CN113221175A

CN113221175A - Authorization method and system based on block chain

Info

Publication number: CN113221175A
Application number: CN202110585286.4A
Authority: CN
Inventors: 王涛
Original assignee: Beijing Chengqitong Technology Co ltd
Current assignee: Beijing Chengqitong Technology Co ltd
Priority date: 2021-05-27
Filing date: 2021-05-27
Publication date: 2021-08-06
Also published as: CN114491647A

Abstract

The invention relates to an authorization method and system based on a block chain, comprising the following steps: acquiring certificate information of an enterprise signed with a user; generating corresponding hash of the certificate information, synchronously requesting a block chain engine to obtain a user key, signing the corresponding hash by using the user key to generate new hash, and uploading the new hash to a corresponding node of a block chain; and synchronizing the new hash data to data persistence layers MYSQL and REDIS of other nodes of the block chain through Kakfa so as to enable the corresponding node to perform high-speed query through a service gateway service. The invention has the beneficial effects that: by introducing the blockchain technology, the user credential record is provided to the blockchain for the enterprise. The characteristics of block chain distribution, non-tampering and the like are utilized to ensure the safety, reality and effectiveness of the user certificate. The authorization certificate is signed by a user key, the authorization contract is encrypted and stored on the block chain, and the authorization certificate has uniqueness, high reliability and easy judgment of the authenticity and validity of data.

Description

Authorization method and system based on block chain

Technical Field

The invention belongs to the technical field of communication authorization, and particularly relates to an authorization method and system based on a block chain.

Background

In the traditional processing mode of a user authorization certificate (signing agreement), an enterprise stores the signing information of all users in an enterprise own database. With the development of the internet era, the cloud deployment of enterprise applications and the supporting of a high-concurrency cluster deployment mode, an enterprise can migrate applications to a cloud host, data is stored in a cluster database, multiple copies can be stored, and even disaster recovery is considered, the data is stored in a remote computer room. This approach apparently addresses the security and stability of the data. However, data is still stored in a server managed and controlled by the enterprise, and if the data is tampered, the authenticity of the data cannot be verified by a user and a third-party organization, so that the data is difficult to convince.

Disclosure of Invention

In order to solve the problems of easy tampering and low reliability in the prior art, the invention provides an authorization method and an authorization system based on a block chain, which have the characteristics of difficult tampering, higher reliability, higher safety and the like.

According to the specific implementation mode of the invention, the authorization method based on the block chain comprises the following steps:

acquiring certificate information of an enterprise signed with a user;

generating corresponding hash of the certificate information, synchronously requesting a block chain engine to obtain a user key, signing the corresponding hash by using the user key to generate new hash, and uploading the new hash to a corresponding node of a block chain;

and synchronizing the new hash data to data persistence layers MYSQL and REDIS of other nodes of the block chain through Kakfa so as to enable the corresponding node to perform high-speed query through a service gateway service.

Further, before the obtaining credential information for the enterprise to sign up with the user, the method further includes:

and storing the certificate information of the enterprise signed with the user to a specified address.

Further, the synchronizing the new hash data to the data persistence layers MYSQL and REDIS of other nodes of the blockchain through Kakfa so that the corresponding node performs high-speed query through the service gateway service includes:

and synchronously broadcasting the new hash data to other friend nodes and the main node in the block chain based on the block chain engine.

Further, synchronizing the new hash data to data persistence layers MYSQL and REDIS of other nodes of the blockchain through Kakfa, so that the corresponding node performs high-speed query through a service gateway service further includes:

the master node pulls on-link data within the Kakfa service of each friend node based on the data console service.

and the main node writes the pulled data on the chain into data persistence layers MYSQL and REDIS of the main node based on the data staging service.

Further, the user or the enterprise performs high-speed query of the data on the link through the service gateway service provided by the main node or the friend node.

According to a specific embodiment of the present invention, a block chain-based authorization system is provided, which includes:

the business platform is used for acquiring certificate information signed by an enterprise and a user; generating corresponding hash of the certificate information, synchronously requesting a block chain engine to obtain a user key, signing the corresponding hash by using the user key to generate new hash, and uploading the new hash to a corresponding node of a block chain; and

and the block chain platform is used for synchronizing the new hash data to data persistence layers MYSQL and REDIS of other nodes of the block chain through Kakfa so as to enable the corresponding node to perform high-speed query through a service gateway service.

Further, data interaction is performed between the service platform and the blockchain platform based on an API (application programming interface) provided by the blockchain platform.

The invention has the beneficial effects that: by introducing the blockchain technology, the user credential record is provided to the blockchain for the enterprise. The characteristics of block chain distribution, non-tampering and the like are utilized to ensure the safety, reality and effectiveness of the user certificate. After the user authorization certificate containing the signing information is encrypted and signed by the own private key of the user, the signature file is stored to the block chain by encryption, and the public key and the authority of the user cannot be read. The authorization certificate is signed by a user key, the authorization contract is encrypted and stored on the block chain, and the authorization certificate has uniqueness, high reliability and easy judgment of the authenticity and validity of data.

Drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments of the present invention, and for those skilled in the art, other drawings can be obtained according to the drawings without creative efforts.

FIG. 1 is a flow diagram of a block chain based authorization method provided in accordance with an exemplary embodiment;

fig. 2 is a block diagram of a blockchain-based authorization system provided in accordance with an example embodiment.

Detailed Description

In order to make the objects, technical solutions and advantages of the present invention more apparent, the technical solutions of the present invention will be described in detail below. It is to be understood that the described embodiments are merely exemplary of the invention, and not restrictive of the full scope of the invention. All other embodiments, which can be derived by a person skilled in the art from the examples given herein without any inventive step, are within the scope of the present invention.

Referring to fig. 1, an embodiment of the present invention provides a block chain-based authorization method, which specifically includes:

101. acquiring certificate information of an enterprise signed with a user; the agreement the user has with the enterprise may act as a corresponding credential.

102. Generating corresponding hash of the certificate information, synchronously requesting a block chain engine to obtain a user key, signing the corresponding hash by using the user key to generate new hash, and uploading the new hash to a corresponding node of a block chain;

and generating a hash by the certificate information, acquiring a user key by the synchronous request blockchain engine, and generating a new hash request uplink after the certificate hash is signed by using the user key. And the block chain platform returns corresponding response to the request and uplinks the signed data.

103. And synchronizing the new hash data to data persistence layers MYSQL and REDIS of other nodes of the block chain through Kakfa so as to enable the corresponding node to perform high-speed query through a service gateway service.

And synchronizing the uplink data to the data persistence layers MYSQL and REDIS of the allied nodes through Kakfa.

Specifically, the distributed authorization credential storage service securely stores the identity information and credential information of individual and enterprise users through a blockchain, and provides identity identification, authorization credentials and information interaction for the users, user information providers and user information users under the condition of protecting privacy, so that enterprises and organizations can use and manage user identity information and data authorization more in compliance. Kakfa is a high throughput distributed publish-subscribe messaging system that can handle all the action flow data of a consumer in a web site. Kakfa provides message persistence through the disk data structure of O (1), which can maintain stable performance for a long time even for message storage in TB. It has high throughput performance and even the very common hardware Kakfa can support millions of message processes per second. Redis is a key-value store database in four major classifications of NoSql. It is an open-source, advanced key-value, commonly referred to as a data structure server. Because it supports a variety of data structures such as (string) strings, (list) linked lists, (hash) hashes, (set) sets, (zset) ordered sets, etc. stored value types.

MYSQL is a relational database management system developed by MYSQL AB, sweden, and belongs to the Oracle product. MYSQL is one of the most popular Relational Database Management systems, and in terms of WEB applications, MYSQL is one of the best RDBMS (Relational Database Management System) application software, and has better Management efficiency. Hash is generally translated as a Hash, or transliteration, which is the transformation of an input of arbitrary length into a fixed-length output, which is a Hash value, by a hashing algorithm. This transformation is a kind of compression mapping. In short, it is a function of compressing a message of an arbitrary length to a message digest of a certain fixed length.

Thus, by providing the corresponding interface of the uplink, the enterprise performs the user authorization signing and the cancellation of authorization through the uplink interface, and the blockchain stores the detailed record information (hash value, validity period, whether to approve the authorization, signing time, contractor and the like) of the user authorization and all the change history records of the authorization information. Therefore, the authenticity of the identity information and the certificate information is greatly guaranteed.

In another specific embodiment of the present invention, before obtaining credential information for the enterprise to sign up with the user, the method further includes:

Synchronizing the new hash data to data persistence layers MYSQL and REDIS of other nodes of the block chain through Kakfa, so that the corresponding node can perform high-speed query through a service gateway service, and the method comprises the following steps:

and synchronously broadcasting the new hash data to other friend nodes and the main node in the blockchain based on the blockchain engine.

Synchronizing the new hash data to data persistence layers MYSQL and REDIS of other nodes of the block chain through Kakfa so that the corresponding node can perform high-speed query through a service gateway service further comprises:

the master node pulls the on-link data within the Kakfa service of each friend node based on the data console service.

the main node also writes the pulled data on the chain into data persistence layers MYSQL and REDIS of the main node based on the data staging service.

And the user or the enterprise carries out high-speed query on the data on the link through the service gateway service provided by the main node or the friend node.

Specifically, a block chain platform may be formed by using a federation chain, where the federation chain is one of block chain relation chains, and the federation chain is between a public chain and a private chain and is a block chain in which multiple organizations or organizations participate. The alliance chain is a cluster formed by a plurality of private chains, the alliance chain is a block chain which is managed by a plurality of organizations together, each organization or organization manages one or a plurality of nodes, data of the alliance chain only allows different organizations in the system to read, write and send, the alliance chain has the characteristics of low cost operation and maintenance, high transaction speed, good expansibility and the like, the affirmation time and the transaction number per second of the alliance chain are greatly different from those of the public chain, and the requirements on safety and performance are higher than those of the public chain.

The enterprise stores the original certificate signed by the user to a specified address;

the enterprise submits the related information signed by the user and the original certificate name to a service platform of allied friends through an interface;

the federation friend service platform generates Hash for the certificate information, the synchronous request block chain engine obtains a user secret key, and a new Hash request chain is generated after the user secret key is used for carrying out Hash signature on the certificate;

the block chain platform receives the request response and returns the request response to the service platform, and chains the signed data;

synchronizing the uplink data to a data persistence layer MYSQL and REDIS of the allied nodes through Kakfa;

synchronously broadcasting data to other alliance nodes and alliance main nodes by a blockchain engine of the alliance nodes;

the data center service of the alliance main node pulls uplink data in the Kakfa service of each alliance node;

the data staging service of the alliance main node writes the pulled uplink data into data persistence layers MYSQL and REDIS of the alliance main node;

enterprise and telephone traffic platform inquiry user authorization protocol carries out high-speed inquiry through service gateway service provided by alliance owner or alliance node. Through the distributed authorization certificate storage service, the identity information and the certificate information of individual and enterprise users are safely stored through the block chain, and identity identification, authorization certificates and information interaction are provided for the users, the user information providers and the user information users under the condition of protecting privacy, so that enterprises and institutions can use and manage the user identity information and data authorization more in compliance. The method provides a chain-up API interface, an enterprise carries out user authorization signing and canceling authorization through the chain-up interface, and the blockchain stores user authorization detailed record information (hash value, validity period, whether to approve the authorization, signing time, contractor and the like) and all change historical records of the authorization information. Therefore, the authenticity of the identity information and the certificate information is greatly guaranteed. And meanwhile, the read-write capability of the block chain is optimized, so that the block chain has high concurrent read-write capability.

It is understood that other block chains may be used by those skilled in the art for verifying the authorization information, and the invention is not limited thereto.

Based on the same design concept, referring to fig. 2, an embodiment of the present invention further provides a block chain-based authorization system, which is characterized by including:

And data interaction is carried out between the service platform and the block chain platform based on an API (application programming interface) provided by the block chain platform.

Specifically, the service platform can be oriented to the butt joint of open API interfaces facing a B-end enterprise, such as a supervision department, an operator, a voice platform, and the like, a merchant enterprise faces an enterprise signing and authorizing a C-end user, each alliance chain adopts a multi-node master-slave mode disaster tolerance, and the corresponding alliance chain has three interfaces: uplink related APIs: the method comprises the steps of butting with a B-end enterprise, and receiving signing record data of the B-end enterprise and a C-end user; querying the C-end user authorization state API: the system is in butt joint with a telephone traffic platform side, and can support high-concurrency inquiry of the final called intention condition of a terminal C user; querying a C-end user authorization record API: and the data package is carried out by docking with the supporting party, and is displayed to a supervision department or an operator for inquiry.

By providing the uplink API interface, the enterprise performs user authorization signing and canceling authorization through the uplink interface, and the blockchain stores user authorization detailed record information (hash value, validity period, whether to approve authorization, signing time, contractor and the like) and all change history records of the authorization information. Therefore, the authenticity of the identity information and the certificate information is greatly guaranteed.

The authorization method and system based on the blockchain provided by the above embodiments of the present invention provide the user credentials for the enterprise to be recorded in the blockchain by introducing the blockchain technology. The characteristics of block chain distribution, non-tampering and the like are utilized to ensure the safety, reality and effectiveness of the user certificate. After the user authorization certificate containing the signing information is encrypted and signed by the own private key of the user, the signature file is stored to the block chain by encryption, and the public key and the authority of the user cannot be read. The authorization certificate is signed by a user key, and the authorization contract is encrypted and stored on the block chain, so that the uniqueness is realized, and the credibility is high. If the enterprise tampers the data, the encrypted data is inconsistent with the data on the block chain, so that the real validity of the data is easy to judge.

It will be understood by those skilled in the art that all or part of the steps carried by the method for implementing the above embodiments may be implemented by hardware related to instructions of a program, which may be stored in a computer readable storage medium, and when the program is executed, the program includes one or a combination of the steps of the method embodiments.

In addition, functional units in the embodiments of the present invention may be integrated into one processing module, or each unit may exist alone physically, or two or more units are integrated into one module. The integrated module can be realized in a hardware mode, and can also be realized in a software functional module mode. The integrated module, if implemented in the form of a software functional module and sold or used as a stand-alone product, may also be stored in a computer readable storage medium.

The storage medium mentioned above may be a read-only memory, a magnetic or optical disk, etc.

In the description herein, references to the description of the term "one embodiment," "some embodiments," "an example," "a specific example," or "some examples," etc., mean that a particular feature, structure, material, or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the invention. In this specification, the schematic representations of the terms used above do not necessarily refer to the same embodiment or example. Furthermore, the particular features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

What has been described above includes examples of one or more embodiments. It is, of course, not possible to describe every conceivable combination of components or methodologies for purposes of describing the aforementioned embodiments, but one of ordinary skill in the art may recognize that many further combinations and permutations of various embodiments are possible. Accordingly, the embodiments described herein are intended to embrace all such alterations, modifications and variations that fall within the scope of the appended claims. Furthermore, to the extent that the term "includes" is used in either the detailed description or the claims, such term is intended to be inclusive in a manner similar to the term "comprising" as "comprising" is interpreted when employed as a transitional word in a claim. Furthermore, any use of the term "or" in the specification of the claims is intended to mean a "non-exclusive or".

The above description is only for the specific embodiments of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily conceive of the changes or substitutions within the technical scope of the present invention, and all the changes or substitutions should be covered within the scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the appended claims.

Claims

1. A block chain based authorization method is characterized by comprising the following steps:

acquiring certificate information of an enterprise signed with a user;

2. The blockchain-based authorization method according to claim 1, further comprising, before the obtaining credential information for the enterprise to sign up with the user:

3. The blockchain-based authorization method according to claim 1, wherein the synchronizing the new hash data to data persistence layers MYSQL and REDIS of other nodes of the blockchain through Kakfa so that the corresponding node performs high-speed query through a service gateway service comprises:

4. The blockchain-based authorization method according to claim 3, wherein the synchronizing the new hash data to data persistence layers MYSQL and REDIS of other nodes of the blockchain through Kakfa so as to make the corresponding node perform high-speed query through a service gateway service further comprises:

5. The blockchain-based authorization method according to claim 4, wherein the synchronizing the new hash data to data persistence layers MYSQL and REDIS of other nodes of the blockchain through Kakfa so as to make the corresponding node perform high-speed query through a service gateway service further comprises:

6. The blockchain-based authorization method according to claim 5, wherein a user or a business performs a high-speed query of data on the chain through a service gateway service provided by a master node or a friend node.

7. A blockchain-based authorization system, comprising:

8. The blockchain-based authorization system according to claim 7, wherein the service platform and the blockchain platform interact data based on an API interface provided by the blockchain platform.