Trusted Startup for Blockchain Nodes via Cryptographic Acceleration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing blockchain network architectures face challenges in achieving high performance, availability, and security, particularly in the transition from cloud-based deployments to private networks, leading to increased technical interfaces and maintenance costs, which necessitate further upgrades to support user demands for privatization and security.
Innovation Solution
The implementation of a trusted startup method for a blockchain integrated station using a cryptographic acceleration card for signature verification of disk images, ensuring the authenticity and integrity of deployed software, combined with hardware optimizations such as smart contract processing chips and intelligent network cards, to create a dedicated blockchain node device that forms a Trusted Execution Environment (TEE) for secure and efficient operation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If cloud-based deployments are used, then performance and availability are improved, but security and control are reduced
Solution Approach 1:
The system segments the blockchain node deployment into dedicated hardware devices with isolated Trusted Execution Environments (TEE). Each node operates independently on dedicated hardware rather than shared cloud infrastructure, providing both performance through specialized hardware and security through isolated execution environments that prevent unauthorized access and data breaches.
Solution Approach 2:
The patent introduces cryptographic verification mechanisms as intermediaries between the disk image and execution. The verification module uses digital signatures and hash algorithms to mediate the trust relationship, ensuring that only authenticated and unmodified disk images are executed, thereby maintaining security while enabling automated deployment.
2Reliability
If private network deployments are implemented, then security is improved, but technical interfaces and maintenance costs increase
Solution Approach 1:
The verification module serves multiple functions: it verifies disk image authenticity, checks integrity through hash algorithms, and manages cryptographic credentials. This multi-functional design consolidates what would otherwise require separate technical interfaces into a single unified module, reducing complexity while maintaining security requirements for private network deployments.
Solution Approach 2:
The system implements self-service through automated verification processes. The verification module automatically authenticates disk images using pre-stored cryptographic credentials, eliminating the need for manual security configuration and reducing maintenance requirements. The system performs self-validation without requiring complex external technical interfaces.
3Reliability
If cryptographic verification is performed, then security is improved, but startup time is increased
Solution Approach 1:
The system performs preliminary actions by pre-storing cryptographic credentials (public keys and certificates) in the verification module before runtime. Disk images are signed in advance with cryptographic signatures. During startup, the verification process only needs to check pre-computed signatures and hashes rather than performing complex cryptographic operations from scratch, significantly reducing verification time while maintaining security.
Solution Approach 2:
The verification process uses parameter changes by switching between different verification modes. For disk images with embedded signatures, the system uses signature verification; for images with hash values, it uses hash comparison. This adaptive approach selects the most efficient verification method based on the disk image type, optimizing startup time while ensuring security.
Data Source
Figure 1~2
Figure 3~4
Figure 5~7
AI summary
One or more embodiments of the present disclosure provide a trusted startup method and apparatus of a dedicated blockchain node device. The method includes: initiating, by the dedicated blockchain node device, a signature verification request for a disk image deployed in the dedicated blockchain node device to a cryptographic acceleration card assembled on the dedicated blockchain node device in response to receiving a startup instruction, wherein a provider public key of a provider of the disk image is pre-stored in the cryptographic acceleration card; receiving, by the dedicated blockchain node device, a signature verification result returned by the cryptographic acceleration card, wherein the signature verification result is obtained by the cryptographic acceleration card verifying a current signature of the disk image using the provider public key; executing, by the dedicated blockchain node device, the disk image deployed in the dedicated blockchain node device to form a blockchain node in a case that the signature verification result indicates the current signature passes verification.