Transaction processing method and device, equipment and storage medium

Abstract

The embodiment of the invention discloses a transaction processing method and device, equipment and a storage medium, and can be applied to the field of block chains. The method comprises the steps that a transaction verification request initiated by an object node is acquired, the transaction verification request comprises a to-be-processed transaction and an object public key of a first object, and the to-be-processed transaction is initiated by the first object; generating a transaction authentication message based on the signature private key of the service node and the to-be-processed transaction; sending the transaction authentication message to a first communication address associated with the object public key, so that the object node initiates a transaction processing request to the block chain network after obtaining the transaction authentication message from the first communication address; wherein the transaction processing request comprises a to-be-processed transaction and a transaction authentication message, and the transaction processing request is used for requesting the block chain network to process the to-be-processed transaction after determining that the to-be-processed transaction is an effective transaction based on the transaction authentication message. By adopting the embodiment of the invention, the security of transaction processing can be improved, and the applicability is high.

Description

Technical Field

[0001] The present application relates to the field of blockchain, and in particular to a transaction processing method, device, equipment and storage medium. Background Art

[0002] With the continuous development of blockchain technology, based on the security and reliability of blockchain network storage transactions, more and more transactions rely on blockchain networks for storage to ensure the security and non-tamperability of transaction storage. Currently, when storing transactions in blockchain networks, the objects usually submit pending transactions directly to the blockchain network, and the blockchain network reaches consensus on the pending transactions and finally stores the blocks on the chain.

[0003] However, the pending transactions received by the current blockchain network mainly rely on the object private key to achieve transaction validity and security, resulting in low security in transaction processing. Summary of the invention

[0004] The embodiments of the present application provide a transaction processing method, apparatus, device, and storage medium, which can improve the security of transaction processing and have high applicability.

[0005] On the one hand, an embodiment of the present application provides a transaction processing method, the method comprising:

[0006] Obtaining a transaction verification request initiated by the object node, the transaction verification request including the transaction to be processed and the object public key of the first object, the transaction to be processed being initiated by the first object;

[0007] Generate a transaction authentication message based on the signature private key of the service node and the above pending transaction;

[0008] Send the transaction authentication message to the first communication address associated with the object public key, so that the object node obtains the transaction authentication message from the first communication address and then initiates a transaction processing request to the blockchain network;

[0009] Among them, the above-mentioned transaction processing request includes the above-mentioned pending transaction and the above-mentioned transaction authentication message, and the above-mentioned transaction processing request is used to request the above-mentioned blockchain network to process the above-mentioned pending transaction after determining that the above-mentioned pending transaction is a valid transaction based on the above-mentioned transaction authentication message.

[0010] On the other hand, an embodiment of the present application provides a transaction processing method, the method comprising:

[0011] Obtaining a transaction processing request initiated by the target node, wherein the transaction processing request includes a pending transaction and a transaction authentication message;

[0012] The transaction authentication message is generated by the service node based on the signature private key of the service node and the transaction to be processed after the service node obtains the transaction verification request initiated by the object node for the transaction to be processed, and is sent to the first communication address;

[0013] The first communication address is associated with the object public key of the first object initiating the transaction to be processed;

[0014] The transaction processing request is submitted by the object node after obtaining the transaction authentication message through the first communication address;

[0015] Determine the transaction validity of the pending transaction based on the signature public key of the service node and the transaction authentication message;

[0016] In response to determining that the pending transaction is a valid transaction, the pending transaction is processed.

[0017] On the other hand, an embodiment of the present application provides a transaction processing device, the device comprising:

[0018] A first acquisition module is used to acquire a transaction verification request initiated by an object node, wherein the transaction verification request includes a pending transaction and an object public key of a first object, and the pending transaction is initiated by the first object;

[0019] An information generation module, used to generate a transaction authentication message based on the signature private key of the service node and the above-mentioned pending transaction;

[0020] An information sending module, used to send the transaction authentication message to a first communication address associated with the object public key, so that the object node obtains the transaction authentication message from the first communication address and then initiates a transaction processing request to the blockchain network;

[0021] Among them, the above-mentioned transaction processing request includes the above-mentioned pending transaction and the above-mentioned transaction authentication message, and the above-mentioned transaction processing request is used to request the above-mentioned blockchain network to process the above-mentioned pending transaction after determining that the above-mentioned pending transaction is a valid transaction based on the above-mentioned transaction authentication message.

[0022] On the other hand, an embodiment of the present application provides a transaction processing device, the device comprising:

[0023] A second acquisition module is used to acquire a transaction processing request initiated by the target node, wherein the transaction processing request includes a pending transaction and a transaction authentication message;

[0024] The transaction authentication message is generated by the service node based on the signature private key of the service node and the transaction to be processed after the service node obtains the transaction verification request initiated by the object node for the transaction to be processed, and is sent to the first communication address;

[0025] The first communication address is associated with the object public key of the first object initiating the transaction to be processed;

[0026] The transaction processing request is submitted by the object node after obtaining the transaction authentication message through the first communication address;

[0027] A transaction verification module, used to determine the transaction validity of the pending transaction based on the signature public key of the service node and the transaction authentication message;

[0028] The transaction processing module is used to process the transaction to be processed in response to determining that the transaction to be processed is a valid transaction.

[0029] On the other hand, an embodiment of the present application provides an electronic device, including a processor and a memory, wherein the processor and the memory are connected to each other;

[0030] The memory is used to store computer programs;

[0031] The above-mentioned processor is used to execute the transaction processing method provided in the embodiment of the present application when calling the above-mentioned computer program.

[0032] On the other hand, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the transaction processing method provided by the embodiment of the present application.

[0033] On the other hand, an embodiment of the present application provides a computer program product, which includes a computer program. When the above computer program is executed by a processor, it implements the transaction processing method provided by the embodiment of the present application.

[0034] In the embodiment of the present application, before the object node submits the pending transaction to the blockchain network, the service node can obtain the transaction verification request initiated by the object node to send a transaction authentication message to the object node for validating the pending transaction processing. In this case, the blockchain network can obtain the transaction processing request including the transaction authentication message, so that the validity of the pending transaction can be determined in advance based on the transaction authentication message before the blockchain network reaches a consensus on the pending transaction to ensure that the pending transaction is initiated by the corresponding object, thereby ensuring the security of transaction processing and high applicability. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0036] Figure 1 It is a schematic diagram of the system architecture provided by the embodiment of the present application;

[0037] Figure 2 It is a timing diagram of the transaction processing method provided in the embodiment of the present application;

[0038] Figure 3 It is a schematic diagram of a transaction processing scenario provided by an embodiment of the present application;

[0039] Figure 4 It is a schematic diagram of a scenario for generating an object private key provided in an embodiment of the present application;

[0040] Figure 5 It is a schematic diagram of a scenario for retrieving a private key of an object provided in an embodiment of the present application;

[0041] Figure 6 It is a structural diagram of a data sharing system provided in an embodiment of the present application;

[0042] Figure 7 This is a schematic diagram of the blockchain structure provided by the embodiment of the present application;

[0043] Figure 8 It is a structural schematic diagram of a transaction processing device provided in an embodiment of the present application;

[0044] Fig. 9 is another structural schematic diagram of the transaction processing device provided in an embodiment of the present application;

[0045] Fig.10 It is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0046] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0047] The embodiments of the present application can be applied to the blockchain field, and can be used to verify the validity of pending transactions submitted to the blockchain network, thereby improving transaction security and stability.

[0048] See also Figure 1 , Figure 1 It is a schematic diagram of the system architecture provided in an embodiment of the present application. Figure 1 The system architecture shown includes a service node 10, an object node 20, and a blockchain network 30.

[0049] The service node 10 may obtain the transaction verification request initiated by the target node 20 .

[0050] The transaction verification request is submitted to the service node by the object node 20 after obtaining the pending transaction initiated by the first object, and the transaction verification request includes the pending transaction and the object public key of the first object.

[0051] After obtaining the transaction verification request, the service node 10 can generate a transaction authentication message based on the signature private key of the service node 10 and the transaction to be processed, and send the transaction authentication message to the first communication address associated with the object public key, so that the object node 20 can obtain the transaction authentication message from the first communication address.

[0052] Among them, the transaction authentication message is used by the blockchain network 30 to verify the transaction validity of the transaction to be processed.

[0053] For the blockchain network 30, the blockchain network 30 can obtain the transaction processing request initiated by the object node 20 after obtaining the transaction authentication message. The transaction processing request is used to request the blockchain network 30 to process the pending transaction.

[0054] The transaction processing request includes pending transactions and transaction authentication messages.

[0055] Furthermore, after receiving the transaction processing request, the blockchain network 30 can determine the transaction validity of the pending transaction based on the signature public key and transaction authentication message of the service node 10, and process the pending transaction when it is determined that the pending transaction is a valid transaction.

[0056] The object node 20 and the service node 10 may be servers or terminal devices, which is not limited here.

[0057] The terminal device may be a personal computer, a laptop, a smart phone, a tablet computer, a smart watch, an intelligent voice interaction device, a smart home appliance, a vehicle-mounted terminal, and an intelligent wearable device, but is not limited thereto. The server may be an independent physical server, or a server cluster or distributed system consisting of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms.

[0058] The service node 10 generates and distributes transaction authentication messages based on an authentication service running in a trusted execution environment (TEE).

[0059] Among them, TEE is a secure area within the Central Processing Unit (CPU). TEE runs in an independent environment and runs in parallel with the operating system. The CPU ensures that the confidentiality and integrity of the code and data in the TEE are protected. The CPU uses both hardware and software to protect data and code, making TEE more secure than the operating system. Trusted applications running in TEE can access the full functionality of the device's main processor and memory, while hardware isolation protects the components of these trusted applications from being affected by user-installed applications running in the main operating system.

[0060] As a technology of trusted computing, TEE can divide independent trusted areas in the CPU and memory, and isolate the running environments of different trusted applications (TA) in the CPU and memory, preventing different TAs from accessing each other's data. Even TAs with higher privileges cannot access across boundaries.

[0061] See also Figure 2 , Figure 2 Schematic diagram of the timing of the transaction processing method provided in the embodiment of the present application. Figure 2 The transaction processing method provided in the embodiment of the present application may specifically include the following steps:

[0062] Step S21: Obtain a transaction verification request.

[0063] In some feasible implementations, the transaction verification request includes the transaction to be processed and the object public key of the first object, and the transaction to be processed is initiated by the first object.

[0064] The transaction verification request is initiated by the object node to the service node after receiving the pending transaction initiated by the first object.

[0065] Among them, the transaction verification request is used to request the service node to generate a transaction authentication message, and the transaction authentication message is used to enable the blockchain network to determine the transaction validity of the transaction to be processed based on the transaction authentication message.

[0066] Step S22: Generate a transaction authentication message based on the signature private key of the service node and the pending transaction.

[0067] In some feasible implementations, after obtaining the transaction verification request, the service node may obtain the transaction to be processed and the object public key of the first object in the transaction verification request.

[0068] Furthermore, the service node may sign the first information based on the signature private key of the service node to obtain the first signature information.

[0069] The first signature information includes at least one of the transaction to be processed, the object public key and the signature expiration time.

[0070] The first signature information is valid within the signature expiration time.

[0071] As an example, the service node may sign the transaction to be processed, the object public key, and the signature expiration time based on the signature private key of the service node to obtain the first signature information.

[0072] For example, if the transaction to be processed is payload, the object public key of the first object is upk, and the signature expiration time is expiredtime, the first information can be expressed as: message (payload|upk|expiredtime). In this case, the service node can sign the pair (payload|upk|expiredtime) based on the signature private key of the service node to obtain the first signature information S.

[0073] Furthermore, after determining the first signature information, the service node may use the first signature information as a transaction authentication message.

[0074] Alternatively, after determining the first signature information, the service node may generate a transaction authentication message based on the first signature information and the signature expiration time.

[0075] For example, the service node may concatenate the first signature information and the signature expiration time, and serialize the concatenated information to obtain a transaction authentication message.

[0076] As an example, the first signature information is S, and the signature expiration time is expiredtime, then S and expiredtime can be concatenated and serialized to obtain the transaction authentication message authenticationMsg.

[0077] In some feasible implementations, the transaction authentication message is generated by the service node based on an authentication service running in a trusted execution environment.

[0078] Among them, the service node needs to initialize the authentication service before generating a transaction authentication message, and generate a signature key pair when initializing the authentication service. The signature key pair includes a node private key and a node public key of the service node.

[0079] Further, the service node may determine a self-signed certificate including a first public key hash of a signature public key of the service node and code metric information of the authentication service.

[0080] Among them, the service node can sign the signature public key based on the signature private key to obtain a self-signed certificate.

[0081] Among them, the first public key hash of the signature public key and the code measurement information of the authentication service can be added in the extension field of the self-signed certificate.

[0082] The code measurement information of the authentication service is used to verify the validity of the authentication service, such as whether the code and configuration information of the authentication service have been tampered with or are secure.

[0083] The code measurement information of the authentication service includes, but is not limited to, the hash measurement of the authentication service code, the signature of the hardware manufacturer on the hash measurement of the authentication service code, the signature of the hardware manufacturer on the hardware public key, and other information.

[0084] Furthermore, the service node may send the self-signed certificate to the blockchain network, so that the blockchain network can process subsequently received transaction processing requests after determining that the authentication service meets the authentication conditions based on the self-signed certificate.

[0085] Among them, after the blockchain network determines that the authentication service meets the authentication conditions, the service node can obtain the transaction verification request initiated by the object node and generate a transaction authentication message for the pending transaction.

[0086] Step S23: Send the transaction authentication message to the first communication address.

[0087] In some feasible implementations, after determining the transaction authentication message, the service node may send the transaction authentication message to the first communication address.

[0088] The first communication address is associated with the object public key of the first object.

[0089] Among them, the first communication address can be an email address, domain name, IP address or other application contact information and other communication addresses, which can be determined based on the actual application scenario requirements and are not limited here.

[0090] The communication address associated with the object public key may be pre-set for the first object and sent to the service node.

[0091] Alternatively, the object public key of the first object is the first communication address of the first object, such as the email address of the first object is the object public key of the first object.

[0092] In some feasible implementations, the transaction verification request initiated by the object node also includes a communication certificate of the service provider corresponding to the first communication address.

[0093] In this case, to ensure that the transaction authentication message can be transmitted securely, the service node can verify the legitimacy of the service provider's communication service based on the service provider's communication certificate when sending the transaction authentication message to the first communication address. If the service provider's communication service passes the legitimacy verification, the transaction authentication message is sent to the first communication address, so that the object node can obtain the transaction authentication message from the first communication address and initiate a transaction processing request to the blockchain network.

[0094] Step S24: Obtain a transaction processing request initiated by the target node after obtaining the transaction authentication message from the first communication address.

[0095] In some feasible implementations, after the object node obtains the transaction authentication message from the first communication address and initiates a transaction processing request, the blockchain network may obtain the transaction processing request initiated by the object node.

[0096] The transaction processing request initiated by the object node includes the transaction to be processed and the transaction authentication message obtained from the first communication address.

[0097] Among them, after the service node obtains the transaction verification request initiated by the object node for the pending transaction, the transaction authentication message is generated and sent to the first communication address based on the signature private key of the service node and the pending transaction.

[0098] Step S25: Determine the transaction validity of the pending transaction based on the signature public key of the service node and the transaction authentication message.

[0099] In some feasible implementations, after obtaining the transaction authentication message, the blockchain network can determine the transaction validity of the pending transaction based on the signature public key of the service node and the transaction authentication message.

[0100] Among them, the blockchain network can determine the transaction validity of pending transactions based on smart contracts.

[0101] Specifically, the blockchain network can determine the first signature information and the signature expiration time based on the transaction authentication message.

[0102] For example, the transaction authentication message is obtained by the service node concatenating and serializing the first signature information and the signature expiration time. The blockchain network can deserialize and split the transaction authentication message to obtain the first signature information and the signature expiration time.

[0103] As an example, the first signature information is S, the signature expiration time is expiredtime, and the service node concatenates and serializes S and expiredtime to obtain the transaction authentication message authenticationMsg. The blockchain network can deserialize and split authenticationMsg to obtain the first signature information S and the signature expiration time expiredtime.

[0104] Furthermore, the blockchain network can determine whether the first signature information is expired based on the signature expiration time, that is, determine whether the current time is before the signature expiration time. If the current time is after the signature expiration time, the blockchain network can determine that the first signature information is expired, stop the transaction validity verification process and stop processing the pending transaction, and return relevant error information to the object node.

[0105] If the current time is before the signature expiration time, the blockchain network can determine that the first signature information has not expired. In this case, the blockchain network can verify the validity of the first signature information based on the signature public key of the service node, the pending transaction, the object public key of the first object, and the signature expiration time.

[0106] If the first signature information passes the signature validity verification, the blockchain network can determine that the pending transaction is a valid transaction. If the first signature does not pass the signature validity verification, the blockchain network can determine that the pending transaction is an invalid transaction.

[0107] The blockchain network may obtain the object public key of the first object through the transaction processing request, that is, the transaction processing request may also include the object public key of the first object. Alternatively, the blockchain network may obtain the object public key of the first object through the object node in advance, which may be determined based on the actual application scenario requirements and is not limited here.

[0108] Among them, when verifying the validity of the first signature information, the blockchain network can input the signature public key of the service node, the transaction to be processed, the object public key of the first object, the signature expiration time and the first signature information into the first signature verification function, and determine whether the first signature information passes the signature message verification based on the output result of the first signature verification function.

[0109] Among them, the first signature verification function can be a signature verification function of an identity-based digital signature (Identity-Based Signature, IBS) algorithm, or other signature verification functions, which can be determined based on the actual application scenario requirements and are not limited here.

[0110] Among them, the IBS algorithm belongs to the Identity-Based Cryptography (IBC) algorithm. The identity-based cryptography algorithm is a type of public key cryptography. The public key of this algorithm can be meaningful information in the real world, such as email addresses, domain names, and IP addresses. Identity-based cryptographic algorithms mainly include identity-based signature algorithms (IBS) and identity-based encryption algorithms (IBE).

[0111] In some feasible implementations, the transaction processing request may further include second signature information, and the second signature information is obtained after the object node signs the transaction to be processed based on the object private key of the first object.

[0112] Optionally, the transaction processing request initiated by the object node may include the transaction to be processed, the transaction authentication message, the second signature information, and the object public key of the first object.

[0113] As an example, a transaction processing request can be expressed as: (payload|authenticationMsg|Sig(payload)|upk). Wherein, payload is the transaction to be processed, authenticationMsg is the transaction authentication message obtained by the object node from the first communication address, upk is the object public key of the first object, and Sig(payload) is the second signature information obtained after the object node signs the transaction to be processed based on the object private key of the first object.

[0114] Furthermore, before the blockchain network determines the transaction validity of the pending transaction based on the transaction authentication message, it may verify the signature validity of the second signature information based on the node public key of the service node, the object public key of the first object and the pending transaction.

[0115] Among them, by verifying the validity of the signature of the second signature information and determining whether the first signature information is expired based on the signature expiration time, attackers can be further prevented from using historical transaction information to conduct transaction attacks, thereby further ensuring the security of transaction processing in the blockchain network.

[0116] Among them, the blockchain network can input the public key of the service node, the object public key of the first object, the transaction to be processed and the second signature information into the second signature verification function, and determine whether the second signature passes the signature validity verification based on the output result of the second signature verification function.

[0117] The second signature verification function is used to verify whether the second signature information is obtained by signing the transaction to be processed with the object public key of the first object.

[0118] Among them, the second signature verification function can be a verification function of the Elliptic Curve Digital Signature Algorithm (ECDSA) algorithm, or other verification functions. The specific function can be determined based on the actual application scenario requirements and is not limited here.

[0119] If the second signature information passes the signature validity verification, the blockchain network can further determine the transaction validity of the pending transaction based on the transaction authentication message. If the second signature information fails to pass the signature validity verification, the blockchain network will no longer determine the transaction validity of the pending transaction, nor will it perform subsequent processing on the pending transaction, and will return relevant error information to the target node.

[0120] In some feasible implementations, in order to improve transaction processing efficiency, after receiving a transaction processing request, the blockchain network may determine whether the pending transaction meets the transaction verification conditions. If the pending transaction meets the transaction verification conditions, the signature validity of the second signature information and the signature validity of the first signature information may be further verified.

[0121] The transaction verification condition satisfied by the pending transaction may be at least one of the following:

[0122] The transaction amount of the pending transaction is greater than the preset amount;

[0123] The submission time of the pending transaction is within the preset time range;

[0124] The first subject is the subject on the verification list;

[0125] The transaction to be processed is the Nth transaction submitted by the first object, where N is greater than or equal to 1;

[0126] The transaction type of the pending transaction belongs to preset transaction.

[0127] It should be noted that the above-mentioned pending transactions satisfying the transaction verification conditions are only examples, which can be determined based on the actual application scenario requirements and are not limited here.

[0128] In some feasible implementations, the transaction authentication message is generated by the service node based on an authentication service running in a feasible execution environment.

[0129] In this case, before obtaining the transaction processing request, the blockchain network node can also obtain the self-signed certificate submitted by the service node. The self-signed certificate includes the first public key hash of the signature public key of the service node and the code measurement information of the authentication service.

[0130] The self-signed certificate may also include the signature public key of the service node.

[0131] Among them, the first public key hash of the signature public key and the code measurement information of the authentication service can be added in the extension field of the self-signed certificate.

[0132] The code measurement information of the authentication service is used to verify the validity of the authentication service, such as whether the code and configuration information of the authentication service have been tampered with or are secure.

[0133] The code measurement information of the authentication service includes, but is not limited to, the hash measurement of the authentication service code, the signature of the hardware manufacturer on the hash measurement of the authentication service code, the signature of the hardware manufacturer on the hardware public key, and other information.

[0134] Among them, after the blockchain network receives the self-signed certificate sent by the service node and determines that the code measurement information in the extended field of the self-signed certificate has passed the legitimacy verification, the self-signed certificate can be stored on the chain through consensus and facilitate the acquisition of the self-signed certificate and related information in the certificate (such as the node public key, the first public key hash of the node public key, etc.).

[0135] The blockchain network can obtain the transaction processing request submitted by the object node when it is determined that the authentication service meets the authentication conditions.

[0136] Among them, the certification service meets the certification conditions including at least one of the following:

[0137] The second public key hash of the signature public key obtained by the blockchain network is consistent with the first public key hash;

[0138] The code metrics information of the authentication service is verified through service validity.

[0139] Among them, the blockchain network can verify the validity of the measurement information in the extended field of the self-signed certificate through remote proof or other locally deployed certificate cache services (such as PCCS services). The code measurement information of the authentication service passes the service validity verification, indicating that the code information of the authentication service of the service node has not been tampered with, the authentication service is a reliable service, and the transaction authentication message it generates is a reliable message.

[0140] Among them, the second public key hash of the signature public key obtained by the blockchain network is consistent with the first public key hash, indicating that the signature public key obtained by the blockchain network is generated by the service node and can be used for subsequent transaction validity verification.

[0141] Step S26: In response to determining that the pending transaction is a valid transaction, the pending transaction is processed.

[0142] In some feasible implementations, after determining that the pending transaction is a valid transaction, the blockchain network may perform consensus processing on the pending transaction, and store the pending transaction on the chain after the pending transaction passes the consensus verification.

[0143] Combine the following Figure 3 The transaction verification and processing process provided in the embodiment of the present application are further explained. Figure 3 This is a schematic diagram of a transaction processing scenario provided by an embodiment of the present application, which may specifically include the following steps:

[0144] Step 1: The service node initializes the authentication service before generating a transaction authentication message, and generates a signature key pair when initializing the authentication service. The signature key pair includes a node private key and a node public key of the service node.

[0145] Further, the service node may determine a self-signed certificate including a first public key hash of a signature public key of the service node and code metric information of the authentication service.

[0146] Among them, the service node can sign the signature public key based on the signature private key to obtain a self-signed certificate.

[0147] Among them, the first public key hash of the signature public key and the code measurement information of the authentication service can be added in the extension field of the self-signed certificate.

[0148] The code measurement information of the authentication service is used to verify the validity of the authentication service, such as whether the code and configuration information of the authentication service have been tampered with or are secure.

[0149] The code measurement information of the authentication service includes, but is not limited to, the hash measurement of the authentication service code, the signature of the hardware manufacturer on the hash measurement of the authentication service code, the signature of the hardware manufacturer on the hardware public key, and other information.

[0150] Furthermore, the service node may send the self-signed certificate to the blockchain network, so that the blockchain network can process subsequently received transaction processing requests after determining that the authentication service meets the authentication conditions based on the self-signed certificate.

[0151] Step 2: The blockchain network can verify the validity of the measurement information in the extended field of the self-signed certificate through remote proof. The code measurement information of the authentication service passes the service validity verification, indicating that the code information of the authentication service of the service node has not been tampered with, the authentication service is a reliable service, and the transaction authentication message it generates is a reliable message.

[0152] Step 3: After receiving the pending transaction initiated by the first object, the object node initiates a transaction verification request to the service node.

[0153] The transaction verification request includes the transaction to be processed and the object public key of the first object.

[0154] Step 4: The service node generates a transaction authentication message based on the service node's signature private key and the pending transaction.

[0155] The service node may sign the first information based on the signature private key of the service node to obtain the first signature information.

[0156] The first signature information includes at least one of the transaction to be processed, the object public key and the signature expiration time.

[0157] Among them, the service node can splice the first signature information and the signature expiration time, and serialize the spliced ​​information to obtain a transaction authentication message.

[0158] Step 5: The service node sends the transaction authentication message to the first communication address associated with the object public key.

[0159] Among them, the first communication address can be an email address, domain name, IP address or other application contact information and other communication addresses, which can be determined based on the actual application scenario requirements and are not limited here.

[0160] The object public key of the first object is the first communication address of the first object. For example, the email address of the first object is the object public key of the first object.

[0161] Step 6: The blockchain network obtains a transaction processing request initiated by the object node after obtaining the transaction authentication message from the first communication address.

[0162] After the object node obtains the transaction authentication message from the first communication address and initiates a transaction processing request, the blockchain network can obtain the transaction processing request initiated by the object node.

[0163] The transaction processing request initiated by the object node includes the transaction to be processed and the transaction authentication message obtained from the first communication address.

[0164] The transaction processing request also includes second signature information, and the second signature information is obtained after the object node signs the transaction to be processed based on the object private key of the first object.

[0165] For example, the transaction processing request initiated by the object node may include the transaction to be processed, the transaction authentication message, the second signature information, and the object public key of the first object.

[0166] Step 7: The blockchain network verifies the validity of the pending transaction based on the transaction processing request, and processes the pending transaction if it is a valid transaction.

[0167] After receiving the transaction processing request, the blockchain network can determine whether the pending transaction meets the transaction verification conditions. If the pending transaction meets the transaction verification conditions, the public key of the service node, the object public key of the first object, the pending transaction and the second signature information can be input into the second signature verification function, and the second signature can be determined based on the output result of the second signature verification function to determine whether the second signature passes the signature validity verification.

[0168] If the second signature information passes the signature validity verification, the blockchain network can determine the first signature information and signature expiration time based on the transaction authentication message.

[0169] Furthermore, the blockchain network can determine whether the first signature information is expired based on the signature expiration time. When the blockchain network determines that the first signature information has not expired, the blockchain network can verify the validity of the first signature information based on the signature public key of the service node, the pending transaction, the object public key of the first object, and the signature expiration time.

[0170] If the first signature information passes the signature validity verification, the blockchain network can determine that the pending transaction is a valid transaction. After determining that the pending transaction is a valid transaction, the blockchain network can process the pending transaction through consensus and store it on the chain after the pending transaction passes the consensus verification.

[0171] In an embodiment of the present application, when the transaction processing request includes a second signature obtained by the object node to sign the transaction to be processed based on the object private key of the first object, the object private key of the first object is generated by the service node through a key generation service.

[0172] Among them, the key generation service runs in the trusted execution environment of the service node.

[0173] Specifically, the service node may obtain a private key generation request submitted by the object node through a secure channel, where the private key generation request includes the object public key of the first object.

[0174] After obtaining the private key generation request, the service node may determine whether there is a key pair including the object public key of the first object in the public and private key list stored locally in the service node.

[0175] The public and private key lists may be stored in the trusted execution environment of the service node.

[0176] Among them, after the service node generates a private key for any object node, it will store the object public key and object private key of the node as a key pair in the local public and private key list.

[0177] If the service node determines that there is a key pair including the object public key of the first object in the public-private key list, it is determined that an object private key has been generated for the first object before. At this time, it can be determined that the private key generation request initiated by the object node is illegal, and the service node can refuse to respond to the private key generation request initiated by the object node, and return relevant error information to the object node.

[0178] If the service node determines that there is no key pair including the object public key of the first object in the public-private key list, it is determined that no object private key has been generated for the first object. In this case, the service node may generate an object private key corresponding to the object public key of the first object through a private key generation function based on the node private key and / or the object public key of the service node.

[0179] Among them, the node private key and node public key of the service node can be generated during the initialization process of the key generation service, or after receiving the key generation request. The specific generation can be determined based on the actual application scenario requirements and is not limited here.

[0180] Among them, the private key generation request submitted by the object node and the object private key generated by the service node can be transmitted based on a secure channel.

[0181] The above-mentioned secure channel is established in the following ways:

[0182] The service node negotiates with the object node to establish an initial channel, and sends code measurement information of the key generation service during the process of establishing the initial channel, so that the object node determines the service validity of the key generation service based on the code measurement information of the key generation service;

[0183] When the object node determines that the key generation service passes the service validity verification, the service node determines the initial channel as the secure channel ultimately used for information transmission.

[0184] The code measurement information of the key generation service includes, but is not limited to, the hash measurement of the key generation service code, the hardware manufacturer's signature on the hash measurement of the key generation service code, the hardware manufacturer's signature on the hardware public key, and other information.

[0185] Among them, the object node can verify the validity of the measurement information through remote attestation or other locally deployed certificate cache services. The code measurement information of the key generation service passes the service validity verification, indicating that the code information of the key generation service of the service node has not been tampered with, and the key generation service is a reliable service, which can be used to generate the object private key.

[0186] The secure channel may be a Transport Layer Security (TLS) connection or other connection used for confidential data transmission, which may be determined based on actual application scenario requirements and is not limited here.

[0187] For example, the service node can establish a TLS connection with the object node, and embed the code measurement information of the key generation service into the extension field of the TLS certificate during the TLS connection establishment process (such as the TLS handshake establishment process), so that the object node performs remote attestation after receiving the TLS certificate to determine whether the code measurement information of the key generation service in the extension field of the TLS certificate passes the service validity verification.

[0188] When the target node determines that the code measurement information of the key generation service in the extension field of the TLS certificate passes the service validity verification, the service node may determine the TLS connection established with the target node as a secure channel.

[0189] After establishing the secure channel, the service node can obtain the key generation request initiated by the object node through the secure channel, and after generating the object private key, send the object private key to the object node through the secure channel, and store the object public key and object private key of the first object in the local public and private key list.

[0190] See also Figure 4 , Figure 4 It is a schematic diagram of a scenario for generating an object private key provided in an embodiment of the present application. Figure 4 The method for generating an object private key may specifically include the following steps:

[0191] Step 1: During the initialization process, the service node generates a node public-private key pair, that is, generates a node public key and a node private key, to obtain a node private key used to generate an object private key.

[0192] Step 2: Before requesting to generate an object private key, the object node may register a first communication address with a communication service provider and use the first communication address as the object public key.

[0193] Step 3: The service node may establish a TLS connection with the object node, and embed the code measurement information of the key generation service into the extension field of the TLS certificate during the TLS connection establishment process (such as the TLS handshake establishment process), so that the object node performs remote attestation after receiving the TLS certificate to determine whether the code measurement information of the key generation service in the extension field of the TLS certificate passes the service validity verification.

[0194] When the target node determines that the code measurement information of the key generation service in the extension field of the TLS certificate passes the service validity verification, the service node may determine the TLS connection established with the target node as a secure channel.

[0195] Step 4: After establishing a secure channel (TLS connection), the service node may obtain a private key generation request initiated by the object node, the private key generation request including the object public key of the first object. The service node may further determine the object private key corresponding to the object public key when there is a key pair including the object public key in the local public-private key list.

[0196] Step 5: After determining the object private key corresponding to the object public key of the first object, the service node returns the determined object private key to the service node through the secure channel.

[0197] In some feasible implementations, after the service node generates an object private key corresponding to the object public key of the first object for the object node, the service node may also provide a private key retrieval service for the object node.

[0198] Specifically, the service node may obtain a key retrieval request submitted by the object node, where the key retrieval request includes the object public key of the first object.

[0199] Furthermore, since the service node will store the object private key and object public key of each object in a local public-private key list after generating an object private key for each object, after the service node obtains the object public key of the first object in the key retrieval request, it can first determine whether there is a key pair including the object public key of the first object in the public-private key list.

[0200] If there is no key pair including the object public key of the first object in the public-private key list, it means that the service has not generated an object private key for the first object before. At this time, the service can stop responding to the key retrieval request and return a relevant error to the object node so that the object node can generate an object private key for the first object by initiating a key generation request.

[0201] If a key pair including the object public key of the first object exists in the public-private key list, the service node may directly determine the object private key corresponding to the object public key of the first object from the public-private key list.

[0202] Further, after determining the object private key of the first object, the service node may determine a temporary symmetric key with the object node, and encrypt the determined object private key based on the temporary symmetric key to obtain an encryption key.

[0203] Based on this, the service object can send the encryption key to the first communication address associated with the object public key of the first object, so that the object node obtains the encryption key through the first communication address, and decrypts the encryption key based on the temporary symmetric key to obtain the object private key of the first object.

[0204] Among them, the service node and the object node can also establish a secure channel first, and implement the key retrieval request and the negotiation and determination process of the temporary symmetric key through the secure channel.

[0205] Optionally, after determining the encryption key, the service node may also send the encryption key to the object node through the secure channel, so that the object node decrypts the encryption key based on the temporary symmetric key to obtain the object private key of the first object.

[0206] The manner in which the service node and the object node determine the temporary symmetric key may be specifically determined based on the actual application scenario requirements and is not limited here.

[0207] Optionally, before sending the encryption key to the first communication address associated with the object public key of the first object, the service node may verify the legitimacy of the communication service of the service provider based on the communication certificate of the service provider corresponding to the first communication address. If the communication service of the service provider passes the legitimacy verification, the encryption key is sent to the first communication address so that the object node can obtain the encryption key from the first communication address.

[0208] Among them, the service node can establish a secure channel (such as a TLS connection) with the communication service provider's server and use the communication certificate to verify the legitimacy of the server's TLS certificate.

[0209] Among them, the service node can obtain the above communication certificate through a key retrieval request, or through other interactive information with the object node (such as a transaction verification request). The specific information can be determined based on the actual application scenario requirements and is not limited here.

[0210] Among them, the service node needs to use external communication services in the process of private key generation and private key retrieval. Therefore, during initialization, the service node needs to pre-configure the system certificate that supports the registered external communication service to establish a secure channel with the communication service server. If security needs to be further improved, the service node can build a private communication service inside the TEE for private key generation and private key retrieval, etc.

[0211] See also Figure 5 , Figure 5It is a schematic diagram of a scenario for retrieving an object private key provided in an embodiment of the present application. Figure 5 The method for retrieving the object private key shown may specifically include the following steps:

[0212] Step 1: The service node obtains a key retrieval request submitted by the object node, where the key retrieval request includes the object public key of the first object.

[0213] Step 2: The service node determines whether there is a key pair including the object public key of the first object in the public-private key list.

[0214] Step 3: When the service node determines that there is a key pair including the object public key of the first object in the public-private key list, that is, when it determines that an object private key has been generated for the first object before, the service node negotiates a temporary symmetric key with the object node so that both parties obtain the temporary symmetric key.

[0215] Step 4: The service object uses the temporary symmetric key to encrypt the determined object private key to obtain an encryption key.

[0216] Step 5: After determining the encryption key, the service node sends the encryption key to the communication address corresponding to the object public key of the first object, such as a mailbox with the object public key as the mailbox address.

[0217] Step 6: The object node obtains the encryption key through the first communication address, and decrypts the encryption key based on the temporary symmetric key to obtain the object private key of the first object.

[0218] In an embodiment of the present application, the blockchain network can obtain the object public key of the first object during the process of the object node establishing or registering a transaction account with the blockchain network. In addition, the transaction verification request submitted by the object node is initiated to the service node after the object node determines that the pending transaction meets the transaction verification conditions. If the object node determines that the pending transaction does not meet the transaction verification conditions, the blockchain network can directly obtain the transaction processing request submitted by the object node, and the processing request includes the third signature information obtained after the node object uses the object private key of the first object to sign and the pending transaction. The blockchain can verify the signature validity of the third signature information based on the object public key of the first object, and after the third signature information passes the signature validity verification, the pending transaction is processed on the chain through consensus.

[0219] In an embodiment of the present application, the legitimacy verification of the key generation service and the authentication service can also be achieved by verifying the legitimacy of the trusted execution environment. The trusted execution environment is a hardware-based secure computing environment with inherent endorsement keys for protecting data privacy and authenticating data integrity, source reliability, etc.; it has a memory barrier with the outside, that is, the outside, including the operating system, has no access rights to the storage space within the trusted execution environment domain; it has a remote authentication mechanism for proving to the remote end that the logic running within a trusted execution environment has not been tampered with. The effect achieved by using a trusted execution environment is that the data and program logic within the trusted execution environment domain cannot be spied on by the external environment without active output.

[0220] Among them, remote attestation is a method for the trusted execution environment to prove the legitimacy of the hardware in its running environment to a third party. The feasible execution environment sends a set of information including the hash measurement of its own code logic, signs it, and then returns it to the third party for identity verification. If the verification is successful, the remote attestation is completed, proving that the trusted execution environment has passed the legitimacy verification, that is, proving that the key generation service and the authentication service have passed the legitimacy verification.

[0221] In the embodiment of the present application, after generating the node public and private keys, the service node can store the node public and private keys and the public and private key lists in the trusted domain of the service node, and can use the encryption and sealing function of the TEE to encrypt and store them on the disk when necessary. Among them, encryption and sealing is the behavior of the TEE application to encrypt data based on the hardware-derived symmetric key and save it locally, where the same hardware derives exactly the same symmetric key for the TEE application with the same measurement information, and changes in the hardware or measurement information will result in different derived symmetric keys, thereby achieving secure storage of encrypted data.

[0222] The computing processes such as transaction verification and private key generation involved in the embodiments of the present application can be implemented based on cloud computing technology in the field of cloud technology to improve computing efficiency.

[0223] Cloud technology refers to a hosting technology that unifies hardware, software, network and other resources within a wide area network or local area network to achieve data computing, storage, processing and sharing. Cloud technology is a general term for network technology, information technology, integration technology, management platform technology, application technology, etc. based on the cloud computing business model. It can form a resource pool that can be used on demand and is flexible and convenient. Cloud computing technology will become an important support. The backend services of technical network systems require a large amount of computing and storage resources, such as video websites, picture websites and more portal websites. With the high development and application of the Internet industry, in the future, each item may have its own identification mark, and all need to be transmitted to the backend system for logical processing. Data of different levels will be processed separately. All kinds of industry data require strong system backing support, which can only be achieved through cloud computing.

[0224] Cloud computing is a computing model that is the product of the development and integration of traditional computer and network technologies such as grid computing, distributed computing, parallel computing, utility computing, network storage technologies, virtualization, and load balancing. Cloud computing distributes computing tasks on a resource pool consisting of a large number of computers, allowing various application systems to obtain computing power, storage space, and information services as needed. The network that provides resources is called a "cloud". The resources in the "cloud" are infinitely scalable and can be obtained at any time, used on demand, expanded at any time, and paid for by use.

[0225] In the embodiment of the present application, the blockchain network refers to a system for sharing data between nodes, and the blockchain network can be regarded as a data sharing system including multiple nodes. Figure 6 As shown, Figure 6 It is a structural diagram of the data sharing system provided in an embodiment of the present application. Figure 6 Each node 101 in the data sharing system can receive input information when performing normal work, and maintain the shared data in the data sharing system based on the received input information. In order to ensure the information intercommunication in the data sharing system, there can be an information connection between each node in the data sharing system, and the nodes can transmit information through the above information connection. For example, when any node in the data sharing system receives input information, other nodes in the data sharing system obtain the input information according to the consensus algorithm, and store the input information as data in the shared data, so that the data stored on all nodes in the data sharing system are consistent.

[0226] Each node in the data sharing system has a corresponding node identifier, and each node in the data sharing system can store the node identifiers of other nodes in the data sharing system, so that the generated blocks can be broadcast to other nodes in the data sharing system according to the node identifiers of other nodes. Each node can maintain a node identifier list as shown in the following table, and store the node name and node identifier in the node identifier list accordingly. Among them, the node identifier can be an IP (Internet Protocol, a protocol for interconnecting networks) address and any other information that can be used to identify the node. The following table only uses the IP address as an example for explanation.

[0227] Node Name Node ID Node 1 IP Address 1 Node 2 IP Address 2 … … Node N IP address N

[0228] Each node in the data sharing system stores the same blockchain. The blockchain consists of multiple blocks, see Figure 7 , Figure 7 This is a schematic diagram of the blockchain structure provided by the embodiment of this application. Figure 7 As shown, the blockchain consists of multiple blocks. The genesis block includes a block header and a block body. The block header stores input information feature values, version numbers, timestamps, and difficulty values, and the block body stores input information. The next block of the genesis block uses the genesis block as its parent block. The next block also includes a block header and a block body. The block header stores input information feature values ​​of the current block, feature values ​​of the block header of the parent block, version numbers, timestamps, and difficulty values, and so on. This ensures that the block data stored in each block in the blockchain is associated with the block data stored in the parent block, thereby ensuring the security of the input information in the block.

[0229] In an embodiment of the present application, when the object node conducts asset transactions through the blockchain network, in order to prevent the attacker from transferring the object assets after the object private key is leaked, the blockchain can perform secondary authentication on pending transactions that meet the transaction verification conditions through smart contracts. That is, only when the transaction verification message sent by the service node is received and the pending transaction is determined to be a valid transaction based on the transaction verification message, and the second signature information is determined to be obtained by the object private key signature generated by the service node based on the object private key and the node public key of the service node, and it is determined that the object can access the communication address associated with its public key, the secondary authentication can pass. If the attacker steals the object private key and cannot access the communication address associated with the object public key, the secondary authentication cannot be completed. The secondary authentication for pending transactions is jointly executed by the authentication service and key generation service deployed in the trusted execution environment of the service node, and the blockchain network, and the relevant service code can ensure the effectiveness and security of the secondary authentication process through the validity verification of the code measurement information, and the applicability is high.

[0230] On the other hand, the service node can generate the object private key based on the trusted execution environment, so that the private key generation does not rely on third-party services, reducing the risk of private key leakage and improving key security. At the same time, the private key can be retrieved through the communication address to provide private key retrieval services while realizing private key secure transmission.

[0231] See also Figure 8 , Figure 8 1 is a schematic diagram of a structure of a transaction processing device provided in an embodiment of the present application. The transaction processing device provided in an embodiment of the present application includes:

[0232] A first acquisition module 81 is used to acquire a transaction verification request initiated by an object node, wherein the transaction verification request includes a pending transaction and an object public key of a first object, and the pending transaction is initiated by the first object;

[0233] An information generation module 82, used to generate a transaction authentication message based on the signature private key of the service node and the above-mentioned pending transaction;

[0234] An information sending module 83 is used to send the transaction authentication message to the first communication address associated with the object public key, so that the object node obtains the transaction authentication message from the first communication address and then initiates a transaction processing request to the blockchain network;

[0235] Among them, the above-mentioned transaction processing request includes the above-mentioned pending transaction and the above-mentioned transaction authentication message, and the above-mentioned transaction processing request is used to request the above-mentioned blockchain network to process the above-mentioned pending transaction after determining that the above-mentioned pending transaction is a valid transaction based on the above-mentioned transaction authentication message.

[0236] In some feasible implementations, the information generating module 82 is used to:

[0237] Signing the first information based on the signature private key of the service node to obtain first signature information, where the first information includes the transaction to be processed, the object public key and the signature expiration time;

[0238] Based on the first signature information and the signature expiration time, a transaction authentication message is generated.

[0239] In some feasible implementations, the transaction processing request further includes second signature information, where the second signature information is obtained by the object node signing the transaction to be processed based on the object private key of the first object;

[0240] Among them, the above-mentioned second signature information is used to enable the above-mentioned blockchain network to determine the transaction validity of the above-mentioned pending transaction based on the above-mentioned transaction authentication message after the above-mentioned second signature information passes the signature validity verification based on the node public key of the above-mentioned service node.

[0241] In some feasible implementations, the object private key is generated based on a key generation service running in a trusted execution environment, and the object private key is determined by the information generation module 82 through the key generation service based on the following method:

[0242] Obtaining a private key generation request submitted by the object node, wherein the private key generation request includes the object public key;

[0243] In response to the fact that the key pair including the object public key does not exist in the public and private key list of the service node, generating an object private key corresponding to the object public key by a private key generation function based on the node private key of the service node;

[0244] The private key generation request and the object private key are sent through a secure channel, and the secure channel is established in the following manner:

[0245] Establishing an initial channel with the object node, and sending the code measurement information of the key generation service in the process of establishing the initial channel;

[0246] In response to the object node determining that the key generation service passes the service validity verification based on the code measurement information of the key generation service, the initial channel is determined as the secure channel.

[0247] In some feasible implementations, the first acquisition module 81 is further used to:

[0248] Obtaining a key retrieval request submitted by the object node, wherein the key retrieval request includes the object public key;

[0249] In response to the existence of a key pair including the object public key in the public-private key list of the service node, determining the object private key from the public-private key list;

[0250] Determine a temporary symmetric key with the object node, and encrypt the object private key based on the temporary symmetric key to obtain an encryption key;

[0251] The information sending module 83 is also used for:

[0252] The encryption key is sent to the first communication address, so that the object node obtains the encryption key through the first communication address, and decrypts the encryption key based on the temporary symmetric key to obtain the object private key.

[0253] In some feasible implementations, the transaction authentication message is generated by the information generation module 82 based on an authentication service running in a trusted execution environment, and the method further includes:

[0254] Determine a self-signed certificate, the self-signed certificate including a first public key hash of a signature public key of the service node and code measurement information of the authentication service;

[0255] The self-signed certificate is sent to the blockchain network, so that the blockchain network determines that the authentication service meets the authentication conditions based on the self-signed certificate and then obtains the transaction processing request.

[0256] In a specific implementation, the transaction processing device can execute the above-mentioned Figure 2 For the various steps performed by the service node in the example, please refer to the implementation methods provided by the above-mentioned related steps, which will not be repeated here.

[0257] See also Fig. 9 , Fig. 9 1 is another structural diagram of a transaction processing device provided in an embodiment of the present application. The transaction processing device provided in an embodiment of the present application includes:

[0258] A second acquisition module 91 is used to acquire a transaction processing request initiated by the target node, wherein the transaction processing request includes a pending transaction and a transaction authentication message;

[0259] The transaction authentication message is generated by the service node based on the signature private key of the service node and the transaction to be processed after the service node obtains the transaction verification request initiated by the object node for the transaction to be processed, and is sent to the first communication address;

[0260] The first communication address is associated with the object public key of the first object initiating the transaction to be processed;

[0261] The transaction processing request is submitted by the object node after obtaining the transaction authentication message through the first communication address;

[0262] A transaction verification module 92, configured to determine the transaction validity of the pending transaction based on the signature public key of the service node and the transaction authentication message;

[0263] The transaction processing module 93 is used to process the transaction to be processed in response to determining that the transaction to be processed is a valid transaction.

[0264] In some feasible implementations, the transaction verification module 92 is used to:

[0265] Determine the first signature information and the signature expiration time based on the transaction authentication message;

[0266] The first signature information is obtained by the service node signing the first information based on the signature private key of the service node, and the first information includes the transaction to be processed, the object public key and the signature expiration time;

[0267] In response to determining that the first signature information is not expired based on the signature expiration time, verifying the signature validity of the first signature information based on the signature public key of the service node, the pending transaction, the object public key and the signature expiration time;

[0268] In response to the first signature information passing the signature validity verification, the transaction to be processed is determined to be a valid transaction; in response to the first signature information failing the signature validity verification, the transaction to be processed is determined to be an invalid transaction.

[0269] In some feasible implementations, the transaction processing request further includes second signature information, where the second signature information is obtained by the object node signing the transaction to be processed based on the object private key of the first object;

[0270] The transaction verification module 93 is also used for:

[0271] Performing signature validity verification on the second signature information based on the node public key of the service node, the object public key and the pending transaction;

[0272] In response to the second signature information passing the signature validity verification, the transaction validity of the pending transaction is determined based on the signature public key of the service node and the transaction authentication message.

[0273] In some feasible implementations, the transaction authentication message is generated by the service node based on the authentication service running in the trusted execution environment, and the transaction verification module 93 is further used to:

[0274] Obtain the self-signed certificate submitted by the service node, where the self-signed certificate includes the first public key hash of the signature public key and the code measurement information of the authentication service;

[0275] In response to the authentication service meeting the authentication condition, obtaining the transaction processing request;

[0276] Among them, the above-mentioned certification services meet the certification conditions including:

[0277] The second public key hash of the signature public key obtained by the blockchain network is consistent with the first public key hash mentioned above;

[0278] The code measurement information of the above authentication services is verified through service validity.

[0279] In a specific implementation, the transaction processing device can execute the above-mentioned Figure 2 For the various steps executed by the blockchain network, please refer to the implementation methods provided in the above-mentioned relevant steps, which will not be repeated here.

[0280] See also Fig.10 , Fig.10 Schematic diagram of the structure of the electronic device provided in the embodiment of the present application. Fig.10 As shown, the electronic device 1000 in this embodiment may include: a processor 1001, a network interface 1004 and a memory 1005. In addition, the above-mentioned electronic device 1000 may also include: an object interface 1003, and at least one communication bus 1002. Among them, the communication bus 1002 is used to realize the connection and communication between these components. Among them, the object interface 1003 may include a display screen (Display), a keyboard (Keyboard), and the object interface 1003 may optionally include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface). The memory 1005 may be a high-speed RAM memory, or it may be a non-volatile memory (NVM), such as at least one disk storage. The memory 1005 may optionally also be at least one storage device located away from the aforementioned processor 1001. As Fig.10 As shown, the memory 1005 as a computer-readable storage medium may include an operating system, a network communication module, an object interface module, and a device control application program.

[0281] exist Fig.10 In the electronic device 1000 shown, the network interface 1004 can provide a network communication function; the object interface 1003 is mainly used to provide an input interface for the object; and the processor 1001 can be applied to a service node to call a device control application stored in the memory 1005 to achieve:

[0282] Obtaining a transaction verification request initiated by the object node, the transaction verification request including the transaction to be processed and the object public key of the first object, the transaction to be processed being initiated by the first object;

[0283] Generate a transaction authentication message based on the signature private key of the service node and the above pending transaction;

[0284] Send the transaction authentication message to the first communication address associated with the object public key, so that the object node obtains the transaction authentication message from the first communication address and then initiates a transaction processing request to the blockchain network;

[0285] Among them, the above-mentioned transaction processing request includes the above-mentioned pending transaction and the above-mentioned transaction authentication message, and the above-mentioned transaction processing request is used to request the above-mentioned blockchain network to process the above-mentioned pending transaction after determining that the above-mentioned pending transaction is a valid transaction based on the above-mentioned transaction authentication message.

[0286] In some feasible implementations, the processor 1001 is configured to:

[0287] Signing the first information based on the signature private key of the service node to obtain first signature information, where the first information includes the transaction to be processed, the object public key and the signature expiration time;

[0288] Based on the first signature information and the signature expiration time, a transaction authentication message is generated.

[0289] In some feasible implementations, the transaction processing request further includes second signature information, where the second signature information is obtained by the object node signing the transaction to be processed based on the object private key of the first object;

[0290] Among them, the above-mentioned second signature information is used to enable the above-mentioned blockchain network to determine the transaction validity of the above-mentioned pending transaction based on the above-mentioned transaction authentication message after the above-mentioned second signature information passes the signature validity verification based on the node public key of the above-mentioned service node.

[0291] In some feasible implementations, the object private key is generated by the processor 1001 based on a key generation service running in a trusted execution environment, and the object private key is determined by the processor 1001 through the key generation service based on the following method:

[0292] Obtaining a private key generation request submitted by the object node, wherein the private key generation request includes the object public key;

[0293] In response to the fact that the key pair including the object public key does not exist in the public and private key list of the service node, generating an object private key corresponding to the object public key by a private key generation function based on the node private key of the service node;

[0294] The private key generation request and the object private key are sent through a secure channel, and the secure channel is established in the following manner:

[0295] Establishing an initial channel with the object node, and sending the code measurement information of the key generation service in the process of establishing the initial channel;

[0296] In response to the object node determining that the key generation service passes the service validity verification based on the code measurement information of the key generation service, the initial channel is determined as the secure channel.

[0297] In some feasible implementations, the processor 1001 is further configured to:

[0298] Obtaining a key retrieval request submitted by the object node, wherein the key retrieval request includes the object public key;

[0299] In response to the existence of a key pair including the object public key in the public-private key list of the service node, determining the object private key from the public-private key list;

[0300] Determine a temporary symmetric key with the object node, and encrypt the object private key based on the temporary symmetric key to obtain an encryption key;

[0301] The encryption key is sent to the first communication address, so that the object node obtains the encryption key through the first communication address, and decrypts the encryption key based on the temporary symmetric key to obtain the object private key.

[0302] In some feasible implementations, the transaction authentication message is generated by the processor 1001 based on an authentication service running in a trusted execution environment, and the processor 1001 is further configured to:

[0303] Determine a self-signed certificate, the self-signed certificate including a first public key hash of a signature public key of the service node and code measurement information of the authentication service;

[0304] The self-signed certificate is sent to the blockchain network, so that the blockchain network determines that the authentication service meets the authentication conditions based on the self-signed certificate and then obtains the transaction processing request.

[0305] Optionally, the processor 1001 may be applied to a blockchain network to call a device control application stored in the memory 1005 to implement:

[0306] Obtaining a transaction processing request initiated by the target node, wherein the transaction processing request includes a pending transaction and a transaction authentication message;

[0307] The transaction authentication message is generated by the service node based on the signature private key of the service node and the transaction to be processed after the service node obtains the transaction verification request initiated by the object node for the transaction to be processed, and is sent to the first communication address;

[0308] The first communication address is associated with the object public key of the first object initiating the transaction to be processed;

[0309] The transaction processing request is submitted by the object node after obtaining the transaction authentication message through the first communication address;

[0310] Determine the transaction validity of the pending transaction based on the signature public key of the service node and the transaction authentication message;

[0311] In response to determining that the pending transaction is a valid transaction, the pending transaction is processed.

[0312] In some feasible implementations, the processor 1001 is configured to:

[0313] Determine the first signature information and the signature expiration time based on the transaction authentication message;

[0314] The first signature information is obtained by the service node signing the first information based on the signature private key of the service node, and the first information includes the transaction to be processed, the object public key and the signature expiration time;

[0315] In response to determining that the first signature information is not expired based on the signature expiration time, verifying the signature validity of the first signature information based on the signature public key of the service node, the pending transaction, the object public key and the signature expiration time;

[0316] In response to the first signature information passing the signature validity verification, the transaction to be processed is determined to be a valid transaction; in response to the first signature information failing the signature validity verification, the transaction to be processed is determined to be an invalid transaction.

[0317] In some feasible implementations, the transaction processing request further includes second signature information, where the second signature information is obtained after the processor 1001 signs the transaction to be processed based on the object private key of the first object;

[0318] The processor 1001 is used for:

[0319] Performing signature validity verification on the second signature information based on the node public key of the service node, the object public key and the pending transaction;

[0320] In response to the second signature information passing the signature validity verification, the transaction validity of the pending transaction is determined based on the signature public key of the service node and the transaction authentication message.

[0321] In some feasible implementations, the transaction authentication message is generated by the processor 1001 based on an authentication service running in a trusted execution environment, and the processor 1001 is used to:

[0322] Obtain the self-signed certificate submitted by the service node, where the self-signed certificate includes the first public key hash of the signature public key and the code measurement information of the authentication service;

[0323] In response to the authentication service meeting the authentication condition, obtaining the transaction processing request;

[0324] Among them, the above-mentioned certification services meet the certification conditions including:

[0325] The second public key hash of the signature public key obtained by the blockchain network is consistent with the first public key hash mentioned above;

[0326] The code measurement information of the above authentication services is verified through service validity.

[0327] It should be understood that in some feasible implementations, the processor 1001 may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc. The memory may include a read-only memory and a random access memory, and provide instructions and data to the processor. A portion of the memory may also include a non-volatile random access memory. For example, the memory may also store information about the device type.

[0328] In a specific implementation, the electronic device 1000 can execute the above-mentioned functions through its built-in functional modules. Figure 2 For the implementation methods provided in each step, please refer to the implementation methods provided in the above steps for details, which will not be repeated here.

[0329] The present application also provides a computer-readable storage medium, which stores a computer program and is executed by a processor to implement Figure 2 For the methods provided in each step, please refer to the implementation methods provided in the above steps for details, which will not be repeated here.

[0330] The computer-readable storage medium may be an internal storage unit of the transaction processing device or electronic device provided in any of the aforementioned embodiments, such as a hard disk or memory of the electronic device. The computer-readable storage medium may also be an external storage device of the electronic device, such as a plug-in hard disk, a smart memory card (smart media card, SMC), a secure digital (secure digital, SD) card, a flash card (flash card), etc. equipped on the electronic device. The computer-readable storage medium may also include a magnetic disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc. Further, the computer-readable storage medium may also include both an internal storage unit of the electronic device and an external storage device. The computer-readable storage medium is used to store the computer program and other programs and data required by the electronic device. The computer-readable storage medium may also be used to temporarily store data that has been output or is to be output.

[0331] The present invention provides a computer program product, which includes a computer program. The computer program is executed by a processor. Figure 2 The methods provided in each step.

[0332] The terms "first", "second", etc. in the claims, specification and drawings of the present application are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions. For example, a process, method, system, product or electronic device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or electronic devices. Mentioning "embodiment" in this article means that the specific features, structures or characteristics described in conjunction with the embodiment may be included in at least one embodiment of the present application. Displaying the phrase at various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments. The term "and / or" used in the present application specification and the attached claims refers to any combination of one or more of the items listed in association and all possible combinations, and includes these combinations.

[0333] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Professional and technical personnel may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0334] The above disclosure is only the preferred embodiment of the present application, which cannot be used to limit the scope of rights of the present application. Therefore, equivalent changes made according to the claims of the present application are still within the scope covered by the present application.

Claims

1. A transaction processing method, characterized in that: The method comprises: Obtaining a transaction verification request initiated by an object node, wherein the transaction verification request includes a transaction to be processed and an object public key of a first object, wherein the transaction to be processed is initiated by the first object; Generate a transaction authentication message based on the signature private key of the service node and the pending transaction; Sending the transaction authentication message to a first communication address associated with the object public key, so that the object node initiates a transaction processing request to the blockchain network after obtaining the transaction authentication message from the first communication address; Among them, the transaction processing request includes the pending transaction and the transaction authentication message, and the transaction processing request is used to request the blockchain network to process the pending transaction after determining that the pending transaction is a valid transaction based on the transaction authentication message.

2. The method according to claim 1, characterized in that: The generating a transaction authentication message based on the signature private key of the service node and the pending transaction includes: Signing the first information based on the signature private key of the service node to obtain first signature information, where the first information includes the transaction to be processed, the object public key, and the signature expiration time; A transaction authentication message is generated based on the first signature information and the signature expiration time.

3. The method according to claim 1 or 2, characterized in that: The transaction processing request further includes second signature information, where the second signature information is obtained by the object node signing the transaction to be processed based on the object private key of the first object; Among them, the second signature information is used to enable the blockchain network to determine the transaction validity of the to-be-processed transaction based on the transaction authentication message after determining that the second signature information passes the signature validity verification based on the node public key of the service node.

4. The method according to claim 3, characterized in that The object private key is generated based on a key generation service running in a trusted execution environment, and the object private key is determined by the key generation service based on the following method: Obtaining a private key generation request submitted by the object node, wherein the private key generation request includes the object public key; In response to the absence of a key pair including the object public key in the public-private key list of the service node, generating an object private key corresponding to the object public key by a private key generation function based on the node private key of the service node; The private key generation request and the object private key are sent through a secure channel, and the secure channel is established in the following manner: Establishing an initial channel with the target node, and sending code measurement information of the key generation service during the process of establishing the initial channel; In response to the object node determining that the key generation service passes service validity verification based on the code metric information of the key generation service, the initial channel is determined to be the secure channel.

5. The method according to claim 3, characterized in that: The method further comprises: Obtaining a key retrieval request submitted by the object node, wherein the key retrieval request includes the object public key; In response to the existence of a key pair including the object public key in the public-private key list of the service node, determining the object private key from the public-private key list; Determine a temporary symmetric key with the object node, and encrypt the object private key based on the temporary symmetric key to obtain an encryption key; The encryption key is sent to the first communication address, so that the object node obtains the encryption key through the first communication address, and decrypts the encryption key based on the temporary symmetric key to obtain the object private key.

6. The method according to claim 1, characterized in that The transaction authentication message is generated based on an authentication service running in a trusted execution environment, and the method further includes: Determine a self-signed certificate, the self-signed certificate including a first public key hash of a signature public key of the service node and code metric information of the authentication service; The self-signed certificate is sent to the blockchain network, so that the blockchain network obtains the transaction processing request after determining that the authentication service meets the authentication conditions based on the self-signed certificate.

7. A transaction processing method, characterized in that: The method comprises: Obtaining a transaction processing request initiated by the target node, wherein the transaction processing request includes a pending transaction and a transaction authentication message; The transaction authentication message is generated by the service node based on the signature private key of the service node and the transaction to be processed after the service node obtains the transaction verification request initiated by the object node for the transaction to be processed, and is sent to the first communication address; wherein the first communication address is associated with an object public key of a first object initiating the transaction to be processed; The transaction processing request is submitted by the object node after obtaining the transaction authentication message through the first communication address; Determining the transaction validity of the pending transaction based on the signature public key of the service node and the transaction authentication message; In response to determining that the pending transaction is a valid transaction, the pending transaction is processed.

8. The method according to claim 7, characterized in that The determining the transaction validity of the pending transaction based on the signature public key of the service node and the transaction authentication message includes: Determine first signature information and signature expiration time based on the transaction authentication message; The first signature information is obtained by the service node signing the first information based on the signature private key of the service node, and the first information includes the transaction to be processed, the object public key and the signature expiration time; In response to determining that the first signature information is not expired based on the signature expiration time, performing signature validity verification on the first signature information based on the signature public key of the service node, the pending transaction, the object public key, and the signature expiration time; In response to the first signature information passing the signature validity verification, the pending transaction is determined to be a valid transaction; in response to the first signature information failing the signature validity verification, the pending transaction is determined to be an invalid transaction.

9. The method according to claim 7, characterized in that: The transaction processing request further includes second signature information, where the second signature information is obtained by the object node signing the transaction to be processed based on the object private key of the first object; The method further comprises: Performing signature validity verification on the second signature information based on the node public key of the service node, the object public key and the pending transaction; In response to the second signature information passing the signature validity verification, the transaction validity of the pending transaction is determined based on the signature public key of the service node and the transaction authentication message.

10. The method according to claim 7, characterized in that The transaction authentication message is generated by the service node based on an authentication service running in a trusted execution environment, and the method further includes: Obtaining a self-signed certificate submitted by the service node, the self-signed certificate including a first public key hash of the signature public key and code measurement information of the authentication service; In response to the authentication service meeting the authentication condition, obtaining the transaction processing request; The certification service meets the certification conditions including: The second public key hash of the signature public key obtained by the blockchain network is consistent with the first public key hash; The code measurement information of the authentication service is verified by service validity.

11. A transaction processing device, characterized in that: The device comprises: A first acquisition module, configured to acquire a transaction verification request initiated by an object node, wherein the transaction verification request includes a transaction to be processed and an object public key of a first object, and the transaction to be processed is initiated by the first object; An information generation module, used to generate a transaction authentication message based on the signature private key of the service node and the pending transaction; An information sending module, used to send the transaction authentication message to a first communication address associated with the object public key, so that the object node initiates a transaction processing request to the blockchain network after obtaining the transaction authentication message from the first communication address; Among them, the transaction processing request includes the pending transaction and the transaction authentication message, and the transaction processing request is used to request the blockchain network to process the pending transaction after determining that the pending transaction is a valid transaction based on the transaction authentication message.

12. A transaction processing device, characterized in that: The device comprises: A second acquisition module is used to acquire a transaction processing request initiated by the object node, wherein the transaction processing request includes a pending transaction and a transaction authentication message; The transaction authentication message is generated by the service node based on the signature private key of the service node and the transaction to be processed after the service node obtains the transaction verification request initiated by the object node for the transaction to be processed, and is sent to the first communication address; wherein the first communication address is associated with an object public key of a first object initiating the transaction to be processed; The transaction processing request is submitted by the object node after obtaining the transaction authentication message through the first communication address; A transaction verification module, used to determine the transaction validity of the pending transaction based on the signature public key of the service node and the transaction authentication message; The transaction processing module is used to process the pending transaction in response to determining that the pending transaction is a valid transaction.

13. An electronic device, characterized in that: comprising a processor and a memory, wherein the processor and the memory are connected to each other; The memory is used to store computer programs; The processor is configured to execute the method according to any one of claims 1 to 10 when calling the computer program.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement the method according to any one of claims 1 to 10.

15. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 10 is implemented.

Images