TEA Project’s Sources of Truth: Blockchain, Hardware, and Time

5 min readJan 8, 2022

There are three sources of trust that the TEA project relies on: the blockchain, hardware, and time.

Every node stores their essential data to the blockchain. Based on blockchain’s secure nature, the data stored in blockchain is considered trustable. When doing remote attestation, the verifier won’t trust anything the testee claims; everything needs to come from either the historical data in blockchain, a hardware signed message, or timestamps verified by GPS satellites. All other decisions are made based on those three sources of truth.

There are Three Chains in the TEA Project

The most frequently asked question about the TEA project is if it’s really a blockchain project? Well, the simple answer is no it’s not. The longer answer is that the TEA project sits on top of a blockchain as a so-called layer-2 solution. But it’s not a blockchain itself. The biggest advantage is that TEA won’t compete with any existing blockchain projects, they cooperate instead.

Not only does TEA sit on top of a blockchain, but it includes two other chains that don’t exist in any other blockchain projects: a Trust Chain and a Delegation Chain. These 3 chains work together like a sandwich to build the decentralized trust computing network.

Blockchain — the Layer-1 Supporter

As I mentioned above, TEA itself is not a blockchain, but it’s built on top of blockchain technologies. TEA uses the blockchain as a layer-1 to provide:

Economic incentives and penalties that shape its token economy.
Immutable trust information storage such as credit history, key IDs and hashes.
Block height as a universal clock between TEA nodes.

TEA Runs on Top of Blockchain

TEA itself is not a blockchain, but it is built on top of blockchain technologies. TEA uses blockchain as a layer-1 to provide

Economical incentive and penalty that forms the basis of its token economy.
Immutable trust information storage, such as credit history, key IDs and hashes.
Block height as a universal clock between TEA nodes.

Note that TEA nodes can run above other blockchains. Any blockchain can send a computational oracle request in a blockchain event and receive the result along with PoT (Proof of Trust data) in a tx at the later time.

In our milestone 1 demo, we use Substrate as our layer-1 blockchain provider. But this doesn’t mean TEA can only work with Substrate. In fact, any blockchain layer-1 with smart contract support will work with TEA, such as ETH etc. Of course, newer blockchain projects are preferred. That’s why we chose Substrate: it’s written in Rust and WASM (the same tech that the TEA Project is built on), it’s modern, fast, and release-ready.

TEA Works for Blockchain

TEA not only utilizes blockchain, but TEA also works as a layer-2 solution for layer-1. It can offload expensive and computationally complex tasks from layer-1, run the code in a trusted environment and send the result back to the blockchain together with verifiable Proof of Trust (PoT) data. In our milestone 1 demo, we run a Tensorflow image recognization algorithm offloaded from the blockchain. Have you ever dared run Tensorflow algorithm in a smart contract? Before the TEA Project, you’d have to have been crazy rich to try such a thing.

Delegation Chain — Where the Data and Code Flow

The delegation chain is a network protocol. It guarantees that all the secrets are kept inside and are only transferred between verified trusted hardware modules. The protocol also maintains verifiable randomness when distributing the data to its hosts (we call it pin and repin). The entire data distribution flow can be traced by a series of signatures chained together, which is why it’s called a delegation chain.

A client sends secure data or code to a trusted TEA node as a delegator. If the client doesn’t trust any other nodes, they would be best served owning a TEA node so that they will act as a delegator for their own data or code.
A delegator will be looking for qualified executors among all the TEA nodes in the IPFS p2p network. Remote attestation is done between each node before exchanging any sensitive information
Data or code will be transferred via a repin to a new delegator (called a pinner) to host, or to an executor to run.
No matter where the data or code goes, the proof of delegation (PoD) will be attached at each step. It therefore becomes a delegation chain.
Anyone can verify the delegation chain from the latest step all the way up to the first delegator or the client to make sure the chain is valid. Any hacks in the middle would be easily discovered via the blockchain.
TEA’s layer-1 blockchain will be used to do the verification. Any incentives or punishments is then applied to the participating nodes.

Trust Chain — Our Hardware Security Guard

We support 2 trusted hardware solutions, TEE or TPM/HSM. In the case of TEE, the validation is centralized, so no chain is required. In the case of TPM/HSM, a trust chain runs through the entire remote attestation workflow.

Unlike most other layer-2 trusted computing projects, we don’t trust pure software solutions and we don’t use expensive and unrealistic cryptographic solutions either. We use mature and widely used Trusted Computing technologies, such as TPM / HSM, as our hardware root of trust. We know TPM alone is not secure enough as TPM has many known vulnerabilities. That’s why we insert it between the blockchain and the delegation chain. TPM can be broken, but the potential damage is limited and can be contained.