DEV Community: Hang Yin

Should We Kick Hardware out of Blockchain?

Hang Yin — Sun, 21 Jun 2020 22:54:49 +0000

You may think blockchain has little to do with hardware. After all, from Bitcoin to Etherum, blockchains are all software-defined. The Hardware-based solution is usually more centralized. However, in the privacy-preserving blockchain world, by carefully combining software and hardware, we could design a solution with the best balance between scalability and confidentiality, while still keeping it trustless.

TEE based blockchain confidentiality

Phala Network implements the confidential smart contract. It differs from traditional contracts because contracts run inside a special hardware enclave in CPU, i.e. Trusted Execution Environment. The program running inside TEE is highly isolated from the rest of the world. A malicious attack can neither read the data in the memory without authorization nor manipulate the program to produce any unintended behavior.

In Phala Network, we call the supportive program running inside TEE "pRuntime". pRuntime is the runtime environment that maintains the basic TEE miner and Gatekeeper protocol inside the TEE. It handles the TEE remote attestation, on-chain registration, key management, and confidential contract execution.

But how to convince a user the smart contract is running inside pRuntime, not an emulator that doesn't provide any data security? Here comes the core concept: Remote Attestation.

Remote Attestation

"An application that hosts an enclave can also ask the enclave to produce a report and then pass this report to a platform service to produce a type of credential that reflects enclave and platform state. This credential is known as a quote. This quote can then be passed to entities off of the platform, and verified..."

Remote Attestation is the key to ensure the security of a TEE system. Quoted from Intel, it proves that a certain code (measured by the hash of the code), optionally with some customized data generated by the code, is running inside an up-to-date genuine Intel SGX enclave.

Secret Provisioning

Remote Attestation is a basic building block for confidential smart contracts. But it's not very useful if we cannot establish an end-to-end secure communication channel between a party to TEE. Intel SGX also provides a Secret Provisioning protocol to solve the problem elegantly.

By adopting the Secret Provisioning protocol, a chain of trust from the user to pRuntime can be established:

The blockchain has the hash of the canonical pRuntime code
pRuntime runs the remote attestation protocol, gets a report with the data: hash of the attested code (pRuntime itself); and the public key of an ephemeral identity key pair
The RA report is submitted to the blockchain and validated on-chain
The blockchain compares the hash from the RA report (implies: the participant is a canonical pRuntime in TEE)
The identity public key is registered on the blockchain (implies: only the current pRuntime has control over this identity key)

As a result, as long as a message is signed by the identity key, it must be produced by the registered pRuntime. Users can further establish a TLS-like connection to a pRuntime with its registered public key.

To communicate with TEE, the user can get the public key of a certain pRuntime from the blockchain (from TEE registration). Then the user can use the public key of his substrate account to run a Diffie-Hellman protocol. It derives a secret key for communication between the user and the pRuntime.

As the chain-of-trust established, it also implies the identity key is sufficient to uniquely represent the identity of the pRuntime. So a single Remote Attestation can protect all the future communication with the pRuntime, if under the assumption of no TEE hardware breach (which will be discussed later).

How about upgrading?

On-chain upgrading is a critical requirement as it greatly reduces the security risks exposed by a hard-fork upgrade. Substrate natively supports on-chain runtime upgrade. It’s done by the on-chain governance pallet. On the TEE side, the runtime is also upgradable.

When upgrading pRuntime, we should submit the hash of the new pRuntime version to the blockchain. Then the community can review the code, discuss, and vote for the upgrade by an on-chain governance process similar to Substrate.
Both Gatekeepers and miners have to upgrade pRuntime once a new version is accepted on-chain. Miners are easier because they can simply stop mining, do the upgrade, and resume mining. This is possible because miners are not required to be always online. Gatekeepers have high availability requirements. So they either run another TEE client with the newer version, and wait for a natural Gatekeepers switch in the next election period, or do an emergency encryption dump of the states, and recover it to the new pRuntime.

Though there are risks to dump the state, it's still useful in case of an emergency. SGX provides a “seal to enclave” feature, which can produce a cipher that can only be decrypted by the same enclave.

To mitigate the risks for hardware security exploits, the keys in the Gatekeepers are distributed by a Shamir secret sharing scheme, which means that even the sealing is broken, the host still cannot get the original keys without massive collusion.

Attack and defense

Our threat model partially assumes the TEE manufacturer can be trusted. This is reasonable. First, they don’t know how their hardware will be used and thus only can plan the attack ahead of time, reducing the risks. Second, if affected by zero-day attacks, the other applications running on this CPU are generally at risk.

Though we have the above assumption, we see actual hardware exploits come in the past. Fortunately, the vulnerable can usually be mitigated in a few ways.

It's common to think software vulnerabilities are patchable while hardware vulnerabilities are not. This is not always the case. CPU can be patched by microcode updates. With the special design of Intel SGX architecture, most of the vulnerabilities can be fixed. Recently there was an attack called SGAxe, it was fixed by a microcode upgrade followed by a group key rotation. After the key rotation and revocation, all the out-of-date devices get rejected by the remote attestation.

But you might ask, what if someone still finds zero-day hardware vulnerable? Suppose the vulnerability requires physical access to exploit it, miners will be possible to steal data from the confidential contract. In this case, can apply randomness to mitigate. The blockchain can randomly assign some miners to the confidential contracts in a period. The miners shuffle in every such period. As long as the malicious party doesn't have control over a great number of miners, the cost to do such an attack will be significantly high because it requires a massive control in a relatively long time.

In the worst case where the enclave is fully cracked, exposing the confidential data available to the attacker and allowing the attacker to arbitrarily manipulate the execution, we still don't want to give up the correctness of confidential contract. Therefore we have the design that confidential contracts can require one or more replications.

The replication number doesn’t affect how the contract is executed because all the inputs are from the blockchain and thus deterministic. However, if more than one replica exists, multiple TEEs will try to commit the states back to the blockchain. In this case, there will be a simple on-chain voting process. We require a simple majority to “finalize” the states.

By having replications, it failed-back to a Polkadot's validator-like security model. The attacker must control a sufficient amount of miners to break the correctness, even if SGX’s security assumption is broken.

Summary

In the past, blockchains are only software. The miss of confidentiality has long become a limitation for mass adoption. With the help of hardware and carefully designed protocol, we showed that it's possible to build a secure, scalable, and confidential-preserving blockchain.

About Phala

A Substrate-based confidential smart contract blockchain on which you can develop confidential-preserving and privacy-first blockchain apps. Member of Substrate Builders Program starting lineup. Recipient of Web3 Foundation Grant.

Website | Twitter | Github

Testnet PoC-1 Launched | Phala Updates v0.1.1 (3.30–4.5)

Hang Yin — Sun, 05 Apr 2020 16:45:38 +0000

Mainnet

Launched testnet PoC-1 which has private transfer and private token with 4 bounty quests. Until GMT 11:30, Apr.5th, there have been 209 privacy tokens and 305 contract innovations on testnet; 56 users have completed Quest I (to transfer and issue their own privacy tokens). For the full list of reward giving, you may refer to the doc on our Github ;
Added a search function on testnet; faucetbot, Substrate update, and UX improvement is under development according to advice from the community;
Fixed an error on polkadot-js: Throws an error when signing with a locked keypair;
Improved user experience on Phala forum;

Web3 Analytics:

Almost completed all pages of frontend development;
Improving the structure of backend to perform a better authorization design of data rental and standardized protocols.

Community:

Community	Statistics	Week-on-week change
Chinese	1037	+6.80%
English	213	+10.94%
Global Followers	8,378	+3.47%

Launched the PoC-1 testnet bounty program on our forum, where over 100 topics have been created for event discussion. For the full list of reward giving, you may refer to the doc on our Github;
Had over 5,000 messages discussing testnet event in our community groups last week with an impressive activity rate of 45.47%. Harvested over 2,600 impressions and clicks on contents related to Phala testnet;
Translated Yuval Noah Harari: the world after coronavirus from English to Chinese.

Activity:

Hang Yin, Chief Scientist of Phala Network, attended zkSummit5 online.
Zhe Wang, COO of Phala Network, shared his experience as a serial entrepreneur on CampusVC.

PoC-1 Testnet Is Ready | Phala Updates v0.0.7

Hang Yin — Thu, 02 Apr 2020 17:39:53 +0000

Mainnet:

Completed development of PoC-1 testnet (POA & Single Node TEE) which will be launched on March.30th! Candy program will start soon after the testnet launches;
Configuration parameters of official mining hardware "Sentinel" are settled.
Online sale and assembling service will be available next week;
3 more motherboards passed our test. Now we have 17 types of motherboards tested in "The Privacy Awakens" program.
Officially published Phala Token Economics Whitepaper on our website.

Product: Web3 Analytics

Completed UI development of user client;
Completed debugging of API;
Completed 90% of frontend development.

Community

Rounded off our Twitter airdrop with Math Wallet as 200 KSM sent to all winners! We now have 3,224 followers on Twitter.
Over 150 participants attended our "Token Economics Whitepaper Quiz Game" in the Chinese community and 73 winners won rewards for their speed and talent at last.
Uploaded 5 episodes of "Learn Phala's Token Economics in 5 Minutes" videos and claimed over 900 clicks. English version will be uploaded to Youtube as well :)

Everyone’s Phala Token Economics Whitepaper

Hang Yin — Thu, 02 Apr 2020 17:32:26 +0000

Phala’s token economics design has been one of the frequently asked questions since 2019. After weeks of discussion, composing and refining, we are proud to announce that we have officially published our Token Economics Whitepaper! Click to check →

Also, we composed a shorter and simpler version here — containing economic model, token distribution, governance, etc. — for everyone to quickly understand how our token works. Enjoy. :)

1. Is mining available on Phala Network?

Sure. All you need is an Intel pc or laptop, and all you have to do is keeping your node online. A detailed mining introduction would be published in June. Follow our Twitter or Medium, or join our Telegram group to receive the latest news!

2. What’s the name of Phala’s token?

PHA. The total supply of PHA is 1 billion. 1% (100 million) of PHA will be distributed by the launch of testnest; for the rest, you may check the full version whitepaper on our website.

3. How does PHA function?

Network Utility: to trade or exchange network resources such as trusted computing resources, data trading settlement, security, and other services. To be specific, PHA mainly functions for TCPU (Trusted Computing Processing Unit), on-chain computing and storage resources, off-chain storage resources and other data value captured by a series of standardized protocols.
Governance: PHA works as a crucial identification of Gatekeepers and member of PhalaDAO. To be one of those important roles in Phala community, you have to stake a certain amount of PHA.

4. What roles does Phala design in the network?

We have 4 roles in Phala Network: Gatekeeper, Nominator, TEE Miner, and PhalaDAO.

Gatekeepers manage the distribution of keys and produce new blocks. Staking of PHA and one or more nominators are essential for one to be a nominator.
Nominators are entitled to nominate one or more Gatekeepers with a certain amount of PHA staked for them.
TEE Miners provide computing power for the whole network as they keep their mining hardware online (pcs or laptops)
PhalaDAO is responsible for the growth of Phala Network and open to all kinds of roles: developers, GateKeepers, investors, miners, and normal members.

5. What consensus mechanism does Phala apply?

Phala applies NPoS where nominators may nominate Gatekeepers they trust and gain returns from validators’ production by staking PHA for them.
Phala expects 40% of PHA to be staked to NPoS while 60% PHA to be paid and traded in the markets. The annualized inflation rate and the annualized return rate of staking are expected to be 5% and 12.5% (in the circumstance that 40% of PHA are staked).

6. How does Phala distribute PHA?

Base on the principle of “fair distribution based on contribution”. We hope the ones who paid efforts and time to our network could be rewarded respectively.
Our distribution system is designed as bellow:

7. What is the releasing model of PHA?

The diagram of PHA Releasing Model
The red diagonal line: the release of total PHA supply
The dark green curve: the release of team PHA
The light green curve: the release of financing PHA
The orange & light blue Curve: Test Network Rewards & Target User Airdrops
The grey curve: the release of Matrix mining rewards

8. How will Phala distribute PHA as mining rewards?

Phala will distribute 700 million PHA through Matrix Mining. The total supply of mining rewards will be fixed without extra issuance and mining reward will dwindle as the time passes.

Diagram of Matrix mining reward

Participants can attend Matrix mining in 5 different ways:

to keep your node online
to contribute your data to Phala Network
to develop on Phala
to trade data at Phala data market
to complete computation missions

9. Are there any requests related to Matrix mining?

Though it’s quite easy to start mining, still we suggest you pay attention to the following elements that will affect your mining rewards:

the performance of the mining hardware
the length of average online duration
the length of total online duration
the number of successful executions
the recorded penalty rate

10. Are there other ways to earn PHA?

Other than mining, we also encourage users to join this fight against data breach by taking their control back on their data. Any app accessed to Phala would have to ask permission before collecting data, and users will gain returns after they authorize the utility of their information.
Also, to realize the vision above, we encourage developers and enterprises to access their products and apps to Phala Network or our product W3A. We prepare rich bounties for the first 10,000 products willing to access.
Or, you can choose to pay for the data others provided at our data exchange market. To pay is to recognize the value of information :).

11. Will there be airdrop events?

Yes! We will have 3 waves of LockDrop airdrops, which, we think, will help us identify our believers who value the future of personal data control.

To stake KSM to Phala nodes to receive KSM interest rewards and PHA airdrops
To attend the first parachain auction (IPO) (for users holding DOT)
To lock FIL (or other decentralized data storage protocols) to receive airdrops

12. Does Phala apply any innovation on governance?

Anonymous voting: using confidential contracts to complete voting to guarantee democratic anonymity;
Liquid Democratic Voting Mechanism and relevant algorithm: to fully increase the voting participation rate;
Introduced DAO instead of Committee: to increase openness and combine staking with community and decision making.

Besides, all amendments to Phala protocol require a referendum to be validated.

13. How does Phala realize secret voting?

As a confidential smart contract platform, Phala Network can make each election verifiable and trusted in system design as trust relationships could be calculated confidentially.

14. What is Liquid Democracy? How to implement it?

Liquid democracy originates from Bryan Ford’s paper “Delegative Democracy” published in 1884 — for a certain issue, one can vote directly, or to delegate the right to a representative.

In liquid democratic DAO, the delegation relationship is progressed as a dendrogram. To calculate and update the number of votes, it is necessary to process preorder traversal for postorder traversal when each vote occurs. The complexity of the time cost would be O(n).
It is hard to achieve in traditional blockchains but achievable on Phala Network. Liquid democracy calculation requires a large pack of data which might not fit in one block; gas fee could be expensive as well. Yet with TEE technology, we can perform liquid democracy with efficiency and confidentiality.

15. What’s the function of Phala DAO?

Phala’s governance will be managed through DAO instead of a representative committee system or the House of Lords system.
The voting right of DAO is defined as “Share”. Share is non-transferable and can be issued indefinitely though, the total proportion is always fixed as 100%. DAO’s decision-making system follows the majority rule and output results as “approve” or “disapprove”.

About Phala

The 1st Substrate-based confidential smart contract platform on which you can develop secret-preserving and privacy-protecting blockchain apps. Member of Parity Builders Program starting lineup. Winner of Web3 Foundation Grant.

Ekiden，An Oasis of Scalability Experiment

Hang Yin — Fri, 06 Mar 2020 10:51:14 +0000

Before Starting

Does trusted computing have to be combined with blockchain?
Is privacy protection an artifitial demand?
Is it political right to cling on "decentralization"?
In what ways can we realize Multiple Party Computing (MPC)?

I've been thinking about these questions since 2017.

In discussions with my friends and peers, I found some questions are frequently mentioned and worth to elaborate, and decided to start writing a sery to study on similar projects, comparing their solutions, to try give answers for my friends and myself.

Today, I am introducing a highlight in blockchain field : Ekiden of Oasis Labs.

I. Oasis Labs

Oasis Labs is a smart contract network able to be confidential from computing to storage and application layer. Dawn Song, Founder and CEO of Oasis Labs, famed as "Godmother of Computer Security" by Chinese tech media, is well-known globally in data security and cryptology fields. She completed her Tsing-Hua B.S. at 1996, Carnegie Mellon M.S. at 1999, and UC Berckley Doctor's degree at 2002. Then she started to teach in computer science in CMU, later transferred to UCB.

Decorated as the top-gun and medal harvester by peers and collogues, Professor Song has achieved legendary academic success. She won the MacArthur Fellowship, and enlisted in Innovators Under 35 by MIT Technology Review. During her research in CMU, she supervised the paper which established the Dynamic Taint Analysis in networking or computer security. This literature not only became the most frequently referenced article, but also enlightened the tide of the computer safety development in real world business.

No wonder her team became a pearl in the palm in Silicon Valley. In April 2018, venture capital grapevines leak the news she was building a team and raising funds. On July 9th of the same year, Oasis Labs officially announced they completed an A round fund raising led by a16z, co-invested by Polychain and other 18 capitals.

The mission of Oasis is to build a "cloud computing platform" based on block-chain technology. It would be able to balance privacy, stability and performance. By their technology integrating hardware and software, they made it come true that compute-intensive applications such as AI could be run on blockchains for the first time. Their vision is an organic bond between Ethereum and AWS from Amazon Cloud, breakingthrough scalability paradox and privacy protection issue long-existed on public chains.

Oasis features for 4 characteristics:

Privacy: fixing transparency problem of public chains via a full-scale all staking privacy protection from the bottom layer to the application layer;
Safety: ensuring both on-chain security and off-chain security via a hybrid architecture combing TEE technology and blockchain;
Scalability: largely improving efficiency via a novo architecture deviding computation and consensus execution;
Flexibility: easily building applictaions with numerous Built-in tools and SDKs;

And Ekiden was their debut.

II. Ekiden

Ekiden is the pronunciation of posthouse relay race in Japanese: 10 people teamed up to finish runnig a half marathon.

Professor Song and other 8 members of Oasis Labs published a 20 paged article in April 2018:
《Ekiden: A Platform for Confidentiality-Preserving, Trustworthy, and Performant Smart Contracts》, in which they discussed about the bottlenecks, their solutions and challenges of current blockchain technology through 9 chapters.

Before Ekiden, crux of blockchain and TEE was analyzed unfolded as below:

Deficiencies of TEE:
- Data lost or postpone in TEE caused by host transmission flaw
- Data leakage caused by external attack
- Trusted time source could be falsified
Proof of publication problem on POW chains
Key management in TEE
Atomic delivery of execution results

As Professor Song concluded, Ethereum is inefficient because it put consensus, storage and computation on the same layer, which is also the reason why Ekiden's structure is devided into 4 layers:

Application Layer
Computation Layer
Storage Layer
Consensus Layer

The decoupling of computation, storage and uniformity is vital to realize high performance and security.

With such a divided structure, Ekiden solves throughput capacity and security problems by combing blockchain with off-line EVM expansion solution. Utilizing hardware-based Trusted Execution Environment (TEE) technology (say, SGX from Intel), Ekiden increases throughput capacity in a safe offchain environment. By increasing data security and throughput capacity to an utmost condition, Ekiden is aimed to build a valuble protocol for fields such as DeFi and health care, on which the features we mentioned are essential for Dapps.

The application layer, namely, the smart contract layer, is designed for shceduling. Builders could schedule contract logics on chain, or use Oasis Labs tamplate contracts, storaging confidential codes in storage layer. In addition, Oasis Labs employed privacy data analysis and deep learning in programming framwork to protect sensitive input in contracts from leak.

The computation layers executes smart contracts on nodes equipped with trusted hardwares. Developers could set a number of nodes to run his or her contracts, instead of using all of the nodes, to improve computation speed.

The storage layer is designed for storage, as the name suggests. While designing, Professor Song uses IPFS as an reference, applying encrypted storage, data cutting and high redundancy to assure data security. This layer focus on the verifying of the fidelity of the data. Dawn had publish other papers for related algorithm.

In Ekiden, it is ensured contents running in contracts are confidential and automatically encrypted with keys only known by related nodes.

Ekiden network is composed by three parts: clients, computing nodes, and consensus nodes.

Clients means users who can create new smart contract or execute existing ones.

Computing node use multiple TEEs to execute smart contracts. Within TEE, the computing node executes protocol requests from clients and generate verifiable proof of validity. Computing nodes also manage keys via key manager which will generate or search keys according to requests.

Consensus nodes maintains status update and validity of decentralized ledgers.

Superiority

Ekiden is backward compatible with the Ethereum network and will support contracts coding on Ethereum with EVM: ERC20 smart contract automatically inherits the protocol guarantee, including the status of the confidential contract and the high performance of offline operations on the compute nodes.

Any Ethereum-based Dapps could apply Ekiden as a capacity expansion solution. It is more convenient for devs to develop on Ekiden for its compatibility with Rust and EVm. That's why Ekiden owns obvious advantages in the amount fo developers and users than other high-throughput blockchains.

In the preliminary tests of Ekiden network, the team reported a 600-fold increase in throughput, 400-fold reduction in latency, and 1000-fold reduction in cost compared to the Ethereum network. Though performance could be diluted when it's serving the whole system, Ekiden will be able to adjust itself to the best by integating the incredible performance mantioned. Initial testing has also proved that Ekiden supports computationally intensive cases, such as costly machine learning applications on Ethereum network.

Its value created by scalability, security, and low-cost transactions could be applied to thousands of uses, which is not yet achievable on Ethereum at this stage. Also, Ekiden's team combines its theory and expertise. When still working at Uber, they found a startup (later acquired by Yahoo and FireEye), designed a few other products which were all successfully adopted in practicle uses.

A Flaw

World-known "Godmother of Computer Security" and her team who have worked in the privacy and security field for decades chose TEE as their solution, for it effectively relieves computation presssure on consensus layer from transaction computing which could be run on computing nodes and storage nodes. It results in increase of scalability as consesus layer focusing on results. "Scalability" is a hot issue facing by all public chains; As for Oasis Labs, though featured by confidentiality using TEE, it seems scalability is the main dish, privacy protection is yet a dessert.

Still, A flaw exists: application value is reduced due to weakened "composability". While emphasizing independent execution of contracts, Ekiden sacrifices mutual calls between contracts, for their confidential contracts can only be performed by local computation.

Take Ethereum as an example ~~(again)~~. In the traditional smart contract chains, each node will sequentially execute all transactions in the block. The consensus protocol ensures that each node could easily cooperate with each other for they share a complete and consistent database.

But in Ekiden, contracts are not allowed to call or access to each other, though it's efficient, secure, and robust.

To step further, Phala uses blockchain as the consensus layer for confidential contracts calls, making composability possible and realizing security shared by all nodes.

It is very similar to relay chain and parallel chain desigend by Polkadot. Data synchronization, state sequence, and communication protocols could be new challenges, on which we've been discussing with Parity team. A mature plan is about to be borned and we will share it in the near future:)

To Concluede

Oasis Labs claims to be the next in blockchain. Indeed, compared with Ethereum, its advatage is obvious -- say, supporting ERC-20 protocol -- but developers could use languages compatible with Rust and EVM to write on Ethereum.

Challenges does not exist only in development and theories. It's said their efforts on community building and product promotion are not enough to be known by the public to whom Oasis is only a name within investing news and academic papers. Fortunately, those problems could be fixed soon once they realized.

Another issue we need to concern is, perfect protocols can be built on paper, but it would be another story when it comes to business and commercialization, which should be awared and prepared by both developers and clients.

Starting with Barbican, Sandbox and Trusted Computing

Hang Yin — Fri, 06 Mar 2020 10:42:55 +0000

Barbican

In 1268 A.D., Kublai Khan, emperor of Chinese Yuan Dynasty, sent two of his generals -- Liu Zheng and A Shu -- led their armies to attack Xiangyang, which marked the launch of the war against Song Dynasty. Their armies were famed as "God's Whip", yet they failed, and struggled attacking Xiangyang for 6 years. In 1269, he sent his prime minister Shi Tianze to support, and started to build walls to blockage Xiangyang and the Han river channel. They then successfully repelled Song’s reinforcements for several times. Mongolia decided to seize Xiangyang at all costs, increasing armies to over 100,000 people in just one year .

However, the defensive projects established by the Xiangyang’s castellan, Lv Wende, should not be underestimated. Building by the Han River, protected by steeps, rich with foods and reserves, Xiangyang stayed impregnable until 1274 for Mongolia’s continuous blockage. In 1279, the Southern Song Dynasty came into its end as the final emperor jumped into the sea with Lu Xiufu, his last loyal minister.

Other than Mongo’s death, united people, solid spirit and Song’s support, the key reason why a small city Xiangyang could defend for 6 years is interesting: Xiangyang was built with the Han River as its natural moat and with a brilliant structure outside its each gate: a barbican.

Some of you may feel confused about the design. Our ancients may lack technology and scientific knowledge, but they are as smart (or even smarter) as we are . They did so based on their hundreds years of battling experience combined with a comprehensive defensive system consisting of architectures and strategies.

Once you broke into the fist gate you would find yourself caged, having nowhere to go but becoming a human target aimed by archers standing on the outside wall.

The brilliance of Chinese Barbican could be concluded as:

To set dual protection mechanism on weak and key sections;
To restrict actions of untrusted objects;
To build a structure facilitating recognizing and eliminating untrusted objects.

Such design was then applied to computer defense system, called the “Sandbox Model”.

Sandbox

In the field of computer security, Sandbox is a security mechanism that provides an isolated environment for suspecisious programs. It first let the suspicious program to fully perform while recording its every move. If the program behaved as a virus, the Sandbox would “rollback”: erase the traces and actions of the virus and restore the system to a normal state.

Similar to Chinese Barbican, its design theoretically guarantees the following:

Dual protection: system-level and container-level sandboxes can be enable through virtualized environments;
Restriction: Sandbox provides disk and memory space that is recycled after use. Network access, access to real systems, and reading of input devices would be prohibited or strictly restricted.
Restoration: once a virus is found in a Sandbox, files, registries, etc. would be restored at other places to protect them from unauthorized access or anonymous operation.

The problem is, it relies on detection capabilities. If viruses cover themselves or evade security scanning in some way, they can infect users' devices and eventually invade company networks and business-critical systems.

As the attack methods of malicious users change in more various ways, defenders have to write codes to build higher firewalls, run more complicated tests, which leads to more malicious data records, triguring more false alarms. As the cost of maintenance goes up and the system efficiency goes down, leaving rare efforts and time against new attacks, in security designs using detection-response mechanism, malicious programs could keep testing until they could fool the guards.

Thus, a new security model -- TEE, Trusted Execution Environment -- came out. Contrary to the "Sandbox" model, trusted computing assumes that "trust" is the scarce resource. As a comprehensive technological innovation of logic verification, computing architecture, and computing modes, etc., TEE realizes “Defense Offense” by fixing logical defects, ensuring the logical combination of computing tasks to stay safe from tampering or attacking.

Trusted Computing

Development of Trusted Computing
In 1983, the United States Department of Defense formulated the world's first Trusted Computer System Evaluation Criteria (TCSEC), and for the first time proposed the concepts of Trusted Computing and Trusted Computing Base (TCB), and put the TCB serves as the basis for system security.

In 1990, the International Organization for Standardization and the International Electrotechnical Commission ISO / IEC defined credibility based on behavioral expectations in the directory service series standards they published: If the second object acts exactly as the first object expected, the second one will be considered as “credible”.

In 1999, well-known IT companies such as IBM, HP, Intel, and Microsoft initiated the establishment of the Trusted Computing Platform Alliance (TCPA, Trusted Computing Platform Alliance), which marks the entry of trusted computing into the industry.

In 2003, In Advanced Trusted Environment v11.pdf, TEE was defined as “a set of software and hardware components that provide the necessary facilities for the application”, and one of two defined security levels needs to be met. The first is to defend software attacks, and the second is to defend both software and hardware attacks.

Now let’s learn about some important concepts in TEE computer theory.

Roots of Trust and Chain of Trust
Trusted computing technology first set a root of trust in a computer system, gradually testing to trust layer by layer: from the root to the hardware platform, operation system, and applications.

Roots of Trust

Roots of Trust (RoT) is a set of functions that is always trusted by the computer’s operating system (OS). The RoT serves as separate compute engine controlling the trusted computing platform cryptographic processor on the PC or mobile device it is embedded in.According to the classification of the security chip and the Trusted Software Stack running on it, there are currently three main trusted computing standards: Trusted Platform Module (TPM), Trusted Cryptography Module (TCM), and Trusted Platform Control Module (TPCM).

Chain of Trust

In computer security, a chain of trust is established by validating each component of hardware and software from the end entity up to the root certificate. It is intended to ensure that only trusted software and hardware can be used while still retaining flexibility.

The “trusted” components could be tested through detection or verification.

Detection: to collect data and status from a component;
Verification: Compare the results of detection with the reference value to see if they are consistent.

If a component passed both of them, it would be marked as trusted.

There are 3 rules when establishing a chain of trust:

All modules or components, except CRTM (the starting point of the chain of trust building, the first piece of code for trusted metrics), are considered untrusted until they passed the verification and classed into trusted boundary. 
Modules or components inside the trusted boundary can be used as verification agents to perform integrity verification on modules or components that have not yet completed verification.
Only modules or components within the trusted boundary have access to relevant TPM control rights.

TPM (Trusted Platform Module)
Generally, the trusted computing platform uses the TPM chip machine key and its relevant software as the root of trust.

Trusted Platform Module (TPM, also known as ISO/IEC 11889) is an international standard for a secure cryptoprocessor, a dedicated microcontroller designed to secure hardware through integrated cryptographic keys.

The use of TPM, to some extent, reduces the risk of important data being stolen by malware such as Trojans, but it cannot prevent runtime attacks. If a hacker cracks while a legitimate application is running, he can read decrypted data directly in memory.

To solve a problem like this, we should also find a way to prevent hackers from reading the memory space used by legitimate applications, which is the reason why Trusted Execution Environment (Trusted Execution Environment) is proposed.

TEE (Trusted Execution Environment) & REE (Rich Execution Environment)
In 2010, Global Platform announced for the first time a set of TEE system system standards. Global Platform's series of TEE specifications, which is also the current many commercial or open source products generally refer to this specification and implement it in accordance with its various functional interfaces. Global Platform defines part of the TEE from the interface and protocol implementation level, as well as the definition of typical application specifications. TEE owns characteristics as follow:

Cooperative software-hardware security mechanism: as its essential attribute, Isolation can be implemented through software or hardware.

Shared Computing: through which one computer can share computing and hardware for better performance.

Openness: TEE is necessary when REE exists.

Now you might understand why TEE technology is different from the sandbox model: the former is guided by the presumption of guilt, and the former is guided by the presumption of innocence.

In the model of presumption of guilt, TEE works when REE exists. Generally, TEE and REE could be recognized as Secure World and Normal World. For example, a system usually runs in Normal World, but when it needs to run requests with confidential needs such as face ID verification or private key signature for payments, it has to run in the Secure World.

Trust Zone

In 2006, ARM introduced TrustZone technology which divides the working status of the CPU into Normal World Status (NWS) and Secure World Status (SWS) in ARMv6 architecture.

TrustZone-enabled chips provide hardware-level protection and security isolation of peripheral hardware resources. When CPU is in a normal state, no application can access the secure hardware device, nor can it access the memory, cache, and other peripheral secure hardware devices that are in Secure World state.

In specific application environments, users’ sensitive data can be stored in TEE, and the trusted application (TA, Trusted Application) uses important algorithms and processing logic to complete the data processing. When users’ sensitive data is required for identity verification, the verification result is obtained from the TEE side by defining a specific request number on the REE side.

Intel SGX

In 2013, Intel introduced a TEE-based instruction set extension: SGX (full name Intel Software Guard Extension), which aims to provide mandatory guarantee through hardware security, does not depend on the security status of firmware and software, and provides a trusted execution environment for user space .

SGX realizes isolated operation between different programs through a new set of instruction set extensions and access control mechanisms to protect the confidentiality and completeness of critical user code and data from malicious software.

Different from the idea of ARM TrustZone, SGX would not identify and isolate all malware on the platform; instead, it encapsulates the security operations of legitimate software in an Enclave, protecting it from malware attacks. Neither of the privileged softwares or non-privileged ones could access Enclave.

Once software and data are in Enclave, even the operating system cannot influence the code and data in Enclave. Enclave's security boundary includes only CPU and itself. This design avoids software-based TEE's defects in software security vulnerabilities and threats, which greatly improves system security.

Currently, when it comes to utility in commercial level, Intel SGX is rather mature for it allows
third parties to use the "remote authentication" mechanism to build their own trust certificates.

Shortcomings of SGX

Still, Intel SGX has its shortcomings as following:
Especially rely on Intel platform, namely, “centralized”, which is also the reason why TEE has been criticized among all MPS modes.
Little enclave memory for high performance and multiple programs.
Unable to defend side-channel attacks.
Has to interact with untrusted areas for its enclave itself is in user mode and cannot execute system calls by itself.

Yet Indeed, computer components are designed for different objects, just like we can’t send people to live in the Chinese Barbican. This is also the reason why we found TEE and blockchain could complement each other in proper application scenes.

What Can Blockchian-TEE Structure Do

Through the decentralized network and consensus mechanism, blockchain could highly reduce the security risks and malicious possibilities of manufacturers such as Intel, and ensure the availability of trusted chains (this chain is not a blockchain). Phala Network will be compatible with multiple TEE protocols in the future. Even if Intel were under a massive attack, the blockchain system would recover data by punishing malicious nodes by switching TPM nodes.
The problem of Enclave interacting with untrusted areas could be solved for blockchain is a perfect technology of building trusted network. Therefore, letting TEE interact with blockchain smart contracts through the blockchain is a brilliant complementary combination. This is also the reason why Phala network values cross-chain capabilities.

TEE’s function added to promote blockchain application: technological support on privacy protection

When it comes to privacy protection, data leak events of Facebook might come into your mind. Confidentiality actually covers a wider field including business confidentiality.

There are generally 3 generations of technologies on privacy protection:

The 1st generation: Zcash and Monero. They realized privacy protection of transactions mainly through zero-knowledge proof, ring signature, and confidential transfer, which ensures they can encrypt transactions of original tokens.
The 2nd generation: Aztex, a privacy protocol on Ethereum that uses technology similar to Zcash to achieve transaction privacy for ERC20 tokens. as an extension of the first generation, they can protect transaction privacy as well, yet faint in case if Turing-complete smart contracts are involved.
The 3rd generation: networks like us. We hope to expand the objects from “privacy” to “confidentiality”. Not only users’ privacy, but also confidential datas in any smart contract. We want “Confidential Smart Contract” to calculate like any other Turing-complete smart contracts without data exposure.

Currently confidential smart contract can be implemented through Multi-Party Computing (MPC) and Trusted Execution Environment (TEE).

The former is based on pure cryptographic technologies such as homomorphic encryption and zero-knowledge proof without relying on any hardware. It can be applied in specific fields with high efficiency, such as verifiable random numbers and distributed key generation, but in general computing, they cause an average performance loss of one million times.

The latter has to rely on trusted computing hardware (mainly Intel’s CPU) but can achieve very efficient general-purpose computing. Thus we chose the latter and are committed to realize an universal confidential Turing-complete smart contract.

To conclude, if you read this article to this line, we are trying to make this world a little bit better by fixing privacy and confidential issues in a blockchain way. Our Testnet is on the way so we wrote this article to explain our vision and technological ideas. Hope it’s interesting :)