Retrieving access data for blockchain networks using highly available trusted execution environments
Disclosed herein are methods, systems, and apparatus, including computer programs encoded on computer storage media, for retrieving data from external data sources for processing within a blockchain network. One of the methods includes receiving a request for data that includes encrypted data, the encrypted data including access data that is encrypted using a service public key of a key management node; selecting a relay system node from a plurality of relay system nodes that share a service private key of the key management node; transmitting the request to the relay system node; receiving a response provided from the relay system node, the response including result data and a digital signature, wherein the digital signature is generated based on the result data and the service private key of the key management node; and transmitting the response to a client.
1. A computer-implemented method for retrieving data from an external data source that is external to a blockchain network, the method comprising:
receiving, from a client smart contract and by a relay system smart contract executing within the blockchain network, a request for retrieving the data from the external data source, the request comprising encrypted data, the encrypted data comprising access data for accessing the external data source that is encrypted using a service public key of a key management node that is external to the blockchain network;
selecting, by the relay system smart contract, a relay system node from a plurality of relay system nodes that are external to the blockchain network, wherein the plurality of relay system nodes are distributed with a service private key of the key management node;
executing, by the key management node, an attestation process with each of the plurality of relay system nodes and an attestation service, wherein the key management node executes a key distribution process with the plurality of relay system nodes, the key distribution process resulting the service private key of the key management node being distributed to the plurality of relay system nodes;
transmitting, by the relay system smart contract, the request to the relay system node;
receiving, from the relay system node and by the relay system smart contract, a return result in response to the request, the return result comprising the data retrieved from the external data source obtained by the relay system node and a digital signature, wherein the digital signature is generated based on the data retrieved from the external data source and the service private key of the key management node; and
transmitting, by the relay system smart contract, the return result to the client smart contract.
2. The computer-implemented method of claim 1 , further comprising:
provisioning, by an attestation process of the key management node, the service private key and the service public key of the key management node.
3. The computer-implemented method of claim 2 , further comprising:
executing, by a client device, the attestation process with the key management node and an attestation service; and
obtaining, by the client device, the service public key of the key management node during the attestation process.
4. The computer-implemented method of claim 3 , wherein the return result is validated by the client device using the service public key of the key management node.
5. The computer-implemented method of claim 1 , wherein the plurality of relay system nodes each execute a trusted execution environment (TEE).
6. The computer-implemented method of claim 1 , wherein the request is decrypted by the relay system node to obtain the access data using the service private key of the key management node.
7. A non-transitory, computer-readable storage medium storing one or more instructions executable by a computer system to perform operations comprising:
receiving, from a client smart contract and by a relay system smart contract executing within a blockchain network, a request for retrieving data from an external data source, the request comprising encrypted data, the encrypted data comprising access data for accessing the external data source that is encrypted using a service public key of a key management node that is external to the blockchain network;
selecting, by the relay system smart contract, a relay system node from a plurality of relay system nodes that are external to the blockchain network, wherein the plurality of relay system nodes are distributed with a service private key of the key management node;
executing, by the key management node, an attestation process with each of the plurality of relay system nodes and an attestation service, wherein the key management node executes a key distribution process with the plurality of relay system nodes, the key distribution process resulting the service private key of the key management node being distributed to the plurality of relay system nodes;
transmitting, by the relay system smart contract, the request to the relay system node;
receiving, from the relay system node and by the relay system smart contract, a return result in response to the request, the return result comprising the data retrieved from the external data source obtained by the relay system node and a digital signature, wherein the digital signature is generated based on the data retrieved from the external data source and the service private key of the key management node; and
transmitting, by the relay system smart contract, the return result to the client smart contract.
8. The non-transitory, computer-readable storage medium of claim 7 further comprising:
provisioning, by an attestation process of the key management node, the service private key and the service public key of the key management node.
9. The non-transitory, computer-readable storage medium of claim 8 , further comprising:
executing, by a client device, the attestation process with the key management node and an attestation service; and
obtaining, by the client device, the service public key of the key management node during the attestation process.
10. The non-transitory, computer-readable storage medium of claim 9 , wherein the return result is validated by the client device using the service public key of the key management node.
11. The non-transitory, computer-readable storage medium of claim 7 , wherein the plurality of relay system nodes each execute a trusted execution environment (TEE).
12. The non-transitory, computer-readable storage medium of claim 7 , wherein the request is decrypted by the relay system node to obtain the access data using the service private key of the key management node.
13. A computer-implemented system, comprising:
one or more computers; and
one or more computer memory devices interoperably coupled with the one or more computers and having tangible, non-transitory, machine-readable media storing one or more instructions that, when executed by the one or more computers, perform one or more operations comprising:
receiving, from a client smart contract and by a relay system smart contract executing within a blockchain network, a request for retrieving data from an external data source, the request comprising encrypted data, the encrypted data comprising access data for accessing the external data source that is encrypted using a service public key of a key management node that is external to the blockchain network;
selecting, by the relay system smart contract, a relay system node from a plurality of relay system nodes that are external to the blockchain network, wherein the plurality of relay system nodes are distributed with a service private key of the key management node;
executing, by the key management node, an attestation process with each of the plurality of relay system nodes and an attestation service, wherein the key management node executes a key distribution process with the plurality of relay system nodes, the key distribution process resulting the service private key of the key management node being distributed to the plurality of relay system nodes;
transmitting, by the relay system smart contract, the request to the relay system node;
receiving, from the relay system node and by the relay system smart contract, a return result in response to the request, the return result comprising the data retrieved from the external data source obtained by the relay system node and a digital signature, wherein the digital signature is generated based on the data retrieved from the external data source and the service private key of the key management node; and
transmitting, by the relay system smart contract, the return result to the client smart contract.
14. The system of claim 13 , wherein the operations further comprise:
provisioning, by an attestation process of the key management node, the service private key and the service public key of the key management node.
15. The system of claim 14 , wherein the operations further comprise:
executing, by a client device, the attestation process with the key management node and an attestation service; and
obtaining, by the client device, the service public key of the key management node during the attestation process.
16. The system of claim 15 , wherein the return result is validated by the client device using the service public key of the key management node.
17. The system of claim 13 , wherein the plurality of relay system nodes each execute a trusted execution environment (TEE).
18. The system of claim 13 , wherein the request is decrypted by the relay system node to obtain the access data using the service private key of the key management node.