Namuhla, amavila kuphela angabhalanga mayelana nobuchwepheshe be-blockchain, i-cryptocurrencies nokuthi ipholile kangakanani. Kodwa lesi sihloko ngeke sincome lobu buchwepheshe, sizokhuluma ngamaphutha abo nezindlela zokuwaqeda.

Ngenkathi sisebenza kwelinye lamaphrojekthi e-Altirix Systems, umsebenzi wavela wokuqinisekisa okuvikelekile, okuvimbela ukucwaninga kwedatha kusuka kumthombo ongaphandle kuya ku-blockchain. Bekudingeka ukuqinisekisa izinguquko kumarekhodi esistimu yesithathu futhi, ngokusekelwe kulezi zinguquko, yenze igatsha elilodwa noma elinye kungqondongqondo yenkontileka ehlakaniphile. Umsebenzi uma uthi nhlá umncane impela, kodwa lapho isimo sezimali somunye wezinhlangothi ezibambe iqhaza kule nqubo sincike emphumeleni wokuqaliswa kwawo, kuvela izidingo ezengeziwe. Okokuqala, lokhu ukuthembela okuphelele kumshini wokuqinisekisa onjalo. Kodwa izinto zokuqala kuqala.

Inkinga ukuthi i-blockchain ngokwayo iyinhlangano ezimele, evaliwe, ngakho-ke izinkontileka ezihlakaniphile ngaphakathi kwe-blockchain azazi lutho ngezwe langaphandle. Ngesikhathi esifanayo, imigomo yezinkontileka ezihlakaniphile ngokuvamile ihlobene nolwazi olumayelana nezinto zangempela (ukubambezeleka kwendiza, amanani okushintshanisa, njll.). Ukuze izinkontileka ezihlakaniphile zisebenze kahle, ulwazi olutholwe ngaphandle kwe-blockchain kufanele luthembeke futhi luqinisekiswe. Le nkinga ixazululwa ngokusebenzisa izibikezelo ezifana ne-Town Crier kanye ne-DECO. Lezi zibikezelo zivumela inkontileka ehlakaniphile kunethiwekhi ye-blockchain ukuthi ithembe ulwazi oluvela kuseva yewebhu ethembekile; singasho ukuthi laba abahlinzeki bolwazi oluthembekile.

Oracles

Cabanga ukuthi inkontileka ehlakaniphile idlulisela i-0.001 btc esikhwameni sakho se-bitcoin uma iklabhu yakho yebhola oyintandokazi iwina indebe yaseRussia. Uma kwenzeka ukunqoba kwangempela, inkontileka ehlakaniphile idinga ukudlulisa ulwazi mayelana nokuthi iyiphi iklabhu ewinile, futhi kuvela izinkinga eziningi lapha: ukuthi ungalutholaphi lolu lwazi, uludlulisela kanjani ngokuphephile kwinkontileka ehlakaniphile nokuthi ungaqinisekisa kanjani ukuthi ulwazi etholwe kunkontileka ehlakaniphile ingabe isebenza ngempela iqondana neqiniso?

Uma kuziwa emthonjeni wolwazi, kungase kube nezimo ezi-2: ukuxhuma inkontileka ehlakaniphile newebhusayithi ethembekile lapho ulwazi olumayelana nemiphumela yomdlalo lugcinwa khona endaweni eyodwa, futhi inketho yesibili ukuxhuma amasayithi amaningana ngesikhathi esisodwa bese ukhetha imininingwane emithonjeni eminingi. ezinikeza idatha efanayo. Ukuze kuqinisekiswe ukunemba kolwazi, kusetshenziswa izibikezelo, isibonelo, i-Oraclize, esebenzisa i-TLSNotary (TLS Notary Modification to Prove the Authentity of Data). Kodwa kukhona ulwazi olwanele ku-Google mayelana ne-Oraclize, futhi kunezihloko ezimbalwa ezikhuluma nge-Habré Namuhla ngizokhuluma ngama-oracle asebenzisa indlela ehluke kancane yokudlulisa ulwazi: I-Town Crier ne-DECO. I-athikili ihlinzeka ngencazelo yezimiso zokusebenza zawo womabili ama-oracle, kanye nokuqhathanisa okuningiliziwe.

I-Crier yedolobha

I-Town Crier (TC) yethulwa yi-IC3 (I-Initiative for CryptoCurrencies and Contracts) ngo-2016 e-CCS'16. Umqondo oyinhloko we-TC: dlulisa imininingwane isuka kuwebhusayithi iye kwinkontileka ehlakaniphile futhi uqiniseke ukuthi ulwazi olulethwe yi-TC luyafana nolukuwebhusayithi. I-TC isebenzisa i-TEE (Trusted Execution Environment) ukuze iqinisekise ubunikazi bedatha. Inguqulo yasekuqaleni ye-TC ichaza indlela yokusebenza ne-Intel SGX.
I-Town Crier iqukethe ingxenye ngaphakathi kwe-blockchain kanye nengxenye ngaphakathi kwe-OS ngokwayo - i-TC Server.

I-TC Contract iku-blockchain futhi isebenza njengesiphetho esiphambili se-TC. Yamukela izicelo ezivela ku-CU (inkontileka ehlakaniphile yomsebenzisi) futhi ibuyisela impendulo evela Kuseva ye-TC. Ngaphakathi kwe-TC Server kukhona i-Relay, esungula uxhumano phakathi kwe-enclave ne-intanethi (i-traffic bidirectional) futhi ixhuma i-enclave ne-blockchain. I-Enclave iqukethe i-progencl, okuyikhodi eyenza izicelo ku-blockchain futhi ibuyisele imilayezo ku-blockchain ngesiginesha yedijithali, i-progencl iqukethe ingxenye yekhodi yenkontileka ehlakaniphile futhi empeleni yenza eminye yemisebenzi yayo.

I-Intel SGX enclave ingacatshangwa njengomtapo wolwazi okwabelwana ngawo ne-API esebenza nge-ecall. Ukulawulwa kokudluliselwa kwe-Ecall ku-enclave. I-enclave isebenzisa ikhodi yayo ize iphume noma kuze kube yilapho kwenzeka okuhlukile. i-ocall isetshenziselwa ukubiza imisebenzi echazwe ngaphandle kwe-enclave. I-Ocall ibulawa ngaphandle kwe-enclave futhi iphathwa njengocingo olungathenjwa yilo. Ngemva kokukhishwa kwe-ocall, ukulawula kubuyiselwa ku-enclave.

Engxenyeni ye-Enclave, isiteshi esivikelekile silungiswa ngeseva yewebhu, i-enclave ngokwayo yenza ukuxhawula kwe-TLS neseva eqondiwe futhi yenze yonke imisebenzi ye-cryptographic ngaphakathi. Ilabhulali ye-TLS (mbedTLS) kanye nekhodi ye-HTTP eyehlisiwe ikhishelwe endaweni ye-SGX. Futhi, i-Enclave iqukethe izitifiketi ze-CA zezimpande (iqoqo lezitifiketi) zokuqinisekisa izitifiketi zamaseva akude. I-Request Handler yamukela isicelo se-datagram ngefomethi ehlinzekwe yi-Ethereum, iyasisusa bese siyasihlukanisa. Bese ikhiqiza ukuthengiselana kwe-Ethereum equkethe idathagram eceliwe, iyisayine nge-skTC futhi iyithumele ku-Relay.

Ingxenye ye-Relay ihlanganisa i-Client Interface, i-TCP, i-Blockchain Interface. I-Client Interface iyadingeka ukuze kuqinisekiswe ikhodi ye-enclave nokuxhumana neklayenti. Iklayenti lithumela isicelo sobufakazi lisebenzisa i-ecall futhi lithola isitembu sesikhathi esisayinwe yi-skTC kanye ne-att (isiginesha yobufakazi), bese i-att iqinisekiswa kusetshenziswa i-Intel Attestation Service (IAS), futhi isitembu sesikhathi siqinisekiswa isevisi yesikhathi ethenjwayo. I-Blockchain Interface iqinisekisa izicelo ezingenayo futhi ibeka ukuthengiselana ku-blockchain ukuze kuthunyelwe ama-datagram. I-Geth iyiklayenti elisemthethweni le-Ethereum futhi ivumela i-Relay ukuthi ihlanganyele ne-blockchain ngezingcingo ze-RPC.

Ukusebenza ne-TEE, i-TC ikuvumela ukuthi usebenzise ama-enclaves amaningana ngokuhambisana, ngaleyo ndlela ukhulise isivinini sokucubungula ulwazi izikhathi ezi-3. Uma nge-enclave eyodwa egijima ijubane lalingu-15 tx/sec, bese kuthi nge-20 parallel running enclaves ijubane liyakhuphuka libe ngu-65 tx/sec; uma kuqhathaniswa, isivinini sokusebenza esiphezulu ku-Bitcoin blockchain singama-26 tx/sec.

Deco

I-DECO (Decentralized Oracles for TLS) yethulwe kokuthi CCS'20, isebenza namasayithi asekela ukuxhumana kwe-TLS. Iqinisekisa ukugcinwa kuyimfihlo kwedatha nobuqotho.
I-DECO ene-TLS isebenzisa ukubethela kwe-symmetric, ngakho iklayenti neseva yewebhu inokhiye bokubethela, futhi iklayenti lingakhohlisa idatha yeseshini ye-TLS uma lifuna. Ukuxazulula le nkinga, i-DECO isebenzisa iphrothokholi yokuxhawula yezindlela ezintathu phakathi kwe-prover (inkontileka ehlakaniphile), isiqinisekisi (i-oracle) neseva yewebhu (umthombo wedatha).

Indlela i-DECO esebenza ngayo ukuthi isiqinisekisi sithola ucezu lwedatha D futhi siqinisekisa kusiqinisekisi ukuthi u-D uvela kuseva ye-TLS S. Enye inkinga ukuthi i-TLS ayisayini idatha futhi kuba nzima ngeklayenti le-TLS ukufakazela ukuthi idatha itholwe kuseva elungile (ubunzima bokufunda).

Iphrothokholi ye-DECO isebenzisa okhiye bokubethela be-KEnc ne-KMac. Iklayenti lithumela isicelo u-Q kuseva yewebhu, impendulo evela kuseva engu-R iza ngefomu elibethelwe, kodwa iklayenti neseva ziphethe i-KMac efanayo, futhi iklayenti lingakha umlayezo we-TLS. Isixazululo se-DECO "ukufihla" i-KMac kuklayenti (prover) ize iphendule isicelo. Manje i-KMac ihlukaniswe phakathi kwe-prover nesiqinisekisi - i-KpMac ne-KvMac. Iseva ithola i-KMac ukuze ibhale ngemfihlo impendulo isebenzisa umsebenzi wengxenye yokhiye KpMac ⊕ KvMac = KMac.

Ngokusetha ukuxhawula ngezindlela ezintathu, ukushintshana kwedatha phakathi kweklayenti neseva kuzokwenziwa ngesiqinisekiso sokuphepha.

Uma ukhuluma ngesistimu ye-oracle ehlukanisiwe, umuntu angeke ahluleke ukusho i-Chainlink, ehlose ukudala inethiwekhi ye-oracle nodes ehambisana ne-Ethereum, i-Bitcoin ne-Hyperledger, kucatshangelwa i-modularity: zonke izingxenye zesistimu zingabuyekezwa. Ngesikhathi esifanayo, ukuqinisekisa ukuphepha, i-Chainlink inikeza i-oracle ngayinye ebamba iqhaza emsebenzini ukuze ikhiphe inhlanganisela yezihluthulelo (zomphakathi neziyimfihlo). Ukhiye oyimfihlo usetshenziselwa ukukhiqiza isiginesha eyingxenye equkethe isinqumo sabo sesicelo sedatha. Ukuze uthole impendulo, kuyadingeka ukuhlanganisa wonke amasiginesha ayingxenye yama-oracle enethiwekhi.

I-Chainlink ihlela ukwenza i-PoC DECO yokuqala egxile ezicelweni zezimali ezisabalalisiwe njengeMiksi. Ngesikhathi sokuloba, kwaphuma izindaba kuForbes zokuthi uChainlink uthole i-DECO eCornell University.

Ukuhlaselwa kwezibikezelo

Ngokombono wokuphepha kolwazi, ukuhlaselwa okulandelayo kwe-Town Crier kucatshangelwe:

1. Umjovo wekhodi yokuxhumana ehlakaniphile kumanodi e-TEE.
   Ingqikithi yokuhlasela: ukudlulisa ikhodi yenkontileka ehlakaniphile engalungile ngamabomu ku-TEE, ngakho-ke, umhlaseli othole ukufinyelela ku-node uzokwazi ukwenza inkontileka yakhe ehlakaniphile (engumgunyathi) kudatha esusiwe. Nokho, amanani okubuyisela azobethelwa ngokhiye oyimfihlo, futhi okuwukuphela kwendlela yokufinyelela idatha enjalo iwukuvuza i-ciphertext ekubuyiselweni/okuphumayo.
   Ukuvikelwa kulokhu kuhlasela kuhlanganisa i-enclave ehlola ukufaneleka kwekhodi etholakala ekhelini lamanje. Lokhu kungafezwa kusetshenziswa uhlelo lwamakheli lapho ikheli lenkontileka linqunywa ngokusheshisa ikhodi yenkontileka.

2. Ukuvuza kwezinguquko ze-ciphertext yesimo senkontileka.
   Umongo wokuhlasela: Abanikazi bamanodi lapho kusetshenziswa khona izinkontileka ezihlakaniphile banokufinyelela isimo senkontileka ngendlela ebethelwe ngaphandle kwendawo efihlekile. Umhlaseli, lapho ethole ukulawula indawo, angaqhathanisa isimo sokuxhumana ngaphambi nangemuva komsebenzi futhi anganquma ukuthi yiziphi izimpikiswano ezifakiwe nokuthi iyiphi indlela yenkontileka ehlakaniphile eyasetshenziswa, njengoba ikhodi yenkontileka ehlakaniphile ngokwayo kanye nezici zayo zokusebenza kutholakala esidlangalaleni.
   Ukuvikelwa ekuqinisekiseni ukwethembeka kwe-node ngokwayo.

3. Ukuhlaselwa kwesiteshi esiseceleni.
   Uhlobo olukhethekile lokuhlasela olusebenzisa ukuqapha kwememori ehlanganisiwe nokufinyelela kwenqolobane kuzimo ezihlukahlukene. Isibonelo sokuhlasela okunjalo yi-Prime and Probe.
   
   Umyalo wokuhlasela:

   • t0: Umhlaseli ugcwalisa yonke inqolobane yedatha yenqubo yesisulu.
   • t1: Isisulu senza ikhodi enokufinyelela kwenkumbulo okuncike kudatha ebucayi yesisulu (okhiye be-cryptographic). Umugqa wenqolobane ukhethwa ngokusekelwe kunani lebhithi yokhiye. Esibonelweni esisemfanekisweni, i-keybit = 0 kanye nekheli elithi X ku-cache line 2. Idatha egcinwe ku-X ilayishwa kunqolobane, isusa idatha ebilapho ngaphambili.
   • t2: Umhlaseli uhlola ukuthi yimiphi imigqa yenqolobane yakhe ekhishiwe—imigqa esetshenziswa isisulu. Lokhu kwenziwa ngokulinganisa isikhathi sokufinyelela. Ngokuphinda lokhu kusebenza kwebhithi yokhiye ngayinye, umhlaseli uthola wonke ukhiye.

Ukuvikela Ukuhlasela: I-Intel SGX inokuvikelwa ekuhlaselweni kwesiteshi eseceleni esivimbela ukugadwa kwemicimbi ehlobene nenqolobane, kodwa ukuhlasela kwe-Prime kanye ne-Probe kusazosebenza ngoba umhlaseli uqapha izehlakalo zenqolobane yenqubo yakhe futhi wabelane ngesisulu.

Ngakho, okwamanje asikho isivikelo esinokwethenjelwa kulokhu kuhlasela.

Ukuhlasela okufana ne-Specter ne-Foreshadow (L1TF), efana ne-Prime ne-Probe, nakho kuyaziwa. Zikuvumela ukuthi ufunde idatha kwimemori yenqolobane usebenzisa isiteshi esivela eceleni. Ukuvikela ngokumelene nokuba sengozini kwe-Specter-v2 kunikezwa, okusebenza ngokumelene nokubili kwalokhu kuhlasela.

Maqondana ne-DECO, ukuxhawula ngezindlela ezintathu kunikeza isiqinisekiso sokuphepha:

1. I-Prover Integrity: Umshumayeli ogqekeziwe akakwazi ukwenza amanga ulwazi lwemvelaphi yeseva futhi ngeke abangele iseva ukuthi yamukele izicelo ezingavumelekile noma iphendule ngokungalungile izicelo ezivumelekile. Lokhu kwenziwa ngamaphethini esicelo phakathi kweseva ne-prover.
2. Ubuqotho Bokuqinisekisa: Isiqinisekisi esintshontshiwe asikwazi ukwenza umhloli ukuthi athole izimpendulo ezingalungile.
3. Ubumfihlo: Isiqinisekisi esintshontshiwe sihlola imininingwane yomphakathi kuphela (isicelo, igama leseva).

Ku-DECO, ubungozi bomjovo wethrafikhi kuphela obungenzeka. Okokuqala, ngokuxhawula izindlela ezintathu, isiqinisekisi singathola ubunikazi beseva sisebenzisa i-nonce entsha. Nokho, ngemva kokuxhawulana, isiqinisekisi kufanele sithembele ezinkomba zesendlalelo senethiwekhi (amakheli e-IP). Ngakho-ke, ukuxhumana phakathi kwesiqinisekisi neseva kufanele kuvikelwe ekujovweni kwethrafikhi. Lokhu kufezwa ngokusebenzisa i-Proxy.

Ukuqhathaniswa kwama-oracle

I-Town Crier isekelwe ekusebenzeni nge-enclave engxenyeni yeseva, kuyilapho i-DECO ikuvumela ukuthi uqinisekise ubuqiniso bomsuka wedatha usebenzisa ukuxhawulana kwezindlela ezintathu kanye nokubethela kwedatha ngokhiye be-cryptographic. Ukuqhathaniswa kwalezi zibikezelo kwenziwa ngokuvumelana nalezi zindlela ezilandelayo: ukusebenza, ukuphepha, izindleko nokusebenza.

I-Crier yedolobha
Deco

ukusebenza
Ngokushesha (0.6s ukuqeda)
Kancane kancane (ama-10.50s ukuqeda iphrothokholi)

ukuphepha
Ivikeleke kancane
Kuphephe kakhudlwana

izindleko
Ibiza kakhulu
Kushibhile

ukusebenziseka
Idinga ihadiwe ekhethekile
Isebenza nanoma iyiphi iseva esekela i-TLS

Ukusebenza: Ukuze usebenze ne-DECO, ukuxhawula kwezindlela ezintathu kuyadingeka, lapho ukusetha nge-LAN kuthatha imizuzwana engu-0.37, ukuze uxhumane ngemva kokusungulwa kokuxhumeka, i-2PC-HMAC iyasebenza (0,13 s ngokubhala ngakunye). Ukusebenza kwe-DECO kuncike ku-TLS cipher suite etholakalayo, usayizi wedatha yangasese, kanye nobunkimbinkimbi bobufakazi bohlelo lokusebenza oluthile. Ukusebenzisa inketho yokukhetha kanambambili ku-IC3 njengesibonelo: ukuqedela umthetho olandelwayo nge-LAN kuthatha cishe imizuzwana engu-10,50. Ngokuqhathanisa, i-Town Crier ithatha cishe imizuzwana engu-0,6 ukuqedela isicelo esifanayo, esishesha cishe izikhathi ezingu-20 kune-DECO. Zonke izinto ziyalingana, i-TC izoshesha.

Ukuphepha: Ukuhlaselwa kwe-Intel SGX enclave (ukuhlaselwa kwesiteshi esiseceleni) kuyasebenza futhi kungabangela umonakalo wangempela kubahlanganyeli benkontileka ehlakaniphile. Mayelana ne-DECO, ukuhlaselwa okuhlobene nomjovo wethrafikhi kungenzeka, kodwa ukusetshenziswa kommeleli kunciphisa ukuhlaselwa okunjalo kube ize. Ngakho-ke i-DECO iphephe kakhudlwana.

izindleko: Izindleko zemishini esekela i-Intel SGX ziphezulu kunezindleko zokusetha umthetho olandelwayo ku-DECO. Yingakho i-TC ibiza kakhulu.

Ukuziphatha: Ukuze usebenze ne-Town Crier, amathuluzi akhethekile asekela i-TEE ayadingeka. Isibonelo, i-Intel SGX isekelwa kumndeni wephrosesa we-Intel Core wesizukulwane sesithupha nakamuva. I-DECO ikuvumela ukuthi usebenze nganoma iyiphi imishini, nakuba kukhona ukulungiselelwa kwe-DECO usebenzisa i-TEE. Ngokwenqubo yokusetha, ukuxhawula kwe-DECO kwezindlela ezintathu kungase kuthathe isikhathi, kodwa lokhu akulutho uma kuqhathaniswa nomkhawulo wehadiwe we-TC, ngakho-ke i-DECO iyasebenza kakhulu.

isiphetho

Uma ubheka lezi zisho ezimbili ngokwehlukana bese uziqhathanisa ngezindlela ezine, kuyacaca ukuthi i-Town Crier ingaphansi kwe-DECO ngamaphuzu amathathu kwamane. I-DECO inokwethenjelwa kakhulu ngokubuka kokuphepha kolwazi, ishibhile futhi iyasebenza kakhulu, nakuba ukusetha iphrothokholi yezinkampani ezintathu kungathatha isikhathi futhi kunemibi yayo, isibonelo, imisebenzi eyengeziwe enokhiye bokubethela. I-TC ishesha kune-DECO, kodwa ukuba sengozini kokuhlaselwa kwesiteshi esiseceleni kuyenza ibe sengozini yokulahlekelwa ubumfihlo. Kumele kuqashelwe ukuthi i-DECO yethulwa ngoJanuwari 2020, futhi akukadluli isikhathi esanele sokuyibheka njengephephile. I-Town Crier ibilokhu ihlaselwa iminyaka emi-4 futhi idlule ezivivinyweni eziningi, ngakho ukusetshenziswa kwayo kumaphrojekthi amaningi kuyafaneleka.

Source: www.habr.com