Blockchain system and its communication method, storage medium, and program product

Abstract

The present application discloses a blockchain system and its communication method, storage medium, and program product, which are used to improve the security and correctness of communication between nodes in the blockchain. A communication method for a blockchain system provided in an embodiment of the present application includes: a client node sends a verification request to an authentication node based on a software guard extension (SGX) application; wherein the verification request includes encrypted verification information; the authentication node based on the SGX application includes an SGX untrusted execution environment and an SGX trusted execution environment; the SGX trusted execution environment includes an SGX secure enclave; the SGX secure enclave decrypts the encrypted verification information carried in the verification request to obtain decrypted verification information; wherein the SGX secure enclave stores at least part of a smart contract; the SGX secure enclave processes the verification information according to the smart contract, obtains a processing result, encrypts the processing result, and sends the encrypted processing result to the client node.

Description

Technical Field

[0001] The present application relates to the field of blockchain technology, and in particular to a blockchain system and its communication method, storage medium, and program product. Background Art

[0002] Blockchain technology is primarily categorized into public and permissioned blockchains. Permissioned blockchains can be further divided into private and consortium blockchains based on the number of participating nodes. Consortium blockchain technology can be used to optimize the business processes of most traditional information systems, and is particularly well-suited for business scenarios where there is no central authority, multi-party collaboration, and manageable risks. The shared ledger mechanism of consortium blockchains can significantly reduce reconciliation costs in such scenarios, improve data acquisition efficiency, increase fault tolerance, strengthen trust, and prevent malicious fraud.

[0003] However, consortium blockchains still face numerous challenges in practical deployment, such as data privacy and computational security. Smart contracts are the only channel for external interaction with the blockchain system and the only way to generate transactions. Ensuring the secure operation and correct execution of smart contract code is crucial, as is ensuring data privacy. Summary of the Invention

[0004] The embodiments of the present application provide a blockchain system and its communication method, storage medium, and program product, which are used to improve the security and correctness of communication between nodes in the blockchain.

[0005] An embodiment of the present application provides a communication method for a blockchain system, wherein the blockchain system includes a client node and an authentication node based on a software protection extension SGX application. The method includes:

[0006] The client node sends a verification request to an authentication node based on a software protection extension (SGX) application; wherein the verification request includes encrypted verification information; the authentication node based on the SGX application includes an SGX untrusted execution environment and an SGX trusted execution environment; the SGX trusted execution environment includes an SGX secure area;

[0007] The SGX secure area decrypts the encrypted verification information carried in the verification request to obtain decrypted verification information; wherein the SGX secure area stores at least part of the smart contract;

[0008] The SGX secure area processes the verification information according to the smart contract, obtains the processing result, encrypts the processing result, and sends the encrypted processing result to the client node.

[0009] In some embodiments, before the client node sends a verification request to the authentication node based on the software protection extension SGX application, the method further includes:

[0010] The client node generates and stores a first public-private key pair; the first public-private key pair includes a first public key and a first private key;

[0011] The authentication node based on the SGX application generates and stores a second public-private key pair within the SGX secure area; the second public-private key pair includes a second public key and a second private key;

[0012] The client node sends a registration request, first client identity information, and a first public key to an authentication node based on an SGX application;

[0013] The SGX untrusted execution environment generates first identity information based on the first client identity information, and sends the first identity information, the first client identity information, and the first public key to the SGX trusted execution environment;

[0014] The SGX secure area stores the first client identity information and the first public key, and sends the second public key to the SGX untrusted execution environment;

[0015] The SGX untrusted execution environment sends a registration success message and the second public key to the client node;

[0016] The client node stores the second public key.

[0017] In some embodiments, before the client node sends a verification request to the authentication node based on the software protection extension SGX application, the method further includes:

[0018] The client node generates a temporary session key;

[0019] The client node encrypts the verification information according to the temporary session key to obtain the encrypted verification information;

[0020] The client node encrypts the temporary session key according to the second public key to obtain an encrypted temporary session key;

[0021] The client node signs the encrypted verification information according to the first private key to obtain first signature information;

[0022] The client node sends a verification request to the authentication node based on the software protection extension SGX application, specifically including:

[0023] The client node sends the encrypted verification information, the encrypted temporary session key, and the first signature information to the authentication node based on the SGX application.

[0024] In some embodiments, the SGX secure enclave decrypts the encrypted verification information carried in the verification request. Before obtaining the decrypted verification information, the method further includes:

[0025] The SGX untrusted execution environment sends the verification request to the SGX secure area in the SGX trusted execution environment;

[0026] The SGX security area verifies whether the first signature information is correct based on the first public key;

[0027] When the first signature information is correct, the SGX security area decrypts the encrypted verification information carried in the verification request.

[0028] In some embodiments, the SGX secure enclave decrypts the encrypted verification information carried in the verification request, specifically including:

[0029] The SGX secure area extracts the temporary session key from the encrypted temporary session key according to the second private key;

[0030] The SGX secure area decrypts the encrypted verification information based on the temporary session key.

[0031] In some embodiments, encrypting the processing result specifically includes:

[0032] The SGX secure area encrypts the processing result according to the temporary session key to obtain the encrypted processing result;

[0033] The SGX security area signs the encrypted processing result according to the second private key to obtain second signature information.

[0034] In some embodiments, sending the encrypted processing result to the client node specifically includes:

[0035] The SGX secure area sends the encrypted processing result and the second signature information to the SGX untrusted execution environment;

[0036] The SGX untrusted execution environment sends the encrypted processing result and the second signature information to the client node.

[0037] In some embodiments, after sending the encrypted processing result to the client node, the method further includes:

[0038] The client node verifies whether the second signature information is correct according to the second public key;

[0039] When the second signature information is correct, the client node decrypts the encrypted processing result according to the temporary session key to obtain the processing result.

[0040] In some embodiments, the blockchain system further includes: a first node and a second node; after the SGX secure area processes the verification information according to the smart contract, obtains the processing result, and encrypts the processing result, it further includes:

[0041] The SGX secure area stores the processing results;

[0042] The first node and the second node send a processing result acquisition request to the authentication node based on the SGX application;

[0043] The authentication node based on the SGX application sends the processing result to the first node and the second node according to the processing result acquisition request.

[0044] A blockchain system provided by an embodiment of the present application includes: a client node and an authentication node based on a software protection extension SGX application;

[0045] Client nodes include:

[0046] A first sending and receiving module is configured to: send a verification request to an authentication node based on an SGX application, wherein the verification request includes encrypted verification information; and receive an encrypted processing result sent by the authentication node based on the SGX application;

[0047] The authentication node based on SGX application includes: SGX untrusted execution environment and SGX trusted execution environment; SGX trusted execution environment includes: SGX secure area; SGX secure area includes:

[0048] A smart contract storage module, configured to store at least part of the smart contract;

[0049] The first encryption and decryption module is configured to: receive a verification request, decrypt the encrypted verification information carried in the verification request, and obtain the decrypted verification information;

[0050] The information processing module is used to process verification information according to the smart contract, obtain processing results, and encrypt the processing results;

[0051] The second sending and receiving module is used to send the encrypted processing result.

[0052] In some embodiments, the client node further comprises:

[0053] A first key generation module is configured to generate and store a first public-private key pair; the first public-private key pair includes a first public key and a first private key;

[0054] The first sending and receiving module is further used to: send a registration request, the first client identity information, and the first public key to the authentication node based on the SGX application;

[0055] The SGX untrusted execution environment includes: a first identity information generation module, a third sending and receiving module;

[0056] The SGX security area further includes: a second key generation module, and a first storage module;

[0057] The second key generation module is used to: generate and save a second public-private key pair; the second public-private key pair includes a second public key and a second private key;

[0058] The first identity information generation module is configured to: execute a preset client registration function, generate first identity information according to the first client identity information, and send the first identity information, the first client identity information, and the first public key to the SGX trusted execution environment;

[0059] The first storage module is used to: store the first client identity information and the first public key;

[0060] The second sending and receiving module is further used to: send the second public key to the third sending and receiving module;

[0061] The third sending and receiving module is used to: generate registration success information, and send the registration success information and the second public key to the client node;

[0062] The first sending and receiving module is further used to receive registration success information and the second public key.

[0063] In some embodiments, the first key generation module is further configured to: generate a temporary session key;

[0064] The client node also includes:

[0065] The second encryption and decryption module is configured to: encrypt the verification information according to the temporary session key to obtain the encrypted verification information; encrypt the temporary session key according to the second public key to obtain the encrypted temporary session key; and sign the encrypted verification information according to the first private key to obtain the first signature information;

[0066] The first sending and receiving module is specifically used to send encrypted verification information, encrypted temporary session key and first signature information to the authentication node based on the SGX application.

[0067] In some embodiments, the third sending and receiving module is further used to: send the encrypted verification information, the encrypted temporary session key, and the first signature information to the SGX secure area in the SGX trusted execution environment;

[0068] The SGX security area further includes: a verification module, configured to verify whether the first signature information is correct according to the first public key;

[0069] The first encryption and decryption module is specifically used to decrypt the encrypted verification information carried in the verification request when the first signature information is correct.

[0070] In some embodiments, the first encryption / decryption module is used to decrypt the encrypted verification information carried in the verification request, specifically including:

[0071] A temporary session key is extracted from the encrypted temporary session key according to the second private key, and the encrypted verification information is decrypted according to the temporary session key.

[0072] In some embodiments, the first encryption and decryption module is used to encrypt the processing result, specifically including:

[0073] Encrypting the processing result according to the temporary session key to obtain the encrypted processing result;

[0074] The encrypted processing result is signed according to the second private key to obtain second signature information.

[0075] In some embodiments, the second sending and receiving module is used to send the encrypted processing result, specifically including:

[0076] Sending the encrypted processing result and the second signature information to the third sending and receiving module;

[0077] The third sending and receiving module is further used to send the encrypted processing result and the second signature information to the client node.

[0078] In some embodiments, the first sending and receiving module is used to receive the encrypted processing result sent by the authentication node based on the SGX application, specifically including: receiving the encrypted processing result and the second signature information;

[0079] The second encryption and decryption module is further used to: verify whether the second signature information is correct according to the second public key; when the second signature information is correct, the client node decrypts the encrypted processing result according to the temporary session key to obtain the processing result.

[0080] In some embodiments, the first storage module is further configured to store processing results;

[0081] The blockchain system also includes: a first node and a second node;

[0082] The first node includes: a fourth sending and receiving module;

[0083] The second node includes: a fifth sending and receiving module;

[0084] The fourth sending and receiving module and the fifth sending and receiving module are both used to send a processing result acquisition request to the authentication node based on the SGX application;

[0085] The second sending and receiving module is further configured to: send the processing result to the first node and the second node respectively according to the processing result acquisition request;

[0086] The fourth sending and receiving module and the fifth sending and receiving module are both used to receive processing results.

[0087] The present invention provides a blockchain system, including:

[0088] one or more processors;

[0089] a storage device for storing one or more programs;

[0090] When one or more programs are executed by one or more processors, the one or more processors implement the blockchain communication method provided in the embodiments of the present application.

[0091] An embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the blockchain communication method provided by an embodiment of the present application.

[0092] A computer program product provided in an embodiment of the present application includes a computer program, which, when executed by a processor, implements the blockchain communication method provided in an embodiment of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0093] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0094] Figure 1 A flowchart of a communication method for a blockchain system provided in an embodiment of the present application;

[0095] Figure 2 A flowchart of another blockchain system communication method provided in an embodiment of the present application;

[0096] Figure 3 A flowchart of another communication method of a blockchain system provided in an embodiment of the present application;

[0097] Figure 4 A schematic diagram of a blockchain system provided in an embodiment of the present application;

[0098] Figure 5 A schematic diagram of another blockchain system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0099] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions of the embodiments of the present application will be clearly and completely described below in conjunction with the drawings of the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. And in the absence of conflict, the embodiments in the present application and the features in the embodiments can be combined with each other. Based on the described embodiments of the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0100] Unless otherwise defined, the technical or scientific terms used in this application should have the usual meaning understood by people with ordinary skills in the field to which this application belongs. The words "first", "second" and similar terms used in this application do not indicate any order, quantity or importance, but are only used to distinguish different components. Words such as "include" or "comprise" mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects. Words such as "connect" or "connected" are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect.

[0101] It should be noted that the sizes and shapes of the figures in the accompanying drawings do not reflect the actual scale and are only for the purpose of illustrating the contents of this application. The same or similar reference numerals throughout represent the same or similar elements or elements with the same or similar functions.

[0102] The embodiment of the present application provides a communication method of a blockchain system, wherein the blockchain system includes a client node and an authentication node based on a software protection extension SGX application, such as Figure 1 As shown, the method includes:

[0103] S101. A client node sends a verification request to an authentication node based on a software protection extension (SGX) application; wherein the verification request includes encrypted verification information; the authentication node based on the SGX application includes an SGX untrusted execution environment and an SGX trusted execution environment; the SGX trusted execution environment includes an SGX secure area;

[0104] S102. The SGX secure enclave decrypts the encrypted verification information carried in the verification request to obtain decrypted verification information; wherein the SGX secure enclave stores at least part of the smart contract;

[0105] S103. The SGX secure area obtains a processing result based on the smart contract processing verification information, encrypts the processing result, and sends the encrypted processing result to the client node.

[0106] It should be noted that Software Guard Extensions (SGX), as a trusted execution environment, can encapsulate the secure operations of legitimate software that needs to be protected in a secure environment called an enclave. The enclave is an SGX secure area. All privileged or non-privileged software cannot access the contents of the enclave, which can protect the application's critical code and data from malware attacks. In other words, once the code of the application data is in the enclave, it can be protected from damage by malware with special permissions. In the communication method of the blockchain system provided in the embodiment of the present application, the SGX secure area stores at least part of the smart contract, that is, encapsulates part of the smart contract code in the enclave.

[0107] The blockchain system communication method provided in the embodiments of this application encapsulates at least part of the smart contract in the SGX secure enclave, thereby preventing tampering with the smart contract and interference with the verification process of verification information using the smart contract. This ensures the integrity of the smart contract's key code and the security, correctness, and privacy of the smart contract execution process, thereby enhancing the robustness of the blockchain system. Furthermore, the verification information is loaded into the SGX secure enclave via a secure communication protocol, ensuring the privacy of its transmission and verification process.

[0108] In specific implementations, the SGX secure enclave stores at least some smart contracts. For example, the SGX secure enclave stores the key code for smart contracts. This key code must include code that can verify verification information, such as key instructions for modifying data assets. This ensures the minimum trust base of the blockchain system. The SGX untrusted execution environment deploys low-security code that requires no protection to connect client nodes to the SGX trusted execution environment. In specific implementations, interaction between the SGX trusted execution environment and the SGX untrusted execution environment is performed through the interface functions ECALL and OCALL. ECALL is the interface for calling the SGX trusted execution environment from the untrusted SGX execution environment, while OCALL is the interface for calling the SGX untrusted execution environment from the trusted SGX execution environment.

[0109] In a specific implementation, the verification request may be, for example, a business verification request, and the verification information may be, for example, business-related information on the blockchain. If the business verification request is, for example, a transaction verification request, the verification information may be transaction-related verification information on the blockchain. That is, the authentication node based on the SGX application can verify the transaction-related verification information sent by the client node.

[0110] It should be noted that all communications involved in the embodiments of the present application are carried out in a secure channel.

[0111] In some embodiments, before the client node sends a verification request to the authentication node based on the SGX application, Figure 2 As shown, the communication method of the blockchain system provided in the embodiment of the present application further includes: S201, registration preparation, and S202, registration phase. That is, before data is exchanged between the client node and the authentication node, the client node needs to register with the authentication node.

[0112] In some embodiments, step S201 registration preparation specifically includes:

[0113] S2011. The client node generates and saves a first public-private key pair (PubK, PriK); the first public-private key pair (PubK, PriK) includes a first public key PubK and a first private key PriK;

[0114] S2012. The authentication node based on the SGX application generates and saves a second public-private key pair (EnPubK, EnPriK) within the SGX security area; the second public-private key pair (EnPubK, EnPriK) includes a second public key EnPubK and a second private key EnPriK.

[0115] In the communication method of the blockchain system provided in the embodiment of the present application, the client node and the authentication node each generate a public-private key pair, so that communication-related information between the client node and the authentication node can be encrypted using the public-private key pair. Subsequently, the client node and the authentication node can communicate using the public-private key pair, which can improve the communication security between the client node and the authentication node.

[0116] In some embodiments, step S202 is a registration phase, such as Figure 2 As shown, specifically including:

[0117] S2021. The client node sends a registration request, the first client identity information ClientID, and the first public key PubK to the authentication node based on the SGX application;

[0118] S2022. The SGX untrusted execution environment executes a preset client registration function, generates first identity information EnclaveID according to the first client identity information ClientID, and sends the first identity information EnclaveID, the first client identity information ClientID, and the first public key PubK to the SGX trusted execution environment;

[0119] S2023. The SGX secure area saves the first client identity information ClientID and the first public key PubK, and sends the second public key EnPubK to the SGX untrusted execution environment;

[0120] S2024. The SGX untrusted execution environment sends a registration success message and the second public key EnPubK to the client node.

[0121] S2025. The client node saves the second public key EnPubK.

[0122] That is, during the registration phase, the client node and the authentication node exchange public keys to encrypt information involved in the subsequent communication process, ensuring the privacy and security of the communication process between the client node and the authentication node.

[0123] In specific implementation, Figure 2 As shown, the SGX untrusted execution environment executes a preset client registration function, for example, including: the SGX untrusted execution environment executes the client registration function Register Client through the ECALL instruction.

[0124] In a specific implementation, the client node may generate a first public-private key pair using an RSA algorithm, and the authentication node may also generate a second public-private key pair using an RSA algorithm. The RSA algorithm is an asymmetric encryption algorithm.

[0125] In some embodiments, before the client node sends a verification request to the authentication node based on the software protection extension SGX application, the method further includes:

[0126] The client node generates a temporary session key SK;

[0127] The client node encrypts the verification information according to the temporary session key SK and obtains the encrypted verification information E(p);

[0128] The client node encrypts the temporary session key SK according to the second public key EnPubK to obtain the encrypted temporary session key E(SK);

[0129] The client node signs the encrypted verification information E(p) according to the first private key PriK to obtain the first signature information Sign[E(p)];

[0130] The client node sends a verification request to the authentication node based on the software protection extension SGX application, specifically including:

[0131] The client node sends the encrypted verification information E(p), the encrypted temporary session key E(SK) and the first signature information Sign[E(p)] to the authentication node based on the SGX application.

[0132] In the communication method of the blockchain system provided in the embodiments of the present application, in addition to using the first public-private key pair and the second public-private key pair for encryption, the client node also generates a temporary session key before communication, that is, a new key is generated for each communication. Using the temporary session key to encrypt communication-related information can further improve the security of communication between the client node and the authentication node. The client node encrypts the verification information using the temporary session key pair to obtain encrypted verification information E(p), and then encrypts the temporary session key using the second public key, thereby ensuring the privacy of communication between the client node and the authentication node. Furthermore, the client node signs the encrypted verification information E(p) using the first private key PriK to obtain first signature information Sign[E(p)], and sends the first signature information Sign[E(p)] to the authentication node so that the authentication node can subsequently verify the correctness of the first signature information Sign[E(p)]. This ensures the integrity of communication-related information between the client node and the authentication node, prevents attacks on the verification information during the communication process, and further improves the security and correctness of communication between the client node and the authentication node.

[0133] It should be noted that the embodiment of the present application adopts an asymmetric encryption algorithm in the registration stage and a symmetric encryption algorithm for encrypting verification information in the communication stage, that is, the communication encryption is performed by combining an asymmetric encryption algorithm with a symmetric encryption algorithm, which can improve the security of communication between the client node and the authentication node.

[0134] During specific implementation, the client node generates a random number as a temporary session key.

[0135] In specific implementations, verification information includes, for example, a key information payload that needs to be sent to the authentication node. The key information payload includes, for example, the data or parameters that need to be verified, the input information of the key code of the smart contract, etc.

[0136] In some embodiments, the SGX secure enclave decrypts the encrypted verification information carried in the verification request. Before obtaining the decrypted verification information, the method further includes:

[0137] The SGX untrusted execution environment sends the verification request to the SGX secure area in the SGX trusted execution environment;

[0138] The SGX security area verifies whether the first signature information Sign[E(p)] is correct based on the first public key PubK;

[0139] When the first signature information Sign[E(p)] is correct, the SGX security area decrypts the encrypted verification information E(p) carried in the verification request.

[0140] In the communication method of the blockchain system provided in the embodiment of the present application, the authentication node verifies the correctness of the first signature information Sign[E(p)], and when the first signature information Sign[E(p)] is correct, the encrypted verification information E(p) is decrypted and subsequently verified, thereby ensuring the integrity of the communication-related information between the client node and the authentication node, avoiding the verification information from being attacked during the communication process, and further improving the security and correctness of the communication between the client node and the authentication node.

[0141] In a specific implementation, the SGX untrusted execution environment sends a verification request to the SGX secure area in the SGX trusted execution environment, specifically including: the SGX untrusted execution environment loads {E(p), E(SK), Sign[E(p)]} into the SGX secure area through the ECALL interface.

[0142] In some embodiments, the SGX secure area decrypts the encrypted verification information E(p) carried in the verification request, specifically including:

[0143] The SGX secure area extracts the temporary session key SK from the encrypted temporary session key E(SK) according to the second private key EnPriK;

[0144] The SGX secure area decrypts the encrypted verification information E(p) based on the temporary session key SK.

[0145] In specific implementation, the SGX security area decrypts the encrypted verification information E(p) according to the temporary session key SK to obtain the verification information including the key information payload.

[0146] In some embodiments, the SGX security area processes the verification information according to the smart contract to obtain a processing result, specifically including: the SGX security area executes the smart contract key code, processes the verification information including the key information payload, and obtains the processing result r.

[0147] Taking the verification information as transaction-related verification information as an example, the processing result includes, for example, transaction verification pass information or transaction verification fail information.

[0148] In some embodiments, encrypting the processing result specifically includes:

[0149] The SGX secure area encrypts the processing result r according to the temporary session key SK to obtain the encrypted processing result E(r);

[0150] The SGX security area signs the encrypted processing result E(r) according to the second private key EnPriK to obtain the second signature information Sign[E(r)].

[0151] In some embodiments, sending the encrypted processing result to the client node specifically includes:

[0152] The SGX secure area sends the encrypted processing result E(r) and the second signature information Sign[E(r)] to the SGX untrusted execution environment;

[0153] The SGX untrusted execution environment sends the encrypted processing result E(r) and the second signature information Sign[E(r)] to the client node.

[0154] In some embodiments, after sending the encrypted processing result to the client node, the method further includes:

[0155] The client node verifies whether the second signature information Sign[E(r)] is correct according to the second public key EnPubK;

[0156] When the second signature information Sign[E(r)] is correct, the client node decrypts the encrypted processing result E(r) according to the temporary session key SK to obtain the processing result r.

[0157] In the communication method of the blockchain system provided in the embodiment of the present application, the SGX security area encrypts the processing result r according to the temporary session key SK to obtain the encrypted processing result E(r), and signs the encrypted processing result E(r) according to the second private key EnPriK to obtain the second signature information Sign[E(r)]. The authentication node sends the encrypted processing result E(r) to the client node while also sending the second signature information Sign[E(r)]. Subsequently, the client node can verify whether the second signature information Sign[E(r)] is correct, so that while encrypting the processing result to ensure the privacy of communication, the integrity of communication-related information can be guaranteed, thereby preventing the processing result from being attacked during the communication process, and further improving the security and correctness of communication between the client node and the authentication node.

[0158] Next, we take the client node generating a random number as a temporary session key as an example to illustrate the communication process between the client node and the authentication node. Figure 3 Shown, including:

[0159] S301, the client node generates a random number as a temporary session key SK;

[0160] S302: The client node encrypts the verification information according to the temporary session key SK to obtain encrypted verification information E(p);

[0161] S303. The client node encrypts the temporary session key SK according to the second public key EnPubK to obtain an encrypted temporary session key E(SK);

[0162] S304. The client node signs the encrypted verification information E(p) according to the first private key PriK to obtain first signature information Sign[E(p)];

[0163] S305. The client node sends the encrypted verification information E(p), the encrypted temporary session key E(SK), and the first signature information Sign[E(p)] to the authentication node based on the SGX application;

[0164] S306. The SGX untrusted execution environment sends {E(p), E(SK), Sign[E(p)]} to the SGX secure area through the ECALL interface.

[0165] S307, the SGX security area verifies whether the first signature information Sign[E(p)] is correct according to the first public key PubK;

[0166] S308. When the first signature information Sign[E(p)] is correct, the SGX secure area extracts the temporary session key SK from the encrypted temporary session key E(SK) according to the second private key EnPriK;

[0167] S309. The SGX secure area decrypts the encrypted verification information E(p) carried in the verification request according to the temporary session key SK to obtain the verification information including the key information payload.

[0168] S310, the SGX secure area executes the key code of the smart contract, processes the verification information including the key information payload, and obtains the processing result r;

[0169] S311. The SGX secure area encrypts the processing result r according to the temporary session key SK to obtain the encrypted processing result E(r);

[0170] S312. The SGX secure area signs the encrypted processing result E(r) according to the second private key EnPriK to obtain second signature information Sign[E(r)];

[0171] S313, the SGX secure area sends the encrypted processing result E(r) and the second signature information Sign[E(r)] to the SGX untrusted execution environment;

[0172] S314. The SGX untrusted execution environment sends the encrypted processing result E(r) and the second signature information Sign[E(r)] to the client node;

[0173] S315. The client node verifies whether the second signature information Sign[E(r)] is correct according to the second public key EnPubK;

[0174] S316. When the second signature information Sign[E(r)] is correct, the client node decrypts the encrypted processing result E(r) according to the temporary session key SK to obtain the processing result r.

[0175] It should be noted that, in a specific implementation, if the SGX secure enclave incorrectly verifies the first signature information Sign[E(p)] based on the first public key PubK, an error message is sent to the client node. If the client node incorrectly verifies the second signature information Sign[E(r)] based on the second public key EnPubK, an error message is returned to the verification node.

[0176] In some embodiments, the blockchain system further includes: a first node and a second node; after the SGX secure area processes the verification information according to the smart contract, obtains the processing result, and encrypts the processing result, it further includes:

[0177] The SGX secure area stores the processing results;

[0178] The first node and the second node send a processing result acquisition request to the authentication node based on the SGX application;

[0179] The authentication node based on the SGX application sends the processing result to the first node and the second node according to the processing result acquisition request.

[0180] In some embodiments, the blockchain is a consortium blockchain. In a specific implementation, the first node is a peer node, which includes an endorsement node and a submission node. The second node is a sorting node.

[0181] It should be noted that, taking transactions as an example, in related technologies, transaction entries can only be added to the blockchain ledger after each node in the consortium chain network reaches a consensus on the verification information related to the transaction. This will cause significant delays in the system, thereby affecting the overall throughput of the consortium chain.

[0182] The communication method of the blockchain system provided in the embodiment of the present application can obtain the processing results stored in the SGX security area of the authentication node from the first node and the second node other than the client node. The first node and the second node do not need to re-verify the verification information related to the transaction with the authentication node, thereby reducing the number of verifications of the verification information related to the blockchain system transaction, reducing the transaction delay of the blockchain system, and improving the throughput of the blockchain system.

[0183] Based on the same inventive concept, the present application also provides a blockchain system, such as Figure 4 As shown, it includes: a client node 1 and an authentication node 2 based on software protection extension SGX application;

[0184] Client node 1 includes:

[0185] The first sending and receiving module 11 is used to: send a verification request to the authentication node based on the SGX application, wherein the verification request includes encrypted verification information; and receive the encrypted processing result sent by the authentication node based on the SGX application;

[0186] The authentication node 2 based on the SGX application includes: an SGX untrusted execution environment 21 and an SGX trusted execution environment 22; the SGX trusted execution environment 22 includes: an SGX secure area 221; the SGX secure area 221 includes:

[0187] A smart contract storage module 2211, configured to store at least part of a smart contract;

[0188] The first encryption / decryption module 2212 is configured to: receive a verification request, decrypt the encrypted verification information carried in the verification request, and obtain the decrypted verification information;

[0189] Information processing module 2213, used to: process verification information according to the smart contract, obtain processing results, and encrypt the processing results;

[0190] The second sending and receiving module 2214 is used to send the encrypted processing result.

[0191] The blockchain system provided by the embodiments of this application encapsulates at least part of the smart contract in the SGX secure enclave, thereby preventing tampering with the smart contract and interference with the verification process of verification information using the smart contract. This ensures the integrity of the key code of the smart contract and the security, correctness, and privacy of the smart contract execution process, thereby enhancing the robustness of the blockchain. Furthermore, the verification information is loaded into the SGX secure enclave via a secure communication protocol, ensuring the privacy of its transmission and verification process.

[0192] In specific implementation, the smart contract storage module stores at least part of the smart contract, for example, the key code of the smart contract. The key code needs to include code that can verify the verification information, such as key instructions such as modifying data assets. This can ensure the minimum trust base of the blockchain system. The SGX untrusted execution environment deploys low-security code that does not require protection to connect the client node with the SGX trusted execution environment. In specific implementation, such as Figure 4 As shown, the interaction between the SGX trusted execution environment 22 and the SGX untrusted execution environment 21 is performed through the interface functions ECALL and OCALL.

[0193] In some embodiments, the client node further comprises:

[0194] A first key generation module is configured to generate and store a first public-private key pair; the first public-private key pair includes a first public key and a first private key;

[0195] The first sending and receiving module is further used to: send a registration request, the first client identity information, and the first public key to the authentication node based on the SGX application;

[0196] The SGX untrusted execution environment includes: a first identity information generation module, a third sending and receiving module;

[0197] The SGX security area further includes: a second key generation module, and a first storage module;

[0198] The second key generation module is used to: generate and save a second public-private key pair; the second public-private key pair includes a second public key and a second private key;

[0199] The first identity information generation module is configured to: execute a preset client registration function, generate first identity information according to the first client identity information, and send the first identity information, the first client identity information, and the first public key to the SGX trusted execution environment;

[0200] The first storage module is used to: store the first client identity information and the first public key;

[0201] The second sending and receiving module is further used to: send the second public key to the third sending and receiving module;

[0202] The third sending and receiving module is used to: generate registration success information, and send the registration success information and the second public key to the client node;

[0203] The first sending and receiving module is further used to receive registration success information and the second public key.

[0204] In the blockchain system provided by the embodiments of the present application, the client node and the authentication node each generate a public-private key pair. The client node and the authentication node exchange public keys to encrypt information involved in the subsequent communication process. This ensures the privacy and security of the communication process between the client node and the authentication node.

[0205] In some embodiments, the first key generation module is further configured to: generate a temporary session key;

[0206] The client node also includes:

[0207] The second encryption and decryption module is configured to: encrypt the verification information according to the temporary session key to obtain the encrypted verification information; encrypt the temporary session key according to the second public key to obtain the encrypted temporary session key; and sign the encrypted verification information according to the first private key to obtain the first signature information;

[0208] The first sending and receiving module is specifically used to send encrypted verification information, encrypted temporary session key and first signature information to the authentication node based on the SGX application.

[0209] During specific implementation, the first key generation module generates a random number as a temporary session key.

[0210] In the blockchain system provided in the embodiments of the present application, in addition to using the first public-private key pair and the second public-private key pair for encryption, the client node also generates a temporary session key, that is, a new key is generated for each communication. Using the temporary session key to encrypt communication-related information can further improve the security of communication between the client node and the authentication node. The client node encrypts verification information using the temporary session key pair to obtain encrypted verification information, and then encrypts the temporary session key using the second public key, thereby ensuring the privacy of communication between the client node and the authentication node. Furthermore, the client node also signs the encrypted verification information using the first private key to obtain first signature information, and sends the first signature information to the authentication node so that the authentication node can subsequently verify the correctness of the first signature information. This ensures the integrity of communication-related information between the client node and the authentication node, prevents attacks on the verification information during the communication process, and further improves the security and correctness of communication between the client node and the authentication node.

[0211] In some embodiments, the third sending and receiving module is further used to: send the encrypted verification information, the encrypted temporary session key, and the first signature information to the SGX secure area in the SGX trusted execution environment;

[0212] The SGX security area further includes: a verification module, configured to verify whether the first signature information is correct according to the first public key;

[0213] The first encryption and decryption module is specifically used to decrypt the encrypted verification information carried in the verification request when the first signature information is correct.

[0214] In some embodiments, the first encryption / decryption module is used to decrypt the encrypted verification information carried in the verification request, specifically including:

[0215] A temporary session key is extracted from the encrypted temporary session key according to the second private key, and the encrypted verification information is decrypted according to the temporary session key.

[0216] In some embodiments, the first encryption and decryption module is used to encrypt the processing result, specifically including:

[0217] Encrypting the processing result according to the temporary session key to obtain the encrypted processing result;

[0218] The encrypted processing result is signed according to the second private key to obtain second signature information.

[0219] In some embodiments, the second sending and receiving module is used to send the encrypted processing result, specifically including:

[0220] Sending the encrypted processing result and the second signature information to the third sending and receiving module;

[0221] The third sending and receiving module is further used to send the encrypted processing result and the second signature information to the client node.

[0222] In some embodiments, the first sending and receiving module is used to receive the encrypted processing result sent by the authentication node based on the SGX application, specifically including: receiving the encrypted processing result and the second signature information;

[0223] The second encryption and decryption module is further used to: verify whether the second signature information is correct according to the second public key; when the second signature information is correct, the client node decrypts the encrypted processing result according to the temporary session key to obtain the processing result.

[0224] In the blockchain system provided by the embodiment of the present application, the SGX security area encrypts the processing result according to the temporary session key to obtain an encrypted processing result, and signs the encrypted processing result according to the second private key to obtain second signature information. The authentication node sends the encrypted processing result to the client node while also sending the second signature information. The client node can subsequently verify whether the second signature information is correct. Therefore, while encrypting the processing result to ensure the privacy of communication, the integrity of communication-related information can be ensured, thereby preventing the processing result from being attacked during the communication process, and further improving the security and correctness of communication between the client node and the authentication node.

[0225] In some embodiments, the first storage module is further configured to store processing results;

[0226] The blockchain system also includes: a first node and a second node;

[0227] The first node includes: a fourth sending and receiving module;

[0228] The second node includes: a fifth sending and receiving module;

[0229] The fourth sending and receiving module and the fifth sending and receiving module are both used to send a processing result acquisition request to the authentication node based on the SGX application;

[0230] The second sending and receiving module is further configured to: send the processing result to the first node and the second node respectively according to the processing result acquisition request;

[0231] The fourth sending and receiving module and the fifth sending and receiving module are both used to receive processing results.

[0232] In some embodiments, the blockchain is a consortium blockchain. In a specific implementation, the first node is a peer node, which includes an endorsement node and a submission node. The second node is a sorting node.

[0233] The blockchain system provided by the embodiment of the present application can directly obtain the processing results stored by the authentication node for the first node and the second node other than the client node. The first node and the second node do not need to re-verify the verification information related to the transaction with the authentication node, thereby reducing the number of verifications of the verification information related to the blockchain system transaction, reducing the transaction delay of the blockchain system, and improving the throughput of the blockchain system.

[0234] The present application provides a blockchain system, such as Figure 5 Shown, including:

[0235] One or more processors 3;

[0236] a storage device 4 for storing one or more programs;

[0237] When one or more programs are executed by one or more processors, the one or more processors implement the communication method of the blockchain system provided in the embodiments of the present application.

[0238] The processor may be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, and may implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the method disclosed in conjunction with the embodiments of the present application may be directly embodied as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0239] The storage device is, for example, a memory, and the memory is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs, and modules. The memory may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (ReadOnly Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, and the like. The memory is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The storage device in the embodiment of the present application may also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0240] Those skilled in the art will appreciate that all or part of the steps of the above-mentioned method embodiments may be implemented by hardware associated with program instructions, and the aforementioned program may be stored in a computer-readable storage medium. When the program is executed, the program executes the steps of the above-mentioned method embodiments. The above-mentioned computer storage medium may be any available medium or data storage device that can be accessed by a computer, including but not limited to: mobile storage devices, random access memory (RAM), magnetic storage (such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc.), optical storage (such as CDs, DVDs, BDs, HVDs, etc.), and semiconductor storage (such as ROMs, EPROMs, EEPROMs, non-volatile memories (NAND FLASH), solid-state drives (SSDs)), and other media that can store program codes.

[0241] Alternatively, if the above-mentioned integrated unit of the present application is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for making a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes: a mobile storage device, a random access memory (RAM, Random Access Memory), a magnetic storage device (such as a floppy disk, a hard disk, a magnetic tape, a magneto-optical disk (MO), etc.), an optical storage device (such as a CD, DVD, BD, HVD, etc.), and a semiconductor memory (such as a ROM, EPROM, EEPROM, a non-volatile memory (NAND FLASH), a solid-state drive (SSD)) and other various media that can store program code.

[0242] In some possible implementations, various aspects of the methods provided herein may also be implemented in the form of a program product, which includes program code. When the program product is executed on a computer device, the program code is used to cause the computer device to perform the steps of the methods according to the various exemplary embodiments of the present disclosure described above. For example, the computer device may perform the communication method of the blockchain system described in the embodiments of the present disclosure. The program product may be implemented in any combination of one or more readable media.

[0243] In summary, the blockchain system and its communication method, computer-readable storage medium, and computer program product provided by the embodiments of the present application encapsulate at least a portion of the smart contract in the SGX secure enclave, thereby preventing tampering with the smart contract and interference with the verification process of verification information using the smart contract. This ensures the integrity of the smart contract's key code and the security, correctness, and privacy of the smart contract execution process, thereby enhancing the robustness of the blockchain system. Furthermore, verification information is loaded into the SGX secure enclave via a secure communication protocol, ensuring the privacy of its transmission and verification process.

[0244] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage and optical storage, etc.) that contain computer-usable program code.

[0245] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0246] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0247] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0248] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0249] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A communication method for a blockchain system, characterized in that: The blockchain system includes a client node and an authentication node based on a software protection extension SGX application, and the method includes: The client node sends a verification request to an authentication node based on an SGX application; wherein the verification request includes encrypted verification information; the authentication node based on the SGX application includes an SGX untrusted execution environment and an SGX trusted execution environment; the SGX trusted execution environment includes an SGX secure area; The SGX security area decrypts the encrypted verification information carried in the verification request to obtain the decrypted verification information; wherein the SGX security area stores at least part of the smart contract; The SGX secure area processes the verification information according to the smart contract, obtains a processing result, encrypts the processing result, and sends the encrypted processing result to the client node; Before the client node sends a verification request to the authentication node based on the SGX application, the method further includes: The client node generates and stores a first public-private key pair; the first public-private key pair includes a first public key and a first private key; The SGX application-based authentication node generates and stores a second public-private key pair within the SGX secure area; the second public-private key pair includes a second public key and a second private key; The client node sends a registration request, first client identity information, and the first public key to the SGX application-based authentication node; The SGX untrusted execution environment executes a preset client registration function, generates first identity information according to the first client identity information, and sends the first identity information, the first client identity information, and the first public key to the SGX trusted execution environment; The SGX security area stores the first client identity information and the first public key, and sends the second public key to the SGX untrusted execution environment; The SGX untrusted execution environment sends a registration success message and the second public key to the client node; The client node stores the second public key; The blockchain system further includes: a first node and a second node; the SGX security area processes the verification information according to the smart contract, obtains a processing result, and encrypts the processing result, and further includes: The SGX security area stores the processing result; The first node and the second node send a processing result acquisition request to the authentication node based on the SGX application; The SGX application-based authentication node sends the processing result to the first node and the second node according to the processing result acquisition request.

2. The method according to claim 1, characterized in that Before the client node sends a verification request to the authentication node based on the software protection extension SGX application, the method further includes: The client node generates a temporary session key; The client node encrypts the verification information according to the temporary session key to obtain the encrypted verification information; The client node encrypts the temporary session key according to the second public key to obtain the encrypted temporary session key; The client node signs the encrypted verification information according to the first private key to obtain first signature information; The client node sends a verification request to the authentication node based on the software protection extension SGX application, specifically including: The client node sends the encrypted verification information, the encrypted temporary session key, and the first signature information to the SGX application-based authentication node.

3. The method according to claim 2, characterized in that The SGX secure area decrypts the encrypted verification information carried in the verification request, and before obtaining the decrypted verification information, the method further includes: The SGX untrusted execution environment sends the verification request to the SGX secure area in the SGX trusted execution environment; Verifying, by the SGX security area, whether the first signature information is correct according to the first public key; When the first signature information is correct, the SGX security area decrypts the encrypted verification information carried in the verification request.

4. The method according to claim 3, characterized in that The SGX security area decrypts the encrypted verification information carried in the verification request, specifically including: The SGX secure area extracts the temporary session key from the encrypted temporary session key according to the second private key; The SGX secure area decrypts the encrypted verification information according to the temporary session key.

5. The method according to claim 4, characterized in that Encrypting the processing result specifically includes: The SGX secure area encrypts the processing result according to the temporary session key to obtain the encrypted processing result; The SGX security area signs the encrypted processing result according to the second private key to obtain second signature information.

6. The method according to claim 5, characterized in that Sending the encrypted processing result to the client node specifically includes: The SGX secure area sends the encrypted processing result and the second signature information to the SGX untrusted execution environment; The SGX untrusted execution environment sends the encrypted processing result and the second signature information to the client node.

7. The method according to claim 6, characterized in that After sending the encrypted processing result to the client node, the method further includes: Verifying, by the client node, whether the second signature information is correct according to the second public key; When the second signature information is correct, the client node decrypts the encrypted processing result according to the temporary session key to obtain the processing result.

8. A blockchain system, characterized in that: include: Client nodes and authentication nodes based on software protection extensions for SGX applications; The client node includes: A first sending and receiving module is configured to: send a verification request to the authentication node based on the SGX application, wherein the verification request includes encrypted verification information; and receive an encrypted processing result sent by the authentication node based on the SGX application; The authentication node based on the SGX application includes: an SGX untrusted execution environment and an SGX trusted execution environment; the SGX trusted execution environment includes: an SGX secure area; the SGX secure area includes: A smart contract storage module, configured to store at least part of the smart contract; A first encryption and decryption module is configured to: receive the verification request, decrypt the encrypted verification information carried in the verification request, and obtain decrypted verification information; An information processing module, configured to: process the verification information according to the smart contract, obtain a processing result, and encrypt the processing result; A second sending and receiving module, used for sending the encrypted processing result; The client node also includes: A first key generation module, configured to generate and store a first public-private key pair; the first public-private key pair includes a first public key and a first private key; The first sending and receiving module is further used to: send a registration request, first client identity information, and the first public key to the authentication node based on the SGX application; The SGX untrusted execution environment includes: a first identity information generation module, a third sending and receiving module; The SGX security area further includes: a second key generation module, and a first storage module; The second key generation module is used to: generate and save a second public-private key pair; the second public-private key pair includes a second public key and a second private key; The first identity information generation module is configured to: execute a preset client registration function, generate first identity information according to the first client identity information, and send the first identity information, the first client identity information, and the first public key to the SGX trusted execution environment; The first storage module is used to: store the first client identity information and the first public key; The second sending and receiving module is further used to: send the second public key to the third sending and receiving module; The third sending and receiving module is used to: generate registration success information, and send the registration success information and the second public key to the client node; The first sending and receiving module is further used to: receive the registration success information and the second public key; The first storage module is further configured to store the processing result; The blockchain system further includes: a first node and a second node; The first node includes: a fourth sending and receiving module; The second node includes: a fifth sending and receiving module; The fourth sending and receiving module and the fifth sending and receiving module are both used to send a processing result acquisition request to the authentication node based on the SGX application; The second sending and receiving module is further configured to: send the processing result to the first node and the second node respectively according to the processing result acquisition request; The fourth sending and receiving module and the fifth sending and receiving module are both further configured to receive the processing result.

9. The blockchain system according to claim 8, characterized in that: The first key generation module is further used to: generate a temporary session key; The client node also includes: a second encryption / decryption module configured to: encrypt the verification information according to the temporary session key to obtain the encrypted verification information; encrypt the temporary session key according to the second public key to obtain the encrypted temporary session key; and sign the encrypted verification information according to the first private key to obtain first signature information; The first sending and receiving module is specifically used to send the encrypted verification information, the encrypted temporary session key and the first signature information to the authentication node based on the SGX application.

10. The blockchain system according to claim 9, characterized in that: The third sending and receiving module is further configured to: send the encrypted verification information, the encrypted temporary session key, and the first signature information to the SGX secure area in the SGX trusted execution environment; The SGX security area further includes: a verification module, configured to verify whether the first signature information is correct according to the first public key; The first encryption and decryption module is specifically configured to decrypt the encrypted verification information carried in the verification request when the first signature information is correct.

11. The blockchain system according to claim 10, characterized in that: The first encryption / decryption module is configured to decrypt the encrypted verification information carried in the verification request, specifically including: The temporary session key is extracted from the encrypted temporary session key according to the second private key, and the encrypted verification information is decrypted according to the temporary session key.

12. The blockchain system according to claim 11, characterized in that: The first encryption and decryption module is used to encrypt the processing result, specifically including: Encrypting the processing result according to the temporary session key to obtain the encrypted processing result; The encrypted processing result is signed according to the second private key to obtain second signature information.

13. The blockchain system according to claim 12, characterized in that: The second sending and receiving module is used to send the encrypted processing result, specifically including: Sending the encrypted processing result and the second signature information to the third sending and receiving module; The third sending and receiving module is further configured to send the encrypted processing result and the second signature information to the client node.

14. The blockchain system according to claim 13, wherein: The first sending and receiving module is used to receive the encrypted processing result sent by the authentication node based on the SGX application, specifically including: receiving the encrypted processing result and the second signature information; The second encryption and decryption module is further used to: verify whether the second signature information is correct according to the second public key; when the second signature information is correct, the client node decrypts the encrypted processing result according to the temporary session key to obtain the processing result.

15. A blockchain system, characterized in that: include: one or more processors; a storage device for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the communication method of the blockchain system according to any one of claims 1 to 7.

16. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the communication method of the blockchain system according to any one of claims 1 to 7 is implemented.

17. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the communication method of the blockchain system according to any one of claims 1 to 7 is implemented.

Images