CN111461718A

CN111461718A - Access method, device and system of block chain node

Info

Publication number: CN111461718A
Application number: CN202010261378.2A
Authority: CN
Inventors: 才鑫; 杨涛; 邢磊
Original assignee: China Construction Bank Corp; CCB Finetech Co Ltd
Current assignee: China Construction Bank Corp
Priority date: 2020-04-03
Filing date: 2020-04-03
Publication date: 2020-07-28

Abstract

The invention discloses an access method, a device and a system of a block chain node, wherein the method comprises the following steps: receiving job information from a business system, the job information comprising: job content and job type; responding to the operation type indication to execute data encryption operation, encrypting the operation information according to a pre-generated local private key and then sending the encrypted operation information to a preset block link point according to pre-configured block link point information so as to execute corresponding operation; and then receiving response information returned by the block link point and sending the response information to the service system. By the embodiment of the invention, the safety of transaction can be improved.

Description

Access method, device and system of block chain node

Technical Field

The invention relates to the field of block chains, in particular to an access method, device and system of a block chain node.

Background

At present, one way for a service system to access a block chain network is to use an integrated SDK (Software Development Kit) provided by a bottom technology platform to specify a block chain network address and a related signature private key through codes when completing an uplink transaction, construct an uplink transaction, perform a transaction signature, and invoke a transaction interface. The other access mode is a alliance operator, the alliance operator provides a general access platform or an access gateway, a private key of a user is managed, and a service system directly calls a corresponding upper layer service interface to complete interaction with the block chain network.

The first approach described above uses SDK integration, with major disadvantages: the learning and development cost is high, the SDK toolkit generally only supports main stream development languages such as Java, Go and Nodejs, and if the service system uses other development languages, the integration difficulty is high.

The second approach uses federated operators (e.g., Fabric, Hyperchain) networks) with the disadvantages of: the private key is not local to the participant, so that the situation that the platform maliciously forges the transaction of the participant may exist, and the participant has weak control on the digital assets on the chain.

Disclosure of Invention

In view of the above, the present invention provides a method, an apparatus, and a system for accessing a blockchain node to solve at least one of the above-mentioned problems.

According to a first aspect of the present invention, there is provided an access method for a blockchain node, the method including: receiving job information from a business system, the job information comprising: job content and job type; responding to the operation type indication to execute data encryption operation, according to preconfigured block chain link point information, encrypting the operation information according to a pre-generated local private key and then sending the encrypted operation information to a preset block chain link point so as to execute corresponding operation; and receiving response information returned by the block chain link point, and sending the response information to the service system.

According to a second aspect of the present invention, there is provided a block link point access device, the device being located on a service system side, the device comprising: a job receiving unit configured to receive job information from a business system, the job information including: job content and job type; the sending unit is used for responding to the operation type indication to execute data encryption operation, encrypting the operation information according to a local private key generated in advance and then sending the encrypted operation information to a preset block link point according to the preset block link point information so as to execute corresponding operation; the response receiving unit is used for receiving response information returned from the block chain link points; and the response sending unit is used for sending the response information to the service system.

According to a third aspect of the present invention, there is provided a block link point access system, the system comprising: the access device comprises a service system, a block chain node and the access device for the block chain node, wherein the access device for the block chain node is positioned at the service system side, and the service system performs operation with the block chain node through the access device for the block chain node.

According to a fourth aspect of the present invention, there is provided an electronic device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, the processor implementing the steps of the above method when executing the program.

According to a fifth aspect of the invention, the invention provides a computer-readable storage medium having stored thereon a computer program which, when executed by a processor, carries out the steps of the above-mentioned method.

According to the technical scheme, when the operation type in the operation information indicates that data needs to be encrypted, the received operation information can be encrypted according to a local private key and then sent to the block chain node to execute corresponding operation, then, response information returned by the block chain node is received and sent to the service system, and the private key is locally generated and stored, so that the problem of low transaction security caused by the fact that the private key is not locally located in a participant in the prior art can be solved, and the transaction security can be improved.

Drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below, and it is obvious that the drawings in the following description are some embodiments of the present invention, and for those skilled in the art, other drawings can be obtained according to these drawings without creative efforts.

Fig. 1 is a block diagram of a block-link point access system according to an embodiment of the present invention;

fig. 2 is a block diagram of a block link point access device 2 according to an embodiment of the present invention;

fig. 3 is a detailed structural block diagram of the block link point access device 2 according to the embodiment of the present invention;

fig. 4 is a block diagram of an example architecture of a block link point access device according to an embodiment of the present invention;

fig. 5 is a flow chart of a block link point access method according to an embodiment of the present invention;

FIG. 6 is a schematic diagram of an electronic device according to an embodiment of the invention.

Detailed Description

In order to make the objects, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are some, but not all, embodiments of the present invention. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.

Based on the problems that the existing block link access mode is difficult to develop and low in transaction safety, the embodiment of the invention provides an access scheme of a block link point to solve the problems. Embodiments of the present invention are described in detail below with reference to the accompanying drawings.

Fig. 1 is a block diagram of a block-link point access system according to an embodiment of the present invention, as shown in fig. 1, the system including: the system comprises a service system 1, a block chain node access device 2 and a block chain node 3, wherein the block chain node access device 2 is located at the service system 1 side, and the service system 1 performs operation through the block chain node access device 2 and the block chain node 3.

At present, in a mainstream block chain technology platform, an SDK development kit is provided to access a block chain network, so that the configuration and use of the SDK are complex, and the learning cost of a small access participant is high. The SDK development kit is related to a programming language (usually, Java, Go, Nodejs, etc. are supported), and if the service system is developed by using a programming language, Net, PHP (hypertext preprocessor), etc., the SDK development kit cannot be directly used. The current block chain technology is still in a development stage, a bottom-layer platform is still evolving continuously, and the block chain node access device 2 provided by the embodiment of the invention can support the expansion of different types of block chain networks (such as Fabric, Hyperchain and the like), so that the uncertainty of the bottom-layer technology can be shielded, and the frequent reconstruction of a service system is avoided.

In the embodiment of the invention, the service system does not adopt an SDK development kit to access the block chain network, but accesses the block chain network through interaction of an RESTFul (design style and development mode of a network application program) interface and a block chain node access device, so that the difference of programming languages can be shielded, and the difficulty of block chain application integration is reduced. The block chain node access device 2 is described in detail below.

Fig. 2 is a block diagram of the block-link point access device 2, and as shown in fig. 2, the block-link point access device 2 includes: a job receiving unit 21, a transmitting unit 22, a response receiving unit 23, and a response transmitting unit 24, wherein:

a job receiving unit 21 configured to receive job information from a business system, the job information including: job content and job type. The job type includes whether encryption information is required.

And the sending unit 22 is configured to execute a data encryption operation in response to the operation type indication, and send the operation information to a predetermined block link point after being encrypted according to a pre-generated local private key according to pre-configured block link point information, so as to execute a corresponding operation. The private key is stored locally.

A response receiving unit 23, configured to receive response information returned from the block link point.

A response sending unit 24, configured to send the response information to the service system.

When the operation type in the operation information indicates that data needs to be encrypted, the sending unit 22 encrypts the operation information received by the operation receiving unit 21 according to a local private key and sends the encrypted operation information to the blockchain node to execute a corresponding operation, and then the response receiving unit 23 receives response information returned by the blockchain node and sends the response information to the service system through the response sending unit 24.

In practical operation, as shown in fig. 3, the block link point access device 2 further includes: the allocation unit 25 is configured to allocate the above block link point information.

Specifically, the configuration unit 25 is specifically configured to: configuring the blockchain node information according to a network type (e.g., Fabric, Hyperchain, etc.) to which the blockchain node belongs, where the blockchain node information includes: node address information, and a security policy for data transmission with the node.

With continued reference to fig. 3, the block chain node access apparatus 2 further includes: a public key generation unit 26 and a block chain address setting unit 27, wherein:

a public key generating unit 26 for converting the private key into a public key according to a predetermined rule; the predetermined rule may be a private key transformation public key rule in the prior art, and the present invention is not limited thereto.

A block chain address setting unit 27, configured to set the public key as a block chain address, so as to serve as the identity information of the service system.

In one embodiment, the block link point access device 2 further includes: and an expansion interface unit 28 for connecting different types of blockchain networks.

In actual operation, an operator may directly deploy a block chain node access device (or may be referred to as a lightweight block chain node) on a side of a service system, the block chain node access device (or may be referred to as an access device for short) supports direct completion of configuration related to a private key and a node through an interface, and the service system interacts with the access device through a RESTFul interface, so that difference of a programming language may be shielded, and difficulty in application integration of a block chain is reduced. In view of the security and privacy of the data, the access device does not participate in the consensus of blockchain transactions, nor does it synchronize the data of the master node. The access device and the service system are deployed in the same intranet, and the interaction between the access device and the service system uses an HTTP (HyperText transfer protocol) protocol by default, and additional authentication control is not added, so that the transmission and operation efficiency can be improved.

Fig. 4 is a block diagram of an exemplary block-link point access device, which, as shown in fig. 4, mainly includes three modules: private key module 41, light node configuration module 42, and interface module 43. Each module is described below.

(1) Private key module 41

The private key module 41 uses a tool such as Openssl (Open Secure Sockets L eye), and supports generation of a private key and a certificate, and supports uploading of an external certificate file.

A locally generated private key may be used to sign the blockchain transaction. In practice, the private key may be converted into a public key, and the public key may be converted into a block chain Address (Address), which may serve as a unique identity (i.e., a party identity) of a service system in the block chain network.

Using the Openssl tool, the public and private keys are generated by:

generating a private key: opennssl eparam-generic-name prime256v1-out priv

And (3) generating a public key: openssl-in priv. key-name secp256k 1-generic-out pub. key.

(2) Light node configuration module 42

The light node configuration module 42 may implement configuring the blockchain network information online. For the Fabric network, the light node configuration module 42 configures information such as Peer node address and Order (sequencing service node) node address; for the Hyperchain network, the light node configuration module 42 configures VP/NVP (consensus/non-consensus) node address information.

In one example, the local test environment builds a Fabric blockchain network, and the service address of the Peer node is as follows: grpc://127.0.0.1:7051, service address of Order node: grpc://127.0.0.1: 7050. The light node configuration module 42 configures the service addresses of the Peer node and the Order node so as to facilitate data transmission at a later stage.

In another example, the local test environment builds a Hyperchain blockchain network, and the node address of the Hyperchain network is as follows: 127.0.0.1:8081, the light node configuration module 42 selects a node for later data transfer, e.g., a VP node or an NVP node.

Finally, the node information configured by the light node configuration module 42 is converted into a configuration file for communication between the late access device and the block link point.

In actual operation, the access device also needs to set a Security policy for interacting with the blockchain network (e.g., whether to turn on T L S (Transport L eye Security), etc.).

In one embodiment, for the Hyperchain blockchain network, the security policies between the access device and the Hyperchain nodes mainly include two steps of (1) starting T L S transmission, configuring a T L S certificate adapted to the nodes in the local access device, and performing encrypted transmission on transactions by using T L S after starting, and (2) starting TCert (transaction certificate) verification, wherein SDKCert (SDK certificate) needs to be configured in the local access device, each transaction is signed by using SDKCert, and the Hyperchain nodes also verify the signature, so that the security of transaction sources is ensured.

In a specific implementation process, the light node configuration module 42 may also configure other blockchain network personalization information. For example, for a Hyperchain network, a websocket port may be configured to receive information pushed by a block link point; transaction polling time can also be configured, and for a block chain transaction, the execution result of the transaction is inquired through polling after the block chain transaction is sent to the block chain network. For a Fabric network, the name of the Channel, etc. may be configured.

(3) Interface module 43

The interface module 43 is used for encapsulating the interface with high use frequency and strong universality in the SDK provided by the bottom layer module chain technology platform, and the service system can be called directly through the RESTFul service. The interface of the interface module 43 package includes: the uplink data interface (stores data into the blockchain network), and the block and on-chain transaction information query interface (for example, queries for uplink data by transaction hash values). In addition, the intelligent contract calling interface is a main interface for interaction between the service system and the block chain network in most scenes, and uplink and query of data can be completed by calling the interface.

In actual practice, for a Hyperchain network, a simple transfer transaction interface in the interface module 43 may be called directly, and the uplink data is appended through the extra (extension) field of the transaction. For Fabric networks, the data for the uplink is stored in the parameters that call chaincode by predefining the chaincode. The transaction id (e.g., transaction hash value) is used directly in the data downlink to query the uplink data on the chain. The interface module 43 also supports querying the blockchain for transaction conditions via blockchain hashing.

The following describes the data transmission involved in the uplink data interface, the downlink data interface and the block transaction query interface, respectively.

(1) Data uplink interface

Through the interface, data chaining can be realized, and a message body (JSON) of request data is shown in the following table 1:

TABLE 1

After sending a data uplink request to a block-linked point, the message body (JSON) of the response data returned by the block-linked point is shown in table 2 below:

TABLE 2

(2) Data downlink interface

Through the interface, data downlink can be realized, and the message body (JSON) of the request data is shown in the following table 3:

TABLE 3

After sending a data downlink request to a block link point, the message body (JSON) of response data returned by the block link point is shown in table 4 below:

TABLE 4

(3) Block transaction query interface

Through the interface, block transaction inquiry can be realized, and the message body (JSON) of the request data is shown as the following table 5:

name (R)	Type (B)	Must fill in	Limiting	Description of the invention
					blockHash	String	Is that	66	Block chain hash value

TABLE 5

After sending a data query request to a block link point, the message body (JSON) of the response data returned by the block link point is shown in table 6 below:

TABLE 6

In practical operation, the units and the modules may be combined or may be singly arranged, and the present invention is not limited thereto.

In the embodiment of the invention, the access device can be deployed in an intranet environment to realize access block chains, and if the access device is in a public network environment, the deployment of the access device needs to configure a network firewall to complete security isolation.

In the process of implementing the embodiment of the invention, the type of the bottom layer block chain platform to be accessed is selected by accessing the interface of the access device, and the private key, the certificate and the like required by the access block chain network are generated/uploaded. In addition, parameter information such as block chain network information and security policies needs to be configured; the service system can call the RESTFul interface on the access device to complete data interaction (data uplink, downlink, etc.) with the blockchain network.

Based on similar inventive concepts, the embodiment of the present invention further provides a block link point access method, which is preferably used for performing the functions of the block link point access device 2. The method is described in detail below in conjunction with fig. 5.

Fig. 5 is a flowchart of a block link point access method according to an embodiment of the present invention, as shown in fig. 5, the method including:

step 501, receiving job information from a business system, where the job information includes: job content and job type. The job type includes whether encryption information is required.

Step 502, responding to the operation type indication to execute data encryption operation, according to the pre-configured block link point information, encrypting the operation information according to the pre-generated local private key, and then sending the encrypted operation information to a predetermined block link point to execute corresponding operation. The private key is stored locally.

Step 503, receiving response information returned from the block link point, and sending the response information to the service system.

When the operation type in the operation information indicates that data needs to be encrypted, the received operation information can be encrypted according to a local private key and then sent to the blockchain node to execute corresponding operation, then response information returned by the blockchain node is received and sent to the service system, and the private key is locally generated and stored, so that the problem of low transaction security caused by the fact that the private key is not local to a participant in the prior art can be solved.

Specifically, the block link point information may be configured according to a network type to which the block link point belongs, and the block link point information includes: node address information, and a security policy for data transmission with the node.

In actual operation, the pre-generated private key can be converted into a public key according to a preset rule; and then, setting the public key as a block chain address to serve as the identity information of the service system.

The specific processes (for example, the configuration block link point information and the public-private key generation process) of the above steps may refer to the description in the above system embodiment, and are not described herein again.

FIG. 6 is a schematic diagram of an electronic device according to an embodiment of the invention. The electronic device shown in fig. 6 is a general-purpose data processing apparatus comprising a general-purpose computer hardware structure including at least a processor 601 and a memory 602. The processor 601 and the memory 602 are connected by a bus 603. The memory 602 is adapted to store one or more instructions or programs executable by the processor 601. The one or more instructions or programs are executed by the processor 601 to implement the steps in the block-link point access method described above.

The processor 601 may be a stand-alone microprocessor or a collection of one or more microprocessors. Thus, the processor 601 implements the processing of data and the control of other devices by executing commands stored in the memory 602 to thereby execute the method flows of the embodiments of the present invention as described above. The bus 603 connects the above components together, as well as to the display controller 604 and the display device and input/output (I/O) device 605. Input/output (I/O) device 605 may be a mouse, keyboard, modem, network interface, touch input device, motion sensing input device, printer, and other devices known in the art. Typically, input/output (I/O) devices 605 are connected to the system through an input/output (I/O) controller 606.

The memory 602 may store, among other things, software components such as an operating system, communication modules, interaction modules, and application programs. Each of the modules and applications described above corresponds to a set of executable program instructions that perform one or more functions and methods described in embodiments of the invention.

Embodiments of the present invention further provide a computer-readable storage medium, on which a computer program is stored, where the computer program is executed by a processor to implement the steps of the block link point access method.

In summary, the embodiments of the present invention provide a block link point access scheme, where an access device is deployed locally, and a locally generated private key can be stored locally, so as to ensure absolute control right of a participant on a link asset, and improve security of data transmission; the scheme supports the configuration of a certificate and a block chain network, and the service system accesses the access device through an RESTFul interface, so that the difficulty of block chain application service integration can be reduced; moreover, the access device can support the expansion of different block chain networks, shield the uncertainty of the bottom layer technology, avoid the frequent reconstruction of the service system and simplify the difficulty of integrating the block chain application of the service system.

The preferred embodiments of the present invention have been described above with reference to the accompanying drawings. The many features and advantages of the embodiments are apparent from the detailed specification, and thus, it is intended by the appended claims to cover all such features and advantages of the embodiments which fall within the true spirit and scope thereof. Further, since numerous modifications and changes will readily occur to those skilled in the art, it is not desired to limit the embodiments of the invention to the exact construction and operation illustrated and described, and accordingly, all suitable modifications and equivalents may be resorted to, falling within the scope thereof.

As will be appreciated by one skilled in the art, embodiments of the present invention may be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

The principle and the implementation mode of the invention are explained by applying specific embodiments in the invention, and the description of the embodiments is only used for helping to understand the method and the core idea of the invention; meanwhile, for a person skilled in the art, according to the idea of the present invention, there may be variations in the specific embodiments and the application scope, and in summary, the content of the present specification should not be construed as a limitation to the present invention.

Claims

1. An access method of a blockchain node, the method comprising:

receiving job information from a business system, the job information comprising: job content and job type;

responding to the operation type indication to execute data encryption operation, according to preconfigured block chain link point information, encrypting the operation information according to a pre-generated local private key and then sending the encrypted operation information to a preset block chain link point so as to execute corresponding operation;

and receiving response information returned by the block chain link point, and sending the response information to the service system.

2. The method of claim 1, wherein the blockchain node information is configured by:

configuring the block link point information according to the network type to which the block link point belongs, wherein the block link point information comprises: node address information, and a security policy for data transmission with the node.

3. The method of claim 1, further comprising:

converting the pre-generated private key into a public key according to a preset rule;

and setting the public key as a block chain address to serve as the identity identification information of the service system.

4. A block link point access device, wherein the device is located on a service system side, the device comprising:

a job receiving unit configured to receive job information from a business system, the job information including: job content and job type;

the sending unit is used for responding to the operation type indication to execute data encryption operation, encrypting the operation information according to a local private key generated in advance and then sending the encrypted operation information to a preset block link point according to the preset block link point information so as to execute corresponding operation;

the response receiving unit is used for receiving response information returned from the block chain link points;

and the response sending unit is used for sending the response information to the service system.

5. The apparatus of claim 4, further comprising:

a configuration unit for configuring the block link point information,

the configuration unit is specifically configured to: configuring the block link point information according to the network type to which the block link point belongs, wherein the block link point information comprises: node address information, and a security policy for data transmission with the node.

6. The apparatus of claim 4, further comprising:

a public key generating unit for converting the pre-generated private key into a public key according to a predetermined rule;

and the block chain address setting unit is used for setting the public key as a block chain address to be used as the identity information of the service system.

7. The apparatus of claim 4, further comprising:

and the expansion interface unit is used for connecting different types of block chain networks.

8. A block link point access system, the system comprising: a service system, a block link point, and the block link point access device of any one of claims 4 to 7, wherein the block link node access device is located at the service system side, and the service system operates with the block link node through the block link node access device.

9. An electronic device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, characterized in that the steps of the method according to any of claims 1 to 3 are implemented when the processor executes the program.

10. A computer-readable storage medium, on which a computer program is stored which, when being executed by a processor, carries out the steps of the method of any one of claims 1 to 3.