WO2022205963A1

WO2022205963A1 - Cross-chain access control method, and apparatus

Info

Publication number: WO2022205963A1
Application number: PCT/CN2021/133097
Authority: WO
Inventors: 邱鸿霖
Original assignee: 蚂蚁区块链科技(上海)有限公司; 支付宝(杭州)信息技术有限公司
Priority date: 2021-03-30
Filing date: 2021-11-25
Publication date: 2022-10-06
Also published as: CN112800404B; CN113656780A; CN113656780B; CN112800404A

Abstract

A cross-chain access control method, and an apparatus, the method being executed by a relay device (12), the relay device (12) being connected to a first blockchain (11), and the relay device (12) being pre-provided with an access control list corresponding to the first blockchain (11). The method comprises: receiving a digital signature and a write request for the access control list, wherein the digital signature is a digital signature of a sender of the write request for said write request, and the write request comprises an identifier of a resource in the first blockchain as well as authorization information for the resource; obtaining a public key for verifying the digital signature on the basis of the identifier of the resource; performing verification on the digital signature using the public key; and when verification is passed, writing the authorization information for the resource into the access control list.

Description

A method and device for cross-chain access control

technical field

The embodiments of this specification relate to the field of blockchain technology, and more particularly, to a cross-chain access control method and apparatus.

Background technique

Blockchain technology, also known as distributed ledger technology, is a decentralized distributed database technology characterized by decentralization, openness, transparency, immutability, and trustworthiness. Each data of the blockchain will be broadcast to the blockchain nodes of the entire network, and each full node has a full amount of consistent data. With the popularity of blockchain technology, many different types of chains have emerged, which are applied in the fields of finance, health care, supply chain, asset management and traceability. However, most on-chain applications (encrypted currencies or smart contracts) cannot cross the boundary of the current chain, and cannot cooperate with other chains to realize the circulation of data, thus limiting the space for the blockchain to play. How to make different types of chains cooperate to realize the circulation of data has become the direction of exploration.

In an existing cross-chain technology, the cross-chain message to be sent to the second blockchain is written into the receipt of the first blockchain in the first blockchain, and the off-chain relay device from the first blockchain The blockchain gets the receipt, provides the receipt to the second blockchain. The receipt includes a data read request to the second blockchain or a call request to the smart contract. In this case, in order to ensure the data security in the blockchain, how to control the access authority of the second blockchain is an urgent problem to be solved.

Therefore, a more efficient cross-chain access control scheme is needed.

SUMMARY OF THE INVENTION

The embodiments of this specification aim to provide a more effective cross-chain access control solution to solve the deficiencies in the prior art.

In order to achieve the above purpose, one aspect of this specification provides a cross-chain access control method, the method is executed by a relay device, the relay device is connected to the first blockchain, and the relay device is preset with a The access control table corresponding to the first blockchain, the method includes: receiving a write request to the access control table and a digital signature, wherein the digital signature is the sender of the write request to all The digital signature of the write request, the write request includes the identifier of the resource in the first blockchain and the authorization information for the resource; the digital signature is obtained based on the identifier of the resource and used to verify the digital signature using the public key to verify the digital signature; in the case of passing the verification, write authorization information for the resource in the access control table.

In one embodiment, acquiring the public key for verifying the digital signature based on the identifier of the resource includes determining the owner of the resource based on the identifier of the resource, and acquiring the public key of the owner.

In one embodiment, the identifier of the resource is the account address of the smart contract, and determining the owner of the resource based on the identifier of the resource includes reading the account status of the smart contract from the account state of the smart contract. The owner's account address.

In one embodiment, the identifier of the resource includes an identifier of a first transaction, wherein determining the owner of the resource based on the identifier of the resource includes reading from the first blockchain based on the identifier of the first transaction Get the account address that sent the first transaction.

In an implementation manner, the identifier of the resource includes an identifier of a first block, wherein determining the owner of the resource based on the identifier of the resource includes, based on the first block included in the identifier of the first block The domain name of the block chain, and the domain name certificate of the first block chain is obtained.

In one embodiment, the write request includes an identifier of an authorized account of the resource, and the authorized account is authorized to write the authorization information of the resource in the access control table, wherein in the Writing the authorization information for the resource in the access control table includes writing the identifier of the authorized account of the resource in the access control table.

In one embodiment, acquiring the public key for verifying the digital signature based on the identifier of the resource includes reading the identifier of the authorized account in the access control table, and based on the identifier of the authorized account Obtain the public key of the authorized account.

In one embodiment, the relay device includes a TEE, and the method is performed by the TEE.

Another aspect of this specification provides a cross-chain access control device, the device is deployed in a relay device, the relay device is connected to a first blockchain, and the relay device is preset with the first blockchain. An access control table corresponding to the blockchain, the device includes: a receiving unit configured to receive a write request and a digital signature for the access control table, wherein the digital signature is the sender of the write request For the digital signature of the write request, the write request includes the identifier of the resource in the first blockchain and the authorization information for the resource; the acquiring unit is configured to, based on the identifier of the resource obtaining a public key for verifying the digital signature; a verification unit, configured to use the public key to verify the digital signature; a writing unit, configured to, in the case of passing the verification, in the access control The authorization information for the resource is written in the table.

In one embodiment, the obtaining unit includes a determining subunit configured to determine the owner of the resource based on the identifier of the resource, and a first obtaining subunit configured to obtain the public information of the owner key.

In one embodiment, the identifier of the resource is the account address of the smart contract, and the determining subunit is further configured to read the account address of the owner of the smart contract from the account state of the smart contract.

In one embodiment, the identifier of the resource includes an identifier of the first transaction, wherein the determining subunit is further configured to read and send the first transaction from the first blockchain based on the identifier of the first transaction. The account address of the transaction.

In one embodiment, the identifier of the resource includes the identifier of the first block, wherein the determining subunit is further configured to obtain, based on the domain name of the first blockchain included in the identifier of the first block, obtain The domain name certificate of the first blockchain.

In one embodiment, the write request includes an identifier of an authorized account of the resource, and the authorized account is authorized to write the authorization information of the resource in the access control table, wherein the The writing unit is further configured to write the identifier of the authorized account of the resource in the access control table.

In one embodiment, the acquiring unit further includes a reading subunit, configured to read the identifier of the authorized account in the access control table, and a second acquiring subunit, configured to, based on the The identification of the authorized account obtains the public key of the authorized account.

In an embodiment, the relay device includes a TEE, and the apparatus is deployed in the TEE.

Another aspect of the present specification provides a computer-readable storage medium on which a computer program is stored, when the computer program is executed in a computer, the computer is made to execute any one of the above methods.

Another aspect of the present specification provides a computing device, including a memory and a processor, where executable code is stored in the memory, and when the processor executes the executable code, any one of the foregoing methods is implemented.

Through the cross-chain access control scheme according to the embodiment of this specification, only the owner of the resource or the account authorized by the resource owner can set the access authority of the resource in the ACL table, thereby ensuring the data security of the blockchain, By executing the solution according to the embodiment of the present specification by the TEE in the relay device, data security is further guaranteed.

Description of drawings

By describing the embodiments of the present specification in conjunction with the accompanying drawings, the embodiments of the present specification can be made clearer:

FIG. 1 shows a schematic diagram of a cross-chain system according to an embodiment of the present specification;

FIG. 2 shows a flowchart of a cross-chain access control method according to an embodiment of the present specification;

FIG. 3 shows a flowchart of a cross-chain access control method according to an embodiment of the present specification;

FIG. 4 shows a cross-chain access control apparatus 400 according to an embodiment of the present specification.

Detailed ways

The embodiments of the present specification will be described below with reference to the accompanying drawings.

FIG. 1 shows a schematic diagram of a cross-chain system according to an embodiment of the present specification. As shown in FIG. 1 , the cross-chain system includes a first blockchain 11 , a relay device network 12 and a second blockchain 13 . The relay device network 12 includes a plurality of relay devices with a predetermined connection relationship. FIG. 1 only schematically shows the first relay device 121 and the second relay device 122 , and the other ones are represented by dotted lines. , the first relay device 121 and the second relay device 122 may be directly connected, or may be connected through other relay devices. Each relay device in the relay device network 12 is connected to at least one blockchain, and each relay device stores a look-up table that records the correspondence of a predetermined number of relay devices to the blockchain to which it is connected. Therefore, through the plurality of relay devices in the relay device network 12, the relay device network can be connected with more blockchains. 1 schematically shows that the first blockchain 11 is connected to the first relay device 121 , and the second blockchain 13 is connected to the second relay device 122 .

For example, the second blockchain 13 sends an access request to the first blockchain 11 through the relay device network 12 , and the access request is, for example, to read data in the first blockchain 11 or to call the first blockchain 11 . smart contracts in . Specifically, the second blockchain 13 sends the access request to the first relay device 121 through the relay device network 12 based on the lookup table, and the first relay device 121 determines whether the access request is based on the access control table (ACL table). is authorized to determine whether to access the first blockchain 11 in response to the access request.

Therefore, in order to ensure the security of cross-chain access, how to establish an ACL table is a key part. As shown in FIG. 1 , in the embodiment of this specification, each relay device is further provided with an ACL table writing module, and the ACL table writing module includes an identity authentication sub-module and a resource authentication sub-module. When the user sends an ACL table write request to, for example, the first relay device 121 through its device to set the authorization information of the resource, the first relay device 121 calls the ACL table write module, and first determines the resource through the resource authentication sub-module The owner or the authorized person, and then determine whether the sender of the write request is the owner of the resource or the authorizer of the resource through the identity authentication sub-module, so as to determine whether to perform the ACL table based on the write request. write.

It can be understood that the above description with reference to FIG. 1 is only illustrative, and is not used to limit the scope of the embodiments of the present specification. The above access authority control method will be specifically described below.

Fig. 2 shows a flow chart of a method for cross-chain access control according to an embodiment of the present specification. For example, the method is executed by the first relay device 121 in Fig. 1. The method includes the following steps: Step S202: The write request and the signature of the table, the signature is the digital signature of the sender of the write request to the write request, and the write request includes the identifier of the resource to be authorized in the first blockchain ; Step S204, determine the owner of the resource; Step S206, verify whether the signature is the signature of the owner; Step S208, verify that the digital signature is not the owner's signature in the situation, verify that all whether the signature is the signature of the authorized account of the resource; step S210, write the ACL table based on the write request.

The method shown in FIG. 2 will be described below through various embodiments.

In one embodiment, the owner of the resource 11 in the first blockchain sends a request to write to the ACL table and a digital signature for the write request to the first relay device 121 through his device, so that the first A relay device 121 executes step S202 to receive the above resource owner's write request and signature to the ACL table. Wherein, the digital signature is a digital signature of the write request using the account private key of the sender of the write request, and the write request includes the specific resource to be authorized in the first blockchain. logo. The resources may include, for example, block data, transaction data, smart contracts and the like in the first blockchain 11 . Correspondingly, the write request may include the identifier of the block data, the identifier of the transaction data or the identifier of the smart contract. The identifier of the block data includes, for example, the domain name of the first blockchain, the hash value of the block header or the block number, etc.; the identifier of the transaction data includes, for example, the domain name of the first blockchain, the transaction data of the block. Identification and transaction number, etc.; the identification of the smart contract includes, for example, the domain name of the first blockchain and the account of the smart contract. The write request is, for example, a request to write the authorization content of a specific resource in the ACL table. The authorized content includes, for example, the domain name of the blockchain authorized to use the specific resource, the authorized usage mode of the specific resource, and the like. For example, for smart contract resources, the authorized use methods include calling methods, and for resources such as block data and transaction data, the authorized use methods include reading methods, and so on.

After that, the first relay device 121 executes step S204 to determine the owner of the resource.

After receiving the above write request to the ACL table, the first relay device 121 first needs to confirm who is the owner of the specific resource in the write request, so as to determine whether the sender of the write request is the specified resource. Describe the owner of a specific resource, that is, determine whether the sender has permission to write to the ACL table. Therefore, the first relay device 121 determines the owner of the resource through its resource authentication sub-module.

For example, the specific resource is a smart contract deployed in the first blockchain 11, and the account address of the owner of the smart contract is recorded in the owner field in the account status of the smart contract. Thus, the resource authentication sub-module can read the owner field in the account status of the smart contract to obtain the owner's account address, and can obtain the owner's public account by reading the account status of the owner's account. key.

For example, the specific resource is transaction data stored in the first blockchain 11 . For the transaction data in the blockchain, different blockchains may have different regulations on the owner of the transaction data. For example, in a blockchain, the transaction data of the transaction includes the transaction sender's certificate data, And in this blockchain, the owner of the transaction data is specified as the transaction sender, and in another blockchain, the owner of the transaction can be specified as the owner of the blockchain in the blockchain. The resource authentication sub-module can obtain the specified description of the owner of the transaction data from the first blockchain 11 . For example, if the resource authentication sub-module determines that the owner of the transaction data is the sender of the transaction, the resource authentication sub-module reads the transaction data from the first blockchain 11, thereby obtaining the transaction data from the transaction data. The sending account of the transaction, and the account public key of the sending account can be obtained from the account status of the sending account. If the resource authentication sub-module determines that the owner of the transaction data is the owner of the first blockchain 11, the resource authentication sub-module can obtain the domain name certificate of the first blockchain 11 from the domain name certificate authority, and the domain name certificate The domain name and the public key of the domain name owner are included in the domain name, so as to identify the owner of the domain name, so that the resource authentication sub-module can obtain the public key of the owner of the first blockchain 11 from the domain name certificate. In addition, after acquiring the domain name certificate of the first blockchain 11 for the first time, the resource authentication sub-module can store the domain name certificate locally in the first relay device 121 for subsequent verification of the domain name certificate in the first blockchain 11 Authentication of resources.

For example, the specific resource is block data in the first blockchain 11, and generally, the owner of the block data is the owner of the corresponding blockchain. Therefore, the resource authentication sub-module can obtain the domain name certificate of the first blockchain 11 from the domain name certificate authority or locally, similarly to the above, so as to obtain the public information of the owner of the first blockchain 11 from the domain name certificate. key.

Then, the first relay device 121 executes step S206 to determine whether the signature of the write request is the signature of the owner of the specific resource through the identity authentication sub-module. Specifically, after obtaining the public key of the owner of the specific resource, the identity authentication sub-module uses the public key to decrypt the digital signature of the write request, calculates the hash value of the write request, and compares the decrypted data with the whether the hash values are the same. If the same, it can be determined that the signature of the write request is the signature of the owner of the specific resource, so that the first relay device 121 can perform step S210, and write the ACL table through the ACL table writing module . If not, the first relay device 121 will not write to the ACL table based on the write request, thereby improving the data security of the first blockchain 11 by controlling the writing to the ACL table. Table 1 shows a schematic diagram of the ACL table corresponding to the first blockchain 11 .

Table 1

资源resource	区块链标识Blockchain ID	访问方式interview method
第一合约账户The first contract account	域名2、域名4Domain 2, Domain 4	调用transfer
区块p，交易qblock p, transaction q	域名2Domain 2	读取read
区块mblock m	域名3Domain 3	读取read

As shown in Table 1, the column "Resource" is used to record the identifier of the resource in the first blockchain 11, and the resource includes, for example, block data, transaction data, smart contracts, etc., "Blockchain identifier" A column is used to record the identity of the blockchain that is authorized to use the corresponding resource. In Table 1, the domain name of the blockchain is used as the identity of the blockchain, and the column "Access Mode" is used to record the authorized access to the corresponding resource. The access method includes calling the contract and reading the data. Specifically, assuming that the domain name of the second blockchain 13 is domain name 2, it is recorded in Table 1 that the second blockchain 13 is authorized to call the first contract in the first blockchain 11 and the Read access to transaction q in block p in a blockchain 11.

It can be understood that the access control list shown in Table 1 is only illustrative and not restrictive. For example, the block chain identifier column is not limited to recording the domain name of the block chain, but other block chain identifiers used to uniquely identify the block chain can be recorded. In addition, the access control table is not limited to including those shown in Table 1. 3 columns, but only one or two of them can be recorded, for example, only the "resource" column in table 1 is included in the access control table, which means that the call to the first contract is authorized for all blockchains Permissions, read access to transactions q in block p, and block m.

After the first relay device 121 writes the access authority to the specific resource in the ACL table, when the off-chain device of the first blockchain 11 (for example, the node device of the second blockchain 13 ) passes through the first relay device When 121 accesses the specific resource in the first blockchain 11, the first relay device 121 will perform access control based on the permission setting corresponding to the specific resource in the ACL table.

In an implementation manner, the write request is, for example, a request to write an account identifier authorized to set access rights to a specific resource in the ACL table, where the account identifier is, for example, an account public key or an account address. In this case, after determining that the signature of the write request is the signature of the owner of the specific resource through the resource authentication sub-module and the identity authentication sub-module, the first relay device 121 writes in the ACL table The account ID that authorizes a specific resource. Table 2 shows a schematic diagram of the ACL table in this embodiment.

Table 2

资源resource	区块链标识Blockchain ID	访问方式interview method	被授权帐户Authorized account
第一合约帐户first contract account			abc456、cde352abc456, cde352
区块p，交易qblock p, transaction q			Dec678、ebc426Dec678, ebc426

In the ACL table shown in Table 2, different from Table 1, it also includes an authorized account column, and the authorized account is used to record the account publicity of the account authorized to set the access authority of the resource in the ACL table. key (shown schematically as abc456 in Table 2). It can be understood that the column of authorized accounts in Table 2 is not limited to recording the account public key, but can also record the account address.

In another implementation manner, after performing step S206 to determine that the signature of the write request is not the signature of the resource owner, the first relay device 121 may perform step S208 to determine whether the signature is the signature of an authorized account . Specifically, the first relay device 121 reads the account public key of the authorized account of the specific resource from the ACL table through the ACL table writing module, and uses the public key to verify the signature, thereby determining whether the signature is authorized The signature of the account. In the case where the account address of the authorized account is recorded in the ACL table, the ACL table writing module in the first relay device 121 can obtain the public key corresponding to the account based on the account address, and use the public key to verify the signature .

If the ACL table writing module determines that the signature is the signature of an authorized account, for example, the write request includes a restriction on the access authority to the first contract account, the first relay device 121 based on the write request Through the ACL table writing module, the block chain identifier, access method and other contents associated with the first contract account as shown in Table 1 are written in the ACL table. If it is determined by performing step S208 that the signature is not the signature of the authorized account, the method execution flow ends, and the ACL table is not written.

FIG. 3 shows a flowchart of a method for cross-chain access control according to an embodiment of the present specification. The method is executed by, for example, the first relay device 121 in FIG. 1 , and the method includes the following steps S302-S310.

In this embodiment, the write request includes a signature indication field, which is used to indicate whether the signature of the write request is the signature of the resource owner or the signature of the resource authorized account. The first relay device 121 first executes step S302, and receives a write request to the ACL table and the sender's digital signature for the write request from the sender device. After that, the first relay device 121 executes step S304, and reads the signature indication field in the write request. If the signature indication field indicates that the signature is the identification of the resource owner, that is, the write request is sent by the owner of the resource, the first relay device 121 performs step S306 similarly to the above to determine the resource and in step S308, it is determined whether the signature is the signature of the owner, to determine whether to execute step S312, that is, to determine whether to write the ACL table. If the signature indication field indicates that the signature is the signature of an authorized account, that is, the write request is sent by an authorized account, the first relay device 121 performs step S310 similarly to the above to determine the signature Whether it is the signature of the authorized account to determine whether to write to the ACL table.

The first relay device 121 for executing the above method may be a trusted device, or may include a Trusted Execution Environment (TEE), and execute the above method in the TEE. The sender of the write request (ie the resource owner or the authorized person of the resource) may first authenticate the TEE in the first relay device 121 before sending the write request to the first relay device 121 through its device. Specifically, the sender device may send an authentication request to the TEE. After receiving the verification request, the TEE generates authentication information based on its internal mechanism, and sends the authentication information and the hardware public key of the TEE to the sender device. The authentication information includes, for example, signature information, hardware information, software information, and the like of the TEE. Wherein, the signature information is generated by, for example, the hardware key of the TEE; the hardware information includes, for example, various hardware indicators, such as CPU frequency, memory capacity, etc.; the software information includes the code hash value of each program , code name, version, run log, etc. As is known to those skilled in the art, a TEE can perform "measurements" of a program running in it through memory hardware, such as obtaining a code hash of the program, a hash of the program's memory occupancy at a particular point of execution, etc., and The authentication information includes "measurement" information for the program, which is authentic and credible because the "measurement" information is executed by the TEE's own entity (memory hardware) without involving any software or operating system. After receiving the authentication information, the sender device may send the authentication information to the remote authentication server of the TEE, so as to receive the verification result of the TEE from the server. The verification result includes the identity verification of the TEE, the verification of the internal execution program of the TEE, and the like. Therefore, the sender device can determine that the TEE is authentic and the processing result of the TEE is authentic based on the verification result.

When, for example, the second blockchain 13 sends a resource access request to the first blockchain 11 through the relay device network 12 , the first relay device 121 can access the resource based on the ACL table corresponding to the first blockchain 11 Request verification to determine whether the second blockchain 13 has access rights to the required resources, and after the verification is passed, use the TEE private key to sign the resource access request, and sign the resource access request and TEE Provided to the first blockchain 11. The first blockchain 11 verifies the TEE signature through the pre-obtained TEE public key, and if the verification passes, it can be determined that the resource access request has been authenticated by the access authority of the first relay device 121, so as to process the resource access request.

FIG. 4 shows a cross-chain access control apparatus 400 according to an embodiment of the present specification. The apparatus 400 is deployed in a relay device, the relay device is connected to the first blockchain, and the relay device is preset There is an access control table corresponding to the first blockchain, and the apparatus 400 includes: a receiving unit 41, configured to receive a write request and a digital signature for the access control table, wherein the digital signature is the digital signature of the write request by the sender of the write request, where the write request includes the identifier of the resource in the first blockchain and the authorization information for the resource; the obtaining unit 42, is configured to obtain a public key for verifying the digital signature based on the identifier of the resource; the verification unit 43 is configured to use the public key to verify the digital signature; the writing unit 44 is configured to: In the case of passing the verification, the authorization information for the resource is written in the access control table.

In one embodiment, the obtaining unit 42 includes a determining subunit 421 configured to determine the owner of the resource based on the identifier of the resource, and the first obtaining subunit 422 is configured to obtain all the resources the public key of the person.

In one embodiment, the identifier of the resource is the account address of the smart contract, and the determining subunit 421 is further configured to read the account address of the owner of the smart contract from the account status of the smart contract .

In one embodiment, the identifier of the resource includes an identifier of the first transaction, wherein the determining subunit 421 is further configured to read and send the first transaction from the first blockchain based on the identifier of the first transaction. An account address for the transaction.

In one embodiment, the identifier of the resource includes the identifier of the first block, wherein the determining subunit 421 is further configured to, based on the domain name of the first blockchain included in the identifier of the first block, Obtain the domain name certificate of the first blockchain.

In one embodiment, the write request includes an identifier of an authorized account of the resource, and the authorized account is authorized to write the authorization information of the resource in the access control table, wherein the The writing unit 44 is further configured to write the identifier of the authorized account of the resource in the access control table.

In one embodiment, the obtaining unit 42 further includes a reading subunit 423 configured to read the identifier of the account authorized with respect to the resource in the access control table, and the second obtaining subunit 424 , configured to obtain the public key of the authorized account based on the identity of the authorized account.

It should be understood that the descriptions of "first", "second" and so on herein are only for the simplicity of description to distinguish similar concepts, and have no other limiting effect.

Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the various embodiments may be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, as for the system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and for related parts, please refer to the partial descriptions of the method embodiments.

The foregoing describes specific embodiments of the present specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different from that in the embodiments and still achieve desirable results. Additionally, the processes depicted in the figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

Those of ordinary skill in the art should further realize that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software or a combination of the two, in order to clearly illustrate the hardware and software interchangeability, the components and steps of each example have been generally described in terms of functions in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Persons of ordinary skill in the art may use different methods of implementing the described functionality for each particular application, but such implementations should not be considered beyond the scope of this application. Wherein, the software module can be placed in random access memory (RAM), internal memory, read only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disks, removable disks, CD-ROMs, or technical fields in any other form of storage medium known in the art.

The specific embodiments described above further describe the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above descriptions are only specific embodiments of the present invention, and are not intended to limit the scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included within the protection scope of the present invention.

Claims

A cross-chain access control method, the method is performed by a relay device, the relay device is connected to a first blockchain, and an access corresponding to the first blockchain is preset in the relay device The control table, the method includes:

Receive a write request to the access control table and a digital signature, wherein the digital signature is a digital signature of the write request by the sender of the write request, and the write request includes the first Identification of a resource in the blockchain and authorization information for the resource;

Obtaining the public key for verifying the digital signature based on the identifier of the resource;

verifying the digital signature using the public key;

In the case of passing the verification, the authorization information for the resource is written in the access control table.
The method according to claim 1, wherein obtaining the public key for verifying the digital signature based on the identifier of the resource comprises determining the owner of the resource based on the identifier of the resource, obtaining the owner's public key.
The method according to claim 2, wherein the identifier of the resource is an account address of a smart contract, and determining the owner of the resource based on the identifier of the resource comprises reading all the information from the account state of the smart contract. The account address of the owner of the smart contract.
3. The method of claim 2, wherein the identification of the resource includes an identification of a first transaction, wherein determining the owner of the resource based on the identification of the resource The address of the account that sent the first transaction is read in the block chain.
The method according to claim 2, wherein the identifier of the resource includes an identifier of a first block, wherein determining the owner of the resource based on the identifier of the resource includes, and the identifier based on the first block includes the domain name of the first blockchain, and obtain the domain name certificate of the first blockchain.
The method according to any one of claims 1-5, wherein the write request includes an identifier of an authorized account of the resource, and the authorized account is authorized to write the resource in the access control table. Authorization information, wherein writing the authorization information for the resource in the access control table includes writing the identifier of the authorized account of the resource in the access control table.
The method according to claim 1, wherein obtaining the public key for verifying the digital signature based on the identification of the resource comprises reading the identification of the authorized account in the access control table, and based on the identification of the authorized account The identification of the authorized account obtains the public key of the authorized account.
The method of claim 1, wherein the relay device includes a TEE, and the method is performed by the TEE.
A cross-chain access control device, the device is deployed in a relay device, the relay device is connected to a first blockchain, and an access corresponding to the first blockchain is preset in the relay device A control table, the device includes:

a receiving unit, configured to receive a write request to the access control table and a digital signature, wherein the digital signature is a digital signature of the sender of the write request on the write request, and the write request The request includes the identifier of the resource in the first blockchain and the authorization information for the resource;

an obtaining unit, configured to obtain a public key for verifying the digital signature based on the identifier of the resource;

a verification unit, configured to use the public key to verify the digital signature;

The writing unit is configured to, in the case of passing the verification, write the authorization information for the resource in the access control table.
The apparatus according to claim 9, wherein the obtaining unit comprises a determining subunit configured to determine the owner of the resource based on the identifier of the resource, and a first obtaining subunit configured to obtain the resource The owner's public key.
The apparatus according to claim 10, wherein the identifier of the resource is an account address of a smart contract, and the determining subunit is further configured to read the owner of the smart contract from the account state of the smart contract account address.
The apparatus according to claim 10, wherein the identifier of the resource includes an identifier of the first transaction, wherein the determining subunit is further configured to read and send from the first blockchain based on the identifier of the first transaction The account address of the first transaction.
The apparatus according to claim 10, wherein the identifier of the resource includes an identifier of a first block, wherein the determining subunit is further configured to, based on the first blockchain included in the identifier of the first block domain name, and obtain the domain name certificate of the first blockchain.
The apparatus according to any one of claims 9-13, wherein the write request includes an identifier of an authorized account of the resource, and the authorized account is authorized to write the The authorization information of the resource, wherein the writing unit is further configured to write the identifier of the authorized account of the resource in the access control table.
The apparatus according to claim 9, wherein the obtaining unit further comprises a reading subunit, configured to read the identifier of the authorized account in the access control table, and a second obtaining subunit, configured as , and obtain the public key of the authorized account based on the identity of the authorized account.
The apparatus of claim 9, wherein the relay device includes a TEE, and the apparatus is deployed in the TEE.
A computer-readable storage medium on which a computer program is stored, when the computer program is executed in a computer, the computer is made to perform the method of any one of claims 1-8.
A computing device includes a memory and a processor, the memory stores executable code, and when the processor executes the executable code, the method of any one of claims 1-8 is implemented.