Blockchain-based data processing method, apparatus, device, medium, and product

Abstract

The embodiment of the application provides a kind of based on blockchain data processing method, device, equipment, medium and product, the data processing method based on blockchain includes: receiving the service request sent by service object, service request carries the service data of requested blockchain service, service data includes contract identification data and contract execution data;Business data is transmitted into trusted execution environment, and target service computing contract corresponding to contract identification data is deployed in trusted execution environment;Based on contract execution data, execute target service computing contract in trusted execution environment, obtain the service execution result of blockchain service;Business execution result is uploaded to the storage in blockchain, and business execution result is returned to service object.Using the embodiment of the application, the requested blockchain service can be executed in trusted execution environment, and the execution process of blockchain service is effectively protected from being disclosed.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a blockchain-based data processing method, a blockchain-based data processing device, a computer equipment, a computer-readable storage medium, and a computer program product. Background Technology

[0002] With the rapid development of computer technology, blockchain has been widely applied in various business scenarios. Based on the advantages of blockchain, such as immutability and traceability, the execution process of business transactions (i.e., the execution process of blockchain business) combined with blockchain becomes secure and reliable. Generally, data in blockchain business (e.g., business data involved in executing blockchain business, smart contracts required for executing blockchain business, etc.) is public to blockchain participants; that is, the execution process of blockchain business is public to blockchain participants. Currently, protecting the execution process of blockchain business from public disclosure, and achieving "usable but invisible" data in blockchain business, has become a growing demand from blockchain participants. Therefore, how to protect the execution process of blockchain business from public disclosure has become a current research hotspot. Summary of the Invention

[0003] This application provides a blockchain-based data processing method, apparatus, device, medium, and product that can execute requested blockchain services in a trusted execution environment, effectively protecting the execution process of blockchain services from being disclosed.

[0004] On the one hand, embodiments of this application provide a blockchain-based data processing method, which includes:

[0005] Receive business requests sent by business objects. The business requests carry business data of the requested blockchain business, including contract identification data and contract execution data.

[0006] Business data is transmitted into a trusted execution environment, where a target business computation contract corresponding to the contract identifier data is deployed.

[0007] Based on contract execution data, the target business computation contract is executed in a trusted execution environment to obtain the business execution results of the blockchain business.

[0008] The business execution results are uploaded to the blockchain for storage, and the business execution results are returned to the business object.

[0009] Accordingly, embodiments of this application provide a blockchain-based data processing apparatus, which includes:

[0010] The communication unit is used to receive business requests sent by business objects. The business requests carry business data of the requested blockchain business, including contract identification data and contract execution data.

[0011] The processing unit is used to input business data into the trusted execution environment, where a target business computing contract corresponding to the contract identification data is deployed.

[0012] The processing unit is also used to execute the target business computation contract in a trusted execution environment based on the contract execution data, and obtain the business execution result of the blockchain business;

[0013] The communication unit is also used to upload the business execution results to the blockchain for storage and to return the business execution results to the business object.

[0014] In one implementation, the contract identification data includes a contract name identifier and a contract method identifier; one or more business computation contracts are deployed in the trusted execution environment; the processing unit, used to execute the target business computation contract in the trusted execution environment based on the contract execution data, specifically performs the following steps when obtaining the business execution result of the blockchain business:

[0015] Locate the target business computation contract corresponding to the contract name identifier in the trusted execution environment. The target business computation contract includes one or more contract methods.

[0016] Retrieve the target contract method corresponding to the contract method identifier in the target business computation contract;

[0017] Based on contract execution data, the target contract method is executed in a trusted execution environment to obtain the business execution results of the blockchain business.

[0018] In one implementation, an interface contract corresponding to the target business computation contract is deployed in the blockchain. The interface contract defines the data required to execute the target business computation contract.

[0019] The communication unit is also used to call the interface contract based on the definition of the interface contract to obtain the blockchain data required to execute the target business computing contract from the blockchain;

[0020] The processing unit is also used to transmit blockchain data into a trusted execution environment;

[0021] The processing unit, used to execute the target business computation contract in a trusted execution environment based on contract execution data, specifically performs the following steps when obtaining the business execution result of the blockchain business:

[0022] Based on contract execution data and blockchain data, the target business computation contract is executed in a trusted execution environment to obtain the business execution results of the blockchain business.

[0023] In one implementation, business data and blockchain data are encrypted with the public key of the trusted execution environment before being passed into the trusted execution environment; the processing unit is also used to perform the following steps:

[0024] The business data is decrypted using the private key of the trusted execution environment;

[0025] The blockchain data is decrypted using the private key of the trusted execution environment.

[0026] In one implementation, the processing unit, before passing the business data into the trusted execution environment, is also configured to perform the following steps:

[0027] Perform identity authentication on business objects;

[0028] After the business object is successfully authenticated, the step of transferring the business data into the trusted execution environment is triggered.

[0029] In one implementation, the business request also carries a signature of the business data, which is obtained by signing the business data using the private key of the business object; the processing unit, used for authenticating the business object, specifically performs the following steps:

[0030] The signature of the business data is verified using the public key of the business object.

[0031] If the signature verification of the business data is successful, a list of trusted objects is obtained. The list of trusted objects includes the object identifiers of one or more trusted objects.

[0032] If the list of trusted objects includes the object identifier of the business object, then the authentication of the business object is considered successful.

[0033] In one implementation, an interface contract corresponding to the target business computing contract is deployed in the blockchain. The interface contract defines the data that needs to be uploaded to the blockchain for storage after the target business computing contract is executed.

[0034] The communication unit, used to upload the business execution result to the blockchain for storage, specifically performs the following steps:

[0035] The API contract sends the business execution result to the blockchain, so that the blockchain can store the business execution result after verifying it.

[0036] The business execution result is the data assembly according to the definition of the interface contract.

[0037] In one implementation, the business execution result includes the contract execution result of the target business computation contract, and the target business computation contract itself, wherein the business execution result is signed with the private key of the trusted execution environment; the blockchain verification process for the business execution result includes:

[0038] Obtain the remote proof document corresponding to the target business computing contract, and verify the legitimacy of the trusted execution environment based on the remote proof document;

[0039] If the legitimacy verification of the trusted execution environment passes, the public key of the trusted execution environment is used to verify the signature of the business execution result.

[0040] If the verification of the business execution result is successful, the target business calculation contract in the business execution result is compared with the target business calculation contract stored in the blockchain;

[0041] If the target business computation contract in the business execution result is the same as the target business computation contract stored in the blockchain, then the business execution result is verified.

[0042] In one implementation, the processing unit is further configured to perform the following steps:

[0043] In response to a contract deployment request sent by the contract deployment object, the identity of the contract deployment object is authenticated; the contract deployment request carries the contract to be deployed;

[0044] If the identity of the contract deployment object is successfully authenticated, the contract to be deployed will be deployed.

[0045] In one implementation, the contracts to be deployed include the target business computation contract and the corresponding interface contract; the processing unit, when deploying the contracts to be deployed, specifically performs the following steps:

[0046] Deploy the target business computation contract into a trusted execution environment;

[0047] Deploy the interface contract to the blockchain.

[0048] In one implementation, the processing unit, when deploying the target business computation contract to the trusted execution environment, specifically performs the following steps:

[0049] The target business computing contract is compiled to obtain the compiled file of the target business computing contract;

[0050] Deploy the compiled files of the target business computation contract to the cache space of the trusted execution environment.

[0051] In one implementation, the processing unit is further configured to perform the following steps:

[0052] Generate a remote proof file corresponding to the target business computing contract;

[0053] The remote proof file of the target business computing contract, the compiled file of the target business computing contract, and the target business computing contract are uploaded to the blockchain for storage.

[0054] In one implementation, the processing unit, when deploying the interface contract to the blockchain, specifically performs the following steps:

[0055] The interface contract is compiled to obtain the compiled interface contract file;

[0056] The compiled files of the interface contract are deployed to the blockchain, and the compiled files of the interface contract are hashed in the blockchain. The contract hash is calculated based on the target business calculation contract.

[0057] Accordingly, embodiments of this application provide a computer device, which includes:

[0058] A processor is a tool for implementing computer programs.

[0059] A computer-readable storage medium storing a computer program adapted to be loaded by a processor and executed by the aforementioned blockchain-based data processing method.

[0060] Accordingly, embodiments of this application provide a computer-readable storage medium storing a computer program. When the computer program is read and executed by the processor of a computer device, the computer device performs the aforementioned blockchain-based data processing method.

[0061] Accordingly, embodiments of this application provide a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. The processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the aforementioned blockchain-based data processing method.

[0062] In this embodiment, upon receiving a business request from a business object, the business data of the requested blockchain business carried in the business request can be transmitted to a trusted execution environment. The business data may include contract identification data and contract execution data. Furthermore, a target business computation contract corresponding to the contract identification data is deployed in the trusted execution environment. Then, based on the contract execution data, the target business computation contract can be executed in the trusted execution environment to obtain the business execution result of the blockchain business. As can be seen from the above, in this embodiment, all data related to the blockchain business is located in a trusted execution environment (i.e., the business data related to the blockchain business is transmitted to the trusted execution environment, and the target business computation contract related to the blockchain business is deployed in the trusted execution environment). Moreover, the target business computation contract is executed in the trusted execution environment. In other words, the execution process of the blockchain business occurs within the trusted execution environment, which effectively protects the execution process of the blockchain business from being disclosed. Attached Figure Description

[0063] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0064] Figure 1 This is a schematic diagram of the architecture of a blockchain network provided in an embodiment of this application;

[0065] Figure 2 This is a schematic diagram of a blockchain structure provided in an embodiment of this application;

[0066] Figure 3 This is a schematic diagram of a block generation process provided in an embodiment of this application;

[0067] Figure 4a This is a schematic diagram of the architecture of a blockchain-based data processing system provided in an embodiment of this application;

[0068] Figure 4b This is a schematic diagram of another blockchain-based data processing system architecture provided in the embodiments of this application;

[0069] Figure 4c This is a schematic diagram of another blockchain-based data processing system architecture provided in the embodiments of this application;

[0070] Figure 5 This is a flowchart illustrating a blockchain-based data processing method provided in an embodiment of this application;

[0071] Figure 6 This is a flowchart illustrating another blockchain-based data processing method provided in an embodiment of this application;

[0072] Figure 7 This is a schematic diagram of the framework of a data processing operating system provided in an embodiment of this application;

[0073] Figure 8 This is a schematic diagram of a contract deployment process provided in an embodiment of this application;

[0074] Figure 9 This is a schematic diagram of a contract execution process provided in an embodiment of this application;

[0075] Figure 10 This is a schematic diagram of the structure of a blockchain-based data processing device provided in an embodiment of this application;

[0076] Figure 11 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0077] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0078] To better understand the technical solutions provided in the embodiments of this application, the key terms involved in the embodiments of this application will be introduced first:

[0079] (1) Blockchain Network. A blockchain network, or P2P (Peer to Peer) network, is a peer-to-peer network. Each node in a peer-to-peer connection is called a peer node. P2P networks are based on a specific network protocol, which allows peer nodes to maintain the network state without a central node. Each node maintains the state of the entire network and its connection state with neighboring nodes through broadcast interaction with neighboring nodes.

[0080] P2P networks can be understood as... Figure 1The data sharing system 10 shown is a system for data sharing between nodes. This system may include multiple nodes 101, which can refer to clients, terminals, or servers within the system. Each node 101 receives input information during normal operation and maintains shared data within the system based on this information. To ensure interoperability within the system, information connections exist between nodes, allowing for information transmission. For example, when any node in the system receives input information, other nodes obtain this information according to a consensus algorithm and store it as part of the shared data, ensuring consistency across all nodes. Each node in the system has a corresponding node identifier, and can also store the node identifiers of other nodes. This allows for the broadcasting of generated blocks to other nodes based on their identifiers. Each node maintains a node identifier list as shown in Table 1, storing the node name and identifier accordingly. The node identifier can be an IP (Internet Protocol) address or any other information that can be used to identify the node. Table 1 uses IP addresses as an example only:

[0081] Table 1

[0082] Node 1 XXX.XXX.XXX.XX1 Node 2 XXX.XXX.XXX.XX2 … … Node N XXX.XXX.XXX.XXN

[0083] (2) Blockchain. Each node in a blockchain network stores the same blockchain record. Blockchain is a distributed ledger technology in the field of information technology, generally consisting of consensus, transaction blocks and state data storage, cryptographic identity security, etc. Because the ledger is stored in a distributed manner and the blocks are agreed upon, it has characteristics such as immutability, traceability, and joint maintenance. A blockchain consists of multiple blocks; see [link to relevant documentation]. Figure 2The blockchain structure shown consists of multiple blocks. The genesis block includes a block header and a block body. The block header of the genesis block stores the input information feature value, version number, timestamp, and difficulty value, while the block body stores the input information. The next block after the genesis block takes the genesis block as its parent block. The next block also includes a block header and a block body. In addition to storing the input information feature value, version number, timestamp, and difficulty value of the current block, the block header feature value of the parent block is also stored in the next block's block header, and so on. This ensures that the block data stored in each block is related to the block data stored in its parent block, guaranteeing the security of the input information in the blocks.

[0084] When generating the individual blocks in the blockchain, see [link / reference]. Figure 3 The block generation process shown involves the following steps: When a node in the blockchain receives input information, it verifies the input information, stores it in a memory pool, and updates its hash tree used to record the input information. Then, it updates the timestamp to the time the input information was received and attempts to calculate the feature value multiple times using different random numbers, ensuring that the calculated feature value satisfies the following formula:

[0085] SHA256(SHA256(version+prev_hash+merkle_root+ntime+nbits+x)) <TARGET

[0086] Among them, SHA256 (Secure Hash Algorithm 256) is the feature value algorithm used to calculate the feature value; version (version number) is the version information of the relevant block protocol in the blockchain; prev_hash is the block header feature value of the parent block of the current block; merkle_root is the feature value of the input information; ntime is the update time of the update timestamp; nbits is the current difficulty, which is a fixed value for a period of time and is determined again after exceeding the fixed time period; x is a random number; TARGET is the feature value threshold, which can be determined based on nbits.

[0087] Thus, when a random number satisfying the above formula is calculated, the information can be stored accordingly, generating a block header and a block body to obtain the current block. Subsequently, the node where the blockchain resides sends the newly generated block to other nodes in its data sharing system based on the node identifiers of other nodes in the data sharing system. The other nodes then verify the newly generated block and add it to their stored blockchain after verification.

[0088] (3) Smart Contracts. A smart contract is a computerized protocol that can execute the terms of a contract. It is a code implementation that is executed when certain conditions are met. Based on actual business needs, the code is used to complete automated transactions. Of course, smart contracts are not limited to executing contracts for transactions, but can also execute contracts for processing received information.

[0089] (4) Privacy Compute. Privacy Compute (or Privacy Computing) is a technology and system in which multiple (i.e., two or more) parties collaborate to perform joint machine learning and analysis on their data without disclosing their own data. Under the Privacy Compute framework, the participants' data does not leave their local machines, achieving "data usable but not visible".

[0090] (5) SGX. SGX (Software Guard Extensions) is a set of security-related instructions built into the CPU (Central Processing Unit). They allow user-mode and kernel-mode code to define specific memory regions as private regions, which can be called trusted execution environments (i.e., enclaves). The contents of the trusted execution environment are protected and cannot be accessed by any process other than itself (including processes running at higher privilege levels).

[0091] Based on the above description of key terms, this application provides a blockchain-based data processing solution, which may include two stages: contract deployment and contract execution.

[0092] For the contract deployment phase: This application embodiment proposes a business computation contract and an interface contract. One business computation contract can correspond to one interface contract, and both business computation contracts and interface contracts are smart contracts. The business computation contract can be used to perform business computations (i.e., execute business logic). The interface contract corresponding to the business computation contract defines the data required to execute the business computation contract, and also defines the data that needs to be uploaded to the blockchain for storage after the business computation contract is executed. Therefore, the interface contract corresponding to the business computation contract can be used to obtain the data required to execute the business computation contract, and can also be used to upload the data that needs to be stored to the blockchain for storage after the business computation contract is executed. This application embodiment deploys the business computation contract in a trusted execution environment and deploys the corresponding interface contract in the blockchain.

[0093] For the contract invocation phase: When a business request is received from a business object, the business data carried in the request can be passed to the trusted execution environment. This business data may include contract identification data and contract execution data. Then, based on the contract execution data, the target business computation contract corresponding to the contract identification data can be executed in the trusted execution environment to obtain the business execution result of the requested blockchain business. Alternatively, the interface contract corresponding to the target business computation contract can be called to obtain the blockchain data required to execute the target business computation contract. Then, based on the contract execution data and the blockchain data, the target business computation contract corresponding to the contract identification data can be executed in the trusted execution environment to obtain the business execution result of the requested blockchain business. After this, the interface contract corresponding to the target business computation contract can be called to upload the business execution result to the blockchain for storage, and the business execution result can be returned to the business object.

[0094] Based on the above solution, on the one hand, all data involved in the execution of blockchain business resides in a trusted execution environment (business data is passed into the trusted execution environment, and business computation contracts are deployed within it), and the business computation contracts are executed within this trusted execution environment. In other words, the execution of blockchain business occurs within a trusted execution environment, which effectively protects the execution process from being publicly disclosed. On the other hand, through the definition of the interface contract corresponding to the business computation contract, all the data required for executing the business computation contract can be obtained before execution, eliminating the need for repeated retrieval during the contract's execution. This makes the execution of the business computation contract more efficient, thus making the execution of blockchain business more efficient.

[0095] It should be noted that the blockchain-based data processing solution provided in this application embodiment can be implemented by a miniature data processing operating system (Gramine). This data processing operating system is an SGX LibOS (SGX Library Operating System) project. Gramine itself interacts directly with the SGX AESM Gateway (SGX Application Enclave Services Manager Gateway) service, so its implementation does not depend on the SGX SDK (SGX Software Development Kit). Gramine has currently encapsulated multiple Host ABIs (Host Application Binary Interfaces), 36 of which require OCall (untrusted functions). Gramine supports most System V IPC (System V Inter-Process Communication) functions, including fork (a function) and exec (a function). Gramine currently contains nearly 50,000 lines of LibOS code and 20,000 lines of SGX PAL (SGX Programmable Array Logic) code, making it very lightweight after compilation. Gramine's user-space multi-process model is isolated by LibOS, meaning that a new OS (Operating System) process is started by creating a new Enclave. Inter-process communication between LibOS processes is simulated using RPC (Remote Procedure Call).

[0096] The following is combined Figures 4a-4c The following describes the blockchain-based data processing system involved in the embodiments of this application:

[0097] like Figure 4a The data processing system shown may include a first terminal 401, a second terminal 402, and a server 403. The first terminal 401 may be a terminal device used by a contract deployment object, the second terminal 402 may be a terminal device used by a business object, and the server 403 belongs to a blockchain network. The server may deploy a data processing operating system (Gramine) and a blockchain, and the data processing operating system (Gramine) and the blockchain are deployed in different areas of the server 403. Figure 4a The data processing system shown:

[0098] For the contract deployment phase: The contract deployment object can send a contract deployment request to the server 403 through the first terminal 401. The contract deployment request can carry the business computing contract to be deployed and the corresponding interface contract of the business computing contract. Gramine in the server 403 can deploy the business computing contract in the trusted execution environment and deploy the corresponding interface contract of the business computing contract in the blockchain. Then, after the business computing contract and the corresponding interface contract of the business computing contract are successfully deployed, Gramine in the server 403 can return the contract deployment result to the contract deployment object.

[0099] During the contract execution phase: the business object can send a business request to the server 403 via the second terminal 402. The business request can carry contract identification data and contract execution data. Gramine in server 403 can pass the business data into the trusted execution environment. Based on the contract execution data, it executes the target business computation contract corresponding to the contract identification data in the trusted execution environment to obtain the business execution result of the requested blockchain business. Alternatively, Gramine in server 403 can pass the business data into the trusted execution environment. Gramine in server 403 can also call the interface contract corresponding to the target business computation contract to obtain the blockchain data required for the execution of the target business computation contract from the blockchain and pass the blockchain data into the trusted execution environment. Based on the contract execution data and the blockchain data, Gramine in server 403 can execute the target business computation contract in the trusted execution environment to obtain the business execution result of the requested blockchain business. Then, Gramine in server 403 can return the business execution result to the business object. It can also call the interface contract corresponding to the target business computation contract to upload the business execution result to the blockchain for storage.

[0100] like Figure 4b The data processing system shown may include a first terminal 401, a second terminal 402, a trusted server 404, and a blockchain server 405. The first terminal 401 may be a terminal device used by a contract deployment object, the second terminal 402 may be a terminal device used by a business object, and both the trusted server 404 and the blockchain server 405 belong to a blockchain network. The trusted server 404 may deploy a data processing operating system (Gramine), and the blockchain server 405 may deploy a blockchain; that is, the data processing operating system (Gramine) and the blockchain are deployed on different servers. Figure 4c The data processing system shown Figure 4c The data processing system shown is Figure 4b The difference between the data processing systems shown is that, Figure 4bIn the data processing system shown, both the trusted server 404 and the blockchain server 405 belong to the blockchain network, while... Figure 4c In the data processing system shown, trusted server 404 does not belong to the blockchain network, while blockchain server 405 does. Figure 4b and Figure 4c The data processing system shown:

[0101] For the contract deployment phase: The contract deployment object can send a contract deployment request to the trusted server 404 through the first terminal 401. The contract deployment request can carry the business computing contract to be deployed and the corresponding interface contract of the business computing contract. Gramine in the trusted server 404 can deploy the business computing contract in the trusted execution environment and request the blockchain server 405 to deploy the corresponding interface contract of the business computing contract in the blockchain. Then, after the business computing contract and the corresponding interface contract of the business computing contract are successfully deployed, the contract deployment result can be returned to the contract deployment object.

[0102] During the contract execution phase: the business object can send a business request to the trusted server 404 via the second terminal 402. The business request can carry contract identification data and contract execution data. The Gramine in the trusted server 404 can pass the business data into the trusted execution environment. Based on the contract execution data, it executes the target business computation contract corresponding to the contract identification data in the trusted execution environment to obtain the business execution result of the requested blockchain business. Alternatively, the Gramine in the trusted server 404 can pass the business data into the trusted execution environment. The Gramine in the trusted server 404 can also request the blockchain server 405 to call the interface contract corresponding to the target business computation contract to obtain the blockchain data required for the execution of the target business computation contract. After receiving the blockchain data, the Gramine in the trusted server 404 can pass the blockchain data into the trusted execution environment and execute the target business computation contract in the trusted execution environment based on the contract execution data and the blockchain data to obtain the business execution result of the requested blockchain business. Then, the Gramine in the trusted server 404 can return the business execution result to the business object and can also request the blockchain server 405 to call the interface contract corresponding to the target business computation contract to upload the business execution result to the blockchain for storage.

[0103] It should be noted that, in the above Figures 4a-4cIn the data processing system shown, the terminals mentioned can be smartphones, tablets, laptops, desktop computers, smart voice interaction devices, smartwatches, in-vehicle terminals, smart home appliances, aircraft, etc., but are not limited to these; the servers mentioned can be independent physical servers, server clusters or distributed systems composed of multiple physical servers, or cloud servers that provide basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. This application embodiment does not limit this; each terminal and each server can establish a direct communication connection through wired communication or an indirect communication connection through wireless communication. This application embodiment does not limit this. Furthermore, the server deploying the Gramine data processing operating system needs a hardware environment that supports trusted computing, and the blockchain needs to support contract engine capabilities. The process of deploying the Gramine data processing operating system on the server can be as follows: create a basic Gramine environment image, install runtime environments for multiple languages ​​(e.g., Golang and Rust) in the image, compile the corresponding binary files, and install the gateway code in the image.

[0104] It is understood that the blockchain-based data processing system described in the embodiments of this application is for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and does not constitute a limitation on the technical solutions provided in the embodiments of this application. As those skilled in the art will know, with the evolution of system architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0105] The data processing scheme based on blockchain provided in the embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0106] This application provides a blockchain-based data processing method, which mainly describes the execution flow of a business computation contract. This blockchain-based data processing method can be executed by a computer device, which can be server 403 or trusted server 404 in the aforementioned blockchain-based data processing system. Figure 5 As shown, the blockchain-based data processing method may include, but is not limited to, the following steps S501-504:

[0107] S501 receives business requests sent by business objects.

[0108] A business object is an object that requests to execute a blockchain business. The business request sent by the business object can carry the business data of the requested blockchain business. The business data can include contract identification data and contract execution data. Among them, contract identification data refers to the data used to identify the business calculation contract, and contract execution data refers to the contract parameters, that is, the data required to execute the business calculation contract corresponding to the contract identification data.

[0109] S502 transmits business data to the trusted execution environment.

[0110] Before step S502, the business object can be authenticated. If the authentication is successful, the business object is considered trustworthy, and business data can be passed into the trusted execution environment. If the authentication fails, the business object is considered untrustworthy, and business requests can be rejected. The process of authenticating the business object may include the following:

[0111] The first method is to obtain a list of trusted objects (i.e., a whitelist). The list of trusted objects can include the object identifiers of one or more trusted objects. If the list of trusted objects includes the object identifier of the business object, it can be determined that the authentication of the business object has passed. If the list of trusted objects does not contain the object identifier of the business object, it can be determined that the authentication of the business object has failed.

[0112] The second approach is to include a signature of the business data in the business request. This signature can be obtained by signing the business data using the private key of the business object. More specifically, the signature can be obtained by first calculating a digest of the business data using a digest algorithm agreed upon by the business object and the data processing operating system, and then encrypting the digest using the private key of the business object. The signature can be verified using the public key of the business object. If the signature verification fails, the authentication of the business object fails. If the signature verification succeeds, a list of trusted objects (i.e., a whitelist) can be obtained. This whitelist can include the object identifiers of one or more trusted objects. If the trusted object list includes the object identifier of the business object, the authentication of the business object is successful. If the trusted object list does not contain the object identifier of the business object, the authentication of the business object fails.

[0113] The signature verification process may include: decrypting the signature of the business data using the public key of the business object to obtain the first digest information; then, using an agreed digest algorithm to calculate the digest of the business data carried in the business request to obtain the second digest information; if the first digest information and the second digest information are the same, it can be determined that the signature verification of the business data is successful; if the first digest information and the second digest information are different, it can be determined that the signature verification of the business data fails.

[0114] By authenticating the identity of business objects, business requests from untrusted objects can be rejected, thereby preventing untrusted objects from maliciously using trusted computing resources and causing the trusted computing resources to crash.

[0115] In step S502, after the identity authentication of the business object is passed, the business data can be transmitted to the trusted execution environment, where the target business computing contract corresponding to the contract identifier data can be deployed.

[0116] S503, based on contract execution data, executes the target business computation contract in a trusted execution environment to obtain the business execution result of the blockchain business.

[0117] As described above, the interface contract corresponding to the business computation contract defines the data required to execute the business computation contract. This interface contract is deployed in the blockchain. In other words, the interface contract corresponding to the target business computation contract is deployed in the blockchain, and it defines the data required to execute the target business computation contract. In step S503, when the contract execution data contained in the business data is the same as the data required to execute the target business computation contract, the target business computation contract can be directly executed in the trusted execution environment based on the contract execution data to obtain the business execution result of the blockchain business. When the contract execution data contained in the business data is less than the data required to execute the target business computation contract, it is necessary to call the interface contract based on the definition of the interface contract to obtain the blockchain data required to execute the target business computation contract from the blockchain, and then pass the blockchain data into the trusted execution environment. Finally, the target business computation contract can be executed in the trusted execution environment based on the contract execution data and the blockchain data to obtain the business execution result of the blockchain business.

[0118] For cases where it is not necessary to call an interface contract to obtain the blockchain data required to execute the target business computation contract from the blockchain, the contract identification data can include a contract name identifier and a contract method identifier. One or more business computation contracts can be deployed in the trusted execution environment. The target business computation contract corresponding to the contract name identifier can be found in the trusted execution environment. The target business computation contract can include one or more contract methods. Then, the target contract method corresponding to the contract method identifier in the target business computation contract can be obtained. Thus, based on the contract execution data, the target contract method can be executed in the trusted execution environment to obtain the business execution result of the blockchain business.

[0119] For scenarios requiring the invocation of an interface contract to retrieve blockchain data necessary for executing a target business computation contract, the contract identifier data can include a contract name identifier and a contract method identifier. One or more business computation contracts can be deployed in the trusted execution environment. The target business computation contract corresponding to the contract name identifier can be located within the trusted execution environment. This target business computation contract can include one or more contract methods. Then, the target contract method corresponding to the contract method identifier within the target business computation contract can be retrieved. Specifically, the blockchain data can be the blockchain data required to execute the target contract method. Therefore, based on the contract execution data and the blockchain data, the target contract method can be executed in the trusted execution environment to obtain the business execution result of the blockchain business. By defining the data required to execute the target business computation contract through the interface contract corresponding to the target business computation contract, all the data required for the execution of the target business computation contract can be obtained once before execution, eliminating the need for repeated retrieval during the execution process. This makes the execution of the target business computation contract more efficient, thus making the execution of the blockchain business more efficient.

[0120] It should be noted that business data (both business data and blockchain data) can be encrypted using the public key of the trusted execution environment before being passed into the trusted execution environment. Based on this, before executing the target business computation contract in the trusted execution environment, the business data (both business data and blockchain data) can be decrypted using the private key of the trusted execution environment. Then, based on the contract execution data (contract execution data and blockchain data), the target business computation contract can be executed in the trusted execution environment to obtain the business execution result of the blockchain business. By encrypting the data to be passed into the trusted execution environment using the public key of the trusted execution environment outside the trusted execution environment, and decrypting the encrypted data inside the trusted execution environment using the private key of the trusted execution environment, the credibility of the data passed into the trusted execution environment can be improved.

[0121] It should also be noted that the business computation contracts deployed in the trusted execution environment are deployed in the form of compiled business computation contract files (specifically, binary compiled files). Based on contract execution data (contract execution data and blockchain data), the target business computation contract is executed in the trusted execution environment. Specifically, this means executing the binary compiled file of the target business computation contract in the trusted execution environment to obtain the business execution result of the blockchain business. Compiled files have smaller file sizes and higher execution efficiency. Deploying business computation contracts in the form of compiled files in the trusted execution environment not only saves storage space in the trusted execution environment but also accelerates the execution efficiency of business computation contracts, making the execution process of blockchain business more efficient.

[0122] S504 uploads the business execution results to the blockchain for storage and returns the business execution results to the business object.

[0123] In step S504, after obtaining the business execution result of the requested blockchain service, the business execution result can be uploaded to the blockchain for storage and returned to the business object. Regarding the process of returning the business execution result to the business object, the business execution result can be returned to the business object on demand. Specifically, according to the data return requirements of the business request, the result data to be returned can be selected from the business execution result and returned to the business object in plaintext or ciphertext (which can be encrypted using the private key of the trusted execution environment).

[0124] The process of uploading business execution results to the blockchain for storage can involve sending the business execution results to the blockchain by calling the interface contract corresponding to the target business computation contract. Specifically, the interface contract defines the data that needs to be uploaded to the blockchain for storage after the target business computation contract is executed. The business execution results can be assembled according to the definition of the interface contract. The interface contract corresponding to the target business computation contract can be called to send the business execution results to the blockchain, so that the blockchain stores the business execution results after verifying them and refuses to store them if the verification fails.

[0125] The blockchain's verification process for business execution results can include: legitimacy verification of the trusted execution environment, reliability verification of the business execution results, and consistency verification of the target business computation contract; among which:

[0126] ① Legitimacy verification of the trusted execution environment:

[0127] It can obtain the remote proof document corresponding to the target business computing contract and verify the legitimacy of the trusted execution environment based on the remote proof document; if the verification of the legitimacy of the trusted execution environment fails, it can be determined that the verification of the business execution result has failed; if the verification of the legitimacy of the trusted execution environment passes, then ② can be executed.

[0128] The remote proof document (Quote) corresponding to the target business computing contract can be generated and uploaded to the blockchain for storage after the target business computing contract is successfully deployed in the trusted execution environment. The remote proof document can include: a signature of the compiled file of the target business computing contract using the private key of the trusted execution environment, and a signature of the public key of the trusted execution environment using the private key of a remote trusted root (e.g., the private key of an official trusted institution). Based on this, the verification of the legitimacy of the trusted execution environment can include the following: verifying the signature of the public key of the trusted execution environment using the signature of the remote trusted root (e.g., the public key of an official trusted institution). If the signature verification of the public key of the trusted execution environment is successful, then the signature of the compiled file of the target business computing contract can be verified using the public key of the trusted execution environment. If the signature verification of the compiled file of the target business computing contract is successful, then the legitimacy verification of the trusted execution environment is confirmed to have passed; if the signature verification of the public key of the trusted execution environment fails, then the legitimacy verification of the trusted execution environment fails; if the signature verification of the compiled file of the target business computing contract fails, then the legitimacy verification of the trusted execution environment fails. It should be noted that the signature verification process for the public key of the trusted execution environment and the signature verification process for the compiled file of the target business computing contract is similar to the signature verification process for business data described above. For details, please refer to the signature verification process for business data described above, and it will not be repeated here.

[0129] By verifying the legitimacy of the trusted execution environment, it can be concluded that the trusted execution environment is a legitimate trusted execution environment recognized by a trusted organization.

[0130] ② Reliability of business execution results:

[0131] After executing the target business computation contract in the trusted execution environment and obtaining the business execution result of the requested blockchain business, the business execution result can be signed with the private key of the trusted execution environment. If the legitimacy verification of the trusted execution environment passes, the reliability of the business execution result can be verified. Specifically, the reliability verification refers to verifying the signature of the business execution result using the public key of the trusted execution environment. If the signature verification of the business execution result fails, that is, the reliability verification of the business execution result fails, then the verification of the business execution result is determined to have failed. If the signature verification of the business execution result succeeds, that is, the reliability verification of the business execution result succeeds, then ③ can be executed. The signature verification process for the business execution result is similar to the signature verification process for business data described above, and will not be repeated here.

[0132] By verifying the reliability of the business execution results, it can be concluded that the business execution results are reliable and recognized by the trusted execution environment.

[0133] ③ Consistency verification of the target business calculation contract:

[0134] After the target business computation contract is successfully deployed to the trusted execution environment, it needs to be uploaded to the blockchain for storage. If the verification of the business execution result is successful (i.e., the reliability verification of the business execution result is successful), then a consistency verification can be performed on the target business computation contract. Specifically, the consistency verification involves comparing the target business computation contract in the business execution result with the target business computation contract stored in the blockchain. If the target business computation contract in the business execution result is different from the target business computation contract stored in the blockchain, then the consistency verification of the target business computation contract has failed, and the verification of the business execution result has failed. If the target business computation contract in the business execution result is the same as the target business computation contract stored in the blockchain, then the consistency verification of the target business computation contract has succeeded, and the verification of the business execution result has passed.

[0135] The comparison between the target business computation contract in the business execution result and the target business computation contract stored in the blockchain can be performed using contract hashes. Specifically, after the target business computation contract is successfully deployed to the trusted execution environment, a hash algorithm can be used to calculate the contract hash based on the compiled file and the underlying dependency libraries of the target business computation contract. The contract hash can then be uploaded to the blockchain and bound to the corresponding interface contract of the target business computation contract uploaded to the blockchain. The business execution result can include the execution result of the target business computing contract, the target business computing contract (specifically, the compiled file of the target business computing contract), and the underlying dependency library of the target business computing contract. A hash algorithm can be used to calculate the contract hash corresponding to the business execution result based on the compiled file of the target business computing contract and the underlying dependency library of the target business computing contract in the business execution result. Then, the contract hash corresponding to the business execution result can be compared with the contract hash bound to the interface contract. If the contract hash corresponding to the business execution result is the same as the contract hash bound to the interface contract, it can be determined that the target business computing contract in the business execution result is the same as the target business computing contract stored in the blockchain. If the contract hash corresponding to the business execution result is different from the contract hash bound to the interface contract, it can be determined that the target business computing contract in the business execution result is different from the target business computing contract stored in the blockchain.

[0136] By comparing the consistency between the executed target business computation contract and the deployed target business computation contract, it can be determined that the executed target business computation contract has not been tampered with, thus improving the reliability of the business execution results. Furthermore, based on the irreversibility of hash algorithms, the reliability of the consistency verification process is guaranteed on the one hand, and on the other hand, comparisons are not required at the contract level, significantly reducing the amount of data to be compared. Blockchain can efficiently verify business execution results.

[0137] In this embodiment, all data involved in the blockchain business resides in a trusted execution environment (i.e., the business data involved in the blockchain business is transmitted to the trusted execution environment, and the target business computation contract involved in the blockchain business is deployed in the trusted execution environment). Furthermore, the target business computation contract is executed in the trusted execution environment. This means that the execution process of the blockchain business occurs within the trusted execution environment, which effectively protects the execution process from being publicly disclosed. Moreover, the target business computation contract and its corresponding interface contract cooperate with each other. Before the target business computation contract is executed, all the data required for its execution can be obtained at once through the interface contract, eliminating the need for repeated retrieval and effectively improving the execution efficiency of the blockchain business. Additionally, before the target business computation contract is formally executed, identity authentication of the business object can reject business requests from untrusted objects, thereby preventing untrusted objects from maliciously using trusted computing resources and causing the trusted computing resources to crash. Furthermore, the blockchain verifies the business execution results through the legitimacy verification of the trusted execution environment, the reliability verification of the business execution results, and the consistency verification of the target business computation contract, ensuring that the business execution results stored in the blockchain are reliable and trustworthy.

[0138] In the above Figure 5 Based on the blockchain-based data processing method illustrated above, this application provides a blockchain-based data processing method, which mainly introduces the deployment process of business computing contracts and interface contracts. This blockchain-based data processing method can be executed by a computer device, which can be the server 403 or trusted server 404 of the aforementioned blockchain-based data processing system. Figure 6 As shown, the blockchain-based data processing method may include, but is not limited to, the following steps S601-S606:

[0139] S601, in response to a contract deployment request sent by a contract deployment object, authenticates the identity of the contract deployment object.

[0140] S602 If the identity authentication of the contract deployment object is successful, then the contract to be deployed will be deployed.

[0141] In steps S601-S602, the contract deployment object can be an object requesting contract deployment, and the contract to be deployed can be carried in the contract deployment request. The identity of the contract deployment object can be authenticated. If the authentication of the contract deployment object is successful, the contract to be deployed can be deployed; if the authentication of the contract deployment object fails, the contract deployment request of the contract deployment object can be rejected. The process of authenticating the identity of the contract deployment object may include the following:

[0142] The contract to be deployed can be signed with the private key of the contract deployment object. The public key of the contract deployment object can be used to verify the signature of the contract to be deployed. If the verification fails, the authentication of the contract deployment object has failed. If the verification succeeds, a list of trusted objects (i.e., a whitelist) can be obtained. The trusted object list can include the object identifiers of one or more trusted objects. If the trusted object list includes the object identifier of the contract deployment object, the authentication of the contract deployment object has passed. If the trusted object list does not contain the object identifier of the business object, the authentication of the contract deployment object has failed. The verification process for the contract to be deployed is similar to the verification process for business data described above; please refer to the verification process for business data described above for details, which will not be repeated here.

[0143] By authenticating the contract deployment object, contract deployment requests from untrusted objects can be rejected, thereby preventing untrusted objects from maliciously using trusted computing resources and causing the trusted computing resources to crash.

[0144] The contracts to be deployed can include the target business computation contract and its corresponding interface contract. The target business computation contract can be deployed to a trusted execution environment, and the interface contract can be deployed to the blockchain. Specifically:

[0145] The deployment process of the target business computation contract can be described as follows: The target business computation contract can be compiled to obtain the compiled file of the target business computation contract, and then the compiled file of the target business computation contract can be deployed to the cache space of the trusted execution environment. After that, a hash algorithm can be used to calculate the contract hash based on the compiled file of the target business computation contract and the underlying dependency library of the target business computation contract; and a remote proof document corresponding to the target business computation contract can be generated (i.e., the compiled file of the target business computation contract is signed with the private key of the trusted execution environment, and the public key of the trusted execution environment is signed with the private key of a remote root of trust (e.g., the private key of an official trusted institution). The remote proof document can include both signatures.

[0146] The deployment process of the interface contract corresponding to the target business computing contract can be described as follows: The interface contract corresponding to the target business computing contract can be compiled to obtain the compiled file of the interface contract. The compiled file of the interface contract is deployed to the blockchain, and the contract hash (i.e. the contract hash calculated in the above-mentioned deployment process of the target business computing contract) is bound to the compiled file of the interface contract in the blockchain. The contract hash is obtained based on the calculation of the target business computing contract (specifically, it can refer to the compiled file of the target business computing contract).

[0147] After that, the remote proof file corresponding to the target business computing contract, the target business computing contract, the compiled file of the target business computing contract, and the underlying dependency library of the target business computing contract can be uploaded to the blockchain for storage.

[0148] S603 receives business requests sent by business objects.

[0149] In this embodiment, the execution process of step S603 is the same as described above. Figure 5 The execution process of step S501 in the illustrated embodiment is the same; for details, please refer to the above. Figure 5 The description of step S501 in the illustrated embodiment will not be repeated here.

[0150] S604 transmits business data to the trusted execution environment.

[0151] In this embodiment, the execution process of step S604 is the same as described above. Figure 5 The execution process of step S502 in the illustrated embodiment is the same; for details, please refer to the above. Figure 5 The description of step S502 in the illustrated embodiment will not be repeated here.

[0152] S605, based on contract execution data, executes the target business computation contract in a trusted execution environment to obtain the business execution result of the blockchain business.

[0153] In this embodiment, the execution process of step S605 is the same as described above. Figure 5 The execution process of step S503 in the illustrated embodiment is the same; for details, please refer to the above. Figure 5 The description of step S503 in the illustrated embodiment will not be repeated here.

[0154] S606 uploads the business execution results to the blockchain for storage and returns the business execution results to the business object.

[0155] In this embodiment, the execution process of step S606 is the same as described above. Figure 5 The execution process of step S504 in the illustrated embodiment is the same; for details, please refer to the above. Figure 5 The description of step S504 in the illustrated embodiment will not be repeated here.

[0156] In this embodiment, the target business computation contract is deployed to the cache space of the trusted execution environment, facilitating direct reading from the cache space during contract execution, which is both reliable and efficient. The corresponding interface contract is deployed on the blockchain, enabling data retrieval from the blockchain via the interface contract, again ensuring reliability and efficiency. Furthermore, the remote proof document, the target business computation contract itself, its compiled files, its underlying dependency libraries, and the contract hash calculated based on the target business computation contract are uploaded to the blockchain. Leveraging the blockchain's immutable and traceable characteristics, this facilitates verification of the business execution results based on the target business computation contract.

[0157] The above content focuses on the contract deployment and execution schemes based on the Gramine data processing operating system. The following content will focus on the data processing architecture of the Gramine data processing operating system, as well as the contract deployment and execution processes based on the data processing architecture.

[0158] Figure 7 The data processing architecture of the Gramine operating system is illustrated. This architecture can be viewed as a container (Docker container) and may include: a gateway, a runtime module, and a trusted execution environment (Enclave). Specifically:

[0159] (1) Gateway.

[0160] A gateway can be used to connect to the entry points or RPC network interfaces of various modules, and can specifically include:

[0161] The authentication module is used to authenticate the object initiating the request (e.g., the business object and contract deployment object mentioned above) to determine whether the object is trustworthy. When the object is determined to be trustworthy, the request can be responded to; when the object is determined to be untrustworthy, the request can be rejected, thus avoiding the waste of unnecessary computing resources.

[0162] The Blockchain Access module can be used to interact with the blockchain. For example, as mentioned above, it can upload the remote proof file corresponding to the target business computation contract, the target business computation contract itself, its compiled files, and its underlying dependency libraries to the blockchain for storage; it can also retrieve the data required for the execution of the business computation contract from the blockchain; and it can upload the execution results of the business computation contract to the blockchain for storage; and so on.

[0163] The Runtime Access module can be used to interact with the language runtime. After receiving the contract code, it can transfer the contract code to the corresponding runtime for compilation.

[0164] The Trusted Execution Environment Access module (also known as the Enclave Access module) can be used to interact with the Trusted Execution Environment. Typically, it sends the blockchain business to be executed and receives the execution results of the blockchain business.

[0165] (2) Language runtime module (Runtime).

[0166] The language runtime module can include multiple language runtimes, each corresponding to a different contract code writing language. For example, there is a Golang language runtime, a Rust language runtime, and a WASM compiler. It can be used to compile contract code written in the corresponding language into a compiled file (i.e., a binary compiled file, or a binary executable file) using the language runtime or the language compiler.

[0167] (3) Trusted Execution Environment (Enclave).

[0168] Data and code within a trusted execution environment are invisible, and the execution process cannot be interrupted or have its information stolen by external processes. Specifically, this can include:

[0169] A trusted contract interface (API) can include a contract invocation interface (Invoke Contract) and a remote proof interface (Get Quote); the contract invocation interface (Invoke Contract) can be used to invoke and execute business computation contracts, and the remote proof interface can be used to generate remote proof files.

[0170] Contract environments are cache spaces within a trusted execution environment, serving as storage areas for executable business computation contracts. By passing in the contract name identifier and contract method identifier, the corresponding business computation contract can be retrieved and executed. A contract environment can include multiple language standard libraries, each corresponding to a different contract code writing language. For example, it may include the Golang standard library, the Rust standard library, the WASM standard library, and the EVM (a code writing language) standard library, etc.

[0171] The underlying software environment support, which can include the underlying operating system (GNUC) and the corresponding underlying dependency library (GramineLibOS), can ensure the correct construction and execution of the upper-layer contract environment.

[0172] Based on the data processing architecture of the aforementioned data processing operating system (Gramine), the following section combines... Figure 8 Here is a summary of the contract deployment process:

[0173] ① The contract deployment object initiates a contract deployment request. The contract deployment request carries the contract to be deployed written by the business deployment object. The contract to be deployed may include the target business computing contract and the interface contract corresponding to the target business computing contract. The contract to be deployed is signed with the private key of the contract deployment object. The contract deployment request is sent to Gramine's gateway.

[0174] ② Gramine's gateway first authenticates the contract deployment object through the authentication module. It uses the public key of the contract deployment object to determine that the contract deployment request was sent by the contract deployment object and to determine that the contract deployment object is a trusted object in the whitelist, so as to prevent the contract deployment object from maliciously using computing resources and causing a crash.

[0175] ③ Gramine's gateway sends the contracts to be deployed to the language runtime module (Runtime) through the Runtime Access module. The language runtime module can call the corresponding language runtime to compile the target business computation contract and interface contract into compiled files (i.e., executable binary code; if the contract code is written in EVM, compilation is not required).

[0176] ④ Gramine's gateway deploys the compiled files of the target business computation contract to the Enclave for caching via the Enclave Access module. In addition, Gramine can use a hash algorithm to calculate the contract hash based on the compiled files and underlying dependencies of the target business computation contract; it can also generate a remote verification document (Quote) based on the target business computation contract (including the signature of the compiled files of the target business computation contract by the private key of the trusted execution environment, and the signature of the public key of the trusted execution environment by the remote root of trust).

[0177] ⑤ Gramine deploys the interface contract to the blockchain through the Blockchain Access module and binds it to the aforementioned contract hash.

[0178] ⑥ Gramine uploads the proof data to the blockchain for storage via the Blockchain Access module. This proof data may include: the remote proof file corresponding to the target business computation contract, the target business computation contract itself, the compiled files of the target business computation contract, and the underlying dependency libraries of the target business computation contract.

[0179] ⑦ Gramine returns the contract deployment result to the contract deployment object.

[0180] By deploying the target business computation contract to the cache space of the trusted execution environment, it is convenient to read directly from the cache space of the trusted execution environment when executing the target business computation contract, which is both reliable and efficient; and by deploying the interface contract corresponding to the target business computation contract in the blockchain, it is convenient to call the interface contract to obtain data from the blockchain, which is both reliable and efficient.

[0181] Based on the data processing architecture of the aforementioned data processing operating system (Gramine), the following section combines... Figure 9 Here is a summary of the contract execution process:

[0182] ① A business object initiates a business request, which may carry business data. The business data may include contract identification data (which may include contract name identifier and contract method identifier) ​​and contract execution data (i.e. contract parameters). Gramine may use the public key of the published trusted execution environment to encrypt the business data.

[0183] ② Gramine's gateway first authenticates the business object through the authentication module to determine that the contract deployment object is a trusted object in the whitelist, preventing the contract deployment object from maliciously using computing resources and causing a crash.

[0184] ③ Gramine uses the Blockchain Access module to call the interface contract to obtain the blockchain data required for the execution of the target business computing contract from the blockchain. After receiving the data acquisition parameters, the interface contract retrieves the corresponding blockchain data from the blockchain and returns it to Gramine. The blockchain data can be encrypted using the public key of the trusted execution environment.

[0185] ④ Gramine transmits business data and blockchain data to the trusted execution environment (Enclave) through the Enclave Access module. Within the Enclave, data can be decrypted using a private key. After decryption, based on the contract execution data and blockchain data, the Enclave executes the target contract method within the target business computation contract corresponding to the contract name identifier. The target contract method corresponds to the contract method identifier, yielding the business execution result. Afterward, Gramine can sign the business execution result using the private key. The business execution result can include: the execution result of the target business computation contract, the compiled file of the target business computation contract, the underlying dependency libraries of the target business computation contract, etc.

[0186] ⑤ Gramine calls the interface contract through the Blockchain Access module to upload the business execution results to the blockchain for storage. After the blockchain verifies the business execution results, it stores them. The blockchain's verification process for the business execution results may include: verification of the legitimacy of the trusted execution environment, verification of the reliability of the business execution results, and verification of the consistency of the target business computation contract.

[0187] ⑥ Gramine returns ciphertext or plaintext of specific parameters to the business object as needed by the business request.

[0188] All data involved in blockchain business resides within a trusted execution environment (i.e., the business data involved in the blockchain business is transmitted to the trusted execution environment, and the target business computation contracts involved in the blockchain business are deployed within the trusted execution environment). Furthermore, the target business computation contracts are executed within the trusted execution environment. In other words, the execution process of the blockchain business occurs within the trusted execution environment, which effectively protects the execution process from being disclosed. Moreover, the target business computation contracts and their corresponding interface contracts cooperate with each other. Before the target business computation contract is executed, all the data required for its execution can be obtained at once through the interface contract, eliminating the need for repeated retrieval and effectively improving the execution efficiency of the blockchain business.

[0189] The following section uses specific code examples to introduce business calculation contracts and interface contracts:

[0190] An interface contract defines the data required for the execution of its corresponding business computation contract, as well as the data that needs to be stored after the execution of the corresponding business computation contract. The interface contract is always stored on the blockchain. The existence of the interface contract ensures that its corresponding business computation contract can obtain all data before execution, eliminating the need for repeated retrieval during execution and thus guaranteeing efficiency. An example interface contract code for a money transfer business is shown below:

[0191]

[0192]

[0193] As shown in the code above:

[0194] The first line of code indicates that the data required to execute the business computation contract is obtained. The passed-in a, b, and amount represent that object a transfers amount to object b. All three parameters can be ciphertext encrypted with the public key of the trusted execution environment.

[0195] The dataPayload in lines 2-7 contains the contract methods in the business computing contract that need to be called, as well as all the data required to execute the business computing contract;

[0196] Line 8 indicates that dataPayload calls the certificate storage function, which is convenient for subsequent querying.

[0197] Line 9 indicates that dataPayload will be returned, where the data array is a ciphertext array;

[0198] Line 11 is the save method (which is generic), which means storing the business execution result on the blockchain. Here, sig represents the signature of the private key of the trusted environment, and payloadToSave refers to the encrypted data to be stored.

[0199] Line 12 is for signature verification. The public key / business computing contract of the trusted execution environment is global. By obtaining the public key, signature, and stored encrypted data here, we can verify that the business computing contract is indeed executed in the trusted environment and that the executed business computing contract is consistent with the one stored in the blockchain.

[0200] Lines 14-16 of the code store the data that needs to be stored in the blockchain.

[0201] The business computation contract primarily executes within a trusted execution environment. It connects to the data retrieval method in the interface contract and the data storage method in the interface contract, mainly used to execute blockchain business requests. First, the trusted execution environment decrypts the incoming encrypted data, and then passes it to the transfer calculation method in the business computation contract for the following example transfer business:

[0202]

[0203] As shown in the code above:

[0204] The second line of code ensures that object A has a sufficient balance;

[0205] The third line of code directly returns the execution result.

[0206] The methods of the embodiments of this application have been described in detail above. In order to facilitate better implementation of the above solutions of the embodiments of this application, the apparatus of the embodiments of this application is provided below.

[0207] Please see Figure 10 , Figure 10 This is a schematic diagram of a blockchain-based data processing device provided in an embodiment of this application. The data processing device can be installed in a computer device provided in the embodiment of this application. The computer device can be the server 403 or the trusted server 404 mentioned in the above method embodiment. Figure 10 The data processing apparatus shown may be a computer program (including program code) running on a computer device, which can be used to execute... Figure 5 or Figure 6 Some or all of the steps in the method embodiments shown. Please refer to [link / reference]. Figure 10 The data processing apparatus may include the following units:

[0208] The communication unit 1001 is used to receive business requests sent by a business object. The business requests carry business data of the requested blockchain business, including contract identification data and contract execution data.

[0209] Processing unit 1002 is used to transmit business data into a trusted execution environment, where a target business computing contract corresponding to the contract identifier data is deployed.

[0210] Processing unit 1002 is also used to execute the target business computation contract in a trusted execution environment based on contract execution data, and obtain the business execution result of the blockchain business;

[0211] The communication unit 1001 is also used to upload the business execution results to the blockchain for storage and return the business execution results to the business object.

[0212] In one implementation, the contract identification data includes a contract name identifier and a contract method identifier; one or more business computation contracts are deployed in the trusted execution environment; the processing unit 1002, based on the contract execution data, executes the target business computation contract in the trusted execution environment, and when obtaining the business execution result of the blockchain business, specifically performs the following steps:

[0213] Locate the target business computation contract corresponding to the contract name identifier in the trusted execution environment. The target business computation contract includes one or more contract methods.

[0214] Retrieve the target contract method corresponding to the contract method identifier in the target business computation contract;

[0215] Based on contract execution data, the target contract method is executed in a trusted execution environment to obtain the business execution results of the blockchain business.

[0216] In one implementation, an interface contract corresponding to the target business computation contract is deployed in the blockchain. The interface contract defines the data required to execute the target business computation contract.

[0217] The communication unit 1001 is also used to call the interface contract based on the definition of the interface contract to obtain the blockchain data required to execute the target business computing contract from the blockchain;

[0218] Processing unit 1002 is also used to transmit blockchain data into a trusted execution environment;

[0219] Processing unit 1002 is used to execute the target business computation contract in a trusted execution environment based on contract execution data, and to obtain the business execution result of the blockchain business. Specifically, it is used to perform the following steps:

[0220] Based on contract execution data and blockchain data, the target business computation contract is executed in a trusted execution environment to obtain the business execution results of the blockchain business.

[0221] In one implementation, business data and blockchain data are encrypted with the public key of the trusted execution environment before being passed into the trusted execution environment; the processing unit 1002 is also used to perform the following steps:

[0222] The business data is decrypted using the private key of the trusted execution environment;

[0223] The blockchain data is decrypted using the private key of the trusted execution environment.

[0224] In one implementation, before the processing unit 1002 transmits the business data to the trusted execution environment, it further performs the following steps:

[0225] Perform identity authentication on business objects;

[0226] After the business object is successfully authenticated, the step of transferring the business data into the trusted execution environment is triggered.

[0227] In one implementation, the business request also carries a signature of the business data, which is obtained by signing the business data using the private key of the business object; the processing unit 1002, when authenticating the business object, specifically performs the following steps:

[0228] The signature of the business data is verified using the public key of the business object.

[0229] If the signature verification of the business data is successful, a list of trusted objects is obtained. The list of trusted objects includes the object identifiers of one or more trusted objects.

[0230] If the list of trusted objects includes the object identifier of the business object, then the authentication of the business object is considered successful.

[0231] In one implementation, an interface contract corresponding to the target business computing contract is deployed in the blockchain. The interface contract defines the data that needs to be uploaded to the blockchain for storage after the target business computing contract is executed.

[0232] Communication unit 1001, when uploading the business execution result to the blockchain for storage, specifically performs the following steps:

[0233] The API contract sends the business execution result to the blockchain, so that the blockchain can store the business execution result after verifying it.

[0234] The business execution result is the data assembly according to the definition of the interface contract.

[0235] In one implementation, the business execution result includes the contract execution result of the target business computation contract, and the target business computation contract itself, wherein the business execution result is signed with the private key of the trusted execution environment; the blockchain verification process for the business execution result includes:

[0236] Obtain the remote proof document corresponding to the target business computing contract, and verify the legitimacy of the trusted execution environment based on the remote proof document;

[0237] If the legitimacy verification of the trusted execution environment passes, the public key of the trusted execution environment is used to verify the signature of the business execution result.

[0238] If the verification of the business execution result is successful, the target business calculation contract in the business execution result is compared with the target business calculation contract stored in the blockchain;

[0239] If the target business computation contract in the business execution result is the same as the target business computation contract stored in the blockchain, then the business execution result is verified.

[0240] In one implementation, the processing unit 1002 is further configured to perform the following steps:

[0241] In response to a contract deployment request sent by the contract deployment object, the identity of the contract deployment object is authenticated; the contract deployment request carries the contract to be deployed;

[0242] If the identity of the contract deployment object is successfully authenticated, the contract to be deployed will be deployed.

[0243] In one implementation, the contracts to be deployed include the target business computation contract and the corresponding interface contract; the processing unit 1002, when deploying the contracts to be deployed, specifically performs the following steps:

[0244] Deploy the target business computation contract into a trusted execution environment;

[0245] Deploy the interface contract to the blockchain.

[0246] In one implementation, when the processing unit 1002 deploys the target business computing contract to the trusted execution environment, it specifically performs the following steps:

[0247] The target business computing contract is compiled to obtain the compiled file of the target business computing contract;

[0248] Deploy the compiled files of the target business computation contract to the cache space of the trusted execution environment.

[0249] In one implementation, the processing unit 1002 is further configured to perform the following steps:

[0250] Generate a remote proof file corresponding to the target business computing contract;

[0251] The remote proof file of the target business computing contract, the compiled file of the target business computing contract, and the target business computing contract are uploaded to the blockchain for storage.

[0252] In one implementation, when deploying the interface contract to the blockchain, the processing unit 1002 specifically performs the following steps:

[0253] The interface contract is compiled to obtain the compiled interface contract file;

[0254] The compiled files of the interface contract are deployed to the blockchain, and the compiled files of the interface contract are hashed in the blockchain. The contract hash is calculated based on the target business calculation contract.

[0255] According to another embodiment of this application, Figure 10 The data processing apparatus shown can be constructed by combining each unit individually or entirely into one or more other units, or one or more of the units can be further divided into multiple functionally smaller units. This achieves the same operation without affecting the technical effects of the embodiments of this application. The above-mentioned units are based on logical function division. In practical applications, the function of one unit can be implemented by multiple units, or the function of multiple units can be implemented by one unit. In other embodiments of this application, the data processing apparatus may also include other units. In practical applications, these functions can also be implemented with the assistance of other units, and can be implemented collaboratively by multiple units.

[0256] According to another embodiment of this application, the following can be achieved by running on a general-purpose computing device, such as a computer, which includes processing elements and storage elements such as a central processing unit (CPU), random access memory (RAM), and read-only memory (ROM), a device capable of performing operations such as... Figure 5 or Figure 6 The computer program (including program code) for each step involved in some or all of the methods shown, to construct such a Figure 10 The data processing apparatus shown herein, and the blockchain-based data processing method for implementing the embodiments of this application, are described. The computer program may be recorded on, for example, a computer-readable storage medium, loaded onto the aforementioned computing device via the computer-readable storage medium, and run therein.

[0257] In this embodiment, upon receiving a business request from a business object, the business data of the requested blockchain business carried in the business request can be transmitted to a trusted execution environment. The business data may include contract identification data and contract execution data. Furthermore, a target business computation contract corresponding to the contract identification data is deployed in the trusted execution environment. Then, based on the contract execution data, the target business computation contract can be executed in the trusted execution environment to obtain the business execution result of the blockchain business. As can be seen from the above, in this embodiment, all data related to the blockchain business is located in a trusted execution environment (i.e., the business data related to the blockchain business is transmitted to the trusted execution environment, and the target business computation contract related to the blockchain business is deployed in the trusted execution environment). Moreover, the target business computation contract is executed in the trusted execution environment. In other words, the execution process of the blockchain business occurs within the trusted execution environment, which effectively protects the execution process of the blockchain business from being disclosed.

[0258] Based on the above methods and apparatus embodiments, this application provides a computer device, which may be the aforementioned server 403 or trusted server 404. Please refer to... Figure 11 , Figure 11 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Figure 11 The computer device shown includes at least a processor 1101, an input interface 1102, an output interface 1103, and a computer-readable storage medium 1104. The processor 1101, input interface 1102, output interface 1103, and computer-readable storage medium 1104 can be connected via a bus or other means.

[0259] The computer-readable storage medium 1104 can be stored in the memory of a computer device. The computer-readable storage medium 1104 is used to store computer programs, which include computer instructions. The processor 1101 is used to execute the program instructions stored in the computer-readable storage medium 1104. The processor 1101 (or CPU (Central Processing Unit)) is the computing and control core of the computer device. It is adapted to implement one or more computer instructions, specifically to load and execute one or more computer instructions to achieve corresponding method flows or corresponding functions.

[0260] This application also provides a computer-readable storage medium (Memory), which is a memory device in a computer device used to store programs and data. It is understood that the computer-readable storage medium here can include both built-in storage media in the computer device and extended storage media supported by the computer device. The computer-readable storage medium provides storage space that stores the operating system of the computer device. Furthermore, the storage space also stores one or more computer instructions suitable for loading and execution by a processor. These computer instructions can be one or more computer programs (including program code). It should be noted that the computer-readable storage medium here can be high-speed RAM or non-volatile memory, such as at least one disk storage device; optionally, it can also be at least one computer-readable storage medium located remotely from the aforementioned processor.

[0261] In some embodiments, the processor 1101 may load and execute one or more computer instructions stored in the computer-readable storage medium 1104 to implement the aforementioned related... Figure 5 or Figure 6The corresponding steps of the blockchain-based data processing method are shown. In a specific implementation, the computer instructions in the computer-readable storage medium 1104 are loaded by the processor 1101 and executed as follows:

[0262] Receive business requests sent by business objects. The business requests carry business data of the requested blockchain business, including contract identification data and contract execution data.

[0263] Business data is transmitted into a trusted execution environment, where a target business computation contract corresponding to the contract identifier data is deployed.

[0264] Based on contract execution data, the target business computation contract is executed in a trusted execution environment to obtain the business execution results of the blockchain business.

[0265] The business execution results are uploaded to the blockchain for storage, and the business execution results are returned to the business object.

[0266] In one implementation, the contract identification data includes a contract name identifier and a contract method identifier; one or more business computation contracts are deployed in the trusted execution environment; when the computer instructions in the computer-readable storage medium 1104 are loaded and executed by the processor 1101 based on the contract execution data, and the target business computation contract is executed in the trusted execution environment to obtain the business execution result of the blockchain business, the following steps are specifically performed:

[0267] Locate the target business computation contract corresponding to the contract name identifier in the trusted execution environment. The target business computation contract includes one or more contract methods.

[0268] Retrieve the target contract method corresponding to the contract method identifier in the target business computation contract;

[0269] Based on contract execution data, the target contract method is executed in a trusted execution environment to obtain the business execution results of the blockchain business.

[0270] In one implementation, an interface contract corresponding to the target business computation contract is deployed in the blockchain. The interface contract defines the data required to execute the target business computation contract. The computer instructions in the computer-readable storage medium 1104 are loaded by the processor 1101 and are also used to perform the following steps:

[0271] Based on the definition of the interface contract, the interface contract is called to obtain the blockchain data required to execute the target business computation contract from the blockchain;

[0272] Transmit blockchain data into a trusted execution environment;

[0273] When the computer instructions in the computer-readable storage medium 1104 are loaded and executed by the processor 1101 based on contract execution data, and the target business computation contract is executed in a trusted execution environment to obtain the business execution result of the blockchain business, the following steps are specifically performed:

[0274] Based on contract execution data and blockchain data, the target business computation contract is executed in a trusted execution environment to obtain the business execution results of the blockchain business.

[0275] In one implementation, business data and blockchain data are encrypted with the public key of the trusted execution environment before being passed into the trusted execution environment; computer instructions in computer-readable storage medium 1104 are loaded by processor 1101 and are also used to perform the following steps:

[0276] The business data is decrypted using the private key of the trusted execution environment;

[0277] The blockchain data is decrypted using the private key of the trusted execution environment.

[0278] In one implementation, before the computer instructions in the computer-readable storage medium 1104 are loaded and executed by the processor 1101 to pass business data into the trusted execution environment, they are also used to perform the following steps:

[0279] Perform identity authentication on business objects;

[0280] After the business object is successfully authenticated, the step of transferring the business data into the trusted execution environment is triggered.

[0281] In one implementation, the business request also carries a signature of the business data, which is obtained by signing the business data using the private key of the business object. When the computer instructions in the computer-readable storage medium 1104 are loaded and executed by the processor 1101 to authenticate the business object, they are specifically used to perform the following steps:

[0282] The signature of the business data is verified using the public key of the business object.

[0283] If the signature verification of the business data is successful, a list of trusted objects is obtained. The list of trusted objects includes the object identifiers of one or more trusted objects.

[0284] If the list of trusted objects includes the object identifier of the business object, then the authentication of the business object is considered successful.

[0285] In one implementation, an interface contract corresponding to the target business computing contract is deployed in the blockchain. The interface contract defines the data that needs to be uploaded to the blockchain for storage after the target business computing contract is executed.

[0286] When the computer instructions in the computer-readable storage medium 1104 are loaded and executed by the processor 1101 to upload the business execution result to the blockchain for storage, they are specifically used to perform the following steps:

[0287] The API contract sends the business execution result to the blockchain, so that the blockchain can store the business execution result after verifying it.

[0288] The business execution result is the data assembly according to the definition of the interface contract.

[0289] In one implementation, the business execution result includes the contract execution result of the target business computation contract, and the target business computation contract itself, wherein the business execution result is signed with the private key of the trusted execution environment; the blockchain verification process for the business execution result includes:

[0290] Obtain the remote proof document corresponding to the target business computing contract, and verify the legitimacy of the trusted execution environment based on the remote proof document;

[0291] If the legitimacy verification of the trusted execution environment passes, the public key of the trusted execution environment is used to verify the signature of the business execution result.

[0292] If the verification of the business execution result is successful, the target business calculation contract in the business execution result is compared with the target business calculation contract stored in the blockchain;

[0293] If the target business computation contract in the business execution result is the same as the target business computation contract stored in the blockchain, then the business execution result is verified.

[0294] In one implementation, the computer instructions in the computer-readable storage medium 1104 are loaded by the processor 1101 and are also used to perform the following steps:

[0295] In response to a contract deployment request sent by the contract deployment object, the identity of the contract deployment object is authenticated; the contract deployment request carries the contract to be deployed;

[0296] If the identity of the contract deployment object is successfully authenticated, the contract to be deployed will be deployed.

[0297] In one implementation, the contracts to be deployed include a target business computing contract and an interface contract corresponding to the target business computing contract; when the computer instructions in the computer-readable storage medium 1104 are loaded and executed by the processor 1101 to deploy the contracts to be deployed, they are specifically used to perform the following steps:

[0298] Deploy the target business computation contract into a trusted execution environment;

[0299] Deploy the interface contract to the blockchain.

[0300] In one implementation, when the computer instructions in the computer-readable storage medium 1104 are loaded and executed by the processor 1101 to deploy the target business computing contract to the trusted execution environment, they are specifically used to perform the following steps:

[0301] The target business computing contract is compiled to obtain the compiled file of the target business computing contract;

[0302] Deploy the compiled files of the target business computation contract to the cache space of the trusted execution environment.

[0303] In one implementation, the computer instructions in the computer-readable storage medium 1104 are loaded by the processor 1101 and are also used to perform the following steps:

[0304] Generate a remote proof file corresponding to the target business computing contract;

[0305] The remote proof file of the target business computing contract, the compiled file of the target business computing contract, and the target business computing contract are uploaded to the blockchain for storage.

[0306] In one implementation, when the computer instructions in the computer-readable storage medium 1104 are loaded and executed by the processor 1101 to deploy the interface contract to the blockchain, they are specifically used to perform the following steps:

[0307] The interface contract is compiled to obtain the compiled interface contract file;

[0308] The compiled files of the interface contract are deployed to the blockchain, and the compiled files of the interface contract are hashed in the blockchain. The contract hash is calculated based on the target business calculation contract.

[0309] In this embodiment, upon receiving a business request from a business object, the business data of the requested blockchain business carried in the business request can be transmitted to a trusted execution environment. The business data may include contract identification data and contract execution data. Furthermore, a target business computation contract corresponding to the contract identification data is deployed in the trusted execution environment. Then, based on the contract execution data, the target business computation contract can be executed in the trusted execution environment to obtain the business execution result of the blockchain business. As can be seen from the above, in this embodiment, all data related to the blockchain business is located in a trusted execution environment (i.e., the business data related to the blockchain business is transmitted to the trusted execution environment, and the target business computation contract related to the blockchain business is deployed in the trusted execution environment). Moreover, the target business computation contract is executed in the trusted execution environment. In other words, the execution process of the blockchain business occurs within the trusted execution environment, which effectively protects the execution process of the blockchain business from being disclosed.

[0310] According to one aspect of this application, a computer program product or computer program is provided, comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the blockchain-based data processing method provided in the various alternative embodiments described above.

[0311] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A data processing method based on blockchain, characterized in that, The method includes: Receive a business request sent by a business object, wherein the business request carries business data of the requested blockchain business, and the business data includes contract identification data and contract execution data; The business data is transmitted to a trusted execution environment, in which a target business computation contract corresponding to the contract identifier data is deployed; an interface contract corresponding to the target business computation contract is deployed in the blockchain, and the interface contract defines the data required to execute the target business computation contract; one business computation contract corresponds to one interface contract. When the contract execution data contained in the business data is less than the data required to execute the target business calculation contract, based on the definition of the interface contract, the interface contract is invoked to obtain the blockchain data required to execute the target business calculation contract from the blockchain; The blockchain data is then transmitted into the trusted execution environment. Based on the contract execution data and the blockchain data, the target business computation contract is executed in the trusted execution environment to obtain the business execution result of the blockchain business. The business execution result is uploaded to the blockchain for storage, and then returned to the business object.

2. The method as described in claim 1, characterized in that, The contract identification data includes a contract name identifier and a contract method identifier; one or more business computing contracts are deployed in the trusted execution environment; the execution of the target business computing contract in the trusted execution environment based on the contract execution data and the blockchain data to obtain the business execution result of the blockchain business includes: In the trusted execution environment, locate the target business computing contract corresponding to the contract name identifier, wherein the target business computing contract includes one or more contract methods; Obtain the target contract method in the target business computation contract that corresponds to the contract method identifier; Based on the contract execution data and the blockchain data, the target contract method is executed in the trusted execution environment to obtain the business execution result of the blockchain business.

3. The method as described in claim 1, characterized in that, The business data and the blockchain data are encrypted by the public key of the trusted execution environment before being transmitted to the trusted execution environment; the method further includes: The business data is decrypted using the private key of the trusted execution environment; The blockchain data is decrypted using the private key of the trusted execution environment.

4. The method as described in claim 1, characterized in that, Before transmitting the business data into the trusted execution environment, the method further includes: Perform identity authentication on the business object; After the identity of the business object is successfully authenticated, the step of transferring the business data into the trusted execution environment is triggered.

5. The method as described in claim 4, characterized in that, The business request also carries the signature of the business data, which is obtained by signing the business data using the private key of the business object; The authentication of the business object includes: The signature of the business data is verified using the public key of the business object. If the signature verification of the business data is successful, a list of trusted objects is obtained, which includes the object identifiers of one or more trusted objects. If the list of trusted objects includes the object identifier of the business object, then the authentication of the business object is deemed successful.

6. The method as described in claim 1, characterized in that, The blockchain contains an interface contract corresponding to the target business computing contract, which defines the data that needs to be uploaded to the blockchain for storage after the target business computing contract is executed. Uploading the business execution result to the blockchain for storage includes: The interface contract is invoked to send the business execution result to the blockchain, so that the blockchain stores the business execution result after verifying it. The business execution result is a data assembly process according to the definition of the interface contract.

7. The method as described in claim 6, characterized in that, The business execution result includes the contract execution result of the target business computing contract, and the target business computing contract, wherein the business execution result is signed by the private key of the trusted execution environment; The blockchain's verification process for the business execution result includes: Obtain the remote proof file corresponding to the target business computing contract, and verify the legitimacy of the trusted execution environment based on the remote proof file; If the legitimacy verification of the trusted execution environment passes, the public key of the trusted execution environment is used to verify the signature of the business execution result. If the signature verification of the business execution result is successful, the target business calculation contract in the business execution result is compared with the target business calculation contract stored in the blockchain; If the target business computation contract in the business execution result is the same as the target business computation contract stored in the blockchain, then the business execution result is determined to have passed verification.

8. The method as described in claim 1, characterized in that, The method further includes: In response to a contract deployment request sent by a contract deployment object, the identity of the contract deployment object is authenticated; the contract deployment request carries the contract to be deployed. If the identity of the contract deployment object is successfully authenticated, the contract to be deployed will be deployed.

9. The method as described in claim 8, characterized in that, The contracts that need to be deployed include the target business computing contract and the interface contract corresponding to the target business computing contract; The deployment of the contract to be deployed includes: Deploy the target business computing contract to the trusted execution environment; Deploy the interface contract to the blockchain.

10. The method as described in claim 9, characterized in that, Deploying the target business computing contract to the trusted execution environment includes: The target business computing contract is compiled to obtain the compiled file of the target business computing contract; The compiled file of the target business computing contract is deployed to the cache space of the trusted execution environment.

11. The method as described in claim 10, characterized in that, The method further includes: Generate a remote proof file corresponding to the target business computing contract; The remote proof file of the target business computing contract, the compiled file of the target business computing contract, and the target business computing contract are uploaded to the blockchain for storage.

12. The method as described in claim 9, characterized in that, Deploying the interface contract to the blockchain includes: The interface contract is compiled to obtain the compiled file of the interface contract; The compiled file of the interface contract is deployed to the blockchain, and a contract hash is bound to the compiled file of the interface contract in the blockchain. The contract hash is calculated based on the target business calculation contract.

13. A data processing device based on blockchain, characterized in that, The device includes: A communication unit is used to receive a business request sent by a business object. The business request carries business data of the requested blockchain business, including contract identification data and contract execution data. The processing unit is used to transmit the business data into a trusted execution environment, in which a target business computing contract corresponding to the contract identifier data is deployed; the blockchain deploys an interface contract corresponding to the target business computing contract, and the interface contract defines the data required to execute the target business computing contract; one business computing contract corresponds to one interface contract; The processing unit is further configured to, when the contract execution data contained in the business data is less than the data required to execute the target business calculation contract, based on the definition of the interface contract, call the interface contract to obtain the blockchain data required to execute the target business calculation contract from the blockchain; and transmit the blockchain data to the trusted execution environment; The processing unit is further configured to execute the target business computation contract in the trusted execution environment based on the contract execution data and the blockchain data, and obtain the business execution result of the blockchain business; The communication unit is also used to upload the business execution result to the blockchain for storage and to return the business execution result to the business object.

14. A computer device, characterized in that, The computer device includes: A processor is a tool for implementing computer programs. A computer-readable storage medium storing a computer program adapted to be loaded by the processor and executed as described in any one of claims 1 to 12.

15. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program adapted to be loaded by a processor and executed as described in any one of claims 1 to 12.

16. A computer program product, characterized in that, The computer program product includes computer instructions that, when executed by a processor, implement the blockchain-based data processing method as described in any one of claims 1 to 12.

Images