Transaction method and device based on block chain, electronic equipment and storage medium
By integrating a secure enclave into the blockchain system and using secure keys and blockchain verification components for signature verification, the problem of insufficient key management security in the IoT blockchain architecture is solved and transaction security is improved.
Patent Information
- Application Number
- CN202510683823.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-05-26
- Publication Date
- 2025-10-17
AI Technical Summary
The traditional IoT blockchain architecture has insufficient security issues in key management. Keys are easily stolen and the signing operations of contract calls are performed in an insecure environment, which poses a risk of private key theft.
Integrate a secure enclave into the blockchain system, sign transaction data with a secure key, and use the blockchain verification component to verify the signature to ensure the legitimacy of the transaction.
It improves transaction security, reduces the risk of key theft, and enhances network security.
Smart Images
Figure CN120807140A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present disclosure relates to the technical field of blockchains, and in particular to a blockchain-based transaction method and device, electronic equipment and storage medium. BACKGROUND
[0002] The Internet of Things industry has encountered many security challenges in the process of rapid development, such as device identity forgery, data tampering, and stolen communication keys. The combination of blockchain and Internet of Things technology provides more security for the Internet of Things field. For example, it can prevent the data generated by Internet of Things devices from being tampered with. Through decentralized technology, a unique identity is assigned to Internet of Things devices, reducing the risk of single point failure. Through smart contract technology, data access permissions are controlled.
[0003] The traditional Internet of Things blockchain architecture has great risks in key management: 1. The security of traditional key management basically depends on protection at the software level, and the key is easy to steal. Since the use permission of the key is directed to all system users, it cannot meet the basic principle of least privilege key management, causing certain key security management risks; 2. In the process of contract calling, the signature operation is performed in a non-secure environment. Since the private key is in the memory, there is a risk of private key theft. SUMMARY
[0004] Therefore, the purpose of the present disclosure is to provide a blockchain-based transaction method, device, electronic equipment and storage medium that can specifically solve the existing problems.
[0005] To achieve the above purpose, in a first aspect, the present disclosure provides a blockchain-based transaction method applied to a secure enclave, the secure enclave being integrated into the architecture of a blockchain system, the architecture further comprising an application layer and a blockchain verification component. The method comprises: in response to receiving a signature request for transaction data sent by a chaincode program of the application layer, signing to-be-signed information of the transaction data using a secure key; sending the signed transaction data to the blockchain verification component, so that the blockchain verification component generates and sends a signature verification request; in response to receiving the signature verification request sent by the blockchain verification component, performing signature verification; and in response to determining that the verification is passed, returning transaction legal information to the chaincode program of the application layer.
[0006] In a second aspect, a blockchain-based transaction device is provided, which is applied to a secure enclave integrated in an architecture of a blockchain system, the architecture further comprising an application layer and a blockchain verification component, the device comprising: a signing unit configured to, in response to receiving a signature request for transaction data sent by a chaincode program of the application layer, sign to-be-signed information of the transaction data by using a secure key; a generating unit configured to send the signed transaction data to the blockchain verification component, so that the blockchain verification component generates and sends a signature verification request; a verifying unit configured to, in response to receiving the signature verification request sent by the blockchain verification component, perform signature verification; and a result generating unit configured to, in response to determining that the verification is passed, return transaction legal information to the chaincode program of the application layer.
[0007] In a third aspect, an electronic device is provided, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, the processor executing the computer program to implement the method of the first aspect.
[0008] In a fourth aspect, a computer-readable storage medium is provided, which stores a computer program, the computer program being executed by a processor to implement the method of any one of the first aspect.
[0009] In a fifth aspect, a computer program product is provided, which includes a computer program, the computer program being executed by a processor to implement the method of any one of the first aspect.
[0010] In general, the present disclosure has at least the following beneficial effects: the secure enclave is integrated in the architecture of the blockchain system, so that the secure key is stored in the secure enclave, and the network security is verified in a signature manner, thereby improving the security of the transaction. BRIEF DESCRIPTION OF DRAWINGS
[0011] In the drawings, like reference numerals refer to like elements throughout the various drawings. The drawings are not necessarily to scale, emphasis instead being placed on illustrating principles of the present disclosure. It should be understood that the drawings are merely depictions of some embodiments disclosed herein and should not be construed as limiting the scope of the present disclosure.
[0012] Figure 1 A flowchart of a blockchain-based transaction method according to an embodiment of the present disclosure is shown;
[0013] Figure 2 Another flowchart of a blockchain-based transaction method according to an embodiment of the present disclosure is shown;
[0014] Figure 3 A schematic diagram of a blockchain-based transaction device according to an embodiment of the present disclosure is shown;
[0015] Figure 4 A structural schematic diagram of an electronic device provided by an embodiment of the present disclosure is shown.
[0016] Figure 5 A schematic diagram of a storage medium provided by an embodiment of the present disclosure is shown. DETAILED DESCRIPTION
[0017] The present disclosure will be further described below in conjunction with the accompanying drawings and embodiments. It can be understood that the specific embodiments described herein are only used to explain the related application, and not to limit the application. In addition, it should be noted that, for the sake of description, only the parts related to the application are shown in the drawings.
[0018] It should be noted that the embodiments in the present disclosure and the features in the embodiments can be combined with each other without conflict. The present disclosure will be described in detail below with reference to the accompanying drawings and in conjunction with the embodiments.
[0019] Figure 1 A blockchain-based transaction method of the present disclosure is shown. In an embodiment of the present disclosure, applied to a secure enclave integrated in the architecture of a blockchain system, the architecture further includes an application layer and a blockchain verification component, the method comprises:
[0020] Step S101, in response to receiving a signature request for transaction data sent by the chain code program of the application layer, signing the to-be-signed information of the transaction data using a secure key.
[0021] Step S102, sending the signed transaction data to the blockchain verification component, so that the blockchain verification component generates and sends a signature verification request.
[0022] Step S103, in response to receiving the signature verification request sent by the blockchain verification component, performing signature verification.
[0023] Step S104, in response to determining that the verification is passed, returning transaction legal information to the chain code program of the application layer.
[0024] Specifically, the to-be-signed information can include the identification of the transaction data, and can also include the hash value and other specific information corresponding to the transaction data.
[0025] The blockchain verification component is a component that performs signature verification function based on the blockchain network. Through signature verification, it is verified whether the transaction indicated by the transaction data is legal, and if so, the verification is passed.
[0026] The application layer is the business core architecture of the entire blockchain system architecture, and mainly completes the business implementation logic of the blockchain system and the implementation of the chain code program, and contains basic blockchain business implementation such as transaction request.
[0027] In the application layer, the storage of ordinary business data is managed, and the storage mode can be divided into ordinary memory storage and hard disk storage (the two storage modes are ordinary storage), enclave storage (this is a secure storage), and various modes, but the system designer needs to have a basic judgment on the sensitivity of the data. Here, only data with a large quantity and low privacy protection requirement is stored.
[0028] The application layer can define the sensitivity level of the data, and determine the storage mode of the data through the predefined sensitivity level.
[0029] The integration here refers to the communication between the enclave and the blockchain system architecture.
[0030] In some optional implementations of any embodiment of the present disclosure, the secure key has a corresponding unique identifier, and the signed transaction data includes the unique identifier; and the response to the signature verification request sent by the blockchain verification component includes: responding to the signature verification request generated by the blockchain verification component through the unique identifier.
[0031] In some optional implementations of any embodiment of the present disclosure, the method further includes: creating a secure enclave, generating a secure key in the secure enclave, and assigning a unique identifier to each secure key.
[0032] The secure enclave is responsible for the storage of sensitive data, and in the system, it is mainly the secure storage and management of the secure key and a small amount of defined private business data. Key encryption, digital signature and other operations on the secure key should be regarded as sensitive operations, and the related operation process needs to be performed internally. It needs to be supported by hardware and run in the Secure Memory. The communication of the enclave is limited, and the communication with the outside is mainly realized through the enclave wrapper, and the communication with other components in the system will be rejected.
[0033] In some optional implementations of any embodiment of the present disclosure, the secure enclave has an enclave wrapper, the enclave wrapper is used for transmitting sensitive data, the transaction data belongs to the sensitive data, and the signature request is received through the enclave wrapper.
[0034] An enclave wrapper exists in the enclave. The enclave wrapper is responsible for basic communication and interaction with the security layer in the architecture. Here, a basic verification engine needs to be implemented to ensure that only the defined sensitive data can interact with the security layer through the enclave wrapper. The communication method needs to use a secure communication protocol, including but not limited to SSL / TLS, OAuth, etc.
[0035] These implementation manners introduce the enclave wrapper, limit the communication range of the enclave, and reduce the communication risk.
[0036] In some optional implementation manners of any of the embodiments of the present disclosure, the application layer further includes a storage layer and a hardware layer where the secure enclave is located.
[0037] Optionally, the storage layer includes a secure storage area and an insecure storage area, the secure storage area being the secure enclave, for storing sensitive data and performing operations on the sensitive data, and the secure enclave running on the hardware layer.
[0038] Optionally, the application layer includes the chain code program, and there is predefined sensitive information in the application layer, the sensitive information being used to distinguish sensitive data and non-sensitive data.
[0039] The storage layer needs to be separately defined into an insecure storage area InSecurity Storage and a secure storage area Secure Storage. The InSecurity Storage includes memory, hard disk, etc., and the Secure Storage is an enclave.
[0040] Key information and core asset data are maintained in the Secure Storage, and other data are maintained in the InSecurity Storage.
[0041] Figure 2 A blockchain-based transaction method according to an embodiment of the present disclosure is shown. As shown in the figure, the blockchain-based transaction method includes: Figure 2
[0042] The system is initialized, a new enclave is created, the enclave generates and stores keys, and a unique identifier keyId is assigned to each key.
[0043] The chain code program requests the enclave to sign through the enclave wrapper.
[0044] The enclave uses a secure key to sign and returns the signature result to the chain code program.
[0045] The signed transaction is sent to a blockchain verification component, which obtains the keyId.
[0046] The enclave is requested to perform signature verification through the keyId, and the signature verification result is returned to the blockchain verification component.
[0047] The transaction result, i.e., the transaction legality information, is returned.
[0048] The enclave stores the management key, and uses signature verification to verify network security. Compared with directly storing data through the enclave, the enclave memory consumption is reduced.
[0049] The embodiment of the present disclosure provides a blockchain-based transaction device, which is used to execute the blockchain-based transaction method described in the above embodiment. Figure 3 As shown in the figure, the device is applied to a secure enclave, which is integrated into the architecture of a blockchain system, and the architecture further includes an application layer and a blockchain verification component. The device includes: a signature unit 301 configured to, in response to receiving a signature request for transaction data sent by a chaincode program of the application layer, sign to-be-signed information of the transaction data using a secure key; a generation unit 302 configured to send the signed transaction data to the blockchain verification component, so that the blockchain verification component generates and sends a signature verification request; a verification unit 303 configured to, in response to receiving the signature verification request sent by the blockchain verification component, perform signature verification; and a result generation unit 304 configured to, in response to determining that the verification is passed, return transaction legality information to the chaincode program of the application layer.
[0050] The blockchain-based transaction device provided by the above embodiment of the present disclosure and the blockchain-based transaction method provided by the embodiment of the present disclosure have the same beneficial effects as the method used, run or implemented by the application program stored therein.
[0051] The embodiment of the present disclosure further provides an electronic device corresponding to the blockchain-based transaction method provided by the above embodiment, to execute the above blockchain-based transaction method. The embodiment of the present disclosure is not limited.
[0052] Please refer to Figure 4 , which shows a schematic diagram of an electronic device provided by some embodiments of the present disclosure. As Figure 4As shown, the electronic device 40 comprises a processor 400, a memory 401, a bus 402 and a communication interface 403, the processor 400, the communication interface 403 and the memory 401 are connected through the bus 402; the memory 401 stores a computer program capable of running on the processor 400, and the processor 400 executes the computer program to perform the method provided by any one of the preceding embodiments of the present disclosure.
[0053] The memory 401 can include a high-speed random access memory (RAM: Random Access Memory) and can also include a non-volatile memory such as at least one disk memory. The communication connection between the system network element and at least one other network element is realized through at least one communication interface 403 (which can be wired or wireless), and the Internet, a wide area network, a local network, a metropolitan area network, etc. can be used.
[0054] The bus 402 can be an ISA bus, a PCI bus, an EISA bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. The memory 401 is used to store programs, and the processor 400 executes the programs after receiving execution instructions. The blockchain-based transaction method disclosed in any one of the preceding embodiments of the present disclosure can be applied to the processor 400 or implemented by the processor 400.
[0055] The processor 400 can be an integrated circuit chip with signal processing capability. In implementation, each step of the above method can be completed by integrated logic circuits or instructions in the form of software in the processor 400. The processor 400 described above can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a ready programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component. Each method, step and logic block diagram disclosed in the embodiments of the present disclosure can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in combination with the embodiments of the present disclosure can be directly embodied as a hardware code processor for execution, or a combination of hardware and software modules in the code processor for execution. The software module can be located in a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium in the art. The storage medium is located in the memory 401, and the processor 400 reads the information in the memory 401, and combines the hardware to complete the steps of the above method.
[0056] The electronic device provided by the embodiments of the present disclosure and the transaction method based on the blockchain provided by the embodiments of the present disclosure have the same beneficial effects as the method they adopt, run or implement.
[0057] The present disclosure also provides a computer readable storage medium corresponding to the transaction method based on the blockchain provided by the preceding embodiments. Please refer to Figure 5 The computer readable storage medium shown is an optical disc 50, which stores a computer program (i.e. program product) thereon, and the computer program will execute the transaction method based on the blockchain provided by any of the preceding embodiments when run by a processor.
[0058] It should be noted that examples of the computer readable storage medium can also include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other optical, magnetic storage medium, which will not be described one by one here.
[0059] The computer readable storage medium provided by the above-mentioned embodiments of the present disclosure has the same beneficial effects as the method for transaction based on the blockchain provided by the embodiments of the present disclosure, and has the same beneficial effects as the method adopted, run or implemented by the application stored therein.
[0060] It should be noted that:
[0061] It should be noted that:
[0062] From the above description of the embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment method can be realized by means of software and the necessary general hardware platform, of course, it can also be realized by hardware, but in many cases the former is a better embodiment. Based on such understanding, the technical solutions of the present disclosure can be embodied in the form of a software product in essence or in the form of a contribution to the prior art. The computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a plurality of instructions for causing a terminal (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the method described in each embodiment of the present disclosure.
[0063] The embodiments of the present disclosure are described above in conjunction with the accompanying drawings, which are merely specific embodiments of the present disclosure, but the present disclosure is not limited to the above-mentioned specific embodiments. The above-mentioned specific embodiments are merely illustrative and not restrictive, and those skilled in the art can make many forms under the inspiration of the present disclosure without departing from the scope of the present disclosure and the scope of protection of the claims.
Claims
1. A transaction method based on blockchain, characterized in that: Applied to a secure enclave, the secure enclave is integrated into a blockchain system architecture, the architecture also including an application layer and a blockchain verification component, the method comprising: In response to receiving a signature request for transaction data sent by the application layer using a chain code program, signing the to-be-signed information of the transaction data using a security key; Sending the signed transaction data to the blockchain verification component, so that the blockchain verification component generates and sends a signature verification request; In response to receiving a signature verification request sent by the blockchain verification component, performing signature verification; In response to determining that the verification is passed, transaction validity information is returned to the chain code program of the application layer.
2. The method according to claim 1, characterized in that The security key has a corresponding unique identifier, and the signed transaction data includes the unique identifier; The response to receiving the signature verification request sent by the blockchain verification component includes: In response to receiving a signature verification request generated by the blockchain verification component using the unique identifier.
3. The method according to claim 1, characterized in that The method further comprises: A secure enclave is created, security keys are generated in the secure enclave, and a unique identifier is assigned to each security key.
4. The method according to claim 1, wherein The secure enclave has an enclave wrapper, the enclave wrapper is used to transmit sensitive data, the transaction data belongs to the sensitive data, and the signature request is received through the enclave wrapper.
5. The method according to claim 1, wherein The application layer also includes a storage layer and a hardware layer where the secure enclave is located.
6. The method according to claim 5, characterized in that The storage layer includes a secure storage area and an unsecure storage area; The secure storage area is the secure enclave, which is used to store sensitive data and perform operations on sensitive data. The secure enclave runs on the hardware layer.
7. The method according to claim 5, characterized in that The application layer includes the chain code program. Predefined sensitive information exists in the application layer, and the sensitive information is used to distinguish sensitive data from non-sensitive data.
8. A transaction device based on blockchain, characterized in that: Applied to a secure enclave, the secure enclave is integrated into the architecture of a blockchain system, the architecture also including an application layer and a blockchain verification component, and the apparatus includes: a signing unit, configured to, in response to receiving a signature request for transaction data sent by the application layer using a chain code program, sign the to-be-signed information of the transaction data using a security key; a generating unit configured to send the signed transaction data to a blockchain verification component, so that the blockchain verification component generates and sends a signature verification request; a verification unit, configured to perform signature verification in response to receiving a signature verification request sent by the blockchain verification component; The result generating unit is configured to return transaction validity information to the chain code program of the application layer in response to determining that the verification is passed.
9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: The processor runs the computer program to implement the method according to any one of claims 1 to 7.
10. A computer-readable storage medium having a computer program stored thereon, characterized in that: The program is executed by a processor to implement the method according to any one of claims 1 to 7.