Confidential blockchain database with a distributed ledger
The disclosed technology is generally directed to a distributed query-and-command system. In one example of the technology, in a trusted execution environment (TEE) of a first node, database code of the first node and distributed ledger code of the first node is executed, such that execution of the distributed ledger code of the first node instantiates a first instance of a distributed ledger of a consortium blockchain, and such that execution of the query-and-command code of the first node instantiates a first instance of a query-and-command system. The consortium blockchain is distributed among a plurality of nodes, and the query-and-command system is distributed among the plurality of nodes. A first transaction that is associated with modifying the query-and-command system is received. The first transaction is executed. Changes associated with the first transaction to the distributed ledger are persisted.
1. An apparatus, comprising:
a device including at least one memory having processor-executable code stored therein, and at least one processor that is adapted to execute the processor-executable code, wherein the processor-executable code includes processor-executable instructions that, in response to execution, enable the device to perform actions, including:
verifying, by a first node using trusted execution environment (TEE) attestation, that a plurality of other nodes complies with a governance process defined by a consortium blockchain, wherein the consortium blockchain comprises the first node and the plurality of other nodes;
executing, in a TEE of the first node, database code and distributed ledger code, such that the distributed ledger code is distributed among the first node and the plurality of other nodes of the consortium blockchain to provide a distributed ledger, and such that execution of the database code of the first node instantiates a first instance of a database, wherein the database is distributed among the first node and the plurality of other nodes, wherein the TEE comprises a portion of the processor that provides confidentiality and integrity to loaded code and data;
receiving a first transaction that is associated with modifying the database;
executing the first transaction;
receiving a second transaction that is associated with modifying the database;
executing the second transaction;
persisting changes associated with the first and second transactions to the distributed ledger by updating a journal of effects in the distributed ledger, wherein the journal of effects comprises a first entry generated for the first transaction and a second entry generated for the second transaction, and wherein the journal of effects further comprises a commit point after the first entry and the second entry; and
upon reaching the commit point, updating the database based on entries in the journal of effects since a last commit point, wherein the entries in the journal of effects since the last commit point comprise the first entry and the second entry.
2. The apparatus of claim 1 , the actions further including executing, in the TEE of the first node, proxy code.
3. The apparatus of claim 1 , wherein the database is a relational database.
4. The apparatus of claim 1 , wherein the actions further include providing a universally verifiable receipt for the first transaction, wherein the universally verifiable receipt includes a Merkle tree proof and a signed root hash.
5. The apparatus of claim 1 , wherein the actions further include using the distributed ledger to recover the database.
6. The apparatus of claim 1 , wherein persisting the changes associated with the first transaction to the distributed ledger is accomplished responsive to a successful consensus vote within the consortium blockchain.
7. A method, comprising:
verifying, by a first node using trusted execution environment (TEE) attestation, that a plurality of other nodes complies with a governance process defined by a consortium blockchain, wherein the consortium blockchain comprises the first node and the plurality of other nodes;
executing, in a TEE of the first node, query-and-command code of the first node, database code of the first node, and distributed ledger code of the first node, such that execution of the distributed ledger code of the first node instantiates a first instance of a distributed ledger of the consortium blockchain, and such that execution of the query-and-command code of the first node instantiates a first instance of a query-and-command system, wherein the consortium blockchain is distributed among the first node and the plurality of other nodes, and wherein the query-and-command system is distributed among the first node and the plurality of other nodes;
receiving a first transaction that is associated with modifying the query-and-command system;
executing the first transaction;
receiving a second transaction that is associated with modifying the query-and-command system;
executing the second transaction;
persisting changes associated with the first and second transactions to the distributed ledger by updating a journal of effects in the distributed ledger, wherein the journal of effects comprises a first entry generated for the first transaction and a second entry generated for the second transaction, and wherein the journal of effects further comprises a commit point after the first entry and the second entry; and
upon reaching the commit point, updating a database of the query-and-command system based on entries in the journal of effects since a last commit point, wherein the entries in the journal of effects since the last commit point comprise the first entry and the second entry.
8. The method of claim 7 , wherein the query-and-command system is at least one of a message broker.
9. The method of claim 7 , further comprising: executing, in the TEE of the first node, proxy code.
10. The method of claim 7 , wherein the query-and-command system is a relational database.
11. The method of claim 7 , further comprising: providing a universally verifiable receipt for the first transaction, wherein the universally verifiable receipt includes a Merkle tree proof and a signed root hash.
12. The method of claim 7 , further comprising: using the distributed ledger to recover the query-and-command system.
13. A processor-readable storage medium, having stored thereon processor-executable code that, upon execution by at least one processor, enables actions, comprising:
verifying, by a first node using trusted execution environment (TEE) attestation, that a plurality of other nodes complies with a governance process defined by a consortium blockchain, wherein the consortium blockchain comprises the first node and the plurality of other nodes;
executing, in a TEE of the first node, query-and-command code of the first node, database code of the first node, and distributed ledger code of the first node, such that execution of the distributed ledger code of the first node instantiates a first instance of a distributed ledger of the consortium blockchain, and such that execution of the query-and-command code of the first node instantiates a first instance of a query-and-command system, wherein the consortium blockchain is distributed among the first node and the plurality of other nodes, and wherein the query-and-command system is distributed among the first node and the plurality of other nodes;
updating the first instance of the distributed ledger based on a first transaction and a second transaction that are associated with the query-and-command system by updating a journal of effects in the distributed ledger with an entry generated for the first transaction and an entry generated for the second transaction, wherein the journal of effects comprises a commit point after the entries for the first transaction and the second transaction;
executing the first transaction on the query-and-command system;
executing the second transaction on the query-and-command system; and
upon reaching the commit point, updating a database of the query-and-command system based on entries in the journal of effects since a last commit point, wherein the entries in the journal of effects since the last commit point comprise the entries for the first transaction and the second transaction.
14. The processor-readable storage medium of claim 13 , wherein the query-and-command system is at least one of a message broker.
15. The processor-readable storage medium of claim 13 , the actions further comprising: executing, in the TEE of the first node, proxy code.
16. The processor-readable storage medium of claim 13 , wherein the query-and-command system is a relational database.
17. The processor-readable storage medium of claim 13 , the actions further comprising: providing a universally verifiable receipt for the first transaction, wherein the universally verifiable receipt includes a Merkle tree proof and a signed root hash.
18. The processor-readable storage medium of claim 13 , the actions further comprising: using the distributed ledger to recover the query-and-command system.