A blockchain-based data processing method, device, and readable storage medium

Abstract

The application discloses a kind of data processing method, equipment and readable storage medium based on blockchain, the method comprises: obtaining service processing request;Target application includes secret key management development component;Secret key management development component includes ordinary execution environment and trusted execution environment;When the service type of service processing request belongs to trusted service type, in ordinary execution environment, call the trusted function interface associated with service processing request in secret key management development component, pass service processing request to trusted execution environment by the transfer function corresponding to trusted function interface;In trusted execution environment, the trusted processing data carried by service processing request is carried out trusted processing, and trusted result is obtained, and trusted result is returned to ordinary execution environment by the callback function corresponding to trusted function interface;In ordinary execution environment, according to trusted result, service processing is carried out. By the application, the accuracy and legality of trusted result can be improved.

Description

Technical Field

[0001] This application relates to the field of Internet technology, and in particular to a data processing method, device and readable storage medium based on blockchain. Background Technology

[0002] Due to its decentralized and immutable characteristics, blockchain technology can effectively guarantee the authenticity and security of on-chain data. Therefore, with the rapid development of network technology, governments and enterprises are increasingly strengthening the application of blockchain.

[0003] Currently, to ensure the legitimacy and anti-counterfeiting properties of data in a blockchain network, blockchain nodes perform business processing on the data. For example, blockchain node A uses its private key to sign the data to be uploaded to the blockchain and broadcasts the data carrying the signature information to blockchain node B. Blockchain node B verifies the legitimacy of both the blockchain node and the data to be uploaded using the signature information. However, because private keys can be leaked, the legitimacy of blockchain node A cannot be guaranteed, and consequently, the accuracy of the data to be uploaded to the blockchain network cannot be guaranteed. Summary of the Invention

[0004] This application provides a blockchain-based data processing method, device, and readable storage medium, which can improve the accuracy and legitimacy of reliable results.

[0005] This application provides a blockchain-based data processing method, including:

[0006] Obtain the business processing request corresponding to the target application in a normal execution environment; the target application includes a key management development component; the key management development component includes a normal execution environment and a trusted execution environment;

[0007] When the business type of the business processing request belongs to the trusted business type, in the normal execution environment, the trusted function interface associated with the business processing request in the key management development component is called, and the business processing request is passed to the trusted execution environment through the corresponding transfer function of the trusted function interface;

[0008] In a trusted execution environment, trusted processing is performed on the data to be trusted to be processed carried in the business processing request to obtain trusted results. The trusted results are then returned to the normal execution environment through the callback function corresponding to the trusted function interface.

[0009] In a normal execution environment, business processes associated with the blockchain network are performed based on trusted results.

[0010] One embodiment of this application provides a blockchain-based data processing device, including:

[0011] The first acquisition module is used to acquire the business processing request corresponding to the target application in a normal execution environment; the target application includes a key management development component; the key management development component includes a normal execution environment and a trusted execution environment;

[0012] The request passing module is used to pass the business processing request to the trusted execution environment in the normal execution environment when the business type of the business processing request belongs to the trusted business type. It calls the trusted function interface associated with the business processing request in the key management development component and passes the business processing request to the trusted execution environment through the passing function corresponding to the trusted function interface.

[0013] The result callback module is used in a trusted execution environment to perform trusted processing on the data to be trusted in the business processing request, obtain trusted results, and return the trusted results to the normal execution environment through the callback function corresponding to the trusted function interface.

[0014] The business processing module is used to perform business processing related to the blockchain network based on trusted results in a normal execution environment.

[0015] The blockchain-based data processing device also includes:

[0016] The second acquisition module is used to acquire the business type of the business processing request and the trusted processing file in the key management development component in a normal execution environment; the trusted processing file includes the business type corresponding to the trusted processing business provided by the trusted execution environment;

[0017] The type comparison module is used to compare the business type of the business processing request with the business type in the trusted processing file;

[0018] The type determination module is used to determine that the business type of the business processing request belongs to the ordinary business type if there is no business type in the trusted processing file that is the same as the business type of the business processing request.

[0019] The type determination module is also used to determine that the business type of the business processing request belongs to a trusted business type if there is a business type in the trusted processing file that is the same as the business type of the business processing request.

[0020] The business processing request includes a first business processing request, which is used to request the generation of a key pair corresponding to the trusted execution environment.

[0021] The result callback module includes:

[0022] The first acquisition unit is used to acquire the private key generation function according to the first business processing request in a trusted execution environment;

[0023] The first determining unit is used to execute a private key generation function based on the data to be trusted for processing, generate a private key corresponding to the trusted execution environment through the private key generation function, and generate a public key corresponding to the trusted execution environment based on the private key corresponding to the trusted execution environment.

[0024] The first determining unit is further configured to determine the private key and the public key corresponding to the trusted execution environment as the key pair corresponding to the trusted execution environment;

[0025] The first determining unit is also used to determine the successful storage result as a trusted result when the key pair corresponding to the trusted execution environment is successfully stored.

[0026] The result callback module includes:

[0027] The second acquisition unit is used to acquire the encrypted private key file and the private key corresponding to the trusted execution environment in the trusted execution environment.

[0028] The second acquisition unit is also used to decrypt the ciphertext private key file using the private key corresponding to the trusted execution environment to obtain the plaintext private key file;

[0029] The third acquisition unit is used to acquire the first target private key from the plaintext private key file according to the business type of the business processing request;

[0030] The third acquisition unit is also used to perform trusted processing on the data to be trusted based on the first target private key, and obtain a trusted result.

[0031] The business processing request carries the target private key identifier;

[0032] The result callback module includes:

[0033] The fourth acquisition unit is used to acquire an index key-value table in a trusted execution environment; the index key-value table includes index keys generated with a private key identifier and index values ​​generated with a private key.

[0034] The second determining unit is used to match the target private key identifier with the index key in the index key value table, and determine the index value corresponding to the index key including the target index identifier as the target index value;

[0035] The second determining unit is also used to determine the private key in the target index value as the second target private key, and perform trust processing on the data to be trusted based on the second target private key to obtain a trustworthy result.

[0036] The business processing request includes a second business processing request, which is used to request the signature of the data to be processed.

[0037] The result callback module includes:

[0038] The third determining unit is used to obtain the private key corresponding to the target application in the trusted execution environment, sign the data to be trusted to be processed using the private key corresponding to the target application, obtain the signature information, and determine the data to be trusted to be processed carrying the signature information as a trusted result.

[0039] The business processing module is specifically used to broadcast the data to be trusted and processed, carrying signature information, to the blockchain network in a normal execution environment, so that the blockchain network can determine the legitimacy of the data to be trusted and processed based on the signature information.

[0040] Among them, the business processing request includes a third business processing request, which is used to request the encrypted storage of the data to be processed in a trusted manner that has passed consensus in the blockchain network.

[0041] The result callback module includes:

[0042] The fifth acquisition unit is used to acquire the disk public key corresponding to the target application in the trusted execution environment, and to encrypt the data to be trusted for processing using the disk public key corresponding to the target application to obtain ciphertext data.

[0043] The fourth determining unit is used to determine the successful storage result as a trusted result when the encrypted data is successfully stored at the trusted address corresponding to the trusted execution environment.

[0044] The blockchain-based data processing device also includes:

[0045] The third acquisition module is used to acquire a trusted memory instruction library; the trusted memory instruction library includes input hardware instructions, output hardware instructions, and key management logic instructions for running in a trusted execution environment;

[0046] The first generation module is used to generate a transfer function based on the input hardware instructions and a callback function based on the output hardware instructions.

[0047] The second generation module is used to generate glue functions between pass functions and callback functions through a trusted memory instruction library;

[0048] The fourth acquisition module is used to acquire the general function interface according to the key management logic instructions; the general function interface includes the trusted function interface;

[0049] The third generation module is used to generate key management development components based on key management logic instructions, general function interfaces, glue functions, transfer functions, and callback functions, and compile the key management development components into the target application.

[0050] The third generation module includes:

[0051] The fifth determining unit is used to determine the key management logic instructions as trusted programs; the trusted programs run in a trusted execution environment;

[0052] The fifth determining unit is also used to determine the general function interface as a normal program; the normal program runs in a normal execution environment;

[0053] The component generation unit is used to encapsulate glue functions, pass functions, callback functions, trusted programs, and ordinary programs to obtain key management development components.

[0054] The component generation unit includes:

[0055] The first generation subunit is used to encapsulate the glue function, the transfer function, the callback function, the trusted program, and the ordinary program to obtain the initial key management development component;

[0056] The second generation subunit is used to compile the initial key management development component if the programming language corresponding to the initial key management development component is the first programming language and the programming language corresponding to the blockchain node is a second programming language different from the first programming language, so as to obtain a key management development component with the programming language of the third programming language; the blockchain-based data processing device runs on the blockchain node.

[0057] This application provides a computer device, including: a processor, a memory, and a network interface;

[0058] The processor is connected to the memory and the network interface, wherein the network interface is used to provide data communication functions, the memory is used to store computer programs, and the processor is used to call the computer programs so that the computer device executes the methods in the embodiments of this application.

[0059] One aspect of this application provides a computer-readable storage medium storing a computer program adapted for loading by a processor and executing the methods described in this application.

[0060] One aspect of this application provides a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium; a processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the method described in this application.

[0061] In this embodiment, a blockchain node obtains a business processing request corresponding to a target application within a normal execution environment. The target application includes a key management development component, which comprises a normal execution environment and a trusted execution environment. Therefore, when the business type of the processing request is a trusted business type, in the normal execution environment, the blockchain node can call the trusted function interface associated with the business processing request in the key management development component. Furthermore, through the transfer function corresponding to the trusted function interface, the business processing request can be passed to the trusted execution environment. In the trusted execution environment, the data to be processed in the business processing request is processed in a trusted manner to obtain a trusted result. Furthermore, through the callback function corresponding to the trusted function interface, the trusted result can be returned to the normal execution environment. In the normal execution environment, business processing associated with the blockchain network can be performed based on the trusted result. As can be seen above, the target application in this embodiment includes a key management development component based on a trusted execution environment. Therefore, when running the target application, the blockchain node can efficiently and conveniently process the data to be processed in a trusted manner through the trusted execution environment in the key management development component to obtain a trusted result. Since trusted results are generated in a trusted execution environment, their accuracy and legitimacy can be improved. In addition, by developing components through key management, the target application does not need to know about the trusted execution environment, thus reducing the difficulty and complexity of using the trusted execution environment. Attached Figure Description

[0062] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0063] Figure 1 This is a schematic diagram of a system architecture provided in an embodiment of this application;

[0064] Figure 2 This is a schematic diagram of a data processing scenario based on blockchain provided in an embodiment of this application;

[0065] Figure 3 This is a flowchart illustrating a blockchain-based data processing method provided in an embodiment of this application;

[0066] Figure 4 This is a schematic diagram of the structure of a blockchain node provided in an embodiment of this application;

[0067] Figure 5 This is a schematic diagram of a data processing scenario based on blockchain provided in an embodiment of this application;

[0068] Figure 6 This is a flowchart illustrating a blockchain-based data processing method provided in an embodiment of this application;

[0069] Figure 7 This is a schematic diagram of the structure of a blockchain-based data processing device provided in an embodiment of this application;

[0070] Figure 8 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0071] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0072] To facilitate understanding, the following brief explanations are provided for some of the terms:

[0073] 1. Blockchain: In a narrow sense, blockchain is a chain-like data structure with blocks as the basic unit. Blocks use digital digests to verify previously obtained transaction history, making it suitable for the tamper-proof and scalable requirements of distributed ledger scenarios. In a broader sense, blockchain also refers to the distributed ledger technology implemented using the blockchain structure, including distributed consensus, privacy and security protection, peer-to-peer communication technology, network protocols, and smart contracts. The goal of blockchain is to implement a distributed data record ledger that only allows additions, not deletions. The underlying basic structure of the ledger is a linear linked list. The linked list consists of a series of "blocks," with each subsequent block recording the hash value of the previous block. The validity of each block (and the transactions within it) can be quickly verified by calculating the hash value. If a node in the network proposes to add a new block, the block must be confirmed through a consensus mechanism.

[0074] 2. Blockchain Nodes: Blockchain networks divide nodes into consensus nodes (also known as core nodes) and synchronization nodes (which can include data nodes and light nodes). Consensus nodes are responsible for the consensus process across the entire blockchain network; synchronization nodes are responsible for synchronizing the ledger information of the consensus nodes, i.e., synchronizing the latest block data. Both consensus and synchronization nodes include network communication components in their internal structure, because a blockchain network is essentially a peer-to-peer (P2P) network, requiring communication with other nodes in the blockchain network through P2P components. Resources and services in the blockchain network are distributed across various nodes; information transmission and service implementation occur directly between nodes, without the need for intermediaries or centralized servers (third parties).

[0075] 3. Public Key and Private Key: A public key and a private key are a key pair (one public key and one private key) obtained through an algorithm. The public key is the publicly known part of the key pair, while the private key is the private key. Public keys are typically used for encrypting data, verifying digital signatures, etc. This algorithm ensures that the resulting key pair is unique. When using this key pair, if data is encrypted with one key, it must be decrypted with the other key. For example, data encrypted with the public key must be decrypted with the private key, and vice versa; otherwise, decryption will fail.

[0076] 4. Block: A block is a data packet carrying transaction data on a blockchain network. It is a data structure marked with a timestamp and the hash value of the previous block. A block is verified and confirmed by the network's consensus mechanism. A block consists of a block header and a block body. The block header records the metadata of the current block, including the current version number, the hash value of the previous block, the timestamp, a random number, and the hash value of the Merkle root. The block body records detailed data generated over a period of time, including all verified transactions and other information generated during the block creation process; it can be understood as a form of ledger representation.

[0077] 5. Hash Value: Also known as an information feature value or characteristic value, a hash value is generated by converting input data of arbitrary length into cryptographic data and producing a fixed output using a hash algorithm. The original input data cannot be retrieved by decrypting the hash value; it is a one-way cryptographic function. In a blockchain, each block (except the initial block) contains the hash value of its predecessor block, which is called the parent block of the current block. The hash value is a core and crucial aspect of blockchain technology, preserving the authenticity of recorded and viewed data, as well as the integrity of the blockchain as a whole.

[0078] Please see Figure 1 , Figure 1 This is a schematic diagram of a system architecture provided in an embodiment of this application. For example... Figure 1 As shown, the system architecture can be a blockchain network, which may include a consensus network 101 and a synchronization network 102. Nodes in the synchronization network 102 can be called synchronization nodes. Synchronization nodes primarily perform business execution and do not participate in the accounting consensus process. They obtain block data from the consensus network 101 through identity authentication. The consensus network 101 can also be called the core network, and its nodes are called consensus nodes. Consensus nodes possess all the data. The consensus network 101 and the synchronization network 102 can reside in different network environments. Typically, the consensus network 101 is in a private network, while the synchronization network 102 is in a public network, and the two interact through routing boundaries.

[0079] It is understood that the consensus network 101 described above may include one or more consensus nodes; there is no limit to the number of consensus nodes here. Please see also Figure 1 Consensus network 101 may include consensus node 1011, consensus node 1012, ..., consensus node 1013.

[0080] It is understood that the aforementioned synchronization network 102 may include one or more synchronization nodes; the number of synchronization nodes will not be limited here. Please refer to [link to previous document]. Figure 1 The synchronization network 102 may include synchronization node 1021, synchronization node 1022, synchronization node 1023, ..., synchronization node 1024 and synchronization node 1025.

[0081] Each blockchain node (including the consensus node in consensus network 101 and the synchronization node in synchronization network 102) can receive transaction data sent by the client during normal operation, generate blocks based on the received transaction data, and then perform block on-chain processing. It is understood that in the specific embodiments of this application, data related to user information (such as data to be trusted for processing) is involved. When the embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use, and processing of related data must comply with the relevant laws, regulations, and standards of the relevant countries and regions.

[0082] To ensure data interoperability between blockchain nodes, data connections can exist between each blockchain node. For example, there is a data connection between consensus node 1011 and consensus node 1012, a data connection between consensus node 1011 and consensus node 1013, a data connection between synchronization node 1021 and synchronization node 1023, and so on. Furthermore, there are data connections between consensus network 101 and synchronization network 102, such as a data connection between consensus node 1011 and synchronization node 1022, a data connection between consensus node 1012 and synchronization node 1023, and so on.

[0083] It is understandable that blockchain nodes can transmit data or blocks through the aforementioned data connections. These data connections between blockchain nodes can be based on node identifiers. Each blockchain node in the network has a corresponding node identifier, and each node can store the node identifiers of other connected blockchain nodes. This allows the node to broadcast acquired data or generated blocks to other blockchain nodes based on their node identifiers. For example, consensus node 1011 can maintain a list of node identifiers, which stores the node names and identifiers of other blockchain nodes, as shown in Table 1.

[0084] Table 1

[0085] Node Name Node identifier Consensus Node 1012 117.114.151.174 Consensus Node 1013 117.116.189.145 … … Synchronization Node 1021 117.114.151.183 Synchronization Node 1022 117.116.189.125 Synchronization node 1023 119.250.485.362 … …

[0086] The node identifier can be an Internet Protocol (IP) address or any other information that can be used to identify a blockchain node in a blockchain network. Table 1 only uses IP addresses as an example.

[0087] Assuming the node identifier of consensus node 1011 is 117.116.156.425, then consensus node 1011 can send a data synchronization request to synchronization node 1021 through node identifier 117.114.151.183. Synchronization node 1021 can recognize that the data synchronization request was sent by consensus node 1011 through node identifier 117.116.156.425. Similarly, synchronization node 1023 can send transaction data A to consensus node 1011 through node identifier 117.116.156.425. Consensus node 1011 can recognize that transaction data A was sent by synchronization node 1023 through node identifier 119.250.485.362. Data transmission between other nodes is also in the same manner, so it will not be elaborated further.

[0088] It is understood that the above data connection is not limited to the connection method. It can be connected directly or indirectly through wired communication, or directly or indirectly through wireless communication, or through other connection methods. This application does not impose any restrictions on this.

[0089] Understandable, Figure 1 The blockchain nodes in the blockchain network include, but are not limited to, terminal devices or servers. Servers can be independent physical servers, server clusters or distributed systems composed of multiple physical servers, or cloud servers providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. Terminal devices include, but are not limited to, mobile phones, computers, smart voice interaction devices, smart home appliances, vehicle terminals, and aircraft. The terminal devices and servers can be connected directly or indirectly via wired or wireless means; this application embodiment does not impose any limitations on this.

[0090] Further, please see Figure 2 , Figure 2 This is a schematic diagram illustrating a blockchain-based data processing scenario provided in an embodiment of this application. For example... Figure 2 As shown, device object 20a and blockchain node 20b are bound together. This can also be understood as the user object corresponding to blockchain node 20b being device object 20a. Blockchain node 20b can be one of the aforementioned... Figure 1 Any blockchain node in the blockchain, such as consensus node 1012 or synchronization node 1021. Target applications run on this blockchain node 20b. These target applications may include, but are not limited to: social applications for issuing and reimbursing electronic invoices, resource management applications for raising public welfare resources, applications for managing electronic resources, and payment applications for purchasing goods, etc. A complete list of target applications running on blockchain node 20b will not be provided here.

[0091] The application implementation does not limit the type of the Central Processing Unit (CPU) architecture of the blockchain node 20b, as long as it has secure computing capabilities. When developing or upgrading the target application, developers can build a key management development component 20c based on the trusted memory instruction library provided by the CPU architecture (hardware platform), such as Software Guard Extensions (SGX) or a trustzone instruction library for protecting secure memory. This key management development component 20c is a key management software development kit (SDK). Its construction process and specific functions are not described here; please refer to the following text. Figure 6 Further, as described in the text, developers compile the key management development component 20c into the target application, and then release the target application carrying the key management development component 20c. When the target application is installed, the blockchain node 20b, based on the key management development component 20c, can create a trusted execution environment 20e and trusted memory belonging to the target application. The trusted execution environment, also known as Trusted Execution Environments (TEE), is a hardware-based technology for protecting data and algorithms. It is an isolated environment for the processor and memory; only the CPU can access programs running in encrypted memory. Access to the TEE by other layers (hardware, kernel, other applications) is blocked by the CPU.

[0092] like Figure 2 As shown, device object 20a can perform trigger operations on the target application on the display interface provided by blockchain node 20b. For example, in the normal execution environment 20d, device object 20a generates data to be processed through the target application. This embodiment does not limit the data to be processed and can be set according to the actual application scenario. Figure 2 The example uses transaction data. For this transaction data, device object 20a triggers the "confirm" control. At this time, blockchain node 20b, in the normal execution environment 20d, can obtain the business processing request corresponding to the target application. This embodiment does not limit the type of business processing request, including but not limited to data signature requests, data write-to-disk requests, and private key generation requests, which can be set according to the actual application scenario. For ease of description and understanding, the example business processing request in this embodiment is a data signature request (equivalent to the second business processing request described below), that is, a request to sign the aforementioned transaction data.

[0093] Please see again. Figure 2In the normal execution environment 20d, the blockchain node 20b determines the business type of the aforementioned data signature request. When the business type of the data signature request belongs to a trusted business type, the blockchain node 20b can determine that the aforementioned data to be processed (i.e., transaction data) is data to be trusted for processing. Furthermore, in the normal execution environment 20d, the blockchain node 20b calls the trusted function interface (e.g., signature function interface 20j) associated with the data signature request in the key management development component 20e, and transmits the data signature request carrying the transaction data (i.e., data to be trusted for processing) to the trusted execution environment 20e through the transfer function corresponding to the signature function interface 20j.

[0094] Please see again. Figure 2 In the Trusted Execution Environment 20e, blockchain node 20b obtains the encrypted private key file 20f. It is understood that the encrypted private key file 20f is generated by blockchain node 20b encrypting the plaintext private key file 20h using the public key corresponding to the Trusted Execution Environment 20e. The plaintext private key file 20h may include private keys associated with the target application, such as a private key for signing data (equivalent to the private key corresponding to the target application described below), a private key for decrypting encrypted data (equivalent to the disk-bound private key corresponding to the disk-bound public key described below), and a private key for managing smart contracts and operational permissions in the blockchain network (in which case blockchain node 20b has management permissions in the blockchain network). This embodiment does not limit the type and function of the private keys included in the plaintext private key file 20h; they can be set according to the actual application scenario. It is understood that, considering the special nature of the public key corresponding to the Trusted Execution Environment 20e, the public key corresponding to the Trusted Execution Environment 20e may not be publicly disclosed.

[0095] Furthermore, within the Trusted Execution Environment 20e, blockchain node 20b obtains the private key 20g corresponding to the Trusted Execution Environment 20e, such as... Figure 2 As shown, the encrypted private key file 20f is decrypted using the private key 20g corresponding to the trusted execution environment 20e to obtain the plaintext private key file 20h. As mentioned above, the business type of the business processing request is a signature type; therefore, the blockchain node 20b obtains the private key 201h corresponding to the target application from the plaintext private key file 20h. Based on the private key 201h corresponding to the target application, the blockchain node 20b signs the data to be processed (in this embodiment, transaction data) to obtain signature information 20i, and determines the transaction data carrying signature information 20i as a trusted result. Figure 2 As shown, through the callback function corresponding to the trusted function interface, blockchain node 20b returns the trusted result to the normal execution environment 20d.

[0096] like Figure 2 As shown, in the normal execution environment 20d, the blockchain node 20b will carry the data to be trusted for processing (such as signature information 20i) Figure 2 Example transaction data is broadcast to the blockchain network so that the blockchain network can determine the legitimacy of the data to be trusted for processing based on signature information 20i. It is understood that... Figure 2 The interfaces and controls shown are merely some forms of representation for reference. In actual business scenarios, developers can make relevant designs according to product requirements. This application does not limit the specific forms of the interfaces and controls involved.

[0097] In summary, the embodiments of this application have the following advantages: 1. Enhanced security: The target application is compiled with a key management development component that includes a trusted execution environment. This allows the blockchain node to build a trusted secure area at the hardware and software levels. With the authorization and consent of device object 20a, the data of device object 20a, as well as the algorithms used for data security protection, can be stored and executed in the TEE, thus effectively protecting data security. Furthermore, in the blockchain field, private keys associated with blockchain nodes can be managed through TEE technology, thus effectively improving the security of blockchain nodes. 2. Minimal performance loss: TEE has the characteristic of minimal performance loss. Data is encrypted in memory and decrypted and computed in the CPU. Due to the powerful computing capabilities of the CPU, the performance loss of TEE is relatively small. Additionally, because signing is performed locally on the blockchain node, the overhead of network calls can be avoided, reducing the waste of network resources. 3. Multi-platform adaptability: It is adaptable to platforms with trusted memory instruction libraries. 4. Scalability: Key management can be performed using secure computing on devices with secure computing capabilities.

[0098] Further, please see Figure 3 , Figure 3 This is a flowchart illustrating a blockchain-based data processing method provided in an embodiment of this application. This embodiment can be applied to various scenarios, including but not limited to cloud technology, artificial intelligence, smart transportation, and assisted driving. This blockchain-based data processing method can be implemented by blockchain nodes (including...) Figure 1 The synchronization nodes and consensus nodes in the process execute the commands. Figure 3 As shown, the blockchain-based data processing method may include at least the following steps S101-S104.

[0099] Step S101: Obtain the business processing request corresponding to the target application in the normal execution environment; the target application includes a key management development component; the key management development component includes a normal execution environment and a trusted execution environment.

[0100] In the normal execution environment, the business type of the business processing request is obtained, and the trusted processing file in the key management development component is obtained. The trusted processing file includes the business type corresponding to the trusted processing business provided by the trusted execution environment. The business type of the business processing request is compared with the business type in the trusted processing file. If there is no business type in the trusted processing file that is the same as the business type of the business processing request, it is determined that the business type of the business processing request belongs to the normal business type. If there is a business type in the trusted processing file that is the same as the business type of the business processing request, it is determined that the business type of the business processing request belongs to the trusted business type.

[0101] This application does not limit the type of target application; it can be installed on any hardware platform with secure computing capabilities. Therefore, it does not limit the type of business processing request and should be set according to the type of target application and the actual application scenario. The key management development component in this application is a key management software development kit based on a trusted execution environment (TEA). It can be compiled into the target application. In this case, the target application can be divided into two parts: a trusted part and an untrusted part. The trusted part can encrypt and store data and code requiring trusted protection, such as the private key associated with the target application. This private key associated with the target application can be managed in the trusted part. The private key associated with the target application does not leave the trusted part. The trusted part runs in a trusted execution environment. Therefore, applications outside the target application, operating systems (OS), and hardware other than the CPU cannot obtain the private key associated with the target application. Obviously, the trusted part can improve the security of the private key associated with the target application.

[0102] Trusted processing files are pre-described, during the generation of key management development components, of the trusted parts of the target application (including trusted functions, trusted interfaces, trusted business types, etc.). Untrusted parts can only access trusted parts through trusted processing files. Untrusted parts run in a normal execution environment. Applications other than the target application, operating systems (OS), and hardware other than the CPU can all access the normal execution environment. Therefore, the security of the normal execution environment is lower than that of the trusted execution environment.

[0103] The target application starts and runs in a normal execution environment. When a blockchain node receives a business processing request corresponding to the target application in the normal execution environment, the blockchain node first obtains the business type of the business processing request and then obtains the trusted processing file from the key management development component. The trusted processing file includes the business type corresponding to the trusted processing business provided by the trusted execution environment. It can be understood that the trusted processing business should be set according to the application type of the target application. For example, if the target application is a social application used for issuing and reimbursing electronic invoices, the trusted processing business may include the login business of the social application, the access business of data that needs to be securely protected in the social application, and the business of signing electronic invoices and reimbursement electronic invoices, etc. For example, if the target application is a payment application used for purchasing materials, the trusted processing business may include the login business of the payment application, the payment business, and the signing business of transaction data generated when purchasing materials, etc.

[0104] Furthermore, the blockchain node compares the business type of the business processing request with the business type in the trusted processing file. If there is no business type in the trusted processing file that is the same as the business type of the business processing request, then the business type of the business processing request is determined to be a normal business type. For example, in the payment application example above, the device object can view the logistics of the goods it purchased through the blockchain node. If there is a business type in the trusted processing file that is the same as the business type of the business processing request, then the business type of the business processing request is determined to be a trusted business type.

[0105] Step S102: When the business type of the business processing request belongs to the trusted business type, in the normal execution environment, the trusted function interface associated with the business processing request in the key management development component is called, and the business processing request is passed to the trusted execution environment through the transfer function corresponding to the trusted function interface.

[0106] As can be seen from step 1, the data and code in the target application can be divided into trusted and untrusted parts. The trusted part runs in a trusted execution environment. In this embodiment, the trusted part can initialize the key. After the private key associated with the target application is generated, it does not leave the encrypted memory corresponding to the trusted execution environment. Furthermore, the trusted part can provide a signature interface and a decryption interface.

[0107] The interaction between the untrusted and trusted components is achieved through special instructions (including pass functions and callback functions) provided by the trusted memory instruction library. For example, in SGX, the pass function can be implemented by the `ecall` function, and the callback function can be implemented by `ocall`. `ecall` and `ocall` are encapsulated in the SGX SDK. Based on the SGX SDK and its encapsulation capabilities, a key management development component (i.e., a key management software development kit, or key management SDK for short) including `ecall` and `ocall` is obtained. By embedding the key management SDK into the target application, blockchain nodes with the target application installed have key management capabilities. Please also refer to [link to relevant documentation]. Figure 4 , Figure 4 This is a schematic diagram of the structure of a blockchain node provided in an embodiment of this application. Figure 4 As shown, a blockchain node may include a Remote Procedure Call Protocol (RPC) interface, a P2P module, a smart contract module, a consensus module, a key management module, and a cryptographic algorithm module. The key management module integrates trusted computing capabilities and can securely manage private keys associated with the target application. This embodiment does not limit the type or purpose of the private keys associated with the target application; these can be set according to the actual application scenario. The key management module is a trusted component and has key management and key generation permissions.

[0108] The security of the Trusted Execution Environment (TEE) is achieved through CPU isolation of the execution environment. The CPU encrypts memory and provides new instructions specific to the TEE, thus isolating the environment. The TEE only allows the execution of non-privileged code, and therefore will not harm the system.

[0109] Step S103: In the trusted execution environment, the data to be trusted and processed carried by the business processing request is processed in a trusted manner to obtain a trusted result. The trusted result is then returned to the normal execution environment through the callback function corresponding to the trusted function interface.

[0110] Specifically, the business processing request includes a first business processing request, which requests the generation of a key pair corresponding to the trusted execution environment; in the trusted execution environment, a private key generation function is obtained according to the first business processing request; the private key generation function is executed according to the data to be trusted processed, and a private key corresponding to the trusted execution environment is generated through the private key generation function, and a public key corresponding to the trusted execution environment is generated based on the private key; the private key and the public key corresponding to the trusted execution environment are determined as the key pair corresponding to the trusted execution environment; when the key pair corresponding to the trusted execution environment is successfully stored, the successful storage result is determined as a trusted result.

[0111] Specifically, in the trusted execution environment, the encrypted private key file is obtained, and the private key corresponding to the trusted execution environment is obtained; the encrypted private key file is decrypted using the private key corresponding to the trusted execution environment to obtain the plaintext private key file; according to the business type of the business processing request, the first target private key is obtained from the plaintext private key file; and the trusted data to be trusted is processed using the first target private key to obtain a trusted result.

[0112] Specifically, the business processing request carries the target private key identifier; in the trusted execution environment, an index key-value table is obtained; the index key-value table includes index keys generated with the private key identifier and index values ​​generated with the private key; the target private key identifier is matched with the index keys in the index key-value table, and the index value corresponding to the index key including the target index identifier is determined as the target index value; the private key in the target index value is determined as the second target private key, and trusted processing is performed on the data to be trusted based on the second target private key to obtain a trusted result.

[0113] Specifically, the business processing request includes a second business processing request, which is used to request the signing of the data to be trusted for processing; in the trusted execution environment, the private key corresponding to the target application is obtained, and the data to be trusted for processing is signed using the private key corresponding to the target application to obtain the signature information, and the data to be trusted for processing carrying the signature information is determined as a trusted result.

[0114] Specifically, the business processing request includes a third business processing request, which requests the encrypted storage of data to be processed in the blockchain network that has passed consensus. In the trusted execution environment, the public key corresponding to the target application is obtained, and the data to be processed is encrypted using the public key corresponding to the target application to obtain ciphertext data. When the ciphertext data is successfully stored in the trusted address corresponding to the trusted execution environment, the successful storage result is determined as a trusted result.

[0115] Please see also Figure 5 , Figure 5 This is a schematic diagram illustrating a blockchain-based data processing scenario provided in an embodiment of this application. For example... Figure 5 As shown, device object 30a is bound to blockchain node 30b, wherein blockchain node 30b can be one of the aforementioned... Figure 1Any blockchain node in the system, such as consensus node 1012 or synchronization node 1021. Device object 30a can perform a trigger operation on the target application on the interface 301b provided by blockchain node 30b for registering the key pair corresponding to trusted execution environment 30f. For example, in a normal execution environment, device object 30a obtains data 302b to be trusted and processed in the target application. The data 302b to be trusted and processed includes first information (XXXXXXXXXXX) and second information (aa). It is understood that the first information and the second information should be set according to the actual application scenario. In this embodiment, the first information can be used to represent the mobile phone number of device object 30a, and the second information can represent the name of device object 30a. For the data 302b to be trusted and processed, device object 30a performs the operation of trigger determination control 303b. At this time, blockchain node 30b in a normal execution environment can obtain the first business processing request.

[0116] Please see again. Figure 5 In a normal execution environment, blockchain node 30b determines that the business type corresponding to the first business processing request belongs to a trusted business type. Therefore, in the normal execution environment, blockchain node 30b calls the trusted function interface (e.g., key generation function interface 30c) associated with the first business processing request in the key management development component. Through the transfer function corresponding to key generation function interface 30c, the first business processing request carrying the data 302b to be trusted processed is transmitted to the trusted execution environment 30f. In the trusted execution environment 30f, blockchain node 30b can obtain the private key generation function based on the first business processing request. Furthermore, it executes the private key generation function based on the data 302b to be trusted processed, that is, it inputs the data 302b to be trusted processed into the private key generation function. Furthermore, through the private key generation function, blockchain node 30b can generate the private key corresponding to the trusted execution environment 30f, such as... Figure 5 The example private key 301d can be used to generate the public key corresponding to the trusted execution environment 30f, such as... Figure 5 The example public key 302d; blockchain node 30b can transmit the private key corresponding to the trusted execution environment (such as...) Figure 5 The private key (301d) and the public key corresponding to the trusted execution environment (e.g., the public key of the trusted execution environment). Figure 5 The public key 302d is identified as the key pair corresponding to the trusted execution environment 30f. Further, the blockchain node 30b encrypts and stores the key pair corresponding to the trusted execution environment. Optionally, the private key 301d is encrypted and stored, and the public key 302d is broadcast to the outside. When the key pair corresponding to the trusted execution environment is successfully stored, the successful storage result is identified as a trusted result.

[0117] Figure 5This description uses the generation of a key pair corresponding to a trusted execution environment by blockchain node 30b as an example. It is understood that the blockchain node, through the key management development component in the target application, can locally generate a private key associated with the target application. This embodiment does not limit the private key associated with the target application; it can be set according to the actual application scenario. It is understood that the process by which the blockchain node locally generates a private key corresponding to the target application (e.g., a private key used for signing), generates a key pair corresponding to data storage, or generates a key pair that the blockchain node has management authority over in the blockchain network, is consistent with the process by which blockchain node 30b generates a key pair corresponding to the trusted execution environment; therefore, it will not be elaborated upon here.

[0118] Understandable, Figure 5 The interfaces and controls shown are merely some forms of representation for reference. In actual business scenarios, developers can make relevant designs according to product requirements. This application does not limit the specific forms of the interfaces and controls involved.

[0119] The above text Figure 2 The corresponding implementation describes how a blockchain node decrypts an encrypted private key file to obtain a first target private key (e.g., ...) associated with a business processing request. Figure 2 The example uses the private key 201h corresponding to the target application. Optionally, the private key associated with the target application is stored as a key-value pair. The following example illustrates the acquisition and application of the private key: A blockchain node generates a block to be agreed upon for the target application. Before broadcasting this block to the blockchain network, the blockchain node needs to sign it to prove its identity. Therefore, in a normal execution environment, the blockchain node can treat the block to be agreed upon as trusted processing data, generate a block signature request carrying the block to be agreed upon, and then call the transfer function associated with the signature function interface in the key management development component to pass the block signature request carrying the block to be agreed upon and the target private key identifier to the trusted execution environment. In the trusted execution environment, the blockchain node obtains an index key-value table, which includes an index key generated with the private key identifier and an index value generated with the private key.

[0120] Furthermore, the blockchain node matches the target private key identifier with the index key in the index key-value table. If no private key identifier matching the target private key identifier exists in the index key-value table, the target private key identifier is determined to be invalid. In this case, the blockchain node can refuse to sign the block to be reached for consensus and use the message indicating that the target private key identifier is invalid as a trusted result. The blockchain node calls the callback function of the signature function interface to return the trusted result to the normal execution environment, so that the blockchain node can obtain a valid private key identifier in the normal execution environment.

[0121] If a private key identifier identical to the target private key identifier exists in the index key of the index key value table, the blockchain node determines the index value corresponding to the index key including the target index identifier as the target index value, and then determines the private key in the target index value as the second target private key (this second target private key can be the private key corresponding to the target application, i.e., the private key used to sign data (including block or transaction data)). Based on the second target private key, the blockchain node performs trusted processing (i.e., signature processing) on ​​the data to be trusted (i.e., the block to be consensus), obtains the block signature information for the block to be consensus, determines the block to be consensus carrying the block signature information as a trusted result, calls the callback function of the signature function interface, and returns the trusted result to the normal execution environment. In step S104 below, the blockchain node broadcasts the block to be consensus carrying the block signature information to the blockchain network so that the blockchain network can determine the legitimacy of the block to be consensus based on the block signature information.

[0122] Step S104: In a normal execution environment, perform business processing associated with the blockchain network based on the trusted results.

[0123] Specifically, in a normal execution environment, the data to be trusted for processing, carrying signature information, is broadcast to the blockchain network so that the blockchain network can determine the legitimacy of the data to be trusted for processing based on the signature information.

[0124] Based on steps S101-S104, the key management development component in this embodiment can include two parts: a trusted part and an untrusted part. The trusted part implements key management, specifically encapsulating functions such as key initialization, key sealing (including encryption of the plaintext private key file and key-value pair storage), key desealing, data signing, and data decryption. The trusted part is computationally invisible to memory; the operating system and applications cannot directly access the corresponding data; only the CPU can see the plaintext data, thus protecting the security of the private key. The boundary between the trusted and untrusted parts is declared in the trusted processing file. The untrusted part passes the data to be signed or decrypted to the trusted part by calling a transfer function. The trusted part deseales the plaintext private key, performs the data signing or decryption operation, and passes the signed or decrypted result data back to the untrusted part through a callback function.

[0125] The technical solution provided in this application only requires devices that support TEE, which are basically available on modern CPUs. The security capabilities of TEE are encapsulated into a key management SDK, which enables secure key management on the local blockchain node, greatly reducing hardware costs and making it easy to use without affecting the distributed nature of the blockchain network.

[0126] In this embodiment, a blockchain node obtains a business processing request corresponding to a target application within a normal execution environment. The target application includes a key management development component, which comprises a normal execution environment and a trusted execution environment. Therefore, when the business type of the processing request is a trusted business type, in the normal execution environment, the blockchain node can call the trusted function interface associated with the business processing request in the key management development component. Furthermore, through the transfer function corresponding to the trusted function interface, the business processing request can be passed to the trusted execution environment. In the trusted execution environment, the data to be processed in the business processing request is processed in a trusted manner to obtain a trusted result. Furthermore, through the callback function corresponding to the trusted function interface, the trusted result can be returned to the normal execution environment. In the normal execution environment, business processing associated with the blockchain network can be performed based on the trusted result. As can be seen above, the target application in this embodiment includes a key management development component based on a trusted execution environment. Therefore, when running the target application, the blockchain node can efficiently and conveniently process the data to be processed in a trusted manner through the trusted execution environment in the key management development component to obtain a trusted result. Since trusted results are generated in a trusted execution environment, their accuracy and legitimacy can be improved. In addition, by developing components through key management, the target application does not need to know about the trusted execution environment, thus reducing the difficulty and complexity of using the trusted execution environment.

[0127] For further information, please see [link / reference]. Figure 6 , Figure 6 This is a flowchart illustrating a blockchain-based data processing method provided in an embodiment of this application. This blockchain-based data processing method can be implemented by blockchain nodes (including...) Figure 1 The synchronization nodes and consensus nodes in the process execute the commands. Figure 6 As shown, the blockchain-based data processing method may include at least the following steps S201-S205.

[0128] Step S201: Obtain a trusted memory instruction library; the trusted memory instruction library includes input hardware instructions, output hardware instructions, and key management logic instructions for running in a trusted execution environment.

[0129] Understandably, a hardware platform with secure computing capabilities can provide a trusted memory instruction library for blockchain nodes. This trusted memory instruction library is secured by hardware security and does not rely on the security status of firmware and software. It provides a trusted execution environment for the device object space. Through trusted instruction set extensions and access control mechanisms, it can achieve isolated operation between different programs and ensure the confidentiality and integrity of the device object's critical code and data from being damaged by malicious software.

[0130] Step S202: Generate a transfer function based on the input hardware instruction and a callback function based on the output hardware instruction.

[0131] Ordinary applications (starting in a normal execution environment) cannot directly call the trusted execution environment. Therefore, this application provides a transfer function and a callback function so that the target application in the normal execution environment can call the trusted execution environment. The software development kit corresponding to the trusted memory instruction library can provide trusted processing files for the target application. Therefore, when developing or upgrading the target application, the developers of the target application can declare the interface in the trusted processing file that the untrusted part needs to communicate with the trusted part.

[0132] Step S203: Generate a glue function between the pass function and the callback function using a trusted memory instruction library.

[0133] After generating the trusted processing file, the blockchain node can automatically generate glue code using the tools provided by the software development kit corresponding to the trusted memory instruction library. The glue code encapsulates the transfer function and the callback function. The transfer function is generated by a special hardware instruction, namely the input hardware instruction in step S202. Similarly, the callback function is generated by another special hardware instruction, namely the output hardware instruction in step S202.

[0134] Based on the software development kit corresponding to the trusted memory instruction library, blockchain nodes can encapsulate key management-related interfaces and develop key management development components in two parts. The trusted part is executed in a trusted execution environment and includes key initialization, key sealing, signature interface, encryption interface, decryption interface, etc. All key-related operations associated with the target application are implemented in the trusted part; the untrusted part is responsible for providing the interface used by the target application.

[0135] Step S204: Obtain the general function interface according to the key management logic instruction; the general function interface includes the trusted function interface.

[0136] Blockchain nodes can change the logic of key usage (such as initializing key pairs, the relationship between public and private keys and their addresses, data signature calculation, and data decryption calculation) to calling the key management interface of trusted computing. The key management development component links to different implementation libraries on different hardware platforms, but is unified at the interface layer. Therefore, the differences at the hardware layer can be shielded. As long as the CPU of the device acting as a blockchain node supports trusted computing features and enables these features, the key management development component can be used to manage keys.

[0137] Step S205: Generate a key management development component based on the key management logic instructions, general function interface, glue function, pass function, and callback function, and compile the key management development component into the target application.

[0138] Specifically, the key management logic instructions are defined as trusted programs; trusted programs run in a trusted execution environment; general function interfaces are defined as ordinary programs; ordinary programs run in a normal execution environment; glue functions, transfer functions, callback functions, trusted programs, and ordinary programs are encapsulated to obtain key management development components.

[0139] The specific process of obtaining the key management development component may include: encapsulating glue functions, transfer functions, callback functions, trusted programs, and ordinary programs to obtain an initial key management development component; if the programming language corresponding to the initial key management development component is a first programming language, and the programming language corresponding to the blockchain node is a second programming language different from the first programming language, then the initial key management development component is compiled to obtain a key management development component with a third programming language; a blockchain node refers to a node running the target application.

[0140] This application supports multiple languages. If the programming language corresponding to the initial key management development component is a first programming language (e.g., a general-purpose programming language, such as C), and the programming language corresponding to the blockchain node is a second programming language different from the first programming language (e.g., Golang in computer programming languages), then the blockchain node compiles the initial key management development component to obtain a key management development component with a third programming language (e.g., another computer programming language that can call C, which is generated based on Golang).

[0141] The encapsulation of the key management development component utilizes the software development kit corresponding to the trusted memory instruction library and the national cryptographic algorithm. Since the trusted execution environment cannot directly use the national cryptographic algorithm (such as the OpenSSL algorithm), blockchain nodes need to use the national cryptographic algorithm provided by the Secure Sockets Layer (SSL) library.

[0142] In this embodiment, a blockchain node obtains a business processing request corresponding to a target application within a normal execution environment. The target application includes a key management development component, which comprises a normal execution environment and a trusted execution environment. Therefore, when the business type of the processing request is a trusted business type, in the normal execution environment, the blockchain node can call the trusted function interface associated with the business processing request in the key management development component. Furthermore, through the transfer function corresponding to the trusted function interface, the business processing request can be passed to the trusted execution environment. In the trusted execution environment, the data to be processed in the business processing request is processed in a trusted manner to obtain a trusted result. Furthermore, through the callback function corresponding to the trusted function interface, the trusted result can be returned to the normal execution environment. In the normal execution environment, business processing associated with the blockchain network can be performed based on the trusted result. As can be seen above, the target application in this embodiment includes a key management development component based on a trusted execution environment. Therefore, when running the target application, the blockchain node can efficiently and conveniently process the data to be processed in a trusted manner through the trusted execution environment in the key management development component to obtain a trusted result. Since trusted results are generated in a trusted execution environment, their accuracy and legitimacy can be improved. In addition, by developing components through key management, the target application does not need to know about the trusted execution environment, thus reducing the difficulty and complexity of using the trusted execution environment.

[0143] Further, please see Figure 7 , Figure 7This is a schematic diagram of the structure of a blockchain-based data processing device provided in an embodiment of this application. The aforementioned blockchain-based data processing device can be a computer program (including program code) running on a computer device; for example, the blockchain-based data processing device is an application software. This device can be used to execute the corresponding steps in the method provided in the embodiments of this application. Figure 7 As shown, the blockchain-based data processing device 1 may include: a first acquisition module 11, a request transmission module 12, a result callback module 13, and a business processing module 14.

[0144] The first acquisition module 11 is used to acquire the business processing request corresponding to the target application in a normal execution environment; the target application includes a key management development component; the key management development component includes a normal execution environment and a trusted execution environment;

[0145] The request passing module 12 is used to, in the normal execution environment, call the trusted function interface associated with the business processing request in the key management development component when the business type of the business processing request belongs to the trusted business type, and pass the business processing request to the trusted execution environment through the passing function corresponding to the trusted function interface.

[0146] The result callback module 13 is used to perform trusted processing on the data to be trusted in the business processing request carried in the trusted execution environment, obtain trusted results, and return the trusted results to the normal execution environment through the callback function corresponding to the trusted function interface.

[0147] The business processing module 14 is used to perform business processing related to the blockchain network based on trusted results in a normal execution environment.

[0148] The specific functional implementations of the first acquisition module 11, request transmission module 12, result callback module 13, and business processing module 14 can be found above. Figure 3 Steps S101-S104 in the corresponding embodiment will not be described again here.

[0149] Please see again Figure 7 The blockchain-based data processing device 1 may further include: a second acquisition module 15, a type determination module 16, and a type determination module 17.

[0150] The second acquisition module 15 is used to acquire the business type of the business processing request and the trusted processing file in the key management development component in a normal execution environment; the trusted processing file includes the business type corresponding to the trusted processing business provided by the trusted execution environment;

[0151] The type comparison module 16 is used to compare the business type of the business processing request with the business type in the trusted processing file;

[0152] The type determination module 17 is used to determine that the business type of the business processing request belongs to the ordinary business type if there is no business type in the trusted processing file that is the same as the business type of the business processing request.

[0153] The type determination module 17 is also used to determine that the business type of the business processing request belongs to a trusted business type if there is a business type in the trusted processing file that is the same as the business type of the business processing request.

[0154] The specific functional implementation methods of the second acquisition module 15, the type determination module 16, and the type determination module 17 can be found above. Figure 3 Step S101 in the corresponding embodiment will not be described again here.

[0155] Please see again Figure 7 The business processing request includes a first business processing request, which is used to request the generation of a key pair corresponding to the trusted execution environment;

[0156] The result callback module 13 may include: a first acquisition unit 131 and a first determination unit 132.

[0157] The first acquisition unit 131 is used to acquire a private key generation function in a trusted execution environment according to a first business processing request;

[0158] The first determining unit 132 is used to execute a private key generation function based on the data to be trusted for processing, generate a private key corresponding to the trusted execution environment through the private key generation function, and generate a public key corresponding to the trusted execution environment based on the private key corresponding to the trusted execution environment.

[0159] The first determining unit 132 is further configured to determine the private key and the public key corresponding to the trusted execution environment as the key pair corresponding to the trusted execution environment;

[0160] The first determining unit 132 is also used to determine the successful storage result as a trusted result when the key pair corresponding to the trusted execution environment is successfully stored.

[0161] The specific functional implementation of the first acquisition unit 131 and the first determination unit 132 can be found in the above description. Figure 3 Step S103 in the corresponding embodiment will not be described again here.

[0162] Please see again Figure 7 The result callback module 13 may include: a second acquisition unit 133 and a third acquisition unit 134.

[0163] The second acquisition unit 133 is used to acquire the encrypted private key file and the private key corresponding to the trusted execution environment in the trusted execution environment.

[0164] The second acquisition unit 133 is also used to decrypt the ciphertext private key file using the private key corresponding to the trusted execution environment to obtain the plaintext private key file;

[0165] The third acquisition unit 134 is used to acquire the first target private key from the plaintext private key file according to the business type of the business processing request.

[0166] The third acquisition unit 134 is also used to perform trusted processing on the data to be trusted based on the first target private key, and obtain a trusted result.

[0167] The specific functional implementation methods of the second acquisition unit 133 and the third acquisition unit 134 can be found in the above description. Figure 3 Step S103 in the corresponding embodiment will not be described again here.

[0168] Please see again Figure 7 The business processing request carries the target private key identifier;

[0169] The result callback module 13 may include: a fourth acquisition unit 135 and a second determination unit 136.

[0170] The fourth acquisition unit 135 is used to acquire an index key-value table in a trusted execution environment; the index key-value table includes an index key generated with a private key identifier and an index value generated with a private key.

[0171] The second determining unit 136 is used to match the target private key identifier with the index key in the index key value table, and determine the index value corresponding to the index key including the target index identifier as the target index value;

[0172] The second determining unit 136 is further configured to determine the private key in the target index value as the second target private key, and perform trusted processing on the data to be trusted based on the second target private key to obtain a trusted result.

[0173] The specific functional implementation methods of the fourth acquisition unit 135 and the second determination unit 136 can be found in the above description. Figure 3 Step S103 in the corresponding embodiment will not be described again here.

[0174] Please see again Figure 7 The business processing request includes a second business processing request, which is used to request the signature of the data to be processed.

[0175] The result callback module 13 may include: a third determination unit 137.

[0176] The third determining unit 137 is used to obtain the private key corresponding to the target application in a trusted execution environment, sign the data to be trusted processed using the private key corresponding to the target application, obtain signature information, and determine the data to be trusted processed carrying the signature information as a trusted result.

[0177] The business processing module 14 is specifically used to broadcast the data to be trusted and processed, carrying signature information, to the blockchain network in a normal execution environment, so that the blockchain network can determine the legitimacy of the data to be trusted and processed based on the signature information.

[0178] The specific functional implementation methods of the third determining unit 137 and the business processing module 14 can be found in the above description. Figure 3 Steps S103-S104 in the corresponding embodiment will not be described again here.

[0179] Please see again Figure 7 The business processing request includes a third business processing request, which is used to request the encrypted storage of data to be processed in a trusted manner through consensus in the blockchain network.

[0180] The result callback module 13 may include: a fifth acquisition unit 138 and a fourth determination unit 139.

[0181] The fifth acquisition unit 138 is used to acquire the disk public key corresponding to the target application in a trusted execution environment, and to encrypt the data to be trusted to be processed using the disk public key corresponding to the target application to obtain ciphertext data.

[0182] The fourth determining unit 139 is used to determine the successful storage result as a trusted result when the encrypted data is successfully stored at the trusted address corresponding to the trusted execution environment.

[0183] The specific functional implementation methods of the fifth acquisition unit 138 and the fourth determination unit 139 can be found in the above description. Figure 3 Step S103 in the corresponding embodiment will not be described again here.

[0184] Please see again Figure 7 The blockchain-based data processing device 1 may further include: a third acquisition module 18, a first generation module 19, a second generation module 20, a fourth acquisition module 21, and a third generation module 22.

[0185] The third acquisition module 18 is used to acquire a trusted memory instruction library; the trusted memory instruction library includes input hardware instructions, output hardware instructions, and key management logic instructions for running in a trusted execution environment;

[0186] The first generation module 19 is used to generate a transfer function based on the input hardware instruction and a callback function based on the output hardware instruction.

[0187] The second generation module 20 is used to generate glue functions between the pass function and the callback function through a trusted memory instruction library;

[0188] The fourth acquisition module 21 is used to acquire the general function interface according to the key management logic instruction; the general function interface includes the trusted function interface;

[0189] The third generation module 22 is used to generate a key management development component based on key management logic instructions, general function interfaces, glue functions, transfer functions, and callback functions, and to compile the key management development component into the target application.

[0190] The specific functional implementation methods of the third acquisition module 18, the first generation module 19, the second generation module 20, the fourth acquisition module 21, and the third generation module 22 can be found above. Figure 6 Steps S201-S205 in the corresponding embodiment will not be described again here.

[0191] Please see again Figure 7 The third generation module 22 may include: a fifth determining unit 221 and a component generation unit 222.

[0192] The fifth determining unit 221 is used to determine the key management logic instruction as a trusted program; the trusted program runs in a trusted execution environment;

[0193] The fifth determining unit 221 is also used to determine the general function interface as a normal program; the normal program runs in a normal execution environment;

[0194] The component generation unit 222 is used to encapsulate the glue function, the pass function, the callback function, the trusted program, and the ordinary program to obtain the key management development component.

[0195] The specific functional implementation methods of the fifth determining unit 221 and the component generating unit 222 can be found in the above description. Figure 6 Step S205 in the corresponding embodiment will not be described again here.

[0196] Please see again Figure 7 The component generation unit 222 may include a first generation subunit 2221 and a second generation subunit 2222.

[0197] The first generation subunit 2221 is used to encapsulate the glue function, the transfer function, the callback function, the trusted program, and the ordinary program to obtain the initial key management development component;

[0198] The second generation subunit 2222 is used to compile the initial key management development component if the programming language corresponding to the initial key management development component is the first programming language and the programming language corresponding to the blockchain node is a second programming language different from the first programming language, so as to obtain a key management development component with the programming language of the third programming language; the blockchain-based data processing device runs on the blockchain node.

[0199] The specific functional implementation of the first generation subunit 2221 and the second generation subunit 2222 can be found above. Figure 6 Step S205 in the corresponding embodiment will not be described again here.

[0200] In this embodiment, a blockchain node obtains a business processing request corresponding to a target application within a normal execution environment. The target application includes a key management development component, which comprises a normal execution environment and a trusted execution environment. Therefore, when the business type of the processing request is a trusted business type, in the normal execution environment, the blockchain node can call the trusted function interface associated with the business processing request in the key management development component. Furthermore, through the transfer function corresponding to the trusted function interface, the business processing request can be passed to the trusted execution environment. In the trusted execution environment, the data to be processed in the business processing request is processed in a trusted manner to obtain a trusted result. Furthermore, through the callback function corresponding to the trusted function interface, the trusted result can be returned to the normal execution environment. In the normal execution environment, business processing associated with the blockchain network can be performed based on the trusted result. As can be seen above, the target application in this embodiment includes a key management development component based on a trusted execution environment. Therefore, when running the target application, the blockchain node can efficiently and conveniently process the data to be processed in a trusted manner through the trusted execution environment in the key management development component to obtain a trusted result. Since trusted results are generated in a trusted execution environment, their accuracy and legitimacy can be improved. In addition, by developing components through key management, the target application does not need to know about the trusted execution environment, thus reducing the difficulty and complexity of using the trusted execution environment.

[0201] Further, please see Figure 8 , Figure 8 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Figure 8As shown, the computer device 1000 may include: at least one processor 1001, such as a CPU; at least one network interface 1004; a user interface 1003; a memory 1005; and at least one communication bus 1002. The communication bus 1002 is used to enable communication between these components. The user interface 1003 may include a display screen and a keyboard. The network interface 1004 may optionally include a standard wired interface or a wireless interface (such as a Wi-Fi interface). The memory 1005 may be high-speed RAM or non-volatile memory, such as at least one disk drive. Optionally, the memory 1005 may also be at least one storage device located remotely from the aforementioned processor 1001. Figure 8 As shown, the memory 1005, which serves as a computer storage medium, may include an operating system, a network communication module, a user interface module, and a device control application program.

[0202] exist Figure 8 In the computer device 1000 shown, the network interface 1004 provides network communication functionality; the user interface 1003 is mainly used to provide an input interface for the user; and the processor 1001 can be used to call the device control application stored in the memory 1005 to achieve:

[0203] Obtain the business processing request corresponding to the target application in a normal execution environment; the target application includes a key management development component; the key management development component includes a normal execution environment and a trusted execution environment;

[0204] When the business type of the business processing request belongs to the trusted business type, in the normal execution environment, the trusted function interface associated with the business processing request in the key management development component is called, and the business processing request is passed to the trusted execution environment through the corresponding transfer function of the trusted function interface;

[0205] In a trusted execution environment, trusted processing is performed on the data to be trusted to be processed carried in the business processing request to obtain trusted results. The trusted results are then returned to the normal execution environment through the callback function corresponding to the trusted function interface.

[0206] In a normal execution environment, business processes associated with the blockchain network are performed based on trusted results.

[0207] It should be understood that the computer device 1000 described in the embodiments of this application can execute the foregoing text. Figure 3 as well as Figure 6 The description of the blockchain-based data processing method in the corresponding embodiments can also be performed as described above. Figure 7The description of the blockchain-based data processing device 1 in the corresponding embodiments will not be repeated here. Furthermore, the beneficial effects of using the same method will also not be repeated.

[0208] This application also provides a computer-readable storage medium storing a computer program, the computer program including program instructions, which are implemented when executed by a processor. Figure 3 as well as Figure 6 The blockchain-based data processing methods provided in each step are detailed above. Figure 3 as well as Figure 6 The implementation methods provided for each step will not be elaborated here. Furthermore, the beneficial effects of using the same method will also not be described in detail.

[0209] The aforementioned computer-readable storage medium can be the internal storage unit of the blockchain-based data processing apparatus provided in any of the foregoing embodiments or the computer device, such as the hard drive or memory of the computer device. The computer-readable storage medium can also be an external storage device of the computer device, such as a plug-in hard drive, smart media card (SMC), secure digital (SD) card, flash card, etc., provided on the computer device. Furthermore, the computer-readable storage medium can include both internal and external storage units of the computer device. The computer-readable storage medium is used to store the computer program and other programs and data required by the computer device. The computer-readable storage medium can also be used to temporarily store data that has been output or will be output.

[0210] This application also provides a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the aforementioned... Figure 3 as well as Figure 6 The description of the blockchain-based data processing method in the corresponding embodiments will not be repeated here. Furthermore, the beneficial effects of using the same method will also not be repeated.

[0211] The terms "first," "second," etc., in the specification, claims, and drawings of this application are used to distinguish different objects, not to describe a specific order. Furthermore, the term "comprising," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, apparatus, product, or device that includes a series of steps or units is not limited to the listed steps or modules, but may optionally include steps or modules not listed, or may optionally include other step units inherent to these processes, methods, apparatuses, products, or devices.

[0212] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this application.

[0213] The methods and related apparatuses provided in this application are described with reference to the method flowcharts and / or structural diagrams provided in this application. Specifically, each block of the method flowchart and / or structural diagram, as well as combinations of blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing device to create a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing device, generate instructions for implementing the process. Figure 1 A schematic diagram of one or more processes and / or structures. Figure 1 The computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 A schematic diagram of one or more processes and / or structures. Figure 1 The functions specified in one or more boxes. These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable apparatus for implementing the process. Figure 1 A process or multiple processes and / or structures illustrate the steps of the functions specified in one or more boxes.

[0214] The above-disclosed embodiments are merely preferred embodiments of this application and should not be construed as limiting the scope of this application. Therefore, any equivalent variations made in accordance with the claims of this application shall still fall within the scope of this application.

Claims

1. A data processing method based on blockchain, characterized in that, include: Generate pending data for the target application in a normal execution environment, respond to the confirmation operation for the pending data, and obtain the business processing request corresponding to the target application in the normal execution environment; The target application is compiled with a key management development component; Based on the key management development component, a trusted execution environment is created for the target application; the target application includes at least one of a social application, a resource management application, and a payment application. When the business type of the business processing request belongs to a trusted business type, in the normal execution environment, the trusted function interface associated with the business processing request in the key management development component is called, and the business processing request is passed to the trusted execution environment through the transfer function corresponding to the trusted function interface; In the trusted execution environment, the data to be trusted and processed carried by the business processing request is processed in a trusted manner to obtain a trusted result. The trusted result is then returned to the normal execution environment through the callback function corresponding to the trusted function interface. The data to be processed is the data to be processed; In the normal execution environment, business processes associated with the blockchain network are performed based on the trusted results.

2. The method according to claim 1, characterized in that, The method further includes: In the normal execution environment, the business type of the business processing request is obtained, and the trusted processing file in the key management development component is obtained; the trusted processing file includes the business type corresponding to the trusted processing business provided by the trusted execution environment. Compare the business type of the business processing request with the business type in the trusted processing file; If the trusted processing file does not contain a business type that is the same as the business type of the business processing request, then the business type of the business processing request is determined to be a normal business type. If the trusted processing file contains a business type that is the same as the business type of the business processing request, then the business type of the business processing request is determined to be a trusted business type.

3. The method according to claim 1, characterized in that, The business processing request includes a first business processing request, which is used to request the generation of a key pair corresponding to the trusted execution environment; In the trusted execution environment, the data to be processed in the business processing request is subjected to trusted processing to obtain a trusted result, including: In the trusted execution environment, a private key generation function is obtained according to the first business processing request; The private key generation function is executed according to the data to be trusted for processing. The private key generation function generates the private key corresponding to the trusted execution environment. The public key corresponding to the trusted execution environment is generated according to the private key corresponding to the trusted execution environment. The private key and the public key corresponding to the trusted execution environment are determined as the key pair corresponding to the trusted execution environment; When the key pair corresponding to the trusted execution environment is successfully stored, the successful storage result is determined as a trusted result.

4. The method according to claim 1, characterized in that, In the trusted execution environment, the data to be processed in the business processing request is subjected to trusted processing to obtain a trusted result, including: In the trusted execution environment, obtain the encrypted private key file and obtain the private key corresponding to the trusted execution environment; The encrypted private key file is decrypted using the private key corresponding to the trusted execution environment to obtain the plaintext private key file. Based on the business type of the business processing request, obtain the first target private key from the plaintext private key file; Based on the first target private key, the data to be trusted is processed to obtain a trusted result.

5. The method according to claim 1, characterized in that, The business processing request carries the target private key identifier; In the trusted execution environment, the data to be processed in the business processing request is subjected to trusted processing to obtain a trusted result, including: In the trusted execution environment, an index key-value table is obtained; the index key-value table includes index keys generated with a private key identifier, and index values ​​generated with the private key. The target private key identifier is matched with the index key in the index key value table, and the index value corresponding to the index key including the target private key identifier is determined as the target index value; The private key in the target index value is determined as the second target private key. Based on the second target private key, the data to be trusted is processed to obtain a trusted result.

6. The method according to claim 1, characterized in that, The business processing request includes a second business processing request, which is used to request the signature of the data to be trusted for processing. In the trusted execution environment, the data to be processed in the business processing request is subjected to trusted processing to obtain a trusted result, including: In the trusted execution environment, the private key corresponding to the target application is obtained, and the data to be trusted for processing is signed using the private key corresponding to the target application to obtain signature information. The data to be trusted for processing carrying the signature information is then determined as a trusted result. In the ordinary execution environment, performing business processing related to the blockchain network based on the trusted result includes: In the normal execution environment, the data to be trusted for processing, carrying the signature information, is broadcast to the blockchain network so that the blockchain network can determine the legitimacy of the data to be trusted for processing based on the signature information.

7. The method according to claim 1, characterized in that, The business processing request includes a third business processing request, which is used to request the encrypted storage of data to be processed in a trusted manner that has passed consensus in the blockchain network. In the trusted execution environment, the data to be processed in the business processing request is subjected to trusted processing to obtain a trusted result, including: In the trusted execution environment, the public key corresponding to the target application is obtained, and the data to be trusted for processing is encrypted using the public key corresponding to the target application to obtain ciphertext data; When the encrypted data is successfully stored at the trusted address corresponding to the trusted execution environment, the successful storage result is determined as a trusted result.

8. The method according to claim 1, characterized in that, The method further includes: Obtain a trusted memory instruction library; the trusted memory instruction library includes input hardware instructions, output hardware instructions, and key management logic instructions for operation in the trusted execution environment; The transfer function is generated according to the input hardware instruction, and the callback function is generated according to the output hardware instruction; The trusted memory instruction library is used to generate a glue function between the transfer function and the callback function; The general function interface is obtained according to the key management logic instructions; the general function interface includes the trusted function interface. Based on the key management logic instructions, the general function interface, the glue function, the transfer function, and the callback function, the key management development component is generated, and the key management development component is compiled into the target application.

9. The method according to claim 8, characterized in that, The step of generating the key management development component based on the key management logic instructions, the general function interface, the transmission function, and the callback function includes: The key management logic instructions are identified as trusted programs; the trusted programs run in the trusted execution environment. The general-purpose functional interface is defined as a regular program; the regular program runs in the regular execution environment; The glue function, the transfer function, the callback function, the trusted program, and the ordinary program are encapsulated to obtain the key management development component.

10. The method according to claim 9, characterized in that, The key management development component is obtained by encapsulating the glue function, the transfer function, the callback function, the trusted program, and the ordinary program, including: The glue function, the transfer function, the callback function, the trusted program, and the ordinary program are encapsulated to obtain an initial key management development component; If the programming language corresponding to the initial key management development component is a first programming language, and the programming language corresponding to the blockchain node is a second programming language different from the first programming language, then the initial key management development component is compiled to obtain the key management development component with the programming language of a third programming language; the blockchain node refers to the node running the target application.

11. A data processing device based on blockchain, characterized in that, include: The first acquisition module is used to generate pending data of the target application in a normal execution environment, respond to the confirmation operation for the pending data, and acquire the business processing request corresponding to the target application in the normal execution environment; the target application is compiled with a key management development component; The first acquisition module is further configured to create a trusted execution environment for the target application based on the key management development component; the target application includes at least one of a social application, a resource management application, and a payment application; The request passing module is used to, when the business type of the business processing request belongs to a trusted business type, in the normal execution environment, call the trusted function interface associated with the business processing request in the key management development component, and pass the business processing request to the trusted execution environment through the passing function corresponding to the trusted function interface; The result callback module is used to perform trusted processing on the data to be trusted processed carried by the business processing request in the trusted execution environment, obtain a trusted result, and return the trusted result to the normal execution environment through the callback function corresponding to the trusted function interface. The data to be processed is the data to be processed; The business processing module is used to perform business processing related to the blockchain network based on the trusted result in the normal execution environment.

12. A computer device, characterized in that, include: The processor, memory, and network interface are connected to the memory and the network interface, wherein the network interface is used to provide data communication functions, the memory is used to store computer programs, and the processor is used to invoke the computer programs to cause the computer device to perform the method according to any one of claims 1 to 10.

13. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program adapted to be loaded and executed by a processor to cause a computer device having the processor to perform the method of any one of claims 1-10.

14. A computer program product, characterized in that, The computer program product includes computer instructions stored in a computer-readable storage medium, the computer instructions being adapted to be read and executed by a processor to cause a computer device having the processor to perform the method of any one of claims 1-10.

Images