CN112988887B - Foundation system based on block chain - Google Patents

Abstract

The invention discloses a fund system based on a block chain, which is characterized by comprising a plurality of fund service platforms managed and maintained by a fund management platform, wherein the fund service platforms issue donation information provided by registered donors to the block chain after the donation information passes the audit and returns a destination certificate, and issue the donation information provided by a fund service platform administrator to the block chain; the fund service platform comprises a middle layer, a back-end development module and a front-end development module; the back-end development module comprises a block chain technology layer, a chain code layer, a service layer and a data layer; the block chain technology layer comprises a sequencing consensus component and a plurality of different Fabric mirror images, and different foundation platforms correspond to different mirror images; the sequencing consensus component is used for providing consensus sequencing for each piece of donation information and donation destination information transmitted by the chain code layer and packaging the information into blocks; the chain code layer is used for writing trusted distributed system service execution logic in the block chain.

Description

Foundation system based on block chain

Technical Field

The invention belongs to the technical field of block chains, and particularly relates to an autonomous safe extensible foundation system based on a block chain.

Background

The block chain technology originates from digital encryption currency such as bitcoin, and the like, and is essentially a decentralized infrastructure and distributed database, and a unique chain structure and a tree management mode enable the block chain technology to maintain and manage continuously growing and non-falsifiable data records. The blockchain ensures data security by using a cryptographic technology, ensures data consistency by using a consensus mechanism, executes commands by using an intelligent contract and performs data transmission by using P2P networking. The system based on the technology has the characteristics of decentralization, no tampering, multi-party maintenance, distributed consensus, final consistency and the like. The user does not need to use any third-party trusted authority, so that the trusted and equivalent value transmission can be realized by multiple parties which are not mutually understood and trusted. With the development of the digital society, the blockchain has a wide application scene in the fields of digital economy, internet of things, public service and the like.

Block chaining techniques are rapidly expanding into various domains, from public chains to alliance chains, from digital currencies to credit societies, from bitcoins to super ledgers. A federation chaining open-source community ecosystem represented by Hyperhedger Fabric aims at an enterprise-level application scene-oriented permission block chain and is used for solving the trust problem among a plurality of weak trust enterprise main bodies, so that the trust cost caused by complex and tedious business processes among enterprises is reduced, sensitive data sharing is realized in a controllable range, and the efficiency of large-scale collaboration activities among the enterprise main bodies is effectively improved. In the alliance chain HyperLegend Fabric, a user or an organization can join the alliance chain HyperLegend Fabric only by having a specific authority to participate in business operation and read-write maintenance of block chain data, the system separates transaction execution from consensus, supports policy-based endorsement and has an identity management integration based on an industry standard; the block chain system subjected to upgrade iteration has the advantages of high throughput, high concurrency, low delay and the like, and can freely respond when encountering block chain items with complex scenes and large scale. The HyperLegend Fabric overcomes the defects of low transaction efficiency, lack of a perfect identity authentication mechanism and the like of a bit currency public link platform and an Ethernet public link platform, is more suitable for an enterprise inter-level alliance block chain scheme established on a credible basis, and is widely applied to the fields of financial asset storage and management, supply chains, donation traceability, economy sharing, medical insurance and the like.

The public welfare foundation platform is dedicated to public welfare charitable cares, public welfare activities are carried out through network means such as the internet, a mobile terminal and the like, interconnection and intercommunication of public welfare demands and service resources are achieved, public welfare force is gathered more effectively, and public welfare resources are managed and distributed.

But the public interest fund platforms are all centralized, all data are stored in the centralized server, and the risks of data loss, tampering and the like exist. Meanwhile, each great public welfare organization often has trust problems of unfairness in distributing donated materials, mass overstocking of donated articles, low distribution efficiency and the like, so that the great public welfare organizations are pushed up to the wind gap wave tip of public opinion. Therefore, the problems of untimely, unpublished, opaque and the like of information release such as material and good use are all caused; these are the pain points and difficulties faced by the development of the current welfare charity, and the present invention solves these pain point and difficulty problems by means of the blockchain technology.

Disclosure of Invention

In order to solve the problems, the invention provides a fund system based on a block chain, which is used for realizing the platform information management of donated materials and profits of users, ensuring that information is issued in time, is open and transparent, cannot be tampered and can be traced, promoting the development of public welfare behaviors to fragmentation, small quota and normalization and ensuring that public welfare organizations are legal, transparent and efficient.

The system is composed of a fund management platform and a fund service platform together, and is developed based on an autonomous safe block chain bottom platform national secret version hyper ledger Fabric of an autonomous research and development. The block chain bottom platform is a Hyperledger Fabric which is a national cryptograph reformed by using a domestic cryptographic algorithm SM2/SM3/SM4, and the bottom platform is basically consistent with the Hyperledger Fabric of an open-source hyper-ledger in function and has difference in security. The system can realize real-time monitoring and expansion upgrading of multi-foundation meetings and provide a full-link efficient and credible solution for the public service problem of the Internet.

The technical scheme of the invention is as follows:

a fund system based on a block chain is characterized by comprising a plurality of fund service platforms managed and maintained by a fund management platform, wherein each fund corresponds to one fund service platform; the fund service platform issues the donation information provided by the registered donators to the block chain after the approval is passed and returns a destination certificate, and issues the donation information provided by the fund service platform administrator to the block chain; wherein

The fund meeting service platform comprises a middle layer, a rear-end development module and a front-end development module; the back-end development module comprises a block chain technology layer, a chain code layer, a service layer and a data layer, and the front-end development module comprises a view layer and a display layer;

the block chain technology layer comprises a sequencing consensus component and a plurality of different Fabric images, and different foundation platforms correspond to the different Fabric images; the sequencing consensus component is used for providing consensus sequencing for each piece of donation information and donation destination information transmitted by the chain code layer and packaging the donation destination information into blocks so as to ensure data consistency;

the chain code layer is used for compiling trusted distributed system service execution logic in the block chain and realizing specific operation on the data of the block chain technology layer so as to complete the butt joint of the block chain technology layer and the upper layer service thereof; wherein the blockchain technology layer data comprises donation information and donation destination information, the data packets of the blockchain technology layer comprise donation chain code packets and destination chain code packets, and the blockchain of the blockchain technology layer comprises donation chain codes and destination chain codes; writing an intelligent contract with a function of setting donation data in the donation chain code; an intelligent contract with a function of setting the outgoing data is compiled in the outgoing chain code;

the data layer is used for compiling the donation information issued to the blockchain on the donation chain codes and compiling the donation outgoing information issued to the blockchain on the outgoing chain codes;

the service layer is used for resource management and operation and maintenance monitoring and comprises an SDK (software development kit) service end, a resource management module and an operation and maintenance monitoring module; the resources managed by the resource management module comprise a CA certificate, a configuration file at the bottom layer of a block chain, a pluggable consensus plug-in, a Fabric mirror image and an external mirror image;

the middle layer is used for providing each terminal module for the data interaction between the back-end development module and the front-end development module;

the display layer is used for setting an interaction mode of each terminal module of the interface layer and a data acquisition and processing mode;

and the view layer is used for displaying the data.

Furthermore, the intelligent contracts comprise intelligent contracts which are compiled in the donation chain codes and have the functions of adding, deleting, updating, inquiring, richly inquiring and paging display on donation data, intelligent contracts which are compiled in the donation chain codes and have the functions of updating and auditing the donation data, inquiring and donating according to the auditing states and donating according to the going direction inquiry, and intelligent contracts which are compiled in the going direction chain codes and have the functions of adding, deleting, updating, inquiring, richly inquiring and paging display on the going direction data.

Further, the data layer distinguishes uplink data from non-uplink data, and encapsulates a layer of data backup on the block chain bottom layer for the uplink data; and the data layer stores the encapsulated data backup and the un-uplink data into an outer database, and stores the data to be uplink and the hash value thereof into a block chain bottom database in a backup mode.

Further, the user password storage method when the client and the server perform user password interaction in the data layer is as follows:

a) in the registration stage, a client receives a user password and a user name username which are input when a user registers; then obtaining a salt value corresponding to the user name username; then the client generates a hash value according to the user password and the salt value, and sends the hash value and the salt value to the server; the server side saves the hash value and the salt value;

b) in the login stage, a client receives a user password and a user name username input when a user logs in and sends the user password and the user name username to a server, the server inquires a corresponding salt value according to the user name username, and if the corresponding salt value exists, a new salt value is generated and sent to the client; the client generates a hash value hash1 according to the user password and the salt value before updating, generates a hash value hash2 according to the user password and the new salt value, and then sends the hash value hash1 and the hash value hash2 to the server; the server side verifies whether the hash value hash1 is consistent with the hash value stored in the database, if so, the user logs in successfully, and updates the hash value of the user to be hash value hash2 and the salt value to be the new salt value; if the comparison result is inconsistent, returning login failure information;

c) in the password changing stage, a client receives a user name username, an old password and a new password input by a user and sends the user name username, the old password and the new password to a server; the server side inquires a corresponding salt value according to the user name username, and if the corresponding salt value exists, a new salt value is generated and sent to the client side; the client generates a hash value hash1 according to the old password and the salt before updating, generates a hash value hash2 according to the new password and the new salt, and then sends the hash value hash1 and the hash value hash2 to the server; the server side verifies whether the hash value hash1 is consistent with the hash value stored in the database, if so, the old password of the user is updated to the new password, the hash value of the user is updated to the hash value hash2, and the salt value is updated to the new salt value; and if the comparison result is inconsistent, returning failure information.

Further, the external mirror images comprise a Kafka mirror image, a Zookeper mirror image, a Couchdb mirror image, a Mysql mirror image and a Redis mirror image; the system comprises a Kafka mirror image, a Coucheper mirror image, a Couchdb mirror image and a Mysql mirror image, wherein the Kafka mirror image is matched with the Zookeeper mirror image to participate in consensus, the Couchdb mirror image is used for storing block data obtained by packaging donation information and donation destination information into blocks, and the Mysql mirror image and the Redis mirror image are used for storing personal information of users.

Further, the external mirror image is arranged in the same network bridge segment, and the network bridge segment where the external mirror image is located is different from the network bridge segments where other started mirror images are located.

Furthermore, the SDK server executes corresponding service logic by calling different chain codes to implement operations on the issued data.

The invention relates to a foundation service platform based on a block chain technology, which comprises a whole set of foundation service logic architecture combined with the block chain technology and a technical architecture thereof. The service logic architecture brings fund, administrator, donator, donated organization or individual, visitor and supervision department into a alliance chain system together, realizes real-time update, traceability and non-falsification of data of all parties in the alliance by combining the special advantages of the platform, and ensures that the public information track is recyclable, real and credible.

The technical framework is constructed on the bottom layer of the autonomous safety block chain technology, each main functional module is built, and a fund establishment flow, technical details, a strategic development direction and a business mode are carried for the platform.

The common users are not enough to exist as a computing node in the alliance chain independently, so that the invention chains user donation information and going information, and realizes the inquiry and the trace of audit information, material or beneficiary going information so as to realize the characteristics of safety, transparency, going to the center, traceability, tamper resistance and the like of the system;

furthermore, after acquiring a network access permission from a system CA (certification center), a supervision department dynamically adds the network access permission into the block chain network to realize supervision and examination on uplink data;

furthermore, in order to facilitate the expansion and upgrading of the system, the invention manages the bottom Fabric mirror image and adopts a modularized and pluggable common-identification component to improve the expandability of the system;

furthermore, the invention provides concepts of inner layer data storage and outer layer data storage, wherein the storage positions of the inner layer data storage and the outer layer data storage are determined according to different data applications, and the outer layer database is used for realizing the storage of non-uplink data and the backup of uplink data so as to improve the system performance;

furthermore, the invention provides a special salted hash password storage method, which effectively ensures the account security of system users.

A management platform for managing a plurality of fund service platforms comprises a whole set of fund node management logic and a technical framework thereof. The node management logic runs different foundation service platforms to different servers or servers provided by the management platform. In the face of a plurality of foundation conferences, foundation information and actual deployment intention are collected, materials such as certificate keys and the like required by operation of block chain nodes are generated, and Docker images and other software tools of a foundation service platform are prepared for deployment. And generating personalized configuration files and deployment scripts by using the fund personalized information and the management platform server resources, and deploying and managing a plurality of fund service platforms. The platform provides components such as a private mirror image warehouse, a CA center, fund information management, a fund deployment module, a monitoring system and the like, so that the fund system is rapidly and individually deployed, and the running state of the fund system is managed and monitored.

Further, the invention provides a tool for automatically generating the deployment script, which can automatically generate the deployment script of each fund service platform according to the personalized information and the deployment intention of each fund.

Furthermore, the invention provides two monitoring modes respectively aiming at the container log and the foundation service platform so as to realize the monitoring of the service state of each foundation running on the management platform.

Furthermore, the invention compiles the foundation service platform code into an executable mirror image through Docker and stores the executable mirror image and mirror image accessories required by the service platform in a private mirror image warehouse together so as to realize the life cycle management and iterative upgrade of the foundation service platform.

Furthermore, in order to facilitate the user to conveniently and quickly access each sub-fund system to which the management platform belongs without repeatedly registering an account, the invention provides the user database module so as to realize that the user database of each fund can regularly exchange data with the platform user database.

Drawings

FIG. 1 is a flowchart of the overall business architecture of a foundation service platform.

FIG. 2 is a diagram of a fund service platform architecture.

Fig. 3 is a schematic diagram of an autonomous security blockchain underlying platform.

FIG. 4 is a flow chart of a particular method for storing a salted hash code.

FIG. 5 is a diagram of a fund management platform model.

FIG. 6 is a flow diagram of a foundation management platform management process.

Detailed Description

Embodiments of the present disclosure are described below by way of specific examples, which are set forth in order to provide those skilled in the art with a clear understanding of the disclosure. It should be understood that the specific embodiments described herein are merely illustrative of the invention and do not delimit the invention.

The embodiment of the disclosure provides a fund system, which guarantees the credibility of a full link of public service information of the Internet based on a block chain technology. The system consists of a fund service platform and a fund management platform, wherein the system bottom layer is based on a safe and controllable national secret Fabric platform which is independently researched and developed; the whole system consists of a back end (server end) and a front end (webpage end) together, and can be integrated in a server and terminal equipment.

One, fund meeting service platform

Fig. 1 is a flowchart illustrating the overall business architecture of a foundation service platform in a group of foundation clusters (all foundation service platforms managed and maintained by a foundation management platform are referred to as a group of foundation clusters) under a foundation system according to an embodiment of the present disclosure, wherein the flowchart mainly includes the following roles:

foundation: one fund corresponds to one fund service platform and is used for managing the donation business of the ID designated area. The platform provides donation data uplink for users, donation outgoing uplink is provided for platform administrators, and users can obtain donation information and outgoing information after uplink from the platform. All users registered based on this fund and data information of the uplink are managed by this fund. The fund is dedicated to the whole process of getting through charitable donations in a designated area, and comprises all links of seeking donations, docking donations, sending donations, tracking logistics, going to confirmation, information uplink, information disclosure and acceptance supervision.

The administrator: the administrator is an account responsible for the maintenance and management of a fund service platform, and the main work is as follows: managing account information of common users, checking whether donation data is real and credible, checking data to be checked, and setting donation directions for data which passes checking (has been linked).

Donor: the donator refers to a registered user of the fund service platform, the user submits donation information after registering an account, and a fund manager audits and ensures that the information is issued to the chain in time after being correct; after logging in the account on the platform, the donor can check the past donation information and the destination information of each donation.

Guest: a visitor is any visitor who may publicly visit a foundation platform home website (overview page) and browse website messages online.

The regulatory department: a regulatory body refers to an organization or organization, such as a government, public welfare organization, etc., that has regulatory rights and can supervise donation information and go-to information for the fund.

Donated tissue or individual: refers to a group or individual receiving funding assistance from a foundation.

For the example shown in FIG. 1, the overall business process of the foundation service platform can be described as follows:

the fund service platform provides a management interface for a platform administrator, provides a user interface for a donor, and provides a public overview page for a visitor; the donor issues self donation information to the fund, the platform administrator audits the information and links the information after confirming that the information is correct, and if the audit is not passed, the platform administrator does not link the information; the fund transfers donation materials to donated organizations or individuals, the platform returns a destination voucher of the donation materials, and then the system automatically records the destination voucher data information of the donation information in a bottom layer block chain; the donor can inquire the self donation data and the donation destination information of the data through the front end; the guest can view the donation and destination information that is disclosed, while viewing the unique credentials for that information (donation or destination information), which refer to the hash value generated by the blockchain underlay for each piece of information.

The information issued by the donor is firstly checked by the administrator, the information issued by the donor is also linked up and is added with a state value (the initial assumption is 0); after the administrator audits the donation information, if the donation information is correct, setting the donation as an audit passing state, changing the state value from 0 to 1, and simultaneously, issuing and chaining the donation information by the system; if the donation information is wrong, the donation is set to be in an auditing failure state, and the administrator changes the state value to 2 and links the donation information and the information together. The auditing state of the information can be determined by judging the state value attached to the information on the chain, the approved information is returned to the overview page for supervision of all persons, and the information which is not passed is returned to the user again. This arrangement ensures that the administrator can review each piece of information to trace back to which user the original information was issued on the chain.

After the administrator adds the outgoing information of partial donation to the donation information, the system automatically returns the residual donated materials, so that the donator can clearly know the outgoing and residual of the donated materials, and one piece of donation information can correspond to a plurality of pieces of outgoing information. Therefore, data connection is ensured to be correct, chain verification can be achieved, and the donation information is ensured to develop towards fragmentation, small amount and normalization.

The invention adopts a Hash-Save mode to store the uplink of each donation information and the hash value of each outgoing information, so as to determine the state of the information, attaches the hash to each uplink information displayed in the overview page for visitors to check, and simultaneously provides a query interface, so that users can query the corresponding on-chain information through the hash value, thereby ensuring the authenticity and credibility of the information.

The invention also adds the role function of the monitoring part in order to enhance the real reliability of the system data and improve the public credibility of the fund meeting without going through the government monitoring department. The regulatory authority can query almost all data according to business requirements, but does not assign the authority of adding, modifying and deleting data. The management platform is used as a block chain node, and the management platform confirms and distributes the authority and then adds the authority into the block chain network, so as to supervise and examine the uplink data acquired in real time.

Details regarding the specific design of the foundation service platform are described in the foundation service platform technical architecture of FIG. 2.

Fig. 2 is a schematic diagram of a technical architecture of a foundation service platform in the foundation system according to an embodiment of the present invention. The technical framework has a front layer and a rear layer as a whole, and can be divided into three modules according to different functions, namely a rear-end module chain technical module, a rear-end service development module and a front-end service development module. The back end is divided into a block chain technical layer, a chain code layer, a service layer and a data layer, the Chinese secret-sdk-go executes an intelligent contract to complete the operation of the block chain technical layer by calling the chain code layer and interacts with other layers at the back end, the front end is divided into a view layer and a display layer, the middle of the front end and the back end is connected by an interface layer, and the interface layer is an intermediary for butting with each role at the front end and the back end of the platform. The functional layers of the present embodiment are discussed below:

1. block chaining technique layer

The system mainly comprises a whole set of autonomous security block chain bottom platform (as shown in figure 3), and the bottom platform is based on a domestic cryptographic algorithm SM2/SM3/SM4/x.509 national encrypted Fabric image and an upper application development toolkit. The whole set of national secret proprietary mirror images comprise peer-gm, orderer-gm, tools-gm, ccenv-gm, baseimages-gm, ca-gm, baseos-gm, cocodbb-gm and the like, and the tool kit is national secret textile-sdk-go.

And storing the developed and finished national secret Fabric image by creating a private image library. When a new fund platform needs to be generated, the management platform only needs to pull the specified mirror image from the mirror image warehouse, and the specific content is described in the fund management platform part.

Each piece of data is delegated to a modular component that is logically separate from the peers that perform the transaction and maintain the ledger to achieve consensus. The consensus mechanism in the application scene adopts a mainstream distributed message queue technology Kafka and is used for dealing with the situation of high concurrency and high throughput in a distributed environment in a block chain system.

The Orderer (ordering consensus) component provides consensus ordering for each donation and destination information from the chain code layer and packages the information into blocks to ensure data consistency. The ranking consensus component includes Kafka clusters and associated Zookeeper clusters, as well as a number of OSNs (ranking Service nodes). The platform adopts a management mode of a plurality of Kafka and zookeeper nodes, and the nodes are operated and managed in a mirror image mode, so that pluggable and upgraded services are realized.

In the aspect of node authentication, the invention generates a country cipher version certificate and a key material based on an SM2 algorithm for each node in the system based on the country cipher Fabric-CA to realize a node identity admission mechanism so as to configure and manage the identity in the blockchain network.

2. Chain code layer

The chain code layer is mainly used for compiling trusted distributed system service execution logic in the block chain, and realizing specific operation on the block chain technology layer data, so that the butt joint of the block chain technology layer and the core service on the upper layer of the block chain technology layer is completed. The invention is based on the Fabric technology, and adopts a mode of respectively realizing and managing a plurality of intelligent contracts under two sets of chain codes to deal with the complex business scene of the fund.

According to the specific business process of the foundation platform, the data needing uplink comprise Donation information and Donation destination information, so that two sets of application chain code packages are developed based on the system chain code of the Fabric bottom layer, and the Donation chain code packages and the destination chain code packages are defined in the embodiment of the invention.

And compiling intelligent contracts with functions of adding state, deleting state, updating state, inquiring state, richly inquiring, paging display and the like on the donation chain codes and the destination chain codes. The donation chain code also comprises intelligent contracts such as updating the audit state, inquiring donation according to the destination and the like. Thus, the SDK server (i.e., the Fabric-SDK of the service layer) can implement the operation on the uplink data of the blockchain sublayer by calling the chain code to execute the corresponding service logic. The intelligent contract content is as follows:

the business logic executed by the donation chain code packet is as follows:

GetDonationInfo: inquiring a corresponding state in the account book according to an appointed Key (unique donation information identifier), and returning the object after deserialization;

addDonation: the donation state storage function is realized;

querydonatbyid: inquiring the state from the account book according to a specified Key (unique donation information identifier);

modifyDonation: the re-editing function of the uplink donation state is realized;

delDonation: deleting the donation information from the account book, and paying attention to that the donation information is not really deleted but is attached with a deleted label;

queryAllDona: inquiring all donation states in the account book;

queryDonaByDonor: inquiring all donation states of corresponding donators in a rich inquiry mode;

queryDonaByReceiver: inquiring all donation states of corresponding receivers in a rich inquiry mode;

queryDonaByStatus: inquiring all donation states in a certain audit state in a rich inquiry mode;

updateStatus: the modifyDonation is called to modify the auditing state of a donation state;

querydonaByStatusWithPagination: paging the result of the queryDonaByStatus interface query;

getHistoryForDona: inquiring all historical states corresponding to the Key from an account book according to a specified Key (Donation ID), wherein all records of the information corresponding to the Key are added, deleted, changed and inquired;

searchMyDonationList: in a rich query mode, a user queries all donation states of the user;

queryMyDonawithPagination: paging the result of the searchMyDonationList query; intelligent contract to chain code management:

addSupplies: receiving an object and calling a PutSupplies interface to realize a state storage function;

querystopbyid: inquiring the state from the account book according to a specified Key (destination information unique identifier);

delSupplies: deleting a certain state in the Supplies from the account book;

querystop pbybeforedonation id: querying all the destination states in a donation state in a rich query mode;

getHistoryForSupp: inquiring all historical states corresponding to a Key (destination information unique identification) from an account book according to the appointed Key, wherein all records of the information, which is corresponding to the Key, are added, deleted, changed and checked;

modifySupplies: the re-editing function of the uplink going state is realized.

3. Data layer

And compiling the donation information and the going information which require the uplink aiming at the donation chain codes and the going chain codes and storing the donation information and the going information in a database. The data layer is divided into a bottom layer data storage and an outer layer data storage, the invention aims to distinguish uplink data from non-uplink data, a layer of data backup is packaged on the uplink data on the block chain bottom layer, and the outer layer database realizes the storage of the non-uplink data and the backup of the uplink data, thereby improving the system performance.

Facing to the bottom layer, the data management system is a CouchDB database and a WorldState set of the Fabric self-management data and the storage block data.

Facing to the outer layer, in order to facilitate the management of uplink data, the invention provides a common Mysql and Redis database on the block chain database for storing part of non-uplink data, such as mailbox verification codes used during user registration, personal information of users, personal information of administrators, account passwords and the like.

In addition, based on the characteristic that the block chain data cannot be tampered, the long-term use of the platform causes the continuous increase of the account book storage memory and the continuous overlarge storage pressure of the account book, so that the system performance is reduced; if the auditing department needs to temporarily examine the data, suddenly acquiring a large amount of linked data and sorting the data, wherein the arrangement is difficult to avoid and troublesome; the consequence of loss of a large amount of data is serious if backup is not performed. In order to solve the problem, the invention introduces 'data backup', namely, the information needing to be uplink and the generated hash value are stored in an external Mysql database in a backup mode. The backup provides one more layer of guarantee for data storage, and the backup can be conveniently and quickly performed when necessary examination is performed. The intelligent contract and Mysql database instructions can easily access the information state without being calculated by traversing the whole transaction log, and the default state and the data information are represented as Key-Value. The Mysql database stores various index data according to the categories of donation information, destination information, user information and the like, and the combination makes the Mysql database easy to support complex query operations compared with a block chain underlying database, such as all certain types of transactions in a certain block range, the total number of transactions in a certain range and the like.

In order to facilitate the deployment and management of the foundation service platform by the management platform, the invention also uses the Mysql and Redis mirror image form to be matched with the generated whole set of block chain bottom layer mirror image for use.

Although an ordinary user can not be added into a network as a node, the invention aims to ensure that a platform administrator can not see the real account password of the user in a user database, and when the database is attacked, an attacker can not directly acquire the account password of the user, so that the safety of user information is ensured and the decentralization of the whole system is enhanced to a certain degree. Therefore, the invention provides a password storage method.

Referring to fig. 4, the present invention provides a special method for storing a hash password with salt, which is used for a client and a server in a data layer to perform user password information interaction, wherein the client refers to a user host provided on a web page for a foundation user to complete account registration, account login and password modification, the server refers to a background data server of a foundation service platform, and the specific contents and operation flows are as follows:

the password is subjected to salt hash and then stored in the Mysql database in the form of: HASH (password + salt), where password is the user password, salt is the salt (128 bit random string), HASH refers to SM3 cryptographic HASH algorithm that generates 128 bit binary string, and "+" refers to character concatenation. But the use of the salting hash also requires avoiding some unsafe behavior:

salt number repetition: the salt value is easy to be attacked by rainbow tables and other modes after being repeated for a long time.

Short salt number: short salt values do not guarantee sufficient safety and generally require a salt length greater than or equal to the length of the hash value.

Salt hash is done only on one side (server side or client side): if only the server side carries out the salt hash, an attacker only needs to acquire the content sent to the server side by the client side. Even if the attacker does not know the password of the user, the attacker can successfully log in only by sending the acquired content which needs to be sent to the server. And if the salt adding hash is only carried out on the client, the attacker obtains the salt adding hash result stored in the database and sends the salt adding hash result to the server, and the login is successful.

The following conditions therefore need to be satisfied for the above unsafe behaviour:

a change in salt value per entry;

long salt, length of salt greater than or equal to length of hash value;

both the client and server need a salt hash.

The operation flow of the salt adding hash is divided into three steps, namely registration, login and password change.

And (3) registration:

1) the client user registers and inputs an account password set by the user;

2) the client calls a GetSalt (username) interface, and acquires a salt value corresponding to the username from the server, wherein the username does not exist in the database because of the registration link, and the returned salt value is generated randomly;

3) the client inputs the user password and the salt value into an SM3 hash algorithm, returns a hash value and sends the hash value and the salt value to the server;

4) the server side saves this hash value and the salt value (where the back end saves the salt value in the database).

Logging in:

1) a client user logs in, inputs an account password (namely a user name and a password) and sends the account password to a server;

2) the server side inquires a salt value corresponding to the user name, generates a new salt value and sends the new salt value to the client side;

3) the client executes a hash1 generated by a hash algorithm of the password and old salt value input SM3 and a hash2 generated by a hash algorithm of the password and new salt value input SM3, and sends two results to the server;

4) and the server side verifies whether the results of the hash1 and the database are consistent, if so, the login is successful, the hash1 and the old salt value are updated to be the hash2 and the new salt value, and if the comparison result is inconsistent, the login is failed.

Password change:

1) a client user logs in and inputs an account, an old password and a new password;

2) the server side inquires the corresponding salt value, generates a new salt value and sends the new salt value to the client side;

3) the client executes a hash1 generated by an old password and old salt value input SM3 hash algorithm and a hash2 generated by a new password and new salt value input SM3 hash algorithm, and sends the hash1 and the hash2 to the server;

4) and the server side verifies whether the results of the hash1 and the database are consistent, if so, the login is successful, the hash1 and the old salt value are changed into the hash2 and the new salt value, and the old password of the user is changed into the new password. And if the comparison result is inconsistent, returning login failure.

4. Service layer

In order to meet the design policy of high cohesion and low coupling, the invention abstracts the service layer for uniform management on the donation data, the destination data and the user information of each application interface and data layer of the interface layer.

The modules which are responsible for management of the service layer are mutually independent, each module only completes one sub-function of the foundation meeting service platform, and specifically comprises a set of generated system CA certificate, a configuration file of an initialization block chain bottom layer, a pluggable consensus plug-in and an SDK service end.

The service layer relies on a set of certificates generated by the script and an initialization configuration file and starts a set of images required by the platform through a docker-composition tool, wherein the set of images comprises a plurality of Kafka images, Zookeper images, Cochdb images, Mysql images and Redis images, and the images are used as images of an external image collocation block chain technology layer to be started together. The Kafka mirror image is matched with the Zookeeper mirror image to participate in consensus (the Kafka participates in consensus sequencing, and the Zookeeper manages load balance in the Kakfa data transmission process), the Cochdb mirror image stores block data obtained by packaging donation information and outgoing information into blocks, and the Mysql mirror image and the Redis mirror image are responsible for storing personal information of users. The set of images is placed in the same network bridge segment to isolate other launched images. It is noted that peer's startup relies on kafka, Zookeeper and Couchdb, and the circumscribed mirror relies collectively on the blockchain technology layer mirror.

In a test environment, the consensus of default calling of the service layer is a solo mode, and the consensus of the combination of kafka and zookeeper can be changed in configuration in practical application, so that pluggable under different scenes is realized.

The SDK server is mainly used for calling a corresponding API by using an interface object provided by the Fabric-SDK-go to realize the access to the chain code at a service layer, and finally, the terminal can call the API to realize the intelligent contract to execute the state operation in the blockchain account book.

5. Interface layer

The interface layer provides a whole set of APIs for front-end and back-end data interaction, and generally comprises an API for calling the data layers Mysql and Redis and an API for calling the SDK service end to realize the operation of the intelligent contract at the bottom of the block chain, and the definition of the interfaces and the application content in the front end are as follows:

in relation to donation information:

AddDonation: adding donations, wherein the donations are used for a user to control a page to realize the addition of the donation information by the user;

findddonationbyid: inquiring donations, wherein the user controls a page to realize detailed inquiry of single donation information;

SearchwaitAuditList: an un-approved donation list, which is used for acquiring all un-approved donation information by an administrator page;

SearchDonationList: the donation list after the audit is passed is used for the administrator to operate the page and read the page to obtain all donation information after the audit is passed;

SearchTotalOfDonationList: the total number of the donation information after passing the audit is used for reading a page for the visitor to inquire the total number of the love donation;

SearchMyDonationList: appointing all donation lists of a user, and using the donation lists to control a page by the user to obtain all donation information of the user;

passaudio: and changing the non-auditing state of the donation information into an auditing passing state, wherein the auditing passing state is used for controlling a page by an administrator to realize the management of the state of the donation information.

Failpassaudio: and changing the non-auditing state of the donation information into an auditing passing state, wherein the auditing passing state is used for controlling a page by an administrator to realize the management of the state of the donation information.

ModifyDonation: modifying the donation, wherein the modification is used for modifying the donation information by an administrator control page;

DeleteDonation: deleting donations, wherein the donations are used for deleting donation information by an administrator control page;

associated with the destination information:

AddSupplies: adding a destination for an administrator to control a page to realize adding the destination to the donations passed by the single audit;

findsuppliessbyid: and the query destination is used for realizing the query of the single destination information by controlling the page by an administrator, controlling the page by a user and reading the page.

Modifydupplies: the modified destination is used for modifying the destination information by controlling the page by an administrator;

supplielistbybefdonatid: and inquiring the destination list of the single donation, wherein the destination list is used for inquiring all the destination information of the single donation by an administrator controlling a page, a user controlling the page and a user reading the page.

Deletesupppies: deleting the destination, wherein the destination information is deleted by controlling the page by the administrator;

in connection with account login, authentication and management:

UserLogin: logging in, which is used for realizing the information of a common user/administrator login account on a login page;

UserLogout: logging out, wherein the logging out is used for logging out by a user control page and an administrator control page;

SendVerifyCodeByEmailForRegister: mailbox verification, which is used for the registration page to acquire the verification code from the background database and check whether the verification code is matched with the verification code input by the front end;

register: registering, namely registering common users on a registration page and generating an account;

QueryUsers List: the user list is used for an administrator to control the page to acquire user account information and realize the management of the administrator on the user accounts;

DeleteUser: deleting the user, wherein the user is used for deleting the user account information by the administrator operation and control page, so that the administrator can manage the user account;

GetUserSalt: the user salt value is obtained and used for obtaining the user salt value generated by the background through the login page and the registration page, and the interface is used for a special password storage method provided in the specification, which can be referred to above.

6. Revealing layer

The presentation layer is a data interaction layer of the platform server side, and defines how each API of the interface layer interacts and how data acquisition and processing are carried out. The Ajax technology is used for data requests, namely a Post request and a Get request. And carrying out data transmission by using a WebSocket and a Json form.

7. Viewing layer

And displaying the view layer corresponding to the platform page. For the webpage end, technologies such as REACT, HTML5 and CSS are mainly used for page processing, and setting of corresponding data and operation ports is completed. And (3) for the App end, an Android operating system is used for completing the writing of Activity and XML files. The main pages of the Web end provided by the layer comprise: the system comprises a browsing page (for visitors to browse cochain data, the periphery of a platform and the like), a user control page (for common users to use after logging in an account), an administrator control page (for administrators to use after logging in the account), and a user/administrator login and registration page.

Second, fund management platform

Referring to FIG. 5, a diagram of a fund management platform model is provided for an embodiment of the present disclosure. One fund management platform is responsible for managing a group of fund clusters, namely a plurality of fund server platforms. The newly added fund can be registered in the management platform, the management platform authorizes the access authority of the private mirror image warehouse, and after materials required by the new fund service platform are generated, the fund can be deployed and started through the deployment script. Referring to fig. 6, a foundation management platform management flow diagram in the foundation system is provided for the disclosed embodiments. After the fund service platform is deployed and started, the fund management platform continues to manage and monitor all joined fund, and provides technical maintenance and version upgrading for each fund.

The fund management platform comprises a fund management back end and a webpage end provided for management personnel, and the main functions and modules of the fund management platform are a Docker private mirror image warehouse, a platform manager system, a fund information management system, a fund deployment management system and a fund monitoring system.

The Docker private mirror image warehouse is mainly used for deployment and upgrade of foundation and the like. The management platform provides two modes for the deployment of the fund service platform, wherein the two modes are the modes of fund deployment and management platform hosting respectively. The fund can deploy the fund service to the physical or cloud server of the fund service according to the requirement of the fund on data privacy, and can also select to directly use the cloud server of the fund management platform for deployment. The Docker deployment mode is easy to operate, and errors generated by an operating system and a running environment in the deployment process can be reduced. The Docker private image warehouse includes a foundation service platform image into which the foundation code itself is compiled by Docker, in addition to images such as peer-gm, orderer-gm, ccenv-gm, ca-gm, corehdb-gm, mysql, redis, kafka, zookeeper, and the like required by the foundation service platform. If the fund chooses to deploy on a new server, the mirror can be pulled to the local by only installing Docker and Docker-Compound on the new server.

The platform administrator system mainly manages an administrator account and maintains the security of the account, except for initializing an administrator user and a password, the platform administrator system functionally comprises functions of adding a platform administrator, modifying personal information, modifying a personal password, canceling and the like, and a salt hash password storage method is considered to be used for protecting the account password in the security so as to prevent leakage or attack. For a platform administrator, the system needs to maintain a platform administrator data table of Mysql and a Redis database for storing login state information.

The fund information management mainly records and manages information of the fund. The system maintains a Mysql foundation information data table which mainly comprises unique foundation ID, foundation name, legal person, contact way, foundation description, deployment way and other foundation specific information. If a new fund wants to use the fund management traceability service and join the platform, a platform administrator of the fund management platform needs to be contacted, and own fund information is submitted on a webpage or a client. And after the platform audit is passed, providing software required by the foundation system deployment for the platform audit. If the new fund selects a cloud server deployment mode provided by the platform, the management platform allocates platform resources for the new fund, such as a webpage monitoring port number of the fund.

Foundation deployment management primarily provides the manner in which a foundation is deployed, including a suite of materials and deployment scripts needed for deployment. Deployment material includes the aforementioned foundation, peer-gm, orderer-gm, etc. mirrors, certificate keys needed to start block chain link points, as well as startup configuration files and dependency files. After the fund application and deployment, the management platform generates a certificate and other materials for the fund according to the unique ID of the fund and other information after the audit of the management platform passes. According to the personalized configurations of the foundation information, the deployment mode and the like, the management platform can automatically generate a docker-composition- [ foundation ID ]. yaml configuration file, the configuration file provides environment configurations, mapping directories and the like of fabric-peer, fabric-order and mysql, and further provides the configuration and the mapping directory corresponding to the foundation service platform foundation. The personalized configuration of the yaml configuration file comprises the ID of the fund, the directory corresponding to the certificate key and the dependent file directory. The dependency file comprises a foundation website homepage picture, a national secret Fabric activation file and the like, wherein the foundation website homepage picture can be displayed in the website of the foundation, and the national secret Fabric activation file is used for activating the Fabric national secret image of the server.

If a fund is selected to be deployed on a server of the platform, a container such as foundation ID, peer0-gm foundation ID, mysql foundation ID, redis foundation ID and the like is started on a server of the management platform by using a socket-composition tool according to the socket-composition foundation ID. Containers of different fund junctions are divided into different networks and do not interfere with each other during operation.

The monitoring system of the fund mainly comprises two modes of container logs and a fund-based platform. The containers corresponding to the mirror images such as foundation and peer-gm can output logs in the running process, the monitoring system can execute a docker log command, and log information is integrated and displayed on a webpage of the management platform finally. The foundation service platform foundation reserves some interfaces for monitoring and compiles into an executable file monitor, and the monitoring system can access the inside of the container, execute the file with some parameters and obtain an output result. And finally, the monitoring system performs integration processing and displays the integration processing to a webpage end, for example, the monitoring system can inquire the donation data with the donation number XX.

The currently considered fund donation data is controlled by the fund, in order to enable users of various funds to conveniently and mutually access without repeatedly registering an account, a user database is established by a platform, the user database of each fund can regularly interact with the platform user database, and finally the fund and the platform can share one user database without establishing a channel for the donation data of the fund.

The above embodiments are only intended to illustrate the technical solution of the present invention and not to limit the same, and a person skilled in the art can make modifications or equivalent substitutions to the technical solution of the present invention without departing from the spirit and scope of the present invention, and the scope of protection of the present invention should be subject to the claims.

Claims (7)

1. A fund system based on a block chain is characterized by comprising a plurality of fund service platforms managed and maintained by a fund management platform, wherein each fund corresponds to one fund service platform; the fund service platform issues the donation information provided by the registered donators to the block chain after the approval is passed and returns a destination certificate, and issues the donation information provided by the fund service platform administrator to the block chain; wherein

The fund meeting service platform comprises a middle layer, a rear-end development module and a front-end development module; the back-end development module comprises a block chain technology layer, a chain code layer, a service layer and a data layer, and the front-end development module comprises a view layer and a display layer;

the block chain technology layer comprises a sequencing consensus component and a plurality of different Fabric images, and different foundation platforms correspond to the different Fabric images; the sequencing consensus component is used for providing consensus sequencing for each piece of donation information and donation destination information transmitted by the chain code layer and packaging the donation destination information into blocks so as to ensure data consistency;

the chain code layer is used for compiling trusted distributed system service execution logic in the block chain and realizing specific operation on the data of the block chain technology layer so as to complete the butt joint of the block chain technology layer and the upper layer service thereof; wherein the blockchain technology layer data comprises donation information and donation destination information, the data packets of the blockchain technology layer comprise donation chain code packets and destination chain code packets, and the blockchain of the blockchain technology layer comprises donation chain codes and destination chain codes; writing an intelligent contract with a function of setting donation data in the donation chain code; an intelligent contract with a function of setting the destination data is compiled in the destination chain code;

the data layer is used for compiling the donation information issued to the blockchain on the donation chain codes and compiling the donation outgoing information issued to the blockchain on the outgoing chain codes;

the service layer is used for resource management and operation and maintenance monitoring and comprises an SDK (software development kit) service end, a resource management module and an operation and maintenance monitoring module; the resources managed by the resource management module comprise CA certificates, configuration files at the bottom layer of the block chain, pluggable common identification plug-ins, Fabric images and external images;

the middle layer is used for providing each terminal module for the data interaction between the back-end development module and the front-end development module;

the display layer is used for setting an interaction mode and a data acquisition and processing mode of each terminal module of the interface layer;

and the view layer is used for displaying the data.

2. The system of claim 1, wherein the smart contracts include smart contracts written in a donation chain with add, delete, update, query, richness, and pagination status for donated data, smart contracts written in a donation chain with update audit status for donated data, query donation according to audit status, donation according to go to query, and smart contracts written in a go to chain with add, delete, update, query, richness, and pagination status for go to data.

3. The system of claim 1 wherein the data layer distinguishes between uplink data and non-uplink data and encapsulates a layer of data backup for uplink data on top of a blockchain sublayer; and the data layer stores the encapsulated data backup and the un-uplink data into an outer database, and stores the data to be uplink and the hash value thereof into a block chain bottom database in a backup mode.

4. The system of claim 1, wherein the user password storage method when the client and the server perform user password interaction in the data layer is as follows:

a) in the registration stage, a client receives a user password and a user name username which are input when a user registers; then obtaining a salt value corresponding to the user name username; then the client generates a hash value according to the user password and the salt value, and sends the hash value and the salt value to the server; the server side stores the hash value and the salt value;

b) in the login stage, a client receives a user password and a user name username input when a user logs in and sends the user password and the user name username to a server, the server inquires a corresponding salt value according to the user name username, and if the corresponding salt value exists, a new salt value is generated and sent to the client; the client generates a hash value hash1 according to the user password and the salt value before updating, generates a hash value hash2 according to the user password and the new salt value, and then sends the hash value hash1 and the hash value hash2 to the server; the server side verifies whether the hash value hash1 is consistent with the hash value stored in the database, if so, the user successfully logs in, and updates the hash value of the user to be hash value hash2 and the salt value to be the new salt value; if the comparison result is inconsistent, returning login failure information;

c) in the password changing stage, a client receives a user name username, an old password and a new password input by a user and sends the user name username, the old password and the new password to a server; the server side inquires a corresponding salt value according to the user name username, and if the corresponding salt value exists, a new salt value is generated and sent to the client side; the client generates a hash value hash1 according to the old password and the salt value before updating, generates a hash value hash2 according to the new password and the new salt value, and then sends the hash value hash1 and the hash value hash2 to the server; the server side verifies whether the hash value hash1 is consistent with the hash value stored in the database, if so, the old password of the user is updated to the new password, the hash value of the user is updated to the hash value hash2, and the salt value is updated to the new salt value; and if the comparison result is inconsistent, returning failure information.

5. The system of claim 1, wherein the circumscribed image comprises a Kafka image, a Zookeeper image, a Couchdb image, a Mysql image, and a Redis image; the system comprises a Kafka mirror image, a Zookeeper mirror image, a Cochdb mirror image, a Mysql mirror image and a Redis mirror image, wherein the Kafka mirror image is matched with the Zookeper mirror image to participate in consensus, the Cochdb mirror image is used for storing block data obtained by packaging donation information and donation outgoing information into blocks, and the Mysql mirror image and the Redis mirror image are used for storing personal information of users.

6. The system of claim 1 or 5, wherein the external mirror is located in the same network bridge segment and the external mirror is located in a different network bridge segment than other initiated mirrors.

7. The system of claim 1, wherein the SDK server performs operations on the published data by invoking different chain codes to execute corresponding business logic.

Images