Data isolation in blockchain networks

1. A computer-implemented method for isolating data stored on a blockchain maintained by a blockchain network, the method comprising:

receiving, by a blockchain node in the blockchain network, a synchronization request from a light-weight node of the blockchain network, wherein the synchronization request comprises an identity of the light-weight node and a block height associated with the synchronization request and wherein the original world state structure is determined based on the block height and represents a state of the blockchain network at a time when a block associated with the block height was added to the blockchain;

identifying, by the blockchain node, one or more permissions associated with the identity of the light-weight node, comprising:

accessing an access control table that specifies the one or more permissions for a plurality of identities of a plurality of light-weight nodes of the blockchain network; and

identifying the one or more permissions specified in the access control table for the identity of the light-weight node;

determining, by the blockchain node, an original world state structure including a plurality of account records, each account record storing state information for an account associated with the account record, wherein the original world state structure is an original Merkle Patricia Trie (MPT);

identifying, by the blockchain node and based on the one or more permissions, a subset of the plurality of account records that are authorized for access by the light-weight node;

generating, by the blockchain node, an isolated world state structure based on the original world state structure, the isolated world state structure including only the subset of the plurality of account records that are authorized for access by the light-weight node, wherein the isolated world state structure is an isolated MPT, and wherein generating the isolated MPT comprises:

identifying an account record in the original MPT that is accessible to the light-weight node, wherein the account record is located in a particular node of the original MPT, wherein the particular node is a branch node or a leaf node;

identifying a path in the original MPT from the particular node storing the account record to a root node of the MPT;

identifying intermediate nodes located in the original MPT along the path from the particular node storing the account record to the root node of the MPT; and

including the intermediate nodes in the isolated MPT; and

sending, by the blockchain node, a response to the light-weight node that comprises the isolated world state structure.

2. The computer-implemented method of claim 1 , wherein the access control table comprises:

an identity class associated with each of the plurality of identities of the plurality of light-weight nodes of the blockchain network; and

permissions associated with each identity class included in the access control table.

3. The computer-implemented method of claim 1 , wherein the one or more permissions comprises a permission that specifies that the identity of the light-weight node is authorized to access account records associated with a set of permissioned account addresses.

4. The computer-implemented method of claim 1 , wherein generating the isolated MPT comprises modifying the original MPT to produce the isolated MPT, including:

removing all account records that are determined to not be accessible by the light-weight node from the original MPT; and

removing branches of the original MPT from which all account records have been removed leaving only a root hash of each of the branches intact.

5. The computer-implemented method of claim 4 , wherein an account record is determined not to be accessible by the light-weight node if the one or more permissions indicate that the light-weight node does not have read access to the account record.

6. A non-transitory, computer-readable storage medium storing one or more instructions executable by a computer system to perform operations comprising:

receiving, by a blockchain node in a blockchain network, a synchronization request from a light-weight node of the blockchain network, wherein the synchronization request comprises an identity of the light-weight node and a block height associated with the synchronization request and wherein the original world state structure is determined based on the block height and represents a state of the blockchain network at a time when a block associated with the block height was added to the blockchain;

identifying, by the blockchain node, one or more permissions associated with the identity of the light-weight node, comprising:

accessing an access control table that specifies the one or more permissions for a plurality of identities of a plurality of light-weight nodes of the blockchain network; and

identifying the one or more permissions specified in the access control table for the identity of the light-weight node;

determining, by the blockchain node, an original world state structure including a plurality of account records, each account record storing state information for an account associated with the account record, wherein the original world state structure is an original Merkle Patricia Trie (MPT);

identifying, by the blockchain node and based on the one or more permissions, a subset of the plurality of account records that are authorized for access by the light-weight node;

generating, by the blockchain node, an isolated world state structure based on the original world state structure, the isolated world state structure including only the subset of the plurality of account records that are authorized for access by the light-weight node, wherein the isolated world state structure is an isolated MPT, and wherein generating the isolated MPT comprises:

identifying an account record in the original MPT that is accessible to the light-weight node, wherein the account record is located in a particular node of the original MPT, wherein the particular node is a branch node or a leaf node;

identifying a path in the original MPT from the particular node storing the account record to a root node of the MPT;

identifying intermediate nodes located in the original MPT along the path from the particular node storing the account record to the root node of the MPT; and

including the intermediate nodes in the isolated MPT; and

sending, by the blockchain node, a response to the light-weight node that comprises the isolated world state structure.

7. The non-transitory computer-readable storage medium of claim 6 , wherein the access control table comprises:

an identity class associated with each of the plurality of identities of the plurality of light-weight nodes of the blockchain network; and

permissions associated with each identity class included in the access control table.

8. The non-transitory computer-readable storage medium of claim 6 , wherein the one or more permissions comprises a permission that specifies that the identity of the light-weight node is authorized to access account records associated with a set of permissioned account addresses.

9. The non-transitory computer-readable storage medium of claim 6 , wherein generating the isolated MPT comprises modifying the original MPT to produce the isolated MPT, including:

removing all account records that are determined to not be accessible by the light-weight node from the original MPT; and

removing branches of the original MPT from which all account records have been removed leaving only a root hash of each of the branches intact.

10. The non-transitory computer-readable storage medium of claim 9 , wherein an account record is determined not to be accessible by the light-weight node if the one or more permissions indicate that the light-weight node does not have read access to the account record.

11. A system, comprising:

one or more computers; and

one or more computer memory devices interoperably coupled with the one or more computers and having tangible, non-transitory, machine-readable media storing one or more instructions that, when executed by the one or more computers, perform one or more operations comprising:

receiving, by a blockchain node in a blockchain network, a synchronization request from a light-weight node of the blockchain network, wherein the synchronization request comprises an identity of the light-weight node and a block height associated with the synchronization request and wherein the original world state structure is determined based on the block height and represents a state of the blockchain network at a time when a block associated with the block height was added to the blockchain;

identifying, by the blockchain node, one or more permissions associated with the identity of the light-weight node, comprising:

accessing an access control table that specifies the one or more permissions for a plurality of identities of a plurality of light-weight nodes of the blockchain network; and

identifying the one or more permissions specified in the access control table for the identity of the light-weight node;

determining, by the blockchain node, an original world state structure including a plurality of account records, each account record storing state information for an account associated with the account record, wherein the original world state structure is an original Merkle Patricia Trie (MPT);

identifying, by the blockchain node and based on the one or more permissions, a subset of the plurality of account records that are authorized for access by the light-weight node;

generating, by the blockchain node, an isolated world state structure based on the original world state structure, the isolated world state structure including only the subset of the plurality of account records that are authorized for access by the light-weight node, wherein the isolated world state structure is an isolated MPT, and wherein generating the isolated MPT comprises:

identifying an account record in the original MPT that is accessible to the light-weight node, wherein the account record is located in a particular node of the original MPT, wherein the particular node is a branch node or a leaf node;

identifying a path in the original MPT from the particular node storing the account record to a root node of the MPT; and

identifying intermediate nodes located in the original MPT along the path from the particular node storing the account record to the root node of the MPT;

including the intermediate nodes in the isolated MPT; and

sending, by the blockchain node, a response to the light-weight node that comprises the isolated world state structure.

12. The system of claim 11 , wherein the access control table comprises:

an identity class associated with each of the plurality of identities of the plurality of light-weight nodes of the blockchain network; and

permissions associated with each identity class included in the access control table.

13. The system of claim 11 , wherein the one or more permissions comprises a permission that specifies that the identity of the light-weight node is authorized to access account records associated with a set of permissioned account addresses.

14. The system of claim 11 , wherein generating the isolated MPT comprises modifying the original MPT to produce the isolated MPT, including:

removing all account records that are determined to not be accessible by the light-weight node from the original MPT; and

removing branches of the original MPT from which all account records have been removed leaving only a root hash of each of the branches intact.

15. The system of claim 14 , wherein an account record is determined not to be accessible by the light-weight node if the one or more permissions indicate that the light-weight node does not have read access to the account record.