A computer-implemented method for securely executing smart contract operations in a trusted execution environment, TEE, the method comprising: receiving, by a blockchain node participating in a blockchain network, a request specifying an execution of smart contract operations including one or more software instructions associated with a smart contract in a service TEE hosted by the blockchain node, wherein the request comprises a digital envelope and wherein the smart contract operations are encoded in the digital envelope by a client for transmission to the service TEE; recovering, by the service TEE, the smart contract operations from the digital envelope, wherein the request is encrypted by a first public key associated with the service TEE, wherein, by the blockchain node in the service TEE, the request is decrypted with a first private key associated with the service TEE, wherein the first private key is paired with the first public key; in response to decrypting the request, executing, by the blockchain node in the service TEE, the one or more software instructions to produce an execution result; encrypting, by the blockchain node in the service TEE, the execution result with a client encryption key associated with the service TEE to produce an encrypted result, wherein the client encryption key is one of a second public key or a symmetric key derived from a root key based on a key derivation function; and signing, by the blockchain node in the service TEE, the encrypted result using a second private key associated with the service TEE to produce a signed encrypted result, wherein a key management center stores a verification public key that corresponds to the second private key and provides the verification public key to the client for verifying the signed encrypted result, wherein the client retrieves the verification public key from the key management center subject to authentication, and accesses and decrypts the signed encrypted result using the verification public key, and wherein the client then requests that a next operation in the smart contract be executed by the service TEE, and includes the requested next operation and an execution state of the smart contract from the decrypted signed result in the digital envelope sent to the service TEE. receiving, by a blockchain node participating in a blockchain network, a request specifying an execution of smart contract operations including one or more software instructions associated with a smart contract in a service TEE hosted by the blockchain node, wherein the request comprises a digital envelope and wherein the smart contract operations are encoded in the digital envelope by a client for transmission to the service TEE; recovering, by the service TEE, the smart contract operations from the digital envelope, wherein the request is encrypted by a first public key associated with the service TEE, wherein, by the blockchain node in the service TEE, the request is decrypted with a first private key associated with the service TEE, wherein the first private key is paired with the first public key; in response to decrypting the request, executing, by the blockchain node in the service TEE, the one or more software instructions to produce an execution result; encrypting, by the blockchain node in the service TEE, the execution result with a client encryption key associated with the service TEE to produce an encrypted result, wherein the client encryption key is one of a second public key or a symmetric key derived from a root key based on a key derivation function; and signing, by the blockchain node in the service TEE, the encrypted result using a second private key associated with the service TEE to produce a signed encrypted result, wherein a key management center stores a verification public key that corresponds to the second private key and provides the verification public key to the client for verifying the signed encrypted result, wherein the client retrieves the verification public key from the key management center subject to authentication, and accesses and decrypts the signed encrypted result using the verification public key, and wherein the client then requests that a next operation in the smart contract be executed by the service TEE, and includes the requested next operation and an execution state of the smart contract from the decrypted signed result in the digital envelope sent to the service TEE.