Data processing method and device based on block chain and readable storage medium

Abstract

The embodiment of the invention discloses a block chain-based data processing method and device, and a readable storage medium. The method comprises the steps of sending a business transaction to a consensus network; the consensus nodes in the consensus network are used for synchronizing the synchronous transaction data corresponding to the business transaction and the block head to the trusted network when the business transaction is successfully linked; the trusted node in the trusted network is used for storing the synchronous transaction data and the block head in a trusted execution environment when determining that the synchronous transaction data belongs to a legal type according to the block head; sending a data synchronization request to the trusted network, so that the trusted network obtains synchronous transaction data from the trusted execution environment according to the data synchronization request; and storing the synchronous transaction data returned by the trusted node, and performing service processing according to the synchronous transaction data. By adopting the method and the device, the computing resources and the storage resources of the block chain node can be reduced. The embodiment of the invention can be applied to various scenes such as cloud technology, artificial intelligence, intelligent traffic, auxiliary driving and the like.

Description

Technical Field

[0001] The present application relates to the field of Internet technology, and in particular to a data processing method, device, and readable storage medium based on blockchain. Background Art

[0002] With the rapid development of network technology and enterprises' emphasis on data security, blockchain has received great attention and application.

[0003] In the prior art, a blockchain network includes a consensus network and a business network, wherein the business nodes in the business network are not only responsible for synchronizing and verifying the ledger information of the consensus nodes (i.e. synchronizing the latest block data), but also performing business processing. Therefore, when the ledger information continues to increase, its storage space will face the dilemma of insufficient storage resources. Insufficient storage resources may lead to low computing efficiency during business processing, i.e. low execution efficiency. Summary of the invention

[0004] The embodiments of the present application provide a blockchain-based data processing method, device, and readable storage medium, which can reduce the computing resources and storage resources of blockchain nodes.

[0005] On the one hand, an embodiment of the present application provides a data processing method based on blockchain, which is executed by a service node in a service network, and the method includes:

[0006] Send the business transaction to the consensus network so that the consensus node in the consensus network can process the business transaction on the chain; the consensus node is used to synchronize the synchronous transaction data and block header corresponding to the business transaction to the trusted network when the business transaction is successfully on the chain; the block header belongs to the block to which the business transaction belongs; the trusted node in the trusted network is used to store the synchronous transaction data and block header in the trusted execution environment when determining that the synchronous transaction data is of a legal type based on the block header;

[0007] Sending a data synchronization request to the trusted network, so that the trusted node in the trusted network obtains the synchronization transaction data from the trusted execution environment according to the data synchronization request;

[0008] Store the synchronous transaction data returned by the trusted node, and perform business processing associated with the business transaction based on the synchronous transaction data.

[0009] On the one hand, an embodiment of the present application provides a data processing method based on blockchain, which is executed by a trusted node with a trusted execution environment in a trusted network, and the method includes:

[0010] Obtain data synchronization requests for business transactions sent by business nodes in the business network;

[0011] According to the data synchronization request, the synchronization transaction data corresponding to the business transaction is obtained from the trusted execution environment; the synchronization transaction data is stored when the synchronization transaction data is determined to be of a legal type according to the block header; the synchronization transaction data and the block header are sent by the consensus node in the consensus network when the business transaction sent by the business node is successfully uploaded to the chain; the block header belongs to the block to which the business transaction belongs;

[0012] The synchronous transaction data is sent to the business node, so that the business node performs business processing associated with the business transaction according to the synchronous transaction data.

[0013] On the one hand, an embodiment of the present application provides a data processing device based on blockchain, which runs on a service node in a service network, and includes:

[0014] The first sending module is used to send the business transaction to the consensus network so that the consensus node in the consensus network can process the business transaction on the chain; the consensus node is used to synchronize the synchronous transaction data and block header corresponding to the business transaction to the trusted network when the business transaction is successfully on the chain; the block header belongs to the block to which the business transaction belongs; the trusted node in the trusted network is used to store the synchronous transaction data and block header in the trusted execution environment when determining that the synchronous transaction data belongs to a legal type according to the block header;

[0015] A second sending module is used to send a data synchronization request to the trusted network, so that the trusted node in the trusted network obtains the synchronization transaction data from the trusted execution environment according to the data synchronization request;

[0016] The data storage module is used to store the synchronous transaction data returned by the trusted node and perform business processing associated with the business transaction based on the synchronous transaction data.

[0017] Wherein, the first sending module includes:

[0018] A first acquisition unit is used to acquire a transaction on-chain request including a business transaction sent by a business device; the business transaction carries a first signature message;

[0019] The first processing unit is configured to obtain a device public key of the business device according to a transaction on-chain request, and perform signature verification processing on the first signature message through the device public key to obtain a first digital summary;

[0020] A first generating unit, configured to generate a second digital summary corresponding to the business transaction, and compare the first digital summary with the second digital summary;

[0021] A first returning unit, configured to return a request failure message to the service device if the first digital digest is different from the second digital digest;

[0022] The first sending unit is used to send the business transaction to the consensus network if the first digital summary is the same as the second digital summary.

[0023] Wherein, the second sending module includes:

[0024] The second generating unit is used to obtain the transaction chain success message for the business transaction returned by the consensus node, and generate a data synchronization request for the business transaction according to the transaction chain success message;

[0025] The second processing unit is used to obtain a business private key according to the data synchronization request, and to sign the data synchronization request using the business private key to obtain a second signed message;

[0026] The second sending unit is used to send a data synchronization request carrying a second signature message to a trusted network, so that a trusted node in the trusted network obtains a business public key corresponding to a business private key according to the data synchronization request; the business public key is used by the trusted node to verify the second signature message to obtain a verification result; the verification result is used to instruct the trusted node to obtain synchronization transaction data from the trusted execution environment when it is determined that the business node has synchronization authority.

[0027] Wherein, the second sending module includes:

[0028] A third sending unit is used to send a data synchronization request to a trusted network, so that a trusted node in the trusted network generates an authentication challenge random number and a first intermediate key pair in a trusted execution environment according to the data synchronization request; the first intermediate key pair includes a first intermediate private key and a first intermediate public key corresponding to the first intermediate private key; the authentication challenge random number and the first intermediate public key are used by the trusted node to generate a remote authentication request;

[0029] A second acquisition unit, configured to acquire a remote authentication request returned by the trusted node, and generate a second intermediate key pair for the trusted node according to the remote authentication request; the second intermediate key pair includes a second intermediate public key;

[0030] A third generating unit, configured to generate a remote authentication response according to the second intermediate public key and the authentication challenge random number in the remote authentication request;

[0031] The fourth sending unit is used to send the remote authentication response to the trusted node, so that when the trusted node determines that the remote authentication response has legal attributes, it obtains the second intermediate public key in the remote authentication response; the second intermediate public key, the authentication challenge random number and the first intermediate private key are used for the trusted node to generate a communication key; the communication key is used by the trusted node to encrypt the synchronous transaction data obtained from the trusted execution environment to obtain encrypted synchronous transaction data.

[0032] The data storage module includes:

[0033] A third acquisition unit is used to acquire the encrypted synchronization transaction data returned by the trusted node;

[0034] A fourth acquisition unit, configured to acquire an authentication challenge random number and a first intermediate public key from a remote authentication request, and acquire a second intermediate private key from a second intermediate key pair;

[0035] a fourth generating unit, configured to generate a communication key according to the second intermediate private key, the authentication challenge random number and the first intermediate public key;

[0036] The third processing unit is used to decrypt the encrypted synchronous transaction data according to the communication key to obtain the synchronous transaction data and store the synchronous transaction data.

[0037] The data processing device based on blockchain also includes:

[0038] The transaction acquisition module is used to acquire the business transaction initiated by the business device; the business transaction is a resource query transaction; the resource query transaction includes a resource identifier;

[0039] The data storage module includes:

[0040] A fifth acquisition unit, used to acquire a transaction execution result corresponding to the resource query transaction in the synchronous transaction data;

[0041] A second returning unit is used to return the resource data corresponding to the resource identifier to the business device if the transaction execution result is a successful transaction execution result;

[0042] The third returning unit is used to return a resource query failure message to the business device if the transaction execution result is a transaction execution failure result.

[0043] On the one hand, an embodiment of the present application provides a data processing device based on blockchain, which runs on a trusted node with a trusted execution environment in a trusted network, and the device includes:

[0044] A first acquisition module, used to acquire a data synchronization request for a business transaction sent by a business node in the business network;

[0045] The second acquisition module is used to obtain the synchronization transaction data corresponding to the business transaction from the trusted execution environment according to the data synchronization request; the synchronization transaction data is stored when it is determined that the synchronization transaction data belongs to a legal type according to the block header; the synchronization transaction data and the block header are sent by the consensus node in the consensus network when the business transaction sent by the business node is successfully uploaded to the chain; the block header belongs to the block to which the business transaction belongs;

[0046] The data sending module is used to send the synchronous transaction data to the business node, so that the business node performs business processing associated with the business transaction according to the synchronous transaction data.

[0047] Wherein, the second acquisition module includes:

[0048] A first generating unit, configured to generate an authentication challenge random number and a first intermediate key pair in a trusted execution environment according to a data synchronization request; the first intermediate key pair includes a first intermediate public key;

[0049] A second generating unit is used to generate a remote authentication request according to the authentication challenge random number and the first intermediate public key, and send the remote authentication request to the service node, so that the service node generates a second intermediate key pair including the second intermediate public key according to the remote authentication request; the second intermediate public key is used by the service node to generate a remote authentication response to the remote authentication request;

[0050] A first acquisition unit is used to acquire a remote authentication response returned by a service node in a trusted execution environment, perform legitimacy verification on the remote authentication response, and obtain a verification result;

[0051] The second acquisition unit is used to acquire the synchronous transaction data corresponding to the business transaction from the trusted execution environment according to the verification result.

[0052] The second acquisition unit is specifically configured to acquire synchronous transaction data corresponding to the business transaction from the trusted execution environment if the verification result indicates that the remote authentication response has a legal attribute;

[0053] The data sending module includes:

[0054] A third acquisition unit, configured to acquire a second intermediate public key from the remote authentication response and acquire a first intermediate private key from the first intermediate key pair;

[0055] A third generating unit, configured to generate a communication key according to the first intermediate private key, the second intermediate public key and the authentication challenge random number;

[0056] The data encryption unit is used to encrypt the synchronous transaction data according to the communication key to obtain the encrypted synchronous transaction data;

[0057] A data sending unit is used to send encrypted synchronous transaction data to a business node so that the business node generates a communication key based on the second intermediate private key, the first intermediate public key and the authentication challenge random number in the second intermediate key pair; the communication key is used by the business node to decrypt the encrypted synchronous transaction data to obtain the synchronous transaction data.

[0058] The data processing device based on blockchain also includes:

[0059] The third acquisition module is used to obtain the synchronous transaction data sent by the consensus node and the verification data for the synchronous transaction data; the synchronous transaction data includes the business transaction and the transaction execution result corresponding to the business transaction; the verification data includes the transaction verification data and the result verification data;

[0060] The first verification module is used to verify the business transaction according to the transaction verification data to obtain the root hash of the transaction to be verified;

[0061] The second verification module is used to verify the transaction execution result according to the result verification data and obtain the root hash of the result to be verified;

[0062] The third verification module is used to verify the legitimacy of the synchronous transaction data based on the transaction root hash to be verified, the result root hash to be verified, and the block header.

[0063] The third verification module includes:

[0064] The fourth acquisition unit is used to obtain the on-chain transaction root hash and the on-chain result root hash in the block header;

[0065] A hash comparison unit, used to compare the root hash of the transaction to be verified with the root hash of the transaction on the chain, and to compare the root hash of the result to be verified with the root hash of the result on the chain;

[0066] A first determination unit, configured to determine that the synchronization transaction data is of an illegal type if the transaction root hash to be verified is different from the transaction root hash on the chain;

[0067] A second determination unit, configured to determine that the synchronization transaction data is of an illegal type if the root hash of the result to be verified is different from the root hash of the on-chain result;

[0068] The third determination unit is used to determine that the synchronized transaction data is of a legal type if the root hash of the transaction to be verified is the same as the root hash of the on-chain transaction, and the root hash of the result to be verified is the same as the root hash of the on-chain result.

[0069] On one hand, the present application provides a computer device, including: a processor, a memory, and a network interface;

[0070] The above-mentioned processor is connected to the above-mentioned memory and the above-mentioned network interface, wherein the above-mentioned network interface is used to provide a data communication function, the above-mentioned memory is used to store a computer program, and the above-mentioned processor is used to call the above-mentioned computer program so that the computer device executes the method in the embodiment of the present application.

[0071] On one hand, an embodiment of the present application provides a computer-readable storage medium, in which a computer program is stored. The computer program is suitable for being loaded by a processor and executing the method in the embodiment of the present application.

[0072] On the one hand, an embodiment of the present application provides a computer program product, which includes a computer program stored in a computer-readable storage medium; a processor of a computer device reads the computer program from the computer-readable storage medium, and the processor executes the computer program, so that the computer device executes the method in the embodiment of the present application.

[0073] In an embodiment of the present application, a business node in a business network sends a business transaction to a consensus network, so that the consensus node in the consensus network processes the business transaction on the chain; when the business transaction is successfully on the chain, the consensus node synchronizes the synchronous transaction data corresponding to the business transaction and the block header corresponding to the business transaction to the trusted network; when it is determined according to the block header that the synchronous transaction data is of a legal type, the trusted node in the trusted network stores the synchronous transaction data and the block header in a trusted execution environment; further, the business node sends a data synchronization request to the trusted network, so that the trusted node in the trusted network obtains the synchronous transaction data from the trusted execution environment according to the data synchronization request; further, the business node stores the synchronous transaction data returned by the trusted node, and performs business processing associated with the business transaction according to the synchronous transaction data. From the above, it can be seen that the embodiment of the present application proposes a three-layer blockchain network architecture, which includes a consensus network, a trusted network and a business network, wherein the trusted network can synchronize and verify the blockchain (including synchronizing transaction data and block headers) without performing business processing; the business network can obtain data related to its own business in the blockchain (i.e., synchronizing transaction data) and perform business processing, and does not store data that is not related to its own business (including block headers); obviously, the use of this application can reduce the computing resources and storage resources of blockchain nodes. BRIEF DESCRIPTION OF THE DRAWINGS

[0074] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0075] Figure 1 It is a schematic diagram of a system architecture provided by an embodiment of the present application;

[0076] Figure 2 This is a flowchart of a data processing method based on blockchain provided in an embodiment of the present application. Figure 1 ;

[0077] Figure 3 This is a schematic diagram of a data processing scenario based on blockchain provided by an embodiment of the present application. Figure 1 ;

[0078] Figure 4 This is a schematic diagram of a data processing scenario based on blockchain provided by an embodiment of the present application. Figure 2 ;

[0079] Figure 5 This is a schematic diagram of a data processing scenario based on blockchain provided by an embodiment of the present application. Figure 3 ;

[0080] Figure 6 This is a schematic diagram of a data processing scenario based on blockchain provided by an embodiment of the present application. Figure 4 ;

[0081] Figure 7 This is a flowchart of a data processing method based on blockchain provided in an embodiment of the present application. Figure 2 ;

[0082] Figure 8 This is a flowchart of a data processing method based on blockchain provided in an embodiment of the present application. Figure 3 ;

[0083] Fig. 9 This is a flowchart of a data processing method based on blockchain provided in an embodiment of the present application. Figure 4 ;

[0084] Fig.10 This is a schematic diagram of a data processing scenario based on blockchain provided by an embodiment of the present application. Figure 4 ;

[0085] Fig.11 This is a schematic diagram of a data processing device based on blockchain provided in an embodiment of the present application. Figure 1 ;

[0086] Fig.12 This is a schematic diagram of a data processing device based on blockchain provided in an embodiment of the present application. Figure 2 ;

[0087] Fig.13 It is a structural diagram of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0088] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0089] To facilitate understanding, some nouns are briefly explained as follows:

[0090] 1. Blockchain: In a narrow sense, blockchain is a chain data structure with blocks as the basic unit. The digital summary is used in the block to verify the transaction history previously obtained, which is suitable for the needs of tamper-proof and scalability in the distributed accounting scenario; in a broad sense, blockchain also refers to the distributed accounting technology implemented by the blockchain structure, including distributed consensus, privacy and security protection, peer-to-peer communication technology, network protocols, smart contracts, etc. The goal of the blockchain is to realize a distributed data record book, which only allows additions but not deletions. The basic structure of the underlying ledger is a linear linked list. The linked list is composed of "blocks" connected in series, and the hash value of the previous block is recorded in the subsequent block. Whether each block (and the transactions in the block) is legal can be quickly verified by calculating the hash value. If a node in the network proposes to add a new block, it must reach a consensus on the block through the consensus mechanism.

[0091] 2. Block: A data packet that carries transaction data on a blockchain network. It is a data structure marked with a timestamp and a hash value corresponding to the previous block. The block is verified and confirmed by the network's consensus mechanism.

[0092] The block includes a block header and a block body. The block header can record the meta information of the current block, including the current version number, the hash value corresponding to the previous block, timestamp, random number, hash value of the Merkle Root, and other data. The block body can record detailed data generated within a period of time, including all transaction records or other information generated during the block creation process that have been verified by the current block, which can be understood as a form of account book. In addition, the detailed data of the block body can include the unique Merkle Root generated through the hash process of the Merkle Tree and recorded in the block header.

[0093] 3. Hash value: Also known as information characteristic value or characteristic value, the hash value is generated by converting input data of any length into a password and performing a fixed output through a hash algorithm. The original input data cannot be retrieved by decrypting the hash value. It is a one-way encryption function. In the blockchain, each block (except the initial block) contains the hash value of the previous block. The hash value is the potential core foundation and the most important aspect of blockchain technology. It retains the authenticity of the recorded and viewed data, as well as the integrity of the blockchain as a whole.

[0094] 4. Public key and private key: Public key and private key are a key pair obtained through an algorithm. The public key is the public part of the key pair, and the private key is the non-public part. The public key is usually used to encrypt data, verify digital signatures, etc. This algorithm can ensure that the key pair obtained is unique. When using this key pair, if one of the keys is used to encrypt a piece of data, the other key must be used to decrypt it. For example, if the data is encrypted with the public key, it must be decrypted with the private key. If it is encrypted with the private key, it must also be decrypted with the public key, otherwise the decryption will not be successful.

[0095] 5. Asymmetric signature: The signature algorithm includes two keys, a public key (public key for short) and a private key (private key for short). The public key and the private key are a pair. If the private key is used to sign data, the signature can only be verified with the corresponding public key. Because the signing process and the verification process use two different keys, this algorithm is called an asymmetric signature.

[0096] The basic process of exchanging confidential information using asymmetric signatures is as follows: Party A generates a pair of keys and makes the public key public. When Party A needs to send a message to another role (Party B), it uses its own private key to sign the confidential message and then sends it to Party B. Party B then uses Party A's public key to verify the signed message.

[0097] 6. Trusted Execution Environment: It is a technology based on hardware protection of data and algorithms, also known as Trusted Execution Environments (TEE for short). It is an isolated environment for processors and memory. Only the central processing unit (CPU for short) can access programs running in encrypted memory. Access to TEE by other layers (hardware, kernel, other applications) is blocked by the CPU.

[0098] See also Figure 1 , Figure 1 Schematic diagram of a system architecture provided by an embodiment of the present application. Figure 1 As shown, the system architecture can be a blockchain network, wherein the blockchain network can include a consensus network 11, a trusted network 12, and a business network 13. The consensus network 11 can also be called a core network, and the nodes in the consensus network 11 can be called consensus nodes or core nodes. The consensus nodes are responsible for maintaining the consensus mechanism of the blockchain, have full data, and ensure the consistency and security of the ledger data.

[0099] It is understandable that the consensus network 11 may include one or more consensus nodes, and the number of consensus nodes is not limited here. Figure 1, the consensus network 11 may include consensus node 111, consensus node 112, ..., consensus node 113.

[0100] The nodes in the trusted network 12 can be called trusted nodes. The trusted nodes have a trusted execution environment, are responsible for synchronizing and verifying ledger data, and verifying the identity of the subordinate ultra-light nodes (also referred to as business nodes in this embodiment of the application). A TEE node can serve multiple ultra-light nodes, which can ensure the security and reliability of the consensus network.

[0101] It is understandable that the above-mentioned trusted network 12 may include one or more trusted nodes, and the number of trusted nodes is not limited here. Figure 1 The trusted network 12 may include a trusted node 121 , a trusted node 122 , a trusted node 123 , . . . , a trusted node 124 .

[0102] The nodes in the business network 13 can be called business nodes or ultra-light nodes. By connecting to the upper-level TEE nodes (i.e., trusted nodes), they obtain visible events related to their own business in the blockchain, manage event information, do not store account book information, and realize lightweight business interaction.

[0103] It is understandable that the above service network 13 may include one or more service nodes, and the number of service nodes is not limited here. Figure 1 The service network 13 may include a service node 131 , a service node 132 , a service node 133 , . . . , a service node 134 .

[0104] In order to ensure data interoperability between each blockchain node, a data connection may exist between each blockchain node, for example, there is a data connection between consensus node 111 and consensus node 112, there is a data connection between consensus node 111 and consensus node 113, for example, there is a data connection between trusted node 121 and trusted node 123, and there is a data connection between business node 131 and business node 132.

[0105] Furthermore, there is a data connection between the consensus network 11 and the trusted network 12, for example, there is a data connection between the consensus node 111 and the trusted node 122, and there is a data connection between the consensus node 112 and the trusted node 123. There is a data connection between the consensus network 11 and the business network 13, for example, there is a data connection between the consensus node 111 and the business node 132, and there is a data connection between the consensus node 112 and the business node 133. There is a data connection between the business network 13 and the trusted network 12, for example, there is a data connection between the business node 131 and the trusted node 122, and there is a data connection between the business node 132 and the trusted node 123.

[0106] It is understandable that data or blocks can be transmitted between blockchain nodes through the above data connection. The data connection between the above blockchain nodes can be based on node identification. For each blockchain node in the blockchain network, there is a node identification corresponding to it, and each blockchain node can store the node identification of other blockchain nodes connected to itself, so that the acquired data or generated blocks can be broadcast to other blockchain nodes according to the node identification of other blockchain nodes. For example, the consensus node 111 can maintain a node identification list, which stores the node names and node identifications of other blockchain nodes, as shown in Table 1.

[0107] Table 1

[0108] Node Name Node ID Consensus Node 112 AAAAA Consensus Node 113 BBBBB … … Trusted Node 121 CCCCC Trusted Node 122 DDDDD Trusted Node 123 EEEEE … … Business Node 131 FFFFF Business Node 132 GGGGG Business Node 133 HHHHH … …

[0109] Among them, the node identifier can be the Internet Protocol (IP) address for interconnecting networks, or any other information that can be used to identify a node in a blockchain network. Table 1 only uses the IP address as an example for explanation.

[0110] Assuming that the node identifier of consensus node 111 is FFFFF, consensus node 111 can send a data synchronization request to trusted node 121 through node identifier CCCCC, and trusted node 121 can know that the data synchronization request is sent by consensus node 111 through node identifier FFFFF; similarly, trusted node 123 can send a data synchronization request to consensus node 111 through node identifier FFFFF, and consensus node 111 can know that the data synchronization request is sent by trusted node 123 through node identifier EEEEE, and the same is true for data transmission between other nodes, so they will not be described one by one.

[0111] It is understandable that the above-mentioned data connection does not limit the connection method, and can be directly or indirectly connected through wired communication, directly or indirectly connected through wireless communication, or through other connection methods, which are not limited in this application.

[0112] It is understandable that in the specific implementation of this application, related data such as user information (such as business transactions) is involved. When the embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0113] Among them, it is understandable that Figure 1The blockchain nodes shown (such as consensus node 111, trusted node 121 and business node 131) can have a one-to-one correspondence with the corresponding roles (i.e., entity objects in the corresponding business scenarios) that need to be connected to the blockchain network. The business scenarios here can specifically include electronic bill scenarios, resource issuance scenarios, resource transfer scenarios, payment scenarios, etc. At this time, the business data information in the corresponding business scenarios can specifically include electronic bill information in the electronic bill scenario, resource issuance information in the resource issuance scenario, resource transfer information in the resource transfer scenario, asset transfer records in the payment scenario, etc. The specific contents of the business data information in the corresponding business scenarios will not be listed one by one here.

[0114] Understandably, Figure 1 The blockchain nodes in the blockchain network include but are not limited to terminal devices or servers. The above-mentioned server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (Content Delivery Network, referred to as CDN), and big data and artificial intelligence platforms. The above-mentioned terminal devices include but are not limited to mobile phones, computers, intelligent voice interaction devices, smart home appliances, vehicle terminals, aircraft, etc. Among them, the terminal device and the server can be directly or indirectly connected by wired or wireless means, and the embodiments of the present application do not limit this.

[0115] For further information, see Figure 2 , Figure 2 This is a flowchart of a data processing method based on blockchain provided in an embodiment of the present application. Figure 1 The implementation process of the data processing method may be performed in a business node, in a trusted node, or interactively in a business node and a trusted node, which is not limited here. Figure 2 The present application embodiment is described by taking a service node as an example, wherein the service node can be the above-mentioned Figure 1 Any service node in the service network 13 in the system architecture. The embodiments of the present application can be applied to various scenarios, including but not limited to cloud technology, artificial intelligence, smart transportation, assisted driving, etc. Figure 2 As shown, the data processing method may at least include the following steps S101 to S103.

[0116] Step S101, sending the business transaction to the consensus network so that the consensus node in the consensus network can process the business transaction on the chain; the consensus node is used to synchronize the synchronous transaction data and block header corresponding to the business transaction to the trusted network when the business transaction is successfully on the chain; the block header belongs to the block to which the business transaction belongs; the trusted node in the trusted network is used to store the synchronous transaction data and block header in the trusted execution environment when it is determined that the synchronous transaction data is of a legal type based on the block header.

[0117] Specifically, a transaction chain request including a business transaction is obtained from a business device; the business transaction carries a first signature message; according to the transaction chain request, the device public key of the business device is obtained, and the first signature message is verified through the device public key to obtain a first digital summary; a second digital summary corresponding to the business transaction is generated, and the first digital summary and the second digital summary are compared; if the first digital summary is different from the second digital summary, a request failure message is returned to the business device; if the first digital summary is the same as the second digital summary, the business transaction is sent to the consensus network.

[0118] Specifically, the business node obtains a transaction on-chain request including a business transaction sent by a business device. The business device is an off-chain device, which can be a terminal device with an application client installed, a business server corresponding to the application client, or a terminal device and a business server. The embodiment of the present application does not limit the business scenario and transaction content of the business transaction, and can be set according to the actual application scenario. For example, if the business scenario of the business transaction is an electronic invoice scenario, the business transaction includes the electronic invoice information under the electronic invoice scenario; for example, if the business scenario of the business transaction is a resource issuance scenario, the business transaction includes the resource issuance information under the resource issuance scenario.

[0119] For ease of understanding and description, please refer to Figure 3 , Figure 3 This is a schematic diagram of a data processing scenario based on blockchain provided by an embodiment of the present application. Figure 1 .like Figure 3 As shown, the business device 30a is installed with a business application, and the business application is bound to a blockchain address 301a, that is, Figure 3 In the example 111XXXX1111; in the business application, the business device 30a displays the resource identifier 302a, such as Figure 3 In the example 112233, the resource identifier 302a can uniquely identify the digital resource on the blockchain. When responding to the trigger operation for the query control 303a, the business device 30a can generate a business transaction 30b in the business application. It can be understood that the business transaction 30b is a resource query transaction, which is used to request the blockchain to query the digital resource represented by the resource identifier 302a.

[0120] like Figure 3 As shown, business transaction 30b may include blockchain address 301a (eg Figure 3 111XXXX1111 in the example), and resource identifier 302a (such as Figure 3 112233 in the example). Further, the business device 30a obtains the device private key 301c corresponding to the blockchain address 301a, signs the business transaction 30b, obtains the first signature message 30d, generates a transaction on-chain request based on the first signature message 30d and the business transaction 30b, and sends the transaction on-chain request to the business network for processing resource query services.

[0121] Further, the business node 30e in the business network obtains the transaction on-chain request, such as Figure 3 As shown, according to the transaction on-chain request, the business node 30e obtains the device public key 302c of the business device 30a, wherein the device private key 301c and the device public key 302c are a pair of asymmetric keys, and the device public key 302c is generated based on the device private key 301c. Through the device public key 302c, the business node 30e can decrypt the first signature message 30d to obtain the first digital summary; in addition, the second digital summary corresponding to the business transaction 30b is generated, wherein the first digital summary and the second digital summary can both be hash values.

[0122] Further, the service node 30e compares the first digital digest with the second digital digest. If the first digital digest is different from the second digital digest, it can be determined that the service transaction 30b is of an illegal type, so a request failure message is generated, such as Figure 3 As shown, the business node 30e returns a request failure message to the business device 30a; if the first digital digest is the same as the second digital digest, the business node 30e sends the business transaction 30b to the consensus network 30f.

[0123] After the consensus nodes in the consensus network obtain the business transaction, they will process it on the chain. The specific process of chaining is as follows: Figure 4 , Figure 4 This is a schematic diagram of a data processing scenario based on blockchain provided by an embodiment of the present application. Figure 2 .like Figure 4 As shown, the consensus node 30g obtains the business transaction 30b and calls the transaction execution function 30h in the smart contract used to execute the business transaction. It can be understood that the example business transaction 30b in the embodiment of the present application is a resource query transaction, so the transaction execution function 30h can be a resource query function.

[0124] Further, the transaction execution function 30h is executed according to the business transaction 30b to obtain the transaction execution result 1 of the business transaction 30b, wherein the transaction execution function 30h can verify whether the resource identifier (i.e., 112233) in the business transaction 30b exists, that is, whether the corresponding digital resource exists, and the transaction execution function 30h can verify whether the blockchain address (i.e., 111XXXX1111) in the business transaction 30b has the authority to query the digital resource represented by the resource identifier. Based on the above two verifications, the transaction execution function 30h can output the transaction execution result 1 corresponding to the business transaction 30b, for example, the transaction execution result 1 is the details of the digital resource represented by the resource identifier, or the resource identifier does not exist or the blockchain address does not have the query authority.

[0125] For ease of understanding and description, the consensus node 30g in the embodiment of the present application executes four business transactions respectively to obtain four transaction execution results, such as business transaction 1 and transaction execution result 1 corresponding to business transaction 1, business transaction 2 and transaction execution result 2 corresponding to business transaction 2, business transaction 3 and transaction execution result 3 corresponding to business transaction 3, and business transaction 4 and transaction execution result 4 corresponding to business transaction 4. Figure 4 As shown, Figure 4 Y1 in the example can represent business transaction 1 (equivalent to Figure 4 In business transaction 30b), Y2 may represent business transaction 2, Y3 may represent business transaction 3, and Y4 may represent business transaction 4. Figure 4 G1 can represent transaction execution result 1, G2 can represent transaction execution result 2, G3 can represent transaction execution result 3, and G4 can represent transaction execution result 4.

[0126] Furthermore, consensus node 30g performs hash calculations on the four business transactions respectively, and obtains the hash value H of business transaction 1. Y (1) Hash value H of business transaction 2 Y (2) Hash value H of business transaction 3 Y (3), and the hash value H of business transaction 4 Y (4); Then the hash value H Y (1) and hash value H Y (2) Perform a hash operation to obtain a hash value H including the above two hash values Y (12), for the hash value H Y (3) and hash value H Y (4) Perform a hash operation to obtain a hash value H including the above two hash values Y (34); Finally, the hash value H Y (12) and the hash value H Y (34) Perform hash operation to obtain the hash value HY (12) and the hash value H Y The hash value H of (34) Y (1234), through the above processing and the above data, the consensus node 30g can generate a transaction status tree, such as Figure 4 As shown, the hash value H Y (1234) is the transaction tree root of the transaction status tree, which can also be called the transaction root hash.

[0127] Consensus node 30g performs hash calculations on the four transaction execution results respectively and obtains the hash value H of transaction execution result 1. G (1) Hash value H of transaction execution result 2 G (2) Hash value H of transaction execution result 3 G (3), and the hash value H of the transaction execution result 4 G (4); Then the hash value H G (1) and hash value H G (2) Perform a hash operation to obtain a hash value H including the above two hash values G (12), for the hash value H G (3) and hash value H G (4) Perform a hash operation to obtain a hash value H including the above two hash values G (34); Finally, the hash value H G (12) and the hash value H G (34) Perform hash operation to obtain the hash value H G (12) and the hash value H G The hash value H of (34) G (1234), through the above processing and the above data, the consensus node 30g can generate a result state tree, such as Figure 4 As shown, the hash value H G (1234) is the result tree root of the result status tree, which can also be called the result root hash.

[0128] Please see again Figure 4 According to the above four business transactions, the transaction execution results corresponding to the four business transactions, the transaction status tree and the result status tree, the consensus node 30g generates a block to be agreed upon 30i, such as Figure 4 As shown, the consensus block 30i includes a block header and a block body. The block header may include a transaction root hash (i.e. Figure 4 The hash value H in Y (1234)) and the resulting root hash (i.e. Figure 4 The hash value H in G(1234)), in actual application, the block header can also store basic data such as version number, timestamp and difficulty value. The block body includes the executed business transactions, the generated transaction execution results and the status tree (including the transaction status tree and the result status tree).

[0129] Further, the consensus node 30g broadcasts the block 30i to be agreed upon to the remaining consensus nodes in the consensus network. The specific processing process of the remaining consensus nodes after obtaining the block 30i to be agreed upon is basically the same as the processing process after the consensus node 30g obtains the above-mentioned four business transactions. The remaining consensus nodes locally call the transaction execution function, execute the business transaction through the transaction execution function, obtain the transaction execution result to be verified, generate a transaction status tree to be verified and a result status tree to be verified locally, compare the transaction root hash in the consensus block 30i with the locally generated transaction root hash to be verified, and compare the result root hash in the consensus block 30i with the locally generated result root hash to be verified. Through the above two comparison results, the consensus result of the block 30i to be agreed upon is determined, for example, the consensus result is a consensus pass result or a consensus fail result.

[0130] Further, the remaining consensus nodes return the consensus result to the consensus node 30g. The consensus node 30g determines whether to add the block to be agreed upon 30i to the ledger according to the consensus results of all consensus nodes in the consensus network. For example, if the consensus result of the consensus network is a consensus passing result, then the consensus node 30g adds the block to be agreed upon 30i to the ledger (i.e., blockchain) maintained by itself. If the consensus result of the consensus node of the consensus network is a consensus failure result, then the consensus node 30g deletes the block to be agreed upon.

[0131] It is understandable that the processing of the remaining consensus nodes is the same as that of the consensus node 30g. The consensus block 30i successfully added to the blockchain is successfully on-chain, and all data in the consensus block 30i successfully on-chain is the on-chain data, such as the on-chain result root hash and the on-chain transaction root hash.

[0132] It is understandable that the successful on-chaining of a block can indicate the successful on-chaining of the business transaction in the block. When the business transaction is successfully on-chained, the consensus node synchronizes the synchronous transaction data corresponding to the business transaction and the block header corresponding to the business transaction to the trusted network, where the synchronous transaction data refers to the data associated with the business transaction, such as the transaction execution result and the current status of the object in the business transaction.

[0133] The specific process of storing synchronized transaction data and block headers in a trusted execution environment by the trusted nodes in the trusted network will not be described in detail in the present embodiment of the application. Please refer to the following Fig. 9 The description in the corresponding embodiment.

[0134] Step S102: sending a data synchronization request to the trusted network, so that the trusted node in the trusted network obtains the synchronization transaction data from the trusted execution environment according to the data synchronization request.

[0135] Specifically, a data synchronization request is sent to a trusted network so that a trusted node in the trusted network generates an authentication challenge random number and a first intermediate key pair in a trusted execution environment according to the data synchronization request; the first intermediate key pair includes a first intermediate private key and a first intermediate public key corresponding to the first intermediate private key; the authentication challenge random number and the first intermediate public key are used by the trusted node to generate a remote authentication request; the remote authentication request returned by the trusted node is obtained, and a second intermediate key pair for the trusted node is generated according to the remote authentication request; the second intermediate key pair includes a second intermediate public key; a remote authentication response is generated according to the second intermediate public key and the authentication challenge random number in the remote authentication request; the remote authentication response is sent to the trusted node so that the trusted node obtains the second intermediate public key in the remote authentication response when determining that the remote authentication response has a legal attribute; the second intermediate public key, the authentication challenge random number and the first intermediate private key are used by the trusted node to generate a communication key; the communication key is used by the trusted node to encrypt the synchronization transaction data obtained from the trusted execution environment to obtain encrypted synchronization transaction data.

[0136] After obtaining the message that the business transaction is successfully uploaded to the chain broadcast by the consensus network, the business result can send a data synchronization request to the trusted network. The data synchronization request is used to request data associated with the business transaction, which is called synchronized transaction data in this embodiment of the application, including transaction execution results, etc. Please refer to Figure 5 , Figure 5 This is a schematic diagram of a data processing scenario based on blockchain provided by an embodiment of the present application. Figure 3 .like Figure 5 As shown, the service node 40a sends a data synchronization request to the trusted network, and the trusted node 40b in the trusted network obtains the data synchronization request.

[0137] Please see again Figure 5 According to the data synchronization request, the trusted node 40b can generate an authentication challenge random number 40c and a first intermediate key pair in the trusted execution environment. For ease of understanding and description, Figure 5 The example authentication challenge random number 40c is 33…4455, and the first intermediate key pair includes a first intermediate private key 401d and a first intermediate public key 402d corresponding to the first intermediate private key 401d. The first intermediate private key 401d and the first intermediate public key 402d of the first intermediate key pair can be expressed by the following formula (1).

[0138] i=(G∧h)modp (1)

[0139] Wherein, G in formula (1) is the base, p is a prime number, G and P are both authentication challenge random numbers 40c; h represents the first intermediate private key 401d, and i represents the first intermediate public key 402d.

[0140] Furthermore, based on the authentication challenge random number 40c and the first intermediate public key 402d, the trusted node 40b can generate a remote authentication request 401e and send the remote authentication request 401e to the business node 40a. The remote authentication request 401e is used to verify the legitimacy of the business node 40a and ensure the security of the blockchain data.

[0141] Further, the service node 40a obtains the remote authentication request 401e returned by the trusted node 40b, and generates a second intermediate key pair for the trusted node 40b according to the remote authentication request 401e, such as Figure 5 As shown, the second intermediate key pair includes a second intermediate private key 401f and a second intermediate public key 402f generated according to the second intermediate private key 401f. The second intermediate private key 401f and the second intermediate public key 402f of the second intermediate key pair can be expressed by the following formula (2).

[0142] f=(G∧k)modp (2)

[0143] Wherein, k represents the second intermediate private key 401f, f represents the second intermediate public key 402f, and the remaining symbols are the same as those in formula (1).

[0144] According to the second intermediate public key 402f and the authentication challenge random number 40c in the remote authentication request 401e, the service node 40a can generate a remote authentication response 402e, and further send the remote authentication response 402e to the trusted node 40b.

[0145] Please also see Figure 5 as well as Figure 6 , Figure 6 This is a schematic diagram of a data processing scenario based on blockchain provided by an embodiment of the present application. Figure 4 .like Figure 6 As shown, the trusted node 40b verifies the remote authentication response 402e in the trusted execution environment, and when determining that the remote authentication response 402e has a legal attribute, obtains the second intermediate public key 402f in the remote authentication response 402e. Further, based on the second intermediate public key 402f, the authentication challenge random number 40c and the first intermediate private key 401d, the trusted node 40b can generate a communication key 40g, wherein the generation of the communication key can be represented by the following formula (3).

[0146] S=(i∧k)modp=(f∧h)modp (3)

[0147] Here, S in formula (3) represents the communication key 40g.

[0148] Please see again Figure 6 Through the communication key 40g, the trusted node 40b can encrypt the synchronous transaction data obtained from the trusted execution environment to obtain encrypted synchronous transaction data.

[0149] Step S103: store the synchronous transaction data returned by the trusted node, and perform business processing associated with the business transaction according to the synchronous transaction data.

[0150] Specifically, the encrypted synchronous transaction data returned by the trusted node is obtained; the authentication challenge random number and the first intermediate public key are obtained from the remote authentication request, and the second intermediate private key is obtained from the second intermediate key pair; a communication key is generated according to the second intermediate private key, the authentication challenge random number and the first intermediate public key; the encrypted synchronous transaction data is decrypted according to the communication key to obtain the synchronous transaction data, and the synchronous transaction data is stored.

[0151] Please see again Figure 5 as well as Figure 6 , the service node 40a obtains the encrypted synchronous transaction data returned by the trusted node 40b, and can obtain the authentication challenge random number 40c and the first intermediate public key 402d from the remote authentication request 401e, and can obtain the second intermediate private key 401f from the second intermediate key pair. Further, according to the second intermediate private key 401f, the authentication challenge random number 40c and the first intermediate public key 402d, the service node 40a can generate the communication key 40g; according to the communication key 40g, the encrypted synchronous transaction data can be decrypted to obtain the synchronous transaction data.

[0152] The embodiments of the present application can provide an ultra-light client based on TEE technology in a layered blockchain, namely a business node, also called an ultra-light node. The ultra-light node in the layered blockchain can obtain visible events in the blockchain by connecting to an upper-level TEE node, and only manages visible event information without storing any ledger information, thereby realizing lightweight business interaction.

[0153] The upper-level TEE node is responsible for synchronizing and verifying the ledger data, and at the same time verifying the identity of the lower-level ultra-light node. One TEE node can serve multiple ultra-light nodes, so a three-layer structure of consensus network, TEE service layer, and ultra-light node layer can be realized.

[0154] The business nodes in this three-layer structure can avoid storing a large amount of data that is irrelevant to the business they are concerned about. By verifying the ledger data through trusted nodes, the business nodes can avoid verifying the blockchain data themselves, thus saving a lot of computing resources and storage resources, thereby improving scalability and performance issues.

[0155] In an embodiment of the present application, a business node in a business network sends a business transaction to a consensus network, so that the consensus node in the consensus network processes the business transaction on the chain; when the business transaction is successfully on the chain, the consensus node synchronizes the synchronous transaction data corresponding to the business transaction and the block header corresponding to the business transaction to the trusted network; when it is determined according to the block header that the synchronous transaction data is of a legal type, the trusted node in the trusted network stores the synchronous transaction data and the block header in a trusted execution environment; further, the business node sends a data synchronization request to the trusted network, so that the trusted node in the trusted network obtains the synchronous transaction data from the trusted execution environment according to the data synchronization request; further, the business node stores the synchronous transaction data returned by the trusted node, and performs business processing associated with the business transaction according to the synchronous transaction data. From the above, it can be seen that the embodiment of the present application proposes a three-layer blockchain network architecture, which includes a consensus network, a trusted network and a business network, wherein the trusted network can synchronize and verify the blockchain (including synchronizing transaction data and block headers) without performing business processing; the business network can obtain data related to its own business in the blockchain (i.e., synchronizing transaction data) and perform business processing, and does not store data that is not related to its own business (including block headers); obviously, the use of this application can reduce the computing resources and storage resources of blockchain nodes.

[0156] For further information, see Figure 7 , Figure 7 This is a flow diagram of a data processing method provided in an embodiment of the present application. Figure 2 The implementation process of the data processing method may be performed in a business node, in a trusted node, or interactively in a business node and a trusted node, which is not limited here. Figure 7 The present application embodiment is described by taking a service node as an example, wherein the service node can be the above-mentioned Figure 1 Any service node in the service network 13 in the system architecture. Figure 7 As shown, the data processing method may at least include the following steps S201 to S206.

[0157] Step S201, obtaining a business transaction initiated by a business device; the business transaction is a resource query transaction; the resource query transaction includes a resource identifier.

[0158] Specifically, the embodiments of the present application do not limit the business scenarios and transaction contents of business transactions, and can be set according to actual application scenarios. For the sake of ease of description and understanding, the embodiments of the present application take the business scenario of business transactions as an example of resource query scenarios. At this time, the business transaction includes resource query information under the resource query scenario, such as the above Figure 3 Example business transaction 30b.

[0159] Step S202, sending the business transaction to the consensus network so that the consensus node in the consensus network can process the business transaction on the chain; the consensus node is used to synchronize the synchronous transaction data and block header corresponding to the business transaction to the trusted network when the business transaction is successfully on the chain; the block header belongs to the block to which the business transaction belongs; the trusted node in the trusted network is used to store the synchronous transaction data and block header in the trusted execution environment when it is determined that the synchronous transaction data is of a legal type based on the block header.

[0160] For the specific implementation process of step S202, please refer to the above Figure 2 The description of step S102 in the corresponding embodiment is not repeated here.

[0161] Step S203: Send a data synchronization request to the trusted network, so that the trusted node in the trusted network obtains the synchronization transaction data from the trusted execution environment according to the data synchronization request.

[0162] Specifically, obtain the transaction chain success message for the business transaction returned by the consensus node, and generate a data synchronization request for the business transaction based on the transaction chain success message; obtain the business private key based on the data synchronization request, and sign the data synchronization request through the business private key to obtain a second signature message; send the data synchronization request carrying the second signature message to the trusted network, so that the trusted node in the trusted network can obtain the business public key corresponding to the business private key based on the data synchronization request; the business public key is used by the trusted node to verify the second signature message to obtain the verification result; the verification result is used to instruct the trusted node to obtain the synchronization transaction data from the trusted execution environment when it is determined that the business node has synchronization authority.

[0163] It is understandable that the above Figure 2 The corresponding step S102 of the embodiment is used to describe the method of determining the legitimacy of the service node through TEE remote authentication. This step is used to describe the method of determining the legitimacy of the service node through asymmetric signature. In actual scenarios, the trusted node can choose at least one of the above two methods for application.

[0164] Step S204, storing the synchronous transaction data returned by the trusted node, and obtaining the transaction execution result corresponding to the resource query transaction in the synchronous transaction data.

[0165] Specifically, the transaction execution result corresponding to the resource query transaction may include the details of the digital resource represented by the resource identifier, or the resource identifier does not exist, or the blockchain address logged in by the business device does not have query permission.

[0166] Step S205: If the transaction execution result is a successful transaction execution result, the resource data corresponding to the resource identifier is returned to the business device.

[0167] Step S206: If the transaction execution result is a transaction execution failure result, a resource query failure message is returned to the business device.

[0168] In an embodiment of the present application, a business node in a business network sends a business transaction to a consensus network, so that the consensus node in the consensus network processes the business transaction on the chain; when the business transaction is successfully on the chain, the consensus node synchronizes the synchronous transaction data corresponding to the business transaction and the block header corresponding to the business transaction to the trusted network; when it is determined according to the block header that the synchronous transaction data is of a legal type, the trusted node in the trusted network stores the synchronous transaction data and the block header in a trusted execution environment; further, the business node sends a data synchronization request to the trusted network, so that the trusted node in the trusted network obtains the synchronous transaction data from the trusted execution environment according to the data synchronization request; further, the business node stores the synchronous transaction data returned by the trusted node, and performs business processing associated with the business transaction according to the synchronous transaction data. From the above, it can be seen that the embodiment of the present application proposes a three-layer blockchain network architecture, which includes a consensus network, a trusted network and a business network, wherein the trusted network can synchronize and verify the blockchain (including synchronizing transaction data and block headers) without performing business processing; the business network can obtain data related to its own business in the blockchain (i.e., synchronizing transaction data) and perform business processing, and does not store data that is not related to its own business (including block headers); obviously, the use of this application can reduce the computing resources and storage resources of blockchain nodes.

[0169] For further information, see Figure 8 , Figure 8 This is a flow diagram of a data processing method provided in an embodiment of the present application. Figure 3 The implementation process of the data processing method may be performed in a business node, in a trusted node, or interactively in a business node and a trusted node, which is not limited here. Figure 8 The embodiment of the present application is described by taking a trusted node as an example, wherein the trusted node can be the above-mentioned Figure 1 Any trusted node in the business network 12 in the system architecture. Figure 8 As shown, the data processing method may at least include the following steps S301-S303.

[0170] Step S301: obtaining a data synchronization request for a business transaction sent by a business node in a business network.

[0171] Specifically, TEE technology is a hardware-level security protection mechanism. TEE nodes (trusted nodes) use TEE technology to ensure the security and reliability of ledger data, while improving the security and protection capabilities of nodes. The specific functions of TEE nodes are as follows:

[0172] 1. Protect the security and reliability of ledger data through TEE technology. TEE nodes can prevent data from being tampered with or attacked.

[0173] 2. TEE nodes verify the identity of lower-level ultra-light nodes to ensure the security and reliability of the consensus network.

[0174] 3. One TEE node can serve multiple ultra-light nodes, improving node utilization and protection capabilities.

[0175] Through the three-layer blockchain network architecture, the following functions can be achieved:

[0176] 1. Lightweight business interaction: Through the design of ultra-light nodes (i.e. business nodes), lightweight business interaction can be achieved, which improves the scalability and performance of the blockchain;

[0177] 2. Hierarchical structure: Through the design of hierarchical structure, the security and reliability of the consensus network are achieved, while the scalability and performance of the blockchain are improved;

[0178] 3. Security and reliability: Through the application of TEE technology, the security and reliability of ledger data are guaranteed, while the security and protection capabilities of nodes are improved.

[0179] Step S302, according to the data synchronization request, obtain the synchronization transaction data corresponding to the business transaction from the trusted execution environment; the synchronization transaction data is stored when it is determined that the synchronization transaction data is of a legal type according to the block header; the synchronization transaction data and the block header are sent by the consensus node in the consensus network when the business transaction sent by the business node is successfully uploaded to the chain; the block header belongs to the block to which the business transaction belongs.

[0180] Specifically, according to the data synchronization request, an authentication challenge random number and a first intermediate key pair are generated in a trusted execution environment; the first intermediate key pair includes a first intermediate public key; according to the authentication challenge random number and the first intermediate public key, a remote authentication request is generated, and the remote authentication request is sent to the business node, so that the business node generates a second intermediate key pair including a second intermediate public key according to the remote authentication request; the second intermediate public key is used by the business node to generate a remote authentication response to the remote authentication request; in the trusted execution environment, the remote authentication response returned by the business node is obtained, the legitimacy of the remote authentication response is verified, and a verification result is obtained; according to the verification result, the synchronization transaction data corresponding to the business transaction is obtained from the trusted execution environment.

[0181] Among them, according to the verification result, the specific process of obtaining the synchronous transaction data corresponding to the business transaction from the trusted execution environment may include: if the verification result indicates that the remote authentication response has a legal attribute, then obtaining the synchronous transaction data corresponding to the business transaction from the trusted execution environment.

[0182] Step S303: Send the synchronous transaction data to the service node, so that the service node performs service processing associated with the service transaction according to the synchronous transaction data.

[0183] Specifically, a second intermediate public key is obtained from a remote authentication response, and a first intermediate private key is obtained from a first intermediate key pair; a communication key is generated according to the first intermediate private key, the second intermediate public key and an authentication challenge random number; according to the communication key, the synchronization transaction data is encrypted to obtain encrypted synchronization transaction data; the encrypted synchronization transaction data is sent to a business node, so that the business node generates a communication key according to the second intermediate private key in the second intermediate key pair, the first intermediate public key and an authentication challenge random number; the communication key is used by the business node to decrypt the encrypted synchronization transaction data to obtain the synchronization transaction data.

[0184] In an embodiment of the present application, a business node in a business network sends a business transaction to a consensus network, so that the consensus node in the consensus network processes the business transaction on the chain; when the business transaction is successfully on the chain, the consensus node synchronizes the synchronous transaction data corresponding to the business transaction and the block header corresponding to the business transaction to the trusted network; when it is determined according to the block header that the synchronous transaction data is of a legal type, the trusted node in the trusted network stores the synchronous transaction data and the block header in a trusted execution environment; further, the business node sends a data synchronization request to the trusted network, so that the trusted node in the trusted network obtains the synchronous transaction data from the trusted execution environment according to the data synchronization request; further, the business node stores the synchronous transaction data returned by the trusted node, and performs business processing associated with the business transaction according to the synchronous transaction data. From the above, it can be seen that the embodiment of the present application proposes a three-layer blockchain network architecture, which includes a consensus network, a trusted network and a business network, wherein the trusted network can synchronize and verify the blockchain (including synchronizing transaction data and block headers) without performing business processing; the business network can obtain data related to its own business in the blockchain (i.e., synchronizing transaction data) and perform business processing, and does not store data that is not related to its own business (including block headers); obviously, the use of this application can reduce the computing resources and storage resources of blockchain nodes.

[0185] For further information, see Fig. 9 , Fig. 9 This is a flow diagram of a data processing method provided in an embodiment of the present application. Figure 4The implementation process of the data processing method may be performed in a business node, in a trusted node, or interactively in a business node and a trusted node, which is not limited here. Fig. 9 The embodiment of the present application is described by taking a trusted node as an example, wherein the trusted node can be the above-mentioned Figure 1 Any trusted node in the business network 12 in the system architecture. Fig. 9 As shown, the data processing method may at least include the following steps S401 to S407.

[0186] Step S401, obtaining the synchronous transaction data sent by the consensus node and the verification data for the synchronous transaction data; the synchronous transaction data includes the business transaction and the transaction execution result corresponding to the business transaction; the verification data includes the transaction verification data and the result verification data.

[0187] For details, please refer to the above Figure 3 as well as Fig.10 , Fig.10 This is a schematic diagram of a data processing scenario based on blockchain provided by an embodiment of the present application. Figure 5 . Figure 3 In the example, after the consensus on the consensus block 30i is passed, the consensus node 30g can add the consensus block 30i to the blockchain (i.e., the account book), and the data included in the consensus block 30i after the successful addition can be called on-chain data.

[0188] like Fig.10 As shown, the consensus node 30g can obtain the business transaction 30b ( Fig.10 Transaction verification data represented by Y1), the transaction verification data includes the hash value H Y (2) and hash value H Y (34). In the result status tree, the consensus node 30g can obtain the transaction execution result 1 for the business transaction 30b ( Fig.10 The result verification data is represented by G1, and the result verification data includes a hash value H G (2) and hash value H G (34).

[0189] Further, the consensus node 30g synchronizes the verification data including the transaction verification data and the result verification data, as well as the synchronization transaction data including the business transaction and the transaction execution result corresponding to the business transaction, to the trusted node 90a.

[0190] Step S402: Verify the business transaction according to the transaction verification data to obtain the root hash of the transaction to be verified.

[0191] For details, please refer to Fig.10, the trusted node 90a is responsible for the business transaction (i.e. Fig.10 Y1) is hashed to obtain the to-be-verified hash value corresponding to the business transaction. For the sake of convenience, the to-be-verified hash value corresponding to the business transaction is referred to as to-be-verified hash value 1. Further, to-be-verified hash value 1 and hash value H Y (2) Perform a hash operation to obtain a hash value 2 to be verified that includes the above two hash values; further, the trusted node 30g performs a hash operation to obtain the hash value 2 to be verified and the hash value H Y (34) Perform a hash operation to obtain the hash value 2 to be verified and the hash value H Y The hash value 3 to be verified of (34) is the root hash of the transaction to be verified mentioned above.

[0192] Step S403, verify the transaction execution result according to the result verification data to obtain the root hash of the result to be verified.

[0193] For details, please refer to Fig.10 , the trusted node 90a checks the transaction execution result (i.e. Fig.10 G1) is hashed to obtain the to-be-verified hash value corresponding to the business transaction execution result. For the sake of convenience, the to-be-verified hash value corresponding to the transaction execution result is referred to as the to-be-verified hash value 4. Further, the to-be-verified hash value 4 and the hash value H G (2) Perform a hash operation to obtain a hash value 5 to be verified including the above two hash values; further, the trusted node 30g performs a hash operation to obtain the hash value 5 to be verified and the hash value H G (34) Perform a hash operation to obtain the hash value 5 to be verified and the hash value H G The hash value to be verified of (34) is 6, which is the root hash of the result to be verified mentioned above.

[0194] Step S404: verify the legitimacy of the synchronous transaction data according to the transaction root hash to be verified, the result root hash to be verified, and the block header.

[0195] Specifically, obtain the on-chain transaction root hash and the on-chain result root hash in the block header; compare the to-be-verified transaction root hash with the on-chain transaction root hash, and compare the to-be-verified result root hash with the on-chain result root hash; if the to-be-verified transaction root hash is different from the on-chain transaction root hash, it is determined that the synchronized transaction data is of an illegal type; if the to-be-verified result root hash is different from the on-chain result root hash, it is determined that the synchronized transaction data is of an illegal type; if the to-be-verified transaction root hash is the same as the on-chain transaction root hash, and the to-be-verified result root hash is the same as the on-chain result root hash, it is determined that the synchronized transaction data is of a legal type.

[0196] If it is determined that the synchronization transaction data is of an illegal type, the trusted node deletes the synchronization transaction data and the verification data; if it is determined that the synchronization transaction data is of a legal type, the trusted node stores the synchronization transaction data and the verification data in association in the trusted execution environment.

[0197] Step S405: obtaining a data synchronization request for a business transaction sent by a business node in the business network.

[0198] Step S406, according to the data synchronization request, obtain the synchronization transaction data corresponding to the business transaction from the trusted execution environment; the synchronization transaction data is stored when it is determined that the synchronization transaction data is of a legal type according to the block header; the synchronization transaction data and the block header are sent by the consensus node in the consensus network when the business transaction sent by the business node is successfully uploaded to the chain; the block header belongs to the block to which the business transaction belongs.

[0199] Step S407: sending the synchronous transaction data to the service node, so that the service node performs service processing associated with the service transaction according to the synchronous transaction data.

[0200] For the specific implementation process of steps S405 to S407, please refer to the above Figure 8 The description of steps S301 to S303 in the corresponding embodiment will not be repeated here.

[0201] In an embodiment of the present application, a business node in a business network sends a business transaction to a consensus network, so that the consensus node in the consensus network processes the business transaction on the chain; when the business transaction is successfully on the chain, the consensus node synchronizes the synchronous transaction data corresponding to the business transaction and the block header corresponding to the business transaction to the trusted network; when it is determined according to the block header that the synchronous transaction data is of a legal type, the trusted node in the trusted network stores the synchronous transaction data and the block header in a trusted execution environment; further, the business node sends a data synchronization request to the trusted network, so that the trusted node in the trusted network obtains the synchronous transaction data from the trusted execution environment according to the data synchronization request; further, the business node stores the synchronous transaction data returned by the trusted node, and performs business processing associated with the business transaction according to the synchronous transaction data. From the above, it can be seen that the embodiment of the present application proposes a three-layer blockchain network architecture, which includes a consensus network, a trusted network and a business network, wherein the trusted network can synchronize and verify the blockchain (including synchronizing transaction data and block headers) without performing business processing; the business network can obtain data related to its own business in the blockchain (i.e., synchronizing transaction data) and perform business processing, and does not store data that is not related to its own business (including block headers); obviously, the use of this application can reduce the computing resources and storage resources of blockchain nodes.

[0202] For further information, see Fig.11 , Fig.11 This is a schematic diagram of a data processing device based on blockchain provided in an embodiment of the present application. Figure 1 .like Fig.11 As shown, the blockchain-based data processing device 1 can be run on a business node. The blockchain-based data processing device 1 can be a computer program (including program code) running in a computer device, for example, the data processing device is an application software; the data processing device can be used to execute the corresponding steps of the method provided in the embodiment of the present application. Fig.11 As shown, the blockchain-based data processing device 1 may include: a first sending module 11, a second sending module 12 and a data storage module 13.

[0203] The first sending module 11 is used to send the business transaction to the consensus network so that the consensus node in the consensus network can process the business transaction on the chain; the consensus node is used to synchronize the synchronous transaction data and block header corresponding to the business transaction to the trusted network when the business transaction is successfully on the chain; the block header belongs to the block to which the business transaction belongs; the trusted node in the trusted network is used to store the synchronous transaction data and block header in the trusted execution environment when determining that the synchronous transaction data belongs to a legal type according to the block header;

[0204] The second sending module 12 is used to send a data synchronization request to the trusted network, so that the trusted node in the trusted network obtains the synchronization transaction data from the trusted execution environment according to the data synchronization request;

[0205] The data storage module 13 is used to store the synchronous transaction data returned by the trusted node, and perform business processing associated with the business transaction according to the synchronous transaction data.

[0206] The specific functional implementation of the first sending module 11, the second sending module 12 and the data storage module 13 can be found in the above Figure 2 Steps S101 to S103 in the corresponding embodiment will not be described in detail here.

[0207] See also Fig.11 The first sending module 11 may include: a first acquiring unit 111, a first processing unit 112, a first generating unit 113, a first returning unit 114 and a first sending unit 115.

[0208] The first acquisition unit 111 is used to acquire a transaction on-chain request including a business transaction sent by a business device; the business transaction carries a first signature message;

[0209] The first processing unit 112 is used to obtain a device public key of the business device according to the transaction on-chain request, and verify the first signature message through the device public key to obtain a first digital summary;

[0210] A first generating unit 113 is used to generate a second digital summary corresponding to the business transaction, and compare the first digital summary with the second digital summary;

[0211] A first returning unit 114, configured to return a request failure message to the service device if the first digital digest is different from the second digital digest;

[0212] The first sending unit 115 is configured to send the business transaction to the consensus network if the first digital summary is the same as the second digital summary.

[0213] The specific functional implementation of the first acquisition unit 111, the first processing unit 112, the first generation unit 113, the first return unit 114 and the first sending unit 115 can be found in the above Figure 2 The step S101 in the corresponding embodiment will not be described in detail here.

[0214] See also Fig.11 The second sending module 12 may include: a second generating unit 121, a second processing unit 122 and a second sending unit 123.

[0215] The second generating unit 121 is used to obtain the transaction chain success message for the business transaction returned by the consensus node, and generate a data synchronization request for the business transaction according to the transaction chain success message;

[0216] The second processing unit 122 is used to obtain a business private key according to the data synchronization request, and to sign the data synchronization request using the business private key to obtain a second signature message;

[0217] The second sending unit 123 is used to send a data synchronization request carrying a second signature message to a trusted network, so that a trusted node in the trusted network obtains a business public key corresponding to a business private key according to the data synchronization request; the business public key is used by the trusted node to verify the second signature message to obtain a verification result; the verification result is used to instruct the trusted node to obtain synchronization transaction data from the trusted execution environment when it is determined that the business node has synchronization authority.

[0218] The specific functional implementation of the second generating unit 121, the second processing unit 122 and the second sending unit 123 can be found in the above Figure 7 The step S203 in the corresponding embodiment will not be described in detail here.

[0219] See also Fig.11The second sending module 12 may include: a third sending unit 124 , a second acquiring unit 125 , a third generating unit 126 and a fourth sending unit 127 .

[0220] The third sending unit 124 is used to send a data synchronization request to the trusted network, so that the trusted node in the trusted network generates an authentication challenge random number and a first intermediate key pair in the trusted execution environment according to the data synchronization request; the first intermediate key pair includes a first intermediate private key and a first intermediate public key corresponding to the first intermediate private key; the authentication challenge random number and the first intermediate public key are used by the trusted node to generate a remote authentication request;

[0221] The second acquisition unit 125 is used to acquire the remote authentication request returned by the trusted node, and generate a second intermediate key pair for the trusted node according to the remote authentication request; the second intermediate key pair includes a second intermediate public key;

[0222] The third generating unit 126 is used to generate a remote authentication response according to the second intermediate public key and the authentication challenge random number in the remote authentication request;

[0223] The fourth sending unit 127 is used to send the remote authentication response to the trusted node, so that when the trusted node determines that the remote authentication response has legal attributes, it obtains the second intermediate public key in the remote authentication response; the second intermediate public key, the authentication challenge random number and the first intermediate private key are used for the trusted node to generate a communication key; the communication key is used by the trusted node to encrypt the synchronous transaction data obtained from the trusted execution environment to obtain encrypted synchronous transaction data.

[0224] The specific functional implementation of the third sending unit 124, the second acquiring unit 125, the third generating unit 126 and the fourth sending unit 127 can be found in the above Figure 2 The step S102 in the corresponding embodiment will not be described in detail here.

[0225] See also Fig.11 The data storage module 13 may include: a third acquiring unit 131 , a fourth acquiring unit 132 , a fourth generating unit 133 and a third processing unit 134 .

[0226] The third acquisition unit 131 is used to acquire the encrypted synchronization transaction data returned by the trusted node;

[0227] The fourth acquisition unit 132 is used to obtain the authentication challenge random number and the first intermediate public key from the remote authentication request, and obtain the second intermediate private key from the second intermediate key pair;

[0228] The fourth generating unit 133 is used to generate a communication key according to the second intermediate private key, the authentication challenge random number and the first intermediate public key;

[0229] The third processing unit 134 is used to decrypt the encrypted synchronous transaction data according to the communication key to obtain the synchronous transaction data and store the synchronous transaction data.

[0230] The specific functional implementation of the third acquisition unit 131, the fourth acquisition unit 132, the fourth generation unit 133 and the third processing unit 134 can be found in the above Figure 2 The step S103 in the corresponding embodiment will not be described in detail here.

[0231] See also Fig.11 The blockchain-based data processing device 1 may further include: a transaction acquisition module 14.

[0232] The transaction acquisition module 14 is used to acquire the business transaction initiated by the business device; the business transaction is a resource query transaction; the resource query transaction includes a resource identifier;

[0233] The data storage module 13 may include: a fifth obtaining unit 135 , a second returning unit 136 and a third returning unit 137 .

[0234] A fifth acquisition unit 135 is used to acquire a transaction execution result corresponding to the resource query transaction in the synchronization transaction data;

[0235] The second returning unit 136 is configured to return the resource data corresponding to the resource identifier to the business device if the transaction execution result is a successful transaction execution result;

[0236] The third returning unit 137 is configured to return a resource query failure message to the business device if the transaction execution result is a transaction execution failure result.

[0237] The specific functional implementation of the transaction acquisition module 14, the fifth acquisition unit 135, the second return unit 136 and the third return unit 137 can be found in the above Figure 7 The steps S201 and S204 to S206 in the corresponding embodiments are not described in detail here.

[0238] In an embodiment of the present application, a business node in a business network sends a business transaction to a consensus network, so that the consensus node in the consensus network processes the business transaction on the chain; when the business transaction is successfully on the chain, the consensus node synchronizes the synchronous transaction data corresponding to the business transaction and the block header corresponding to the business transaction to the trusted network; when it is determined according to the block header that the synchronous transaction data is of a legal type, the trusted node in the trusted network stores the synchronous transaction data and the block header in a trusted execution environment; further, the business node sends a data synchronization request to the trusted network, so that the trusted node in the trusted network obtains the synchronous transaction data from the trusted execution environment according to the data synchronization request; further, the business node stores the synchronous transaction data returned by the trusted node, and performs business processing associated with the business transaction according to the synchronous transaction data. From the above, it can be seen that the embodiment of the present application proposes a three-layer blockchain network architecture, which includes a consensus network, a trusted network and a business network, wherein the trusted network can synchronize and verify the blockchain (including synchronizing transaction data and block headers) without performing business processing; the business network can obtain data related to its own business in the blockchain (i.e., synchronizing transaction data) and perform business processing, and does not store data that is not related to its own business (including block headers); obviously, the use of this application can reduce the computing resources and storage resources of blockchain nodes.

[0239] For further information, see Fig.12 , Fig.12 This is a schematic diagram of a data processing device based on blockchain provided in an embodiment of the present application. Figure 2 .like Fig.12 As shown, the blockchain-based data processing device 2 can run on a trusted node. The blockchain-based data processing device 2 can be a computer program (including program code) running in a computer device, for example, the data processing device is an application software; the data processing device can be used to execute the corresponding steps of the method provided in the embodiment of the present application. Fig.12 As shown, the blockchain-based data processing device 2 may include: a first acquisition module 21, a second acquisition module 22 and a data sending module 23.

[0240] A first acquisition module 21 is used to acquire a data synchronization request for a business transaction sent by a business node in the business network;

[0241] The second acquisition module 22 is used to obtain the synchronization transaction data corresponding to the business transaction from the trusted execution environment according to the data synchronization request; the synchronization transaction data is stored when it is determined that the synchronization transaction data belongs to a legal type according to the block header; the synchronization transaction data and the block header are sent by the consensus node in the consensus network when the business transaction sent by the business node is successfully uploaded to the chain; the block header belongs to the block to which the business transaction belongs;

[0242] The data sending module 23 is used to send the synchronous transaction data to the service node, so that the service node performs service processing associated with the service transaction according to the synchronous transaction data.

[0243] The specific functional implementation of the first acquisition module 21, the second acquisition module 22 and the data sending module 23 can be found in the above Figure 8 Steps S301 to S303 in the corresponding embodiment are not described in detail here.

[0244] See also Fig.12 The second acquisition module 22 may include: a first generation unit 221, a second generation unit 222, a first acquisition unit 223 and a second acquisition unit 224.

[0245] The first generating unit 221 is used to generate an authentication challenge random number and a first intermediate key pair in a trusted execution environment according to a data synchronization request; the first intermediate key pair includes a first intermediate public key;

[0246] The second generating unit 222 is used to generate a remote authentication request according to the authentication challenge random number and the first intermediate public key, and send the remote authentication request to the service node, so that the service node generates a second intermediate key pair including the second intermediate public key according to the remote authentication request; the second intermediate public key is used by the service node to generate a remote authentication response to the remote authentication request;

[0247] The first acquisition unit 223 is used to acquire the remote authentication response returned by the service node in the trusted execution environment, perform legitimacy verification on the remote authentication response, and obtain a verification result;

[0248] The second acquisition unit 224 is used to acquire the synchronous transaction data corresponding to the business transaction from the trusted execution environment according to the verification result.

[0249] The specific functional implementation of the first generating unit 221, the second generating unit 222, the first acquiring unit 223 and the second acquiring unit 224 can be found in the above Figure 8 The step S302 in the corresponding embodiment will not be described in detail here.

[0250] See also Fig.12 , a second acquisition unit 224, specifically configured to acquire synchronous transaction data corresponding to the business transaction from the trusted execution environment if the verification result indicates that the remote authentication response has a legal attribute;

[0251] The data sending module 23 may include: a third obtaining unit 231 , a third generating unit 232 , a data encryption unit 233 , and a data sending unit 234 .

[0252] The third acquisition unit 231 is used to acquire the second intermediate public key from the remote authentication response and acquire the first intermediate private key from the first intermediate key pair;

[0253] The third generating unit 232 is used to generate a communication key according to the first intermediate private key, the second intermediate public key and the authentication challenge random number;

[0254] The data encryption unit 233 is used to encrypt the synchronous transaction data according to the communication key to obtain encrypted synchronous transaction data;

[0255] The data sending unit 234 is used to send the encrypted synchronous transaction data to the business node, so that the business node generates a communication key based on the second intermediate private key, the first intermediate public key and the authentication challenge random number in the second intermediate key pair; the communication key is used by the business node to decrypt the encrypted synchronous transaction data to obtain the synchronous transaction data.

[0256] The specific functional implementation of the second acquisition unit 224, the third acquisition unit 231, the third generation unit 232, the data encryption unit 233, and the data sending unit 234 can be found in the above Figure 8 Steps S302 to S303 in the corresponding embodiment will not be described in detail here.

[0257] See also Fig.12 The blockchain-based data processing device 2 may also include: a third acquisition module 24, a first verification module 25, a second verification module 26 and a third verification module 27.

[0258] The third acquisition module 24 is used to obtain the synchronous transaction data sent by the consensus node and the verification data for the synchronous transaction data; the synchronous transaction data includes the business transaction and the transaction execution result corresponding to the business transaction; the verification data includes the transaction verification data and the result verification data;

[0259] The first verification module 25 is used to verify the business transaction according to the transaction verification data to obtain the root hash of the transaction to be verified;

[0260] The second verification module 26 is used to verify the transaction execution result according to the result verification data and obtain the root hash of the result to be verified;

[0261] The third verification module 27 is used to verify the legitimacy of the synchronous transaction data according to the transaction root hash to be verified, the result root hash to be verified and the block header.

[0262] The specific functional implementation of the third acquisition module 24, the first verification module 25, the second verification module 26 and the third verification module 27 can be found in the above Fig. 9Steps S401 to S404 in the corresponding embodiment are not described in detail here.

[0263] See also Fig.12 The third verification module 27 may include: a fourth acquisition unit 271 , a hash comparison unit 272 , a first determination unit 273 , a second determination unit 274 and a third determination unit 275 .

[0264] The fourth acquisition unit 271 is used to obtain the on-chain transaction root hash and the on-chain result root hash in the block header;

[0265] A hash comparison unit 272 is used to compare the root hash of the transaction to be verified with the root hash of the transaction on the chain, and to compare the root hash of the result to be verified with the root hash of the result on the chain;

[0266] A first determination unit 273, configured to determine that the synchronization transaction data is of an illegal type if the transaction root hash to be verified is different from the transaction root hash on the chain;

[0267] A second determination unit 274, configured to determine that the synchronization transaction data is of an illegal type if the root hash of the result to be verified is different from the root hash of the on-chain result;

[0268] The third determination unit 275 is used to determine that the synchronization transaction data is of a legal type if the transaction root hash to be verified is the same as the transaction root hash on the chain, and the result root hash to be verified is the same as the result root hash on the chain.

[0269] The specific functional implementation of the fourth acquisition unit 271, the hash comparison unit 272, the first determination unit 273, the second determination unit 274 and the third determination unit 275 can be found in the above Fig. 9 The step S404 in the corresponding embodiment will not be described in detail here.

[0270] From the above, it can be seen that the embodiment of the present application proposes a three-layer blockchain network architecture, which includes a consensus network, a trusted network and a business network, wherein the trusted network can synchronize and verify the blockchain (including synchronizing transaction data and block headers) without performing business processing; the business network can obtain data related to its own business in the blockchain (i.e., synchronizing transaction data) and perform business processing, and does not store data that is not related to its own business (including block headers); obviously, the use of this application can reduce the computing resources and storage resources of blockchain nodes.

[0271] For further information, see Fig.13 , Fig.13 Schematic diagram of the structure of a computer device provided in an embodiment of the present application. Fig.13As shown, the computer device 1000 may include: at least one processor 1001 , such as a CPU, at least one network interface 1004 , a user interface 1003 , a memory 1005 , and at least one communication bus 1002 .

[0272] The communication bus 1002 is used to realize the connection and communication between these components. In some embodiments, the user interface 1003 may include a display screen (Display), a keyboard (Keyboard), and the network interface 1004 may optionally include a standard wired interface, a wireless interface (such as a WI-FI interface). The memory 1005 may be a high-speed RAM memory, or a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0273] The memory 1005 may optionally also be at least one storage device located away from the aforementioned processor 1001. Fig.13 As shown, the memory 1005 as a computer storage medium may include an operating system, a network communication module, a user interface module, and a device control application.

[0274] exist Fig.13 In the computer device 1000 shown, the network interface 1004 can provide a network communication function; the user interface 1003 is mainly used to provide an input interface for the user; and the processor 1001 can be used to call the device control application stored in the memory 1005 to achieve:

[0275] Send the business transaction to the consensus network so that the consensus node in the consensus network can process the business transaction on the chain; the consensus node is used to synchronize the synchronous transaction data and block header corresponding to the business transaction to the trusted network when the business transaction is successfully on the chain; the block header belongs to the block to which the business transaction belongs; the trusted node in the trusted network is used to store the synchronous transaction data and block header in the trusted execution environment when determining that the synchronous transaction data is of a legal type based on the block header;

[0276] Sending a data synchronization request to the trusted network, so that the trusted node in the trusted network obtains the synchronization transaction data from the trusted execution environment according to the data synchronization request;

[0277] Store the synchronous transaction data returned by the trusted node, and perform business processing associated with the business transaction based on the synchronous transaction data.

[0278] Alternatively, the processor 1001 may be configured to call a device control application stored in the memory 1005 to implement:

[0279] Obtain data synchronization requests for business transactions sent by business nodes in the business network;

[0280] According to the data synchronization request, the synchronization transaction data corresponding to the business transaction is obtained from the trusted execution environment; the synchronization transaction data is stored when the synchronization transaction data is determined to be of a legal type according to the block header; the synchronization transaction data and the block header are sent by the consensus node in the consensus network when the business transaction sent by the business node is successfully uploaded to the chain; the block header belongs to the block to which the business transaction belongs;

[0281] The synchronous transaction data is sent to the business node, so that the business node performs business processing associated with the business transaction according to the synchronous transaction data.

[0282] It should be understood that the computer device 1000 described in the embodiment of the present application can execute the description of the data processing method or device in the above embodiments, which will not be repeated here. In addition, the description of the beneficial effects of adopting the same method will not be repeated.

[0283] The present application also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the description of the data processing method or device in the above embodiments is implemented, which will not be repeated here. In addition, the description of the beneficial effects of the same method will not be repeated.

[0284] The computer-readable storage medium may be the data processing device provided in any of the aforementioned embodiments or the internal storage unit of the computer device, such as a hard disk or memory of the computer device. The computer-readable storage medium may also be an external storage device of the computer device, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc., provided on the computer device.

[0285] Furthermore, the computer-readable storage medium may also include both an internal storage unit of the computer device and an external storage device. The computer-readable storage medium is used to store the computer program and other programs and data required by the computer device. The computer-readable storage medium may also be used to temporarily store data that has been output or is to be output.

[0286] The present application also provides a computer program product, which includes a computer program stored in a computer-readable storage medium. The processor of the computer device reads the computer program from the computer-readable storage medium, and the processor executes the computer program, so that the computer device can execute the description of the data processing method or device in the above embodiments, which will not be repeated here. In addition, the description of the beneficial effects of the same method will not be repeated.

[0287] The terms "first", "second", etc. in the description, claims, and drawings of the embodiments of the present application are used to distinguish different objects, rather than to describe a specific order. In addition, the term "comprising" and any of their variations are intended to cover non-exclusive inclusions. For example, a process, method, device, product, or equipment that includes a series of steps or units is not limited to the listed steps or modules, but optionally includes steps or modules that are not listed, or optionally includes other step units inherent to these processes, methods, devices, products, or equipment.

[0288] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0289] The above disclosure is only the preferred embodiment of the present application, which certainly cannot be used to limit the scope of rights of the present application. Therefore, equivalent changes made according to the claims of the present application are still within the scope covered by the present application.

Claims

1. A data processing method based on blockchain, characterized in that: The method is performed by a service node in a service network, and the method includes: Sending the business transaction to the consensus network so that the consensus node in the consensus network processes the business transaction on the chain; the consensus node is used to synchronize the synchronous transaction data and block header corresponding to the business transaction to the trusted network when the business transaction is successfully on the chain; the block header belongs to the block to which the business transaction belongs; the trusted node in the trusted network is used to store the synchronous transaction data and the block header in the trusted execution environment when determining that the synchronous transaction data belongs to a legal type according to the block header; Sending a data synchronization request to the trusted network, so that a trusted node in the trusted network obtains the synchronization transaction data from the trusted execution environment according to the data synchronization request; The synchronous transaction data returned by the trusted node is stored, and business processing associated with the business transaction is performed according to the synchronous transaction data.

2. The method according to claim 1, characterized in that Sending the business transaction to the consensus network includes: Obtaining a transaction on-chain request including a business transaction sent by a business device; the business transaction carries a first signature message; According to the transaction on-chain request, obtain the device public key of the business device, and verify the first signature message through the device public key to obtain a first digital summary; generating a second digital summary corresponding to the business transaction, and comparing the first digital summary with the second digital summary; If the first digital digest is different from the second digital digest, returning a request failure message to the service device; If the first digital summary is the same as the second digital summary, the business transaction is sent to the consensus network.

3. The method according to claim 1, characterized in that The sending of the data synchronization request to the trusted network so that the trusted node in the trusted network obtains the synchronous transaction data from the trusted execution environment according to the data synchronization request includes: Obtaining a transaction chain success message for the business transaction returned by the consensus node, and generating a data synchronization request for the business transaction according to the transaction chain success message; Acquire a business private key according to the data synchronization request, and sign the data synchronization request using the business private key to obtain a second signed message; The data synchronization request carrying the second signature message is sent to the trusted network, so that the trusted node in the trusted network obtains the business public key corresponding to the business private key according to the data synchronization request; the business public key is used by the trusted node to verify the second signature message to obtain a verification result; the verification result is used to instruct the trusted node to obtain the synchronization transaction data from the trusted execution environment when it is determined that the business node has synchronization authority.

4. The method according to claim 1, characterized in that: The sending of the data synchronization request to the trusted network so that the trusted node in the trusted network obtains the synchronous transaction data from the trusted execution environment according to the data synchronization request includes: Sending a data synchronization request to the trusted network, so that a trusted node in the trusted network generates an authentication challenge random number and a first intermediate key pair in the trusted execution environment according to the data synchronization request; the first intermediate key pair includes a first intermediate private key and a first intermediate public key corresponding to the first intermediate private key; the authentication challenge random number and the first intermediate public key are used by the trusted node to generate a remote authentication request; Obtaining the remote authentication request returned by the trusted node, and generating a second intermediate key pair for the trusted node according to the remote authentication request; the second intermediate key pair includes a second intermediate public key; Generate a remote authentication response according to the second intermediate public key and the authentication challenge random number in the remote authentication request; The remote authentication response is sent to the trusted node, so that when the trusted node determines that the remote authentication response has a legal attribute, it obtains the second intermediate public key in the remote authentication response; the second intermediate public key, the authentication challenge random number and the first intermediate private key are used for the trusted node to generate a communication key; the communication key is used for the trusted node to encrypt the synchronous transaction data obtained from the trusted execution environment to obtain encrypted synchronous transaction data.

5. The method according to claim 4, characterized in that The storing the synchronous transaction data returned by the trusted node includes: Obtaining the encrypted synchronous transaction data returned by the trusted node; Obtain the authentication challenge random number and the first intermediate public key from the remote authentication request, and obtain the second intermediate private key from the second intermediate key pair; Generate the communication key according to the second intermediate private key, the authentication challenge random number and the first intermediate public key; The encrypted synchronous transaction data is decrypted according to the communication key to obtain the synchronous transaction data, and the synchronous transaction data is stored.

6. The method according to claim 1, characterized in that The method further comprises: Acquire the business transaction initiated by the business device; the business transaction is a resource query transaction; the resource query transaction includes a resource identifier; Then the performing of business processing associated with the business transaction according to the synchronous transaction data includes: Obtaining a transaction execution result corresponding to the resource query transaction in the synchronous transaction data; If the transaction execution result is a successful transaction execution result, the resource data corresponding to the resource identifier is returned to the business device; If the transaction execution result is a transaction execution failure result, a resource query failure message is returned to the business device.

7. A data processing method based on blockchain, characterized in that: The method is executed by a trusted node having a trusted execution environment in a trusted network, and the method includes: Obtain data synchronization requests for business transactions sent by business nodes in the business network; According to the data synchronization request, the synchronous transaction data corresponding to the business transaction is obtained from the trusted execution environment; the synchronous transaction data is stored when it is determined that the synchronous transaction data belongs to a legal type according to the block header; the synchronous transaction data and the block header are sent by the consensus node in the consensus network when the business transaction sent by the business node is successfully uploaded to the chain; the block header belongs to the block to which the business transaction belongs; The synchronous transaction data is sent to the service node, so that the service node performs service processing associated with the service transaction according to the synchronous transaction data.

8. The method according to claim 7, characterized in that The acquiring, according to the data synchronization request, the synchronous transaction data corresponding to the business transaction from the trusted execution environment includes: According to the data synchronization request, generating an authentication challenge random number and a first intermediate key pair in the trusted execution environment; the first intermediate key pair includes a first intermediate public key; Generate a remote authentication request according to the authentication challenge random number and the first intermediate public key, and send the remote authentication request to the service node, so that the service node generates a second intermediate key pair including a second intermediate public key according to the remote authentication request; the second intermediate public key is used by the service node to generate a remote authentication response to the remote authentication request; In the trusted execution environment, obtaining a remote authentication response returned by the service node, performing legitimacy verification on the remote authentication response, and obtaining a verification result; According to the verification result, synchronous transaction data corresponding to the business transaction is obtained from the trusted execution environment.

9. The method according to claim 8, characterized in that The acquiring, from the trusted execution environment, synchronous transaction data corresponding to the business transaction according to the verification result, includes: If the verification result indicates that the remote authentication response has a legal attribute, obtaining synchronous transaction data corresponding to the business transaction from the trusted execution environment; Then sending the synchronous transaction data to the service node includes: Obtaining the second intermediate public key from the remote authentication response, and obtaining the first intermediate private key from the first intermediate key pair; Generate a communication key according to the first intermediate private key, the second intermediate public key and the authentication challenge random number; Encrypting the synchronous transaction data according to the communication key to obtain encrypted synchronous transaction data; The encrypted synchronous transaction data is sent to the business node so that the business node generates the communication key based on the second intermediate private key in the second intermediate key pair, the first intermediate public key and the authentication challenge random number; the communication key is used by the business node to decrypt the encrypted synchronous transaction data to obtain the synchronous transaction data.

10. The method according to claim 7, characterized in that The method further comprises: Acquire the synchronous transaction data and verification data for the synchronous transaction data sent by the consensus node; the synchronous transaction data includes the business transaction and the transaction execution result corresponding to the business transaction; the verification data includes transaction verification data and result verification data; Verify the business transaction according to the transaction verification data to obtain a root hash of the transaction to be verified; According to the result verification data, the transaction execution result is verified to obtain a root hash of the result to be verified; The legitimacy of the synchronous transaction data is verified according to the transaction root hash to be verified, the result root hash to be verified and the block header.

11. The method according to claim 10, characterized in that The verifying the legitimacy of the synchronous transaction data according to the transaction root hash to be verified, the result root hash to be verified, and the block header includes: Obtaining the on-chain transaction root hash and the on-chain result root hash in the block header; Compare the transaction root hash to be verified with the transaction root hash on the chain, and compare the result root hash to be verified with the result root hash on the chain; If the transaction root hash to be verified is different from the on-chain transaction root hash, it is determined that the synchronous transaction data is of an illegal type; If the root hash of the result to be verified is different from the root hash of the on-chain result, it is determined that the synchronous transaction data is of an illegal type; If the transaction root hash to be verified is the same as the on-chain transaction root hash, and the result root hash to be verified is the same as the on-chain result root hash, it is determined that the synchronized transaction data is of a legal type.

12. A data processing device based on blockchain, characterized in that: The device runs on a service node in a service network, and includes: The first sending module is used to send the business transaction to the consensus network so that the consensus node in the consensus network can process the business transaction on the chain; the consensus node is used to synchronize the synchronous transaction data and the block header corresponding to the business transaction to the trusted network when the business transaction is successfully on the chain; the block header belongs to the block to which the business transaction belongs; the trusted node in the trusted network is used to store the synchronous transaction data and the block header in the trusted execution environment when determining that the synchronous transaction data belongs to a legal type according to the block header; A second sending module, configured to send a data synchronization request to the trusted network, so that a trusted node in the trusted network obtains the synchronous transaction data from the trusted execution environment according to the data synchronization request; The data storage module is used to store the synchronous transaction data returned by the trusted node, and perform business processing associated with the business transaction according to the synchronous transaction data.

13. A data processing device based on blockchain, characterized in that: The device runs on a trusted node with a trusted execution environment in a trusted network, and the device includes: A first acquisition module, used to acquire a data synchronization request for a business transaction sent by a business node in the business network; A second acquisition module is used to acquire the synchronization transaction data corresponding to the business transaction from the trusted execution environment according to the data synchronization request; the synchronization transaction data is stored when it is determined that the synchronization transaction data belongs to a legal type according to the block header; the synchronization transaction data and the block header are sent by the consensus node in the consensus network when the business transaction sent by the business node is successfully uploaded to the chain; the block header belongs to the block to which the business transaction belongs; The data sending module is used to send the synchronous transaction data to the service node, so that the service node performs service processing associated with the service transaction according to the synchronous transaction data.

14. A computer device, characterized in that: include: Processor, memory, and network interface; The processor is connected to the memory and the network interface, wherein the network interface is used to provide a data communication function, the memory is used to store a computer program, and the processor is used to call the computer program so that the computer device executes the method described in any one of claims 1 to 11.

15. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program is suitable for being loaded and executed by a processor, so that a computer device having the processor executes the method according to any one of claims 1 to 11.

16. A computer program product, characterized in that The computer program product comprises a computer program, which is stored in a computer-readable storage medium. The computer program is suitable for being read and executed by a processor, so that a computer device having the processor executes the method according to any one of claims 1 to 11.

Images