Retrieving access data for blockchain networks using highly available trusted execution environments

1. A computer-implemented method for retrieving data from an external data source that is external to a blockchain network, the method comprising:

receiving, from a client smart contract and by a relay system smart contract executing within the blockchain network, a request for retrieving the data from the external data source, the request comprising encrypted data, the encrypted data comprising access data for accessing the external data source that is encrypted using a service public key of a key management node that is external to the blockchain network;

selecting, by the relay system smart contract, a relay system node from a plurality of relay system nodes that are external to the blockchain network, wherein the plurality of relay system nodes are distributed with a service private key of the key management node;

transmitting, by the relay system smart contract, the request to the relay system node;

receiving, from the relay system node and by the relay system smart contract, a return result in response to the request, the return result comprising the data retrieved from the external data source obtained by the relay system node and a digital signature, wherein the digital signature is generated based on the data retrieved from the external data source and the service private key of the key management node; and

transmitting, by the relay system smart contract, the return result to the client smart contract.

2. The computer-implemented method of claim 1 , further comprising:

provisioning, by an attestation process of the key management node, the service private key and the service public key of the key management node.

3. The computer-implemented method of claim 2 , further comprising:

executing, by a client device, the attestation process with the key management node and an attestation service; and

obtaining, by the client device, the service public key of the key management node during the attestation process.

4. The computer-implemented method of claim 3 , wherein the return result is validated by the client device using the service public key of the key management node.

5. The computer-implemented method of claim 1 , wherein the plurality of relay system nodes each execute a trusted execution environment (TEE).

6. The computer-implemented method of claim 1 , wherein the request is decrypted by the relay system node to obtain the access data using the service private key of the key management node.

7. The computer-implemented method of claim 1 , further comprising:

executing, by the key management node, an attestation process with each of the plurality of relay system nodes and an attestation service.

8. The computer-implemented method of claim 7 , wherein the key management node executes a key distribution process with the plurality of relay system nodes, the key distribution process resulting the service private key of the key management node being distributed to the plurality of relay system nodes.

9. A non-transitory, computer-readable storage medium storing one or more instructions that, when executed by a computer system, cause the computer system to perform operations comprising:

receiving, from a client smart contract and by a relay system smart contract executing within a blockchain network, a request for retrieving data from an external data source, the request comprising encrypted data, the encrypted data comprising access data for accessing the external data source that is encrypted using a service public key of a key management node that is external to the blockchain network;

selecting, by the relay system smart contract, a relay system node from a plurality of relay system nodes that are external to the blockchain network, wherein the plurality of relay system nodes are distributed with a service private key of the key management node;

transmitting, by the relay system smart contract, the request to the relay system node;

receiving, from the relay system node and by the relay system smart contract, a return result in response to the request, the return result comprising the data retrieved from the external data source obtained by the relay system node and a digital signature, wherein the digital signature is generated based on the data retrieved from the external data source and the service private key of the key management node; and

transmitting, by the relay system smart contract, the return result to the client smart contract.

10. The non-transitory, computer-readable storage medium of claim 9 further comprising:

provisioning, by an attestation process of the key management node, the service private key and the service public key of the key management node.

11. The non-transitory, computer-readable storage medium of claim 10 , further comprising:

executing, by a client device, the attestation process with the key management node and an attestation service; and

obtaining, by the client device, the service public key of the key management node during the attestation process.

12. The non-transitory, computer-readable storage medium of claim 11 , wherein the return result is validated by the client device using the service public key of the key management node.

13. The non-transitory, computer-readable storage medium of claim 9 , wherein the plurality of relay system nodes each execute a trusted execution environment (TEE).

14. The non-transitory, computer-readable storage medium of claim 9 , wherein the request is decrypted by the relay system node to obtain the access data using the service private key of the key management node.

15. The non-transitory, computer-readable storage medium of claim 9 , wherein the operations further comprise:

executing, by the key management node, an attestation process with each of the plurality of relay system nodes and an attestation service.

16. The non-transitory, computer-readable storage medium of claim 15 , wherein the key management node executes a key distribution process with the plurality of relay system nodes, the key distribution process resulting the service private key of the key management node being distributed to the plurality of relay system nodes.

17. A computer-implemented system, comprising:

one or more computers; and

one or more computer memory devices interoperably coupled with the one or more computers and having tangible, non-transitory, machine-readable media storing one or more instructions that, when executed by the one or more computers, cause the one or more computers to perform one or more operations comprising:

receiving, from a client smart contract and by a relay system smart contract executing within a blockchain network, a request for retrieving data from an external data source, the request comprising encrypted data, the encrypted data comprising access data for accessing the external data source that is encrypted using a service public key of a key management node that is external to the blockchain network;

selecting, by the relay system smart contract, a relay system node from a plurality of relay system nodes that are external to the blockchain network, wherein the plurality of relay system nodes are distributed with a service private key of the key management node;

transmitting, by the relay system smart contract, the request to the relay system node;

receiving, from the relay system node and by the relay system smart contract, a return result in response to the request, the return result comprising the data retrieved from the external data source obtained by the relay system node and a digital signature, wherein the digital signature is generated based on the data retrieved from the external data source and the service private key of the key management node; and

transmitting, by the relay system smart contract, the return result to the client smart contract.

18. The system of claim 17 , wherein the operations further comprise:

provisioning, by an attestation process of the key management node, the service private key and the service public key of the key management node.

19. The system of claim 13 , wherein the operations further comprise:

executing, by a client device, the attestation process with the key management node and an attestation service; and

obtaining, by the client device, the service public key of the key management node during the attestation process.

20. The system of claim 19 , wherein the return result is validated by the client device using the service public key of the key management node.

21. The system of claim 17 , wherein the plurality of relay system nodes each execute a trusted execution environment (TEE).

22. The system of claim 17 , wherein the request is decrypted by the relay system node to obtain the access data using the service private key of the key management node.

23. The system of claim 17 , wherein the operations further comprise:

executing, by the key management node, an attestation process with each of the plurality of relay system nodes and an attestation service.

24. The system of claim 23 , wherein the key management node executes a key distribution process with the plurality of relay system nodes, the key distribution process resulting the service private key of the key management node being distributed to the plurality of relay system nodes.