Overall, this hybrid replication design, which mixes pas-
sive and active replication in the Byzantine model, and the
execute-order-validate paradigm, represent the main inno-
vation in Fabric architecture. They resolve the issues men-
tioned before and make Fabric a scalable system for permis-
sioned blockchains supporting flexible trust assumptions.
To implement this architecture, Fabric contains modular
building blocks for each of the following components:
Ordering service: An ordering service atomically broad-
casts state updates to peers and establishes consensus on
the order of transactions. It has been implemented with
Apache Kafka/ZooKeeper (http://kafka.apache.
org/) and with BFT-SMaRt [3].
Identity and membership: A membership service provider
is responsible for associating peers with cryptographic
identities. It maintains the permissioned nature of Fabric.
Scalable dissemination: An optional peer-to-peer gossip
service disseminates the blocks output by ordering ser-
vice to all peers.
Smart-contract execution: Smart contracts in Fabric run
within a container environment for isolation. They can
be written in standard programming languages but do not
have direct access to the ledger state.
Ledger maintenance: Each peer locally maintains the ledger
in the form of the append-only blockchain and as a snap-
shot of the most recent state in a key-value store (KVS).
The KVS can be implemented by standard libraries, such
as LevelDB or Apache CouchDB.
The remainder of this paper describes the architecture
of Fabric and our experience with it. Section 2 summa-
rizes the state of the art and explains the rationale behind
various design decisions. Section 3 introduces the architec-
ture and the execute-order-validate approach of Fabric in de-
tail, illustrating the transaction execution flow. In Section 4,
the key components of Fabric are defined, in particular, the
ordering service, membership service, peer-to-peer gossip,
ledger database, and smart-contract API. Results and in-
sights gained in a performance evaluation of Fabric with a
Bitcoin-inspired cryptocurrency, deployed in a cluster en-
vironment on commodity public cloud VMs, are given in
Section 5. They show that Fabric achieves, in popular de-
ployment configurations, throughput of more than 3500 tps,
achieving finality [36] with latency of a few hundred ms. Fi-
nally, Section 6 discusses related work.
2. Background
2.1 Order-Execute Architecture for Blockchains
All previous blockchain systems, permissioned or not, fol-
low the order-execute architecture. This means that the
blockchain network orders transactions first, using a con-
Update stateOrder Execute
●
Deterministic (!)
execution
●
Persist state on
all peers
●
Consensus or
atomic broadcast
Figure 1. Order-execute architecture in replicated services.
sensus protocol, and then executes them in the same order
on all peers sequentially.
1
For instance, a PoW-based permissionless blockchain
such as Ethereum combines consensus and execution of
transactions as follows: (1) every peer (i.e., a node that par-
ticipates in consensus) assembles a block containing valid
transactions (to establish validity, this peer already pre-
executes those transactions); (2) the peer tries to solve a PoW
puzzle [28]; (3) if the peer is lucky and solves the puzzle, it
disseminates the block to the network via a gossip protocol;
and (4) every peer receiving the block validates the solution
to the puzzle and all transactions in the block. Effectively,
every peer thereby repeats the execution of the lucky peer
from its first step. Moreover, all peers execute the transac-
tions sequentially (within one block and across blocks). The
order-execute architecture is illustrated by Fig. 1.
Existing permissioned blockchains such as Tendermint,
Chain, or Quorum typically use BFT consensus [9], pro-
vided by PBFT [11] or other protocols for atomic broad-
cast. Nevertheless, they all follow the same order-execute
approach and implement classical active SMR [13, 31].
2.2 Limitations of Order-Execute
The order-execute architecture is conceptually simple and
therefore also widely used. However, it has several draw-
backs when used in a general-purpose permissioned block-
chain. We discuss the three most significant ones next.
Sequential execution. Executing the transactions sequen-
tially on all peers limits the effective throughput that can be
achieved by the blockchain. In particular, since the through-
put is inversely proportional to the execution latency, this
may become a performance bottleneck for all but the sim-
plest smart contracts. Moreover, recall that in contrast to tra-
ditional SMR, the blockchain forms a universal computing
engine and its payload applications might be deployed by an
adversary. A denial-of-service (DoS) attack, which severely
reduces the performance of such a blockchain, could simply
introduce smart contracts that take a very long time to exe-
cute. For example, a smart contract that executes an infinite
loop has a fatal effect, but cannot be detected automatically
because the halting problem is unsolvable.
To cope with this issue, public programmable block-
chains with a cryptocurrency account for the execution cost.
Ethereum, for example, introduces the concept of gas con-
1
In many blockchains with a hard-coded primary application, such as
Bitcoin, this transaction execution is called “transaction validation.” Here
we call this step transaction execution to harmonize the terminology.
3 2018/2/1