomly generated through enclave A. User A then passes the pkb obtained on-chain and its authorization to enclave A. Enclave A verifies the authorization's validity; if successful, it encrypts m using pkb to obtain pkb[m], then exports and uploads it to the chain. The subsequent execution flow of enclave B is similar.

[0101] Optionally, if the randomly generated m is used as a private key, then enclave A also exports its corresponding public key and puts it on the chain for future verification.

[0102] In some optional embodiments, authenticating the identity of the target enclave includes verifying that the enclave was generated via a third-party signature, to ensure that it does not compromise privacy.

[0103] In some optional implementations, local attestation is a built-in Intel feature used for authentication and interaction between enclaves on the same platform, and does not require an external network connection. Assume there are two users, A and B, both supporting Intel's SGX. Suppose user A needs to send a private piece of data `m` to user B's enclave (called the target enclave), while wanting user B to be unable to access the value of `m`. Also, assume all users can only interact with the blockchain and cannot connect to the external network or rely on other third parties. Optionally, it is desirable that user A also does not know the specific value of `m`. This only applies to scenarios where `m` is a random number.

[0104] Assume the target enclave itself does not reveal information about m. Also assume the target enclave contains certain verifiable identity characteristics, such as being generated via a third-party signature, or its hash value being publicly available / specified by user A.

[0105] The method in this application also includes: the installation process of enclave, which, in specific implementation, includes the following steps:

[0106] Step 1: A third party installs an open-source enclave on user B's platform, denoted as enclave B. Enclave B uses SGX's built-in methods to generate a public-private key pair, denoted as pkb and skb. The private key skb is then encrypted, exported, and stored locally on user B's machine. The public key pkb is directly exported, authorized by a third party, and then sent to the blockchain along with the authorization, thus adding it to the blockchain.

[0107] Step 2: If we want user A to be unaware of the specific value of m, a third party needs to install an open-source enclave on user A's platform, denoted as enclave A.

[0108] In some alternative embodiments, a third party provides an interface for statically checking and signing the enclave. This interface is implemented by deploying another open-source enclave. Each access does not require an internet connection, does not require interaction with a third party, and does not cause any privacy breaches of the third party.

[0109] In some optional embodiments, the method for SGX to generate public and private keys is sgx_create_key_pair_ECC_256, which works by the CPU randomly generating a private key by obtaining circuit information and calculating the public key according to the corresponding rule.

[0110] In some optional embodiments, the key used to encrypt and export the skb is a symmetric key inherent to enclave B, related to the hash value of enclave B. The value of this symmetric key is private to the outside world, provided that enclave B does not contain any methods to reveal privacy. Therefore, after the skb is encrypted with this symmetric key, only enclave B can decrypt the ciphertext and recover the skb. Afterwards, enclave B can read the encrypted skb locally at any time and decrypt and use it internally.

[0111] In some alternative implementations, authorization involves a third party signing the information to be authorized using one of their private keys, while the corresponding authorization public key is publicly available on the blockchain, allowing anyone to verify the signature. The third party ensures that all authorized public keys are generated from the open-source enclave, and that the open-source enclave does not leak privacy. Therefore, encrypting private data with authorized public keys and uploading it to the blockchain is secure.

[0112] In some alternative implementations, the installation process only needs to be performed once. Once installed, user B can receive private data from any user to enclave B as many times as possible, without relying on a third party.

[0113] Embodiments of the present invention also provide a storage medium storing a computer program, wherein the computer program is configured to execute the steps in any of the above method embodiments when running.

[0114] Optionally, in this embodiment, the storage medium may be configured to store a computer program for performing the following steps:

[0115] S1, the first user terminal obtains encrypted data by encrypting the privacy data to be transmitted;

[0116] S2, the first user terminal sends the encrypted data to the blockchain for on-chain processing;

[0117] S3, the second user terminal obtains the encrypted data from the blockchain and transmits it to the enclave of the second user terminal;

[0118] S4, decrypt the encrypted data according to the enclave of the second user terminal to obtain the privacy data to be transmitted and verify the identity of the target enclave;

[0119] S5, transmit the privacy data to be transmitted to the target enclave.

[0120] Optionally, the storage medium is also configured to store a computer program for performing the following steps:

[0121] S31, upload the public key generated by the enclave of the second user terminal and the authorization of the public key to the blockchain together.

[0122] Optionally, the storage medium is also configured to store a computer program for performing the following steps:

[0123] S32, the private key generated by the enclave on the second user terminal is encrypted and stored on the second user terminal.

[0124] Optionally, in this embodiment, the storage medium may include, but is not limited to, various media capable of storing computer programs, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0125] Embodiments of the present invention also provide an electronic device including a memory and a processor, the memory storing a computer program and the processor being configured to run the computer program to perform the steps in any of the above method embodiments.

[0126] Optionally, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor and the input / output device is connected to the processor.

[0127] Optionally, in this embodiment, the processor can be configured to perform the following steps via a computer program:

[0128] S1, the first user terminal obtains encrypted data by encrypting the privacy data to be transmitted;

[0129] S2, the first user terminal sends the encrypted data to the blockchain for on-chain processing;

[0130] S3, the second user terminal obtains the encrypted data from the blockchain and transmits it to the enclave of the second user terminal;

[0131] S4, decrypt the encrypted data according to the enclave of the second user terminal to obtain the privacy data to be transmitted and verify the identity of the target enclave; S5, transmit the privacy data to be transmitted to the target enclave.

[0132] Optionally, specific examples in this embodiment can refer to the examples described in the above embodiments and optional implementations, and will not be repeated here.

[0133] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A cross-platform data transmission method, characterized in that, The first and second client terminals used to support the trusted execution environment include: The first user terminal obtains encrypted data by encrypting the privacy data to be transmitted; The first user terminal sends the encrypted data to the blockchain for on-chain processing; The second user terminal obtains the encrypted data from the blockchain and transmits it to the enclave of the second user terminal; Before the second user terminal obtains the encrypted data from the blockchain and transmits it to the enclave of the second user terminal, it also includes: Upload the public key generated by the enclave on the second user terminal, along with the authorization of the public key, to the blockchain; And / or, encrypt and store the private key generated by the enclave on the second user terminal on the second user terminal; in the case that the privacy data includes: random numbers, it also includes: Privacy data is generated based on the enclave of the first user terminal; The first user terminal will obtain the public key generated by the enclave of the second user terminal on the blockchain and send the authorization of the public key to the enclave of the first user terminal; If the authorization of the public key is approved by the first user's enclave verification, the privacy data is encrypted using the public key to obtain encrypted data, and then sent to the blockchain for on-chain processing; The encrypted data is decrypted based on the enclave of the second user terminal to obtain the privacy data to be transmitted and to verify the identity of the target enclave; The privacy data to be transmitted is then transmitted to the target enclave.

2. The method according to claim 1, characterized in that, Also includes: When the first user terminal specifies the hash value of the target enclave, the first user terminal encrypts the hash value and the privacy data to be transmitted and sends it to the blockchain for on-chain processing. The second user terminal obtains the hash value and the encrypted data of the privacy data to be transmitted from the blockchain and transmits it to the enclave of the second user terminal.

3. The method according to claim 1, characterized in that, The process of decrypting the encrypted data using the private key generated by the second user terminal's enclave to obtain the private data to be transmitted and verifying the identity of the target enclave includes: If the encrypted data includes the hash value of the specified target enclave, the hash value of the interaction target is verified. Based on the test results, hash value matching is performed to determine the target enclave corresponding to the hash value.

4. The method according to claim 1, characterized in that, The step of decrypting the encrypted data to obtain the privacy data to be transmitted based on the enclave of the second user terminal and verifying the identity of the target enclave also includes: verifying that the identity of the target enclave is generated by a third-party signature.

5. The method according to claim 1, characterized in that, The second user terminal's enclave is deployed by a third party and is not connected to the external network and / or servers.

6. A cross-platform data transmission device, characterized in that, The apparatus for supporting a first and second user terminal of a trusted execution environment includes: An encryption module is used by the first user terminal to encrypt the privacy data to be transmitted to obtain encrypted data; when the privacy data includes random numbers, privacy data is generated based on the enclave of the first user terminal. This is used to encrypt the privacy data using the public key, and then send it to the blockchain for on-chain processing, provided that the authorization of the first user's enclave verification public key is approved. The on-chain module is used by the first user terminal to send the encrypted data to the blockchain for on-chain processing; Before the second user terminal obtains the encrypted data from the blockchain and transmits it to the enclave of the second user terminal, the public key generated by the enclave of the second user terminal and the authorization of the public key are uploaded to the blockchain together. And / or, encrypt and store the private key generated by the enclave on the second user terminal on the second user terminal; The acquisition module is used by the second user terminal to obtain the encrypted data from the blockchain and transmit it to the enclave of the second user terminal; The verification module is used to decrypt the encrypted data based on the enclave of the second user terminal to obtain the privacy data to be transmitted and to verify the identity of the target enclave; The input module is used to input the privacy data to be transmitted into the target enclave; and to send the public key generated by the first user terminal through obtaining the enclave of the second user terminal on the blockchain and the authorization of the public key to the enclave of the first user terminal.

7. A storage medium, characterized in that, The storage medium stores a computer program, wherein the computer program is configured to execute the method described in any one of claims 1 to 5 when it is run.

8. An electronic device comprising a memory and a processor, characterized in that, The memory stores a computer program, and the processor is configured to run the computer program to perform the method as described in any one of claims 1 to 5.

Images