A data processing and storage method for realizing contract privacy

Abstract

The present invention provides a data processing and storage method for realizing contract privacy, which belongs to the field of data privacy of blockchain. The present invention is based on the solution of trusted execution environment (TEE), and on this basis, proposes a solution for encrypting, setting and replacing keys. Through five steps of contract design, administrator setting keys, administrator modifying keys, TEE key setting, encrypted data reading and storage, users can simply and conveniently use the existing blockchain infrastructure, including using a trusted execution environment to encrypt and store data. Its goal is that users can conveniently set and modify the keys for encrypted data; each blockchain node can decrypt the keys and obtain the original keys to complete the consensus process; the blockchain node program can access the local contract metadata only after authorization, and finally protect the privacy of contract data in the alliance chain scenario.

Description

Technical Field

[0001] The present invention relates to the field of data privacy of blockchain, and in particular to a data processing and storage method for realizing contract privacy. Background Art

[0002] In blockchain projects, due to its distributed nature, each node is required to have the same data. The use of blockchain consensus algorithms requires that the data of each node remain consistent. In existing blockchain applications, users have increasingly high requirements for data privacy. They want to use blockchain to ensure the openness of data and operations and solve the problem of multi-party security and mutual trust. At the same time, they want to protect data privacy and do not want sensitive data to be obtained by a large number of users.

[0003] There are two types of data privacy. The first is the privacy of user application data, and the second is the privacy of blockchain metadata.

[0004] For the former, users can encrypt data locally and then send the data to the blockchain for recording. When using it, they can first read it from the blockchain and then decrypt it locally. This method is applicable to both public and consortium chains, because the owner and user of the data are both users; for the latter, privacy protection of blockchain metadata is a difficult point. First of all, the data must be stored in encrypted form, and each node must be able to read the real data for consensus. How to set, store, distribute, and use keys has become a difficult point for our needs. Summary of the invention

[0005] The main purpose of the present invention is to provide a data processing and storage method for realizing contract privacy, which can effectively solve the problems raised in the background technology.

[0006] To achieve the above object, the technical solution adopted by the present invention is:

[0007] A data processing and storage method for realizing contract privacy. The contract is divided into two parts. One part is a module that does not require privacy computing, which is directly sent to the smart contract virtual machine EVM for execution, and the data is stored in the database in plain text; the other part is a part that requires privacy computing, and the code is passed to the trusted execution environment TEE. At the same time, the input and output data in the TEE environment are also encrypted. The specific data processing and storage method includes the following steps:

[0008] (I) Contract design

[0009] 1) Design two map objects to store the new and old sets of keys, namely map1: stores the currently used keys, which are the old keys; map2: stores the keys to be used or updated, which are the new keys;

[0010] The key of the map is the public key of the node program, and the value is the key encrypted with the node public key;

[0011] 2) Design a key setting function with a map as parameter, SetKey(map[pubkey:value]). The function should use the passed parameter to assign the same value to map1 and map2.

[0012] 3) Design a key modification function with a map parameter, UpdateKey(map[pubkey:value]). The function needs to assign the value of map2 to map1 and set map2 with the newly passed parameter.

[0013] (2) Administrator sets the key

[0014] 1) The blockchain node program obtains the node's public key through the hardware encryption and decryption card, and the contract administrator obtains the node's public key by calling the blockchain node program's API interface;

[0015] 2) The contract administrator uses a random algorithm to generate the encryption key used by the contract locally;

[0016] 3) The contract administrator uses the node’s public key to asymmetrically encrypt the key generated in step 2);

[0017] 4) Repeat step 2) for all consortium blockchain nodes;

[0018] 5) Call the blockchain contract's key setting function SetKey to send the encrypted multiple keys to the contract;

[0019] 6) The method inside the contract stores the key in map1 and map2 respectively;

[0020] 7) The contract administrator completes the key setting. The keys encrypted with the public keys of each node are stored in map1 and map2 in the contract;

[0021] (III) Administrator modifies the key

[0022] 1) The blockchain node program obtains the node's public key through the hardware encryption and decryption card, and the contract administrator obtains the node's public key by calling the blockchain node program's API interface;

[0023] 2) The contract administrator uses a random algorithm to generate a new encryption key for the contract locally;

[0024] 3) The contract administrator uses the node’s public key to asymmetrically encrypt the key generated in step 2);

[0025] 4) Repeat step 3) for all consortium blockchain nodes;

[0026] 5) Call the blockchain contract's key modification function UpdateKey and send the encrypted key to the contract;

[0027] 6) The method inside the contract updates the value in map2 to map1, and updates the content in map2 with the passed parameters;

[0028] 7) The contract administrator completes the modification of the key. Map1 in the contract stores the original contents of map2, and map2 is completely updated with the new key;

[0029] (IV) TEE key setting

[0030] 1) Load the public module of the contract into the contract virtual machine;

[0031] 2) Load the privacy module of the contract into the TEE environment;

[0032] 3) The node program reads the encryption key corresponding to its own node public key from the contract virtual machine;

[0033] 4) The node program sends both the new and old encryption keys to the hardware encryption and decryption card for decryption to obtain the key;

[0034] 5) The node program sets the new and old keys to TEE;

[0035] (V) Encrypted data reading and storage

[0036] 1) TEE asks the node program for data, and the node program reads it from the KV database;

[0037] 2) TEE decrypts the data using the old key;

[0038] 3) TEE performs logical operations;

[0039] 4) TEE encrypts the data to be output with a new key, outputs the encrypted data to the node program, and the node program records the encrypted data in the KV database.

[0040] Preferably, in step (ii) 6), the keys stored in map1 and map2 are the same.

[0041] Preferably, in step (iii) 6), the keys corresponding to the same public keys in map1 and map2 are different.

[0042] Preferably, the data read in step (V) 1) is encrypted data.

[0043] Compared with the prior art, the present invention has the following beneficial effects:

[0044] The solution for private storage of contract metadata provided by the present invention enables users to set and modify keys at the application layer, that is, in the contract, which makes key setting simple and convenient for users. The solution designed by the present invention can also make key modifications immediately available, that is, the key modification is effective when it is modified at the time, without having to wait for multiple block heights to take effect. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 It is a schematic diagram of the contract composition operation architecture of the present invention;

[0046] Figure 2 It is a specific schematic diagram of the present invention. DETAILED DESCRIPTION

[0047] In order to make the technical means, creative features, objectives and effects achieved by the present invention easy to understand, the present invention is further explained below in conjunction with specific implementation methods.

[0048] In traditional smart contract solutions, because there is no requirement for data privacy, the processing logic of smart contracts is: the blockchain node puts the smart contract into the contract virtual machine for operation, and the virtual machine interacts with the blockchain node program to read and write data. However, if privacy requirements are put forward for smart contracts, the intermediate data and result data generated by the contract cannot be leaked, which requires that these data are encrypted and that the contract data cannot be leaked during the execution of the contract.

[0049] like Figure 1 As shown: the contract will be divided into two parts. One part is the module that does not require privacy computing, which is directly sent to the smart contract virtual machine EVM for execution, and the data will be stored in the database in plain text; the other part is the part that requires privacy computing. The code needs to be passed into the trusted execution environment TEE, and the input and output data in the TEE environment also need to be encrypted.

[0050] Regarding the node private key storage solution, we choose to use a hardware encryption and decryption card to generate a public and private key pair. The public key can be obtained from the outside, but the private key cannot be obtained. All functions of the node program that use the private key are performed in the hardware encryption and decryption card, including: data decryption, data signature verification, etc.

[0051] like Figure 2 As shown: The specific processing and storage method includes the following steps:

[0052] (I) Contract design

[0053] 1) Design two map objects to store the new and old sets of keys. The key of the map is the public key of the node program, and the value is the key encrypted with the node public key;

[0054] 2) Design a key setting function with a map as a parameter, for example:

[0055] SetKey(map[pubkey:value]), the function should use the passed parameters to assign the same value to map1 and map2;

[0056] 3) Design a key modification function with a map parameter, UpdateKey(map[pubkey:value]). The function needs to assign the value of map2 to map1 and set map2 with the newly passed parameter.

[0057] (2) Administrator sets the key

[0058] 1) The blockchain node program obtains the node's public key through the hardware encryption and decryption card, and the contract administrator obtains the node's public key by calling the blockchain node program's API interface;

[0059] 2) The contract administrator uses a random algorithm to generate the encryption key used by the contract locally;

[0060] 3) The contract administrator uses the node’s public key to asymmetrically encrypt the key generated in the second step;

[0061] 4) Repeat step 2 for all consortium blockchain nodes;

[0062] 5) Call the blockchain contract's key setting function SetKey to send the encrypted multiple keys to the contract;

[0063] 6) The method inside the contract stores the key in map1 and map2 respectively. Note that the keys stored in map1 and map2 are the same at this time;

[0064] 7) The contract administrator completes the key setting. The keys encrypted with the public keys of each node are stored in map1 and map2 in the contract;

[0065] (III) Administrator modifies the key

[0066] 1) The blockchain node program obtains the node's public key through the hardware encryption and decryption card, and the contract administrator obtains the node's public key by calling the blockchain node program's API interface;

[0067] 2) The contract administrator uses a random algorithm to generate a new encryption key for the contract locally;

[0068] 3) The contract administrator uses the node’s public key to asymmetrically encrypt the key generated in the second step;

[0069] 4) Repeat step 3 for all consortium blockchain nodes;

[0070] 5) Call the blockchain contract's key modification function UpdateKey and send the encrypted key to the contract;

[0071] 6) The method inside the contract updates the value in map2 to map1, and updates the content in map2 with the passed parameters. Note that the keys corresponding to the same public key in map1 and map2 are different at this time;

[0072] 7) The contract administrator completes the modification of the key. Map1 in the contract stores the original contents of map2, and map2 is completely updated with the new key;

[0073] (IV) TEE key setting

[0074] 1) Load the public module of the contract into the contract virtual machine;

[0075] 2) Load the privacy module of the contract into the TEE environment;

[0076] 3) The node program reads the encryption key corresponding to its own node public key from the contract virtual machine;

[0077] 4) The node program sends both the new and old encryption keys to the hardware encryption and decryption card for decryption to obtain the key;

[0078] 5) The node program sets the new and old keys to TEE;

[0079] (V) Encrypted data reading and storage

[0080] 1) TEE asks the node program for data, and the node program reads the data from the KV database. This data is encrypted data;

[0081] 2) TEE decrypts the data using the old key;

[0082] 3) TEE performs logical operations;

[0083] 4) TEE encrypts the data to be output with a new key, outputs the encrypted data to the node program, and the node program records the encrypted data in the KV database.

[0084] It should be noted that in the above embodiments, the key of the contract metadata is set in the contract, not by the node, that is, the encryption of the data is in the hands of the contract administrator, which is convenient and flexible in setting and modifying the key; the keys stored in the contract are encrypted with the public keys of the nodes, and each node corresponds to an encrypted key. Each blockchain node program can only unlock its own encryption key. The private key of the node is in the hardware encryption and decryption card, and the private key does not leave the hardware. The decryption of the contract key is performed in the hardware. The contract is divided into two parts during execution. The ordinary part is executed in the contract virtual machine, and the privacy part is executed in the TEE environment. After the TEE processing is completed, the privacy part of the contract is stored in the node KV database in the form of encrypted data.

[0085] The above shows and describes the basic principles and main features of the present invention and the advantages of the present invention. It should be understood by those skilled in the art that the present invention is not limited to the above embodiments. The above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention to be protected. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. A data processing and storage method for realizing contract privacy, characterized in that: The contract is divided into two parts. One part is a module that does not require privacy computing. It is directly sent to the smart contract virtual machine EVM for execution, and the data is stored in the database in plain text. The other part is the part that requires privacy computing. The code is passed to the trusted execution environment TEE. At the same time, the input and output data in the TEE environment are also encrypted. The specific data processing and storage method includes the following steps: (I) Contract design 1) Design two map objects to store the new and old sets of keys, namely map1: stores the currently used keys, which are the old keys; map2: stores the keys to be used or updated, which are the new keys; The key of the map is the public key of the node program, and the value is the key encrypted with the node public key; 2) Design a key setting function with a map as a parameter. SetKey(map[pubkey:value]), the function should use the passed parameters to assign the same value to map1 and map2; 3) Design a key modification function with a map as a parameter. UpdateKey(map[pubkey:value]), the function needs to assign the value of map2 to map1 and set map2 with the newly passed parameters; (2) Administrator sets the key 1) The blockchain node program obtains the node's public key through the hardware encryption and decryption card, and the contract administrator obtains the node's public key by calling the blockchain node program's API interface; 2) The contract administrator uses a random algorithm to generate the encryption key used by the contract locally; 3) The contract administrator uses the node’s public key to asymmetrically encrypt the key generated in step 2); 4) Repeat step 2) for all consortium blockchain nodes; 5) Call the blockchain contract's key setting function SetKey to send the encrypted multiple keys to the contract; 6) The method inside the contract stores the key in map1 and map2 respectively; 7) The contract administrator completes the key setting. The keys encrypted with the public keys of each node are stored in map1 and map2 in the contract; (III) Administrator modifies the key 1) The blockchain node program obtains the node's public key through the hardware encryption and decryption card, and the contract administrator obtains the node's public key by calling the blockchain node program's API interface; 2) The contract administrator uses a random algorithm to generate a new encryption key for the contract locally; 3) The contract administrator uses the node’s public key to asymmetrically encrypt the key generated in step 2); 4) Repeat step 3) for all consortium blockchain nodes; 5) Call the blockchain contract's key modification function UpdateKey and send the encrypted key to the contract; 6) The method inside the contract updates the value in map2 to map1, and updates the content in map2 with the passed parameters; 7) The contract administrator completes the modification of the key. Map1 in the contract stores the original contents of map2, and map2 is completely updated with the new key; (IV) TEE key setting 1) Load the public module of the contract into the contract virtual machine; 2) Load the privacy module of the contract into the TEE environment; 3) The node program reads the encryption key corresponding to its own node public key from the contract virtual machine; 4) The node program sends both the new and old encryption keys to the hardware encryption and decryption card for decryption to obtain the key; 5) The node program sets the new and old keys to TEE; (V) Encrypted data reading and storage 1) TEE asks the node program for data, and the node program reads it from the KV database; 2) TEE decrypts the data using the old key; 3) TEE performs logical operations; 4) TEE encrypts the data to be output with a new key, outputs the encrypted data to the node program, and the node program records the encrypted data in the KV database.

2. A data processing and storage method for realizing contract privacy according to claim 1, characterized in that: In step (ii) 6), the keys stored in map1 and map2 are the same.

3. A data processing and storage method for realizing contract privacy according to claim 2, characterized in that: In step (iii) 6), the keys corresponding to the same public keys in map1 and map2 are different.

4. A data processing and storage method for realizing contract privacy according to claim 3, characterized in that: The data read in step (five) 1) is encrypted data.

Images