CN113010878A

CN113010878A - Role and authority management method based on block chain

Info

Publication number: CN113010878A
Application number: CN202110314517.8A
Authority: CN
Inventors: 史云凌; 肖峻峰; 张淮
Original assignee: Nanjing Qingzhan Artificial Intelligence Research Institute Co ltd
Current assignee: Nanjing Qingzhan Artificial Intelligence Research Institute Co ltd
Priority date: 2021-03-24
Filing date: 2021-03-24
Publication date: 2021-06-22

Abstract

The invention discloses a role and authority management method based on a block chain, which comprises the following steps: the invention discloses role and permission agreement, role initialization, role new permission endowing, role permission recovery, role permission collection extraction and permission verification in a block chain, and relates to the technical field of computer block chains. The role and authority management method based on the block chain overcomes the defects that the traditional block chain cannot set and verify authority, all information is disclosed and the like, provides consistent multi-role and multi-authority characteristics for users of the multi-block chain, improves the safety of the block chain and protects the privacy of the users.

Description

Role and authority management method based on block chain

Technical Field

The invention relates to the technical field of computer block chains, in particular to a role and authority management method based on a block chain.

Background

Utxo (outstanding Transaction outputs) is an inexpensive Transaction output, which is a core concept for bitcoin Transaction generation and verification. The transactions constitute a set of chain structures, all legal bitcoin transactions can be traced back to the output of one or more transactions onwards, the source of the chain being the mine-digging reward, and the end being the current unspent transaction output.

After bitcoin, etherhouse (Ethereum) is an open-source and smart contract-enabled public blockchain platform that provides decentralized ethernet Virtual machines (Ethereum Virtual machines) to handle point-to-point contracts through its dedicated cryptocurrency ethercoin (etherer, abbreviated as "ETH").

On a traditional block chain, all users are anonymous and have no authority control, anyone can join and quit at any time, and can randomly access the block chain and obtain all data on the block chain. In a block chain of enterprise-level applications, a lot of privacy and confidential data are involved, and the data cannot be disclosed and can only be seen or used within a certain role and authority range.

Disclosure of Invention

Technical problem to be solved

Aiming at the defects of the prior art, the invention provides a role and authority management method based on a block chain, which overcomes the defects that the traditional block chain cannot set and verify authority, all information is disclosed and the like, provides consistent multi-role and multi-authority characteristics for multi-block chain users, improves the safety of the block chain and protects the privacy of the users.

(II) technical scheme

In order to achieve the purpose, the invention is realized by the following technical scheme: a role and authority management method based on a block chain comprises the following steps:

step one, role and authority convention in a block chain:

step two, role initialization:

step three, endowing the role with new authority:

step four, withdrawing the authority of the role:

step five, extracting the authority set of the role:

step six, authority verification:

preferably, the blockchain is a UTXO-based blockchain with an expanded staining field; the authority generally refers to a kind of protection access to resources, in the UTXO model, authority can be stored in dyeing data of UTXO, and one UTXO can store a plurality of authority definition values in dyeing data, but cannot be repeated; adding 1 to the face value which is not spent by the UTXO every time one authority dyeing value is added; the ROLEs are sets having a series of permissions, one ROLE corresponding to one blockchain address (ADDR _ roll), and ADDR _ roll can obtain one or more UTXOs through permission allocation.

Preferably, the role initialization specifically includes the following steps: firstly, an administrator user creates a ROLE, the code of which is ROLE _ A and is named as ROLE A; then the administrator user creates a block chain address ADDR _ a through a block chain ROLE management module (roll _ policy _ MOD); the roll _ policy _ MOD records roll _ a and ADDR _ a as a correspondence, and stores the key of the address ADDR _ a.

Preferably, the giving of the new authority to the role specifically includes the following steps: firstly, inquiring an address ADDR _ A of a ROLE A on a block chain through a block chain ROLE management module (ROLE _ PERMISSION _ MOD); then, setting the dyeing value of the new authority given to the role A as COL _ A; then looking at all UTXOs in the ADDR _ A address, combining all authority dyeing data and removing duplication to generate a set 1(LIST _ 1); when LIST _1 does not contain COL _ A, a UTXO with COL _ A dyeing information is issued to ADDR _ A through a dyeing currency center (a currency center based on a UTXO block chain), and the face value is 1; when the LIST _1 contains the COL _ a, the UTXO is not issued any more; if a plurality of authorities are given to the role A at one time, the dyeing values are respectively COL _ A and COL _ B, and are defined as a set 2(LIST _ 2); then look at all UTXOs in ADDR _ a address, combine all rights staining data and deduplicate, produce set 3(LIST _3), calculate the difference set of LIST _2 and LIST _ 3(LIST _4), when LIST _4 is not empty (assuming COL _ a, COL _ B are included), issue a UTXO with COL _ a and COL _ B staining information to ADDR _ a through the staining coin center, with a face value of 2.

Preferably, the step of withdrawing the role authority specifically includes the following steps: firstly, inquiring an address ADDR _ A of a ROLE A on a block chain through a block chain ROLE management module (ROLE _ PERMISSION _ MOD); then, setting the dyeing value of the new authority of the withdrawing role A as COL _ A; then looking up all UTXOs in the ADDR _ A address, inquiring UTXO (UTXO _ A) containing COL _ A dyeing data, if the VALUE VALUE _ A is larger than 1, extracting all dyeing data in UTXO _ A, and generating a set 5(LIST _ 5); next, cost UTXO _ a; next, a UTXO (UTXO _ B) with the dye data in LIST _5 was issued by the dye issue center with a VALUE of VALUE _ A-1.

Preferably, the set of permissions for extracting roles specifically includes the following steps: firstly, inquiring an address ADDR _ A of a ROLE A on a block chain through a block chain ROLE management module (ROLE _ PERMISSION _ MOD); then look at all UTXOs in ADDR _ a addresses, combine all rights dye data and deduplicate, yielding set 1(LIST _1), LIST _1 being the set of rights owned by the role.

Preferably, the right verification specifically includes the following steps: firstly, providing a ROLE LIST (LIST _ ROLE) of a user to be queried through an external system (OUT _ SYS), then continuously providing a PERMISSION LIST (LIST _ COL) to be verified through the external system (OUT _ SYS), then sequentially querying PERMISSION sets (LIST _ COL _1, LIST _ COL _2 and LIST _ COL _3 …) of all ROLEs through a block chain ROLE management module (ROLE _ PERMISSION _ MOD), and generating a set LIST _ COL _4 after deduplication, and then returning the set to the external system (OUT _ SYS) by calculating the intersection of LIST _ COL and LIST _ COL _ 4.

Advantageous effects

The invention provides a role and authority management method based on a block chain. The method has the following beneficial effects:

(1) according to the role and authority management method based on the block chain, under the distributed environment, the ownership of the data does not belong to the platform any more but belongs to the true owner of the data. The invention discloses a role and authority management method based on UTXO and dyeing technology, which allows a user to obtain different roles in distributed ecology, thereby fully protecting the privacy and rights and interests of a data owner.

(2) According to the role and authority management method based on the block chains, target operation role information is verified through a unified verification center through account addresses (ADDR _ IN _ A) of different types IN a single block chain and addresses (ADDR _ CROS _ A) used for information exchange among a plurality of block chains. And verifying the validity of the address (ADDR _ ANY) which provides the ROLE verification request by adopting a cryptographic digital signature algorithm, extracting ROLE information contained in the ADDR _ ANY, and inquiring all operation ROLE authorities owned by the access address (ADDR _ ANY) through a BLOCK chain (BLOCK _ ROLE) for storing the ROLE authorities.

Drawings

FIG. 1 is a schematic flow chart of the present invention for assigning new rights to roles;

FIG. 2 is a flow chart illustrating the process of retrieving role rights according to the present invention;

FIG. 3 is a flowchart illustrating a process of rights verification according to the present invention.

Detailed Description

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.

Referring to fig. 1-3, the present invention provides a technical solution: a role and authority management method based on a block chain comprises the following steps:

step one, role and authority convention in a block chain:

step two, role initialization:

step three, endowing the role with new authority:

step four, withdrawing the authority of the role:

step five, extracting the authority set of the role:

step six, authority verification:

in this embodiment, the blockchain refers to a blockchain based on UTXO and extended with a dye field; the authority generally refers to a kind of protected access to resources, in the UTXO model, the authority can be stored in dyeing data of the UTXO, and one UTXO can store a plurality of authority definition values in the dyeing data, but cannot be repeated; adding 1 to the face value which is not spent by the UTXO every time one authority dyeing value is added; a ROLE is a set of permissions, one ROLE corresponding to a blockchain address (ADDR _ roll), which may be assigned by the permissions to obtain one or more UTXOs. The blockchain ROLE management module (ROLE _ PERMISSION _ MOD) is responsible for defining the privilege dyeing value, such as (COL _ A, COL _ B, COL _ C), and querying the UTXO owned by an address (ADDR _ ROLE).

In this embodiment, the role initialization specifically includes the following steps: firstly, an administrator user creates a ROLE, the code of which is ROLE _ A and is named as ROLE A; then the administrator user creates a block chain address ADDR _ a through a block chain ROLE management module (roll _ policy _ MOD); the roll _ policy _ MOD records roll _ a and ADDR _ a as a correspondence, and stores the key of the address ADDR _ a.

In this embodiment, the step of giving the new authority to the role specifically includes the following steps: firstly, inquiring an address ADDR _ A of a ROLE A on a block chain through a block chain ROLE management module (ROLE _ PERMISSION _ MOD); then, setting the dyeing value of the new authority given to the role A as COL _ A; then looking at all UTXOs in the ADDR _ A address, combining all authority dyeing data and removing duplication to generate a set 1(LIST _ 1); when LIST _1 does not contain COL _ A, a UTXO with COL _ A dyeing information is issued to ADDR _ A through a dyeing currency center (a currency center based on a UTXO block chain), and the face value is 1; when the LIST _1 contains the COL _ a, the UTXO is not issued any more; if a plurality of authorities are given to the role A at one time, the dyeing values are respectively COL _ A and COL _ B, and are defined as a set 2(LIST _ 2); then look at all UTXOs in ADDR _ a address, combine all rights staining data and deduplicate, produce set 3(LIST _3), calculate the difference set of LIST _2 and LIST _ 3(LIST _4), when LIST _4 is not empty (assuming COL _ a, COL _ B are included), issue a UTXO with COL _ a and COL _ B staining information to ADDR _ a through the staining coin center, with a face value of 2. After a new privilege is given to a ROLE, all users belonging to the ROLE in the block chain using ROLE _ PERMISSION _ MOD will thus obtain the new privilege.

In this embodiment, the permission to retrieve the role specifically includes the following steps: firstly, inquiring an address ADDR _ A of a ROLE A on a block chain through a block chain ROLE management module (ROLE _ PERMISSION _ MOD); then, setting the dyeing value of the new authority of the withdrawing role A as COL _ A; then looking up all UTXOs in the ADDR _ A address, inquiring UTXO (UTXO _ A) containing COL _ A dyeing data, if the VALUE VALUE _ A is larger than 1, extracting all dyeing data in UTXO _ A, and generating a set 5(LIST _ 5); next, cost UTXO _ a; next, a UTXO (UTXO _ B) with the dye data in LIST _5 was issued by the dye issue center with a VALUE of VALUE _ A-1. After recovering the authority of the ROLE, all users belonging to the ROLE in the block chain using ROLE _ PERMISSION _ MOD will lose the recovery authority,

in this embodiment, the method for extracting a permission set of a role specifically includes the following steps: firstly, inquiring an address ADDR _ A of a ROLE A on a block chain through a block chain ROLE management module (ROLE _ PERMISSION _ MOD); then look at all UTXOs in ADDR _ a addresses, combine all rights dye data and deduplicate, yielding set 1(LIST _1), LIST _1 being the set of rights owned by the role.

In this embodiment, the permission verification specifically includes the following steps: firstly, providing a ROLE LIST (LIST _ ROLE) of a user to be queried through an external system (OUT _ SYS), then continuously providing a PERMISSION LIST (LIST _ COL) to be verified through the external system (OUT _ SYS), then sequentially querying PERMISSION sets (LIST _ COL _1, LIST _ COL _2 and LIST _ COL _3 …) of all ROLEs through a block chain ROLE management module (ROLE _ PERMISSION _ MOD), and generating a set LIST _ COL _4 after deduplication, and then returning the set to the external system (OUT _ SYS) by calculating the intersection of LIST _ COL and LIST _ COL _ 4.

During work, firstly, a ROLE is created through an administrator user, and a code is ROLE _ A and is named as ROLE A; then, the administrator user creates a block chain address ADDR _ a through a block chain ROLE management module (roll _ redundancy _ MOD), the roll _ redundancy _ MOD records the roll _ a and the ADDR _ a as a corresponding relation, and a key of the address ADDR _ a is stored; then, inquiring the address ADDR _ A of the ROLE A on the blockchain through a blockchain ROLE management module (ROLE _ PERMISSION _ MOD); the dyeing value of the new authority given to the role A is COL _ A, then all UTXOs in the ADDR _ A address are checked, all authority dyeing data are combined and deduplicated to generate a set 1(LIST _1), when the LIST _1 does not contain COL _ A, a UTXO with COL _ A dyeing information is issued to the ADDR _ A through a dyeing coin issuing center (a coin issuing center based on a UTXO block chain), the face value is 1, and when the LIST _1 contains COL _ A, the UTXO is not issued any more; if a role A is endowed with a plurality of rights, the dyeing values are COL _ A and COL _ B respectively and are defined as a set 2(LIST _2), all UTXOs in an ADDR _ A address are continuously checked, all rights dyeing data are merged and are deduplicated to generate a set 3(LIST _3), a difference set (LIST _4) of the LIST _2 and the LIST _3 is calculated, and when the LIST _4 is not empty (including COL _ A and COL _ B is assumed), a UTXO with COL _ A and COL _ B dyeing information is issued to the ADDR _ A through a dyeing currency center, and the face value is 2; then, inquiring an address ADDR _ A of the ROLE A on the block chain through a block chain ROLE management module (ROLE _ PERMISSION _ MOD); the new authority dyeing value given to the recovery role A is COL _ A; then looking up all UTXOs in the ADDR _ A address, inquiring UTXO (UTXO _ A) containing COL _ A dyeing data, if the VALUE VALUE _ A is larger than 1, extracting all dyeing data in UTXO _ A, and generating a set 5(LIST _ 5); next, cost UTXO _ a; then, issuing a UTXO (UTXO _ B) with dyeing data in LIST _5 through a dyeing and issuing center, wherein the face VALUE is VALUE _ A-1; then, inquiring an address ADDR _ A of the ROLE A on the block chain through a block chain ROLE management module (ROLE _ PERMISSION _ MOD); then looking up all UTXOs in the ADDR _ A address, combining all authority dyeing data and removing duplication to generate a set 1(LIST _1), wherein the LIST _1 is an authority set owned by the role; finally, providing a ROLE LIST (LIST _ ROLE) of a user to be queried through an external system (OUT _ SYS), continuously providing a PERMISSION LIST (LIST _ COL) to be verified through the external system (OUT _ SYS), sequentially querying PERMISSION sets (LIST _ COL _1, LIST _ COL _2 and LIST _ COL _3 …) of all ROLEs through a block chain ROLE management module (ROLE _ PERMISSION _ MOD), and generating a set LIST _ COL _4 after duplication, and then returning the set to the external system (OUT _ SYS) by calculating the intersection of LIST _ COL and LIST _ COL _4 to complete verification.

It is noted that, herein, relational terms such as first and second, and the like may be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Also, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation. The use of the phrase "comprising one of the elements does not exclude the presence of other like elements in the process, method, article, or apparatus that comprises the element.

Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that changes, modifications, substitutions and alterations can be made in these embodiments without departing from the principles and spirit of the invention, the scope of which is defined in the appended claims and their equivalents.

Claims

1. A role and authority management method based on a block chain is characterized by comprising the following steps:

step one, role and authority convention in a block chain:

step two, role initialization:

step three, endowing the role with new authority:

step four, withdrawing the authority of the role:

step five, extracting the authority set of the role:

and step six, authority verification.

2. The method of claim 1, wherein the method comprises: the block chain in the step one is a UTXO-based block chain with an expanded dyeing field; the authority generally refers to a kind of protection access to resources, in the UTXO model, authority can be stored in dyeing data of UTXO, and one UTXO can store a plurality of authority definition values in dyeing data, but cannot be repeated; adding 1 to the face value which is not spent by the UTXO every time one authority dyeing value is added; the ROLEs are sets having a series of permissions, one ROLE corresponding to one blockchain address (ADDR _ roll), and ADDR _ roll can obtain one or more UTXOs through permission allocation.

3. The method of claim 1, wherein the method comprises: the initialization of the role in the second step specifically includes the following steps: firstly, an administrator user creates a ROLE, the code of which is ROLE _ A and is named as ROLE A; then the administrator user creates a block chain address ADDR _ a through a block chain ROLE management module (roll _ policy _ MOD); the roll _ policy _ MOD records roll _ a and ADDR _ a as a correspondence, and stores the key of the address ADDR _ a.

4. The method of claim 1, wherein the method comprises: the step three, giving the new authority to the role specifically comprises the following steps: firstly, inquiring an address ADDR _ A of a ROLE A on a block chain through a block chain ROLE management module (ROLE _ PERMISSION _ MOD); then, setting the dyeing value of the new authority given to the role A as COL _ A; then looking at all UTXOs in the ADDR _ A address, combining all authority dyeing data and removing duplication to generate a set 1(LIST _ 1); when LIST _1 does not contain COL _ A, a UTXO with COL _ A dyeing information is issued to ADDR _ A through a dyeing currency center (a currency center based on a UTXO block chain), and the face value is 1; when the LIST _1 contains the COL _ a, the UTXO is not issued any more; if a plurality of authorities are given to the role A at one time, the dyeing values are respectively COL _ A and COL _ B, and are defined as a set 2(LIST _ 2); then look at all UTXOs in ADDR _ a address, combine all rights staining data and deduplicate, produce set 3(LIST _3), calculate the difference set of LIST _2 and LIST _ 3(LIST _4), when LIST _4 is not empty (assuming COL _ a, COL _ B are included), issue a UTXO with COL _ a and COL _ B staining information to ADDR _ a through the staining coin center, with a face value of 2.

5. The method of claim 1, wherein the method comprises: the permission to withdraw the role in step four specifically includes the following steps: firstly, inquiring an address ADDR _ A of a ROLE A on a block chain through a block chain ROLE management module (ROLE _ PERMISSION _ MOD); then, setting the dyeing value of the new authority of the withdrawing role A as COL _ A; then looking up all UTXOs in the ADDR _ A address, inquiring UTXO (UTXO _ A) containing COL _ A dyeing data, if the VALUE VALUE _ A is larger than 1, extracting all dyeing data in UTXO _ A, and generating a set 5(LIST _ 5); next, cost UTXO _ a; next, a UTXO (UTXO _ B) with the dye data in LIST _5 was issued by the dye issue center with a VALUE of VALUE _ A-1.

6. The method of claim 1, wherein the method comprises: the permission set for extracting roles in the fifth step specifically comprises the following steps: firstly, inquiring an address ADDR _ A of a ROLE A on a block chain through a block chain ROLE management module (ROLE _ PERMISSION _ MOD); then look at all UTXOs in ADDR _ a addresses, combine all rights dye data and deduplicate, yielding set 1(LIST _1), LIST _1 being the set of rights owned by the role.

7. The method of claim 1, wherein the method comprises: the permission verification in the step six specifically comprises the following steps: firstly, providing a ROLE LIST (LIST _ ROLE) of a user to be queried through an external system (OUT _ SYS), then continuously providing a PERMISSION LIST (LIST _ COL) to be verified through the external system (OUT _ SYS), then sequentially querying PERMISSION sets (LIST _ COL _1, LIST _ COL _2 and LIST _ COL _3 …) of all ROLEs through a block chain ROLE management module (ROLE _ PERMISSION _ MOD), and generating a set LIST _ COL _4 after duplication, and then returning the set LIST _ COL to the external system (OUT _ SYS) by calculating the intersection of LIST _ COL and LIST _ COL _4 to complete verification.