Field-programmable gate array based trusted execution environment for use in a blockchain network
View Patent ↗Disclosed herein are methods, systems, and apparatus, including computer programs encoded on computer storage media, for configuring a field programmable gate array (FPGA) based trusted execution environment (TEE) for use in a blockchain network. One of the methods includes storing a device identifier (ID), a first random number, and a first encryption key in a field programmable gate array (FPGA) device; sending an encrypted bitstream to the FPGA device, wherein the encrypted bitstream can be decrypted by the first key into a decrypted bitstream comprising a second random number; receiving an encrypted message from the FPGA device; decrypting the encrypted message from the FPGA device using a third key to produce a decrypted message; in response to decrypting the encrypted message: determining a third random number in the decrypted message; encrypting keys using the third random number; and sending the keys to the FPGA device.
1. A computer-implemented method for configuring a field programmable gate array (FPGA) based trusted execution environment (TEE) for use in a blockchain network, comprising:
storing, by a blockchain node in the blockchain network, a device identifier (ID), a first random number, and a first encryption key in an FPGA device associated with the blockchain node;
sending, by the blockchain node, an encrypted bitstream to the FPGA device, wherein the encrypted bitstream can be decrypted by the FPGA device using the first encryption key into a decrypted bitstream comprising a second random number;
receiving, by the blockchain node, an encrypted message from the FPGA device, wherein the encrypted message is encrypted by the FPGA device using a second key, and wherein the second key is generated by the FPGA device using the device ID, the first random number, and the second random number;
decrypting, by the blockchain node, the encrypted message from the FPGA device using a third key to produce a decrypted message, wherein the third key is pre-stored in a server; and
in response to decrypting the encrypted message using the third key:
determining, by the blockchain node, a third random number embedded in the decrypted message,
encrypting, by the blockchain node, one or more keys using the third random number, and
sending, by the blockchain node, the one or more keys to the FPGA device.
2. The method of claim 1 , wherein the device ID, the first random number, and the first encryption key are stored in a one-time programmable area of the FPGA device.
3. The method of claim 1 , wherein the decrypted bitstream and the second random number are stored in a reprogrammable area of the FPGA device.
4. The method of claim 1 , wherein the device ID, and the first random number are unique to the FPGA device.
5. The method of claim 1 , wherein the decrypted message includes the device ID.
6. The method of claim 1 , wherein the third key is identical to the second key.
7. The method of claim 1 , wherein the FPGA device decrypts and authenticates the encrypted bitstream using a bitstream authentication module and the first encryption key.
8. The method of claim 1 , further comprising:
in response to sending the one or more keys to the FPGA device, initializing, by the blockchain node, a smart contract virtual machine for execution by the FPGA device.
9. A non-transitory, computer-readable storage medium storing one or more instructions executable by a computer system to perform operations comprising:
storing, by a blockchain node in a blockchain network, a device identifier (ID), a first random number, and a first encryption key in an FPGA device associated with the blockchain node;
sending, by the blockchain node, an encrypted bitstream to the FPGA device, wherein the encrypted bitstream can be decrypted by the FPGA device using the first encryption key into a decrypted bitstream comprising a second random number;
receiving, by the blockchain node, an encrypted message from the FPGA device, wherein the encrypted message is encrypted by the FPGA device using a second key, and wherein the second key is generated by the FPGA device using the device ID, the first random number, and the second random number;
decrypting, by the blockchain node, the encrypted message from the FPGA device using a third key to produce a decrypted message, wherein the third key is pre-stored in a server; and
in response to decrypting the encrypted message using the third key:
determining, by the blockchain node, a third random number embedded in the decrypted message,
encrypting, by the blockchain node, one or more keys using the third random number, and
sending, by the blockchain node, the one or more keys to the FPGA device.
10. The non-transitory, computer-readable storage medium of claim 9 , wherein the device ID, the first random number, and the first encryption key are stored in a one-time programmable area of the FPGA device.
11. The non-transitory, computer-readable storage medium of claim 9 , wherein the decrypted bitstream and the second random number are stored in a reprogrammable area of the FPGA device.
12. The non-transitory, computer-readable storage medium of claim 9 , wherein the device ID, and the first random number are unique to the FPGA device.
13. The non-transitory, computer-readable storage medium of claim 9 , wherein the decrypted message includes the device ID.
14. The non-transitory, computer-readable storage medium of claim 9 , wherein the third key is identical to the second key.
15. The non-transitory, computer-readable storage medium of claim 9 , wherein the FPGA device decrypts and authenticates the encrypted bitstream using a bitstream authentication module and the first encryption key.
16. The non-transitory, computer-readable storage medium of claim 9 , wherein the operations further comprise:
in response to sending the one or more keys to the FPGA device, initializing, by the blockchain node, a smart contract virtual machine for execution by the FPGA device.
17. A computer-implemented system, comprising:
one or more computers; and
one or more computer memory devices interoperably coupled with the one or more computers and having tangible, non-transitory, machine-readable media storing one or more instructions that, when executed by the one or more computers, perform one or more operations comprising:
storing, by a blockchain node in a blockchain network, a device identifier (ID), a first random number, and a first encryption key in an FPGA device associated with the blockchain node,
sending, by the blockchain node, an encrypted bitstream to the FPGA device, wherein the encrypted bitstream can be decrypted by the FPGA device using the first encryption key into a decrypted bitstream comprising a second random number,
receiving, by the blockchain node, an encrypted message from the FPGA device, wherein the encrypted message is encrypted by the FPGA device using a second key, and wherein the second key is generated by the FPGA device using the device ID, the first random number, and the second random number,
decrypting, by the blockchain node, the encrypted message from the FPGA device using a third key to produce a decrypted message, wherein the third key is pre-stored in a server, and
in response to decrypting the encrypted message using the third key:
determining, by the blockchain node, a third random number embedded in the decrypted message,
encrypting, by the blockchain node, one or more keys using the third random number, and
sending, by the blockchain node, the one or more keys to the FPGA device.
18. The system of claim 17 , wherein the device ID, the first random number, and the first encryption key are stored in a one-time programmable area of the FPGA device.
19. The system of claim 17 , wherein the decrypted bitstream and the second random number are stored in a reprogrammable area of the FPGA device.
20. The system of claim 17 , wherein the device ID, and the first random number are unique to the FPGA device.
21. The system of claim 17 , wherein the decrypted message includes the device ID.
22. The system of claim 17 , wherein the third key is identical to the second key.
23. The system of claim 17 , wherein the FPGA device decrypts and authenticates the encrypted bitstream using a bitstream authentication module and the first encryption key.
24. The system of claim 17 , wherein the operations further comprise:
in response to sending the one or more keys to the FPGA device, initializing, by the blockchain node, a smart contract virtual machine for execution by the FPGA device.