Blockchain ledger authentication
A computer-implemented method for performing authentication includes: determining, by a database server storing data in a blockchain ledger, a target ledger segment on which time service authentication is to be performed; generating a Merkle tree corresponding to the target ledger segment; determining a root hash of the Merkle tree, the root hash of the Merkle tree being based on a block hash of each data block in a set of one or more data blocks; executing a predetermined time capture process in a trusted execution environment to obtain a trusted time from an interface provided by a trusted time service organization; generating a digital signature for the trusted time and the root hash in the trusted execution environment; and generating a time service certificate including the trusted time, the root hash, and the digital signature.
1. A computer-implemented method for performing authentication, comprising:
determining, by a database server storing data in a blockchain ledger, a target ledger segment on which time service authentication is to be performed;
generating, by the database server, a Merkle tree corresponding to the target ledger segment, the Merkle tree being based on a set of one or more data blocks in the target ledger segment;
determining, by the database server, a root hash of the Merkle tree, the root hash of the Merkle tree being based on a block hash of each data block in the set of one or more data blocks;
executing, by the database server, a predetermined time capture process in a trusted execution environment to obtain a trusted time from an interface provided by a trusted time service organization;
generating, by the database server, a digital signature for the trusted time and the root hash in the trusted execution environment;
generating, by the database server, a time service certificate comprising the trusted time, the root hash, and the digital signature; and
storing, by the database server, the trusted time, the root hash, and the digital signature into a specified data block of the blockchain ledger;
the method further comprising: generating a new data block in the blockchain ledger, wherein generating the new data block in the blockchain ledger comprises:
receiving one or more data records, and determining a hash value of each data record;
determining that a predetermined block forming condition is satisfied;
determining that a sequence number of the new data block in the blockchain ledger is greater than 1; and
generating the new data block in the blockchain ledger, the new data block comprising the one or more data records and a hash value of the new data block,
wherein the hash value of the new data block is determined based on the one or more data records and a hash value of an adjacent previous block in the blockchain ledger.
2. The computer-implemented method of claim 1 , wherein the predetermined block forming condition comprises:
a quantity of to-be-stored data records reaches a quantity threshold; or
a time interval since the forming of the adjacent previous block reaches a time threshold.
3. The computer-implemented method of claim 1 , wherein determining the target ledger segment comprises:
determining a second new data block of the blockchain ledger as the target ledger segment; or
determining, based on a starting block height and a block quantity comprised in an instruction of a user, the target ledger segment.
4. The computer-implemented method of claim 1 , wherein determining the target ledger segment comprises:
selecting, as the target ledger segment, a newly generated ledger segment that satisfies a predetermined time service condition, wherein the predetermined time service condition comprises:
a quantity of newly generated data blocks in the newly generated ledger segment reaches a quantity threshold, or
a time interval since a previous time service authentication reaches a time threshold.
5. The computer-implemented method of claim 1 , wherein the trusted execution environment comprises INTEL SGX, AMD SEV, or ARM TrustZone.
6. The computer-implemented method of claim 1 , further comprising:
writing the root hash, the trusted time, and the digital signature into a second specified data block in the target ledger segment.
7. A non-transitory, computer-readable medium storing one or more instructions that, when executed a computer system of a database server, cause the computer system to perform operations comprising:
determining, by the database server storing data in a blockchain ledger, a target ledger segment on which time service authentication is to be performed;
generating, by the database server, a Merkle tree corresponding to the target ledger segment, the Merkle tree being based on a set of one or more data blocks in the target ledger segment;
determining, by the database server, a root hash of the Merkle tree, the root hash of the Merkle tree being based on a block hash of each data block in the set of one or more data blocks;
executing, by the database server, a predetermined time capture process in a trusted execution environment to obtain a trusted time from an interface provided by a trusted time service organization;
generating, by the database server, a digital signature for the trusted time and the root hash in the trusted execution environment;
generating, by the database server, a time service certificate comprising the trusted time, the root hash, and the digital signature; and
storing, by the database server, the trusted time, the root hash, and the digital signature into a specified data block of the blockchain ledger;
wherein the operations further comprise generating a new data block in the blockchain ledger, wherein generating the new data block in the blockchain ledger comprises:
receiving one or more data records, and determining a hash value of each data record;
determining that a predetermined block forming condition is satisfied;
determining that a sequence number of the new data block in the blockchain ledger is greater than 1; and
generating the new data block in the blockchain ledger, the new data block comprising the one or more data records and a hash value of the new data block,
wherein the hash value of the new data block is determined based on the one or more data records and a hash value of an adjacent previous block in the blockchain ledger.
8. The non-transitory computer-readable medium of claim 7 , wherein the predetermined block forming condition comprises:
a quantity of to-be-stored data records reaches a quantity threshold; or
a time interval since the forming of the adjacent previous block reaches a time threshold.
9. The non-transitory computer-readable medium of claim 7 , wherein determining the target ledger segment comprises:
determining a second new data block of the blockchain ledger as the target ledger segment; or
determining, based on a starting block height and a block quantity comprised in an instruction of a user, the target ledger segment.
10. The non-transitory, computer-readable medium of claim 7 , wherein determining the target ledger segment comprises:
selecting, as the target ledger segment, a newly generated ledger segment that satisfies a predetermined time service condition, wherein the predetermined time service condition comprises:
a quantity of newly generated data blocks in the newly generated ledger segment reaches a quantity threshold, or
a time interval since a previous time service authentication reaches a time threshold.
11. The non-transitory, computer-readable medium of claim 7 , wherein the trusted execution environment comprises INTEL SGX, AMD SEV, or ARM TrustZone.
12. The non-transitory, computer-readable medium of claim 7 , wherein the operations further comprise:
writing the root hash, the trusted time, and the digital signature into a second specified data block in the target ledger segment.
13. A computer-implemented system, comprising:
one or more computers of a database server; and
one or more computer memory devices interoperably coupled with the one or more computers and having tangible, non-transitory, machine-readable media storing one or more instructions that, when executed by the one or more computers, cause the one or more computers to perform one or more operations comprising:
determining, by the database server storing data in a blockchain ledger, a target ledger segment on which time service authentication is to be performed;
generating, by the database server, a Merkle tree corresponding to the target ledger segment, the Merkle tree being based on a set of one or more data blocks in the target ledger segment;
determining, by the database server, a root hash of the Merkle tree, the root hash of the Merkle tree being based on a block hash of each data block in the set of one or more data blocks;
executing, by the database server, a predetermined time capture process in a trusted execution environment to obtain a trusted time from an interface provided by a trusted time service organization;
generating, by the database server, a digital signature for the trusted time and the root hash in the trusted execution environment;
generating, by the database server, a time service certificate comprising the trusted time, the root hash, and the digital signature; and
storing, by the database server, the trusted time, the root hash, and the digital signature into a specified data block of the blockchain ledger;
wherein the operations further comprise generating a new data block in the blockchain ledger, wherein generating the new data block in the blockchain ledger comprises:
receiving one or more data records, and determining a hash value of each data record;
determining that a predetermined block forming condition is satisfied;
determining that a sequence number of the new data block in the blockchain ledger is greater than 1; and
generating the new data block in the blockchain ledger, the new data block comprising the one or more data records and a hash value of the new data block,
wherein the hash value of the new data block is determined based on the one or more data records and a hash value of an adjacent previous block in the blockchain ledger.
14. The computer-implemented system of claim 13 , wherein the predetermined block forming condition comprises:
a quantity of to-be-stored data records reaches a quantity threshold; or a time interval since the forming of the adjacent previous block reaches a time threshold.
15. The computer-implemented system of claim 13 , wherein determining the target ledger segment comprises:
determining a second new data block of the blockchain ledger as the target ledger segment; or
determining, based on a starting block height and a block quantity comprised in an instruction of a user, the target ledger segment.
16. The computer-implemented system of claim 13 , wherein determining the target ledger segment comprises:
selecting, as the target ledger segment, a newly generated ledger segment that satisfies a predetermined time service condition, wherein the predetermined time service condition comprises:
a quantity of newly generated data blocks in the newly generated ledger segment reaches a quantity threshold, or
a time interval since a previous time service authentication reaches a time threshold.
17. The computer-implemented system of claim 13 , wherein the trusted execution environment comprises INTEL SGX, AMD SEV, or ARM TrustZone.
18. The computer-implemented system of claim 13 , wherein the operations further comprise:
writing the root hash, the trusted time, and the digital signature into a second specified data block in the target ledger segment.