WO2018120121A1 - 区块链权限控制方法、装置及节点设备 - Google Patents

区块链权限控制方法、装置及节点设备 Download PDF

Info

Publication number
WO2018120121A1
WO2018120121A1 PCT/CN2016/113739 CN2016113739W WO2018120121A1 WO 2018120121 A1 WO2018120121 A1 WO 2018120121A1 CN 2016113739 W CN2016113739 W CN 2016113739W WO 2018120121 A1 WO2018120121 A1 WO 2018120121A1
Authority
WO
WIPO (PCT)
Prior art keywords
account
address
transaction
node device
block
Prior art date
Application number
PCT/CN2016/113739
Other languages
English (en)
French (fr)
Inventor
谢辉
王健
Original Assignee
深圳前海达闼云端智能科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳前海达闼云端智能科技有限公司 filed Critical 深圳前海达闼云端智能科技有限公司
Priority to CN201680002973.6A priority Critical patent/CN106796685A/zh
Priority to PCT/CN2016/113739 priority patent/WO2018120121A1/zh
Publication of WO2018120121A1 publication Critical patent/WO2018120121A1/zh
Priority to US16/239,359 priority patent/US11558177B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/50—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using hash chains, e.g. blockchains or hash trees
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H04L9/0618—Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation
    • H04L9/0637—Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/04—Payment circuits
    • G06Q20/06—Private payment circuits, e.g. involving electronic currency used among participants of a common payment scheme
    • G06Q20/065—Private payment circuits, e.g. involving electronic currency used among participants of a common payment scheme using e-cash
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/02—Payment architectures, schemes or protocols involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/22—Payment schemes or models
    • G06Q20/223—Payment schemes or models based on the use of peer-to-peer networks
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H04L67/104—Peer-to-peer [P2P] networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3239—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/24—Querying
    • G06F16/245—Query processing
    • G06F16/2458—Special types of queries, e.g. statistical queries, fuzzy queries or distributed queries
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q2220/00—Business processing using cryptography

Definitions

  • the present invention relates to the field of blockchain technology, and in particular, to a blockchain authority control method, device and node device.
  • a blockchain is a decentralized distributed database system in which all nodes in a blockchain network participate in maintenance. It is composed of a series of data blocks generated by cryptography, and each block is a blockchain. One block. According to the order of the generation time, the blocks are linked together in an orderly manner to form a data chain, which is aptly called a blockchain.
  • the blockchain has its own unique block generation, transaction generation and verification protocols, and has security features such as non-tamperable, unforgeable and fully traceable.
  • the blockchain network is based on a P2P network, and each P2P network node participating in transaction and block storage, verification, and forwarding is a node in a blockchain network.
  • the blockchain data is completely public to each node, and the node can view the information of any transaction in any block at will.
  • the blockchain in the related art since the node joining chain is not restricted, the data on the chain is completely open, and is suitable for some publicized information storage without privacy, but is not suitable for the blockchain.
  • Data has a private information store that does not limit the blockchain operation of the account.
  • the present invention provides a blockchain authority control method, device and node device.
  • the first aspect provides a blockchain authority control method, including:
  • the target information is processed correspondingly according to the account authority.
  • the second aspect provides a blockchain authority control method, which is applied to a node device in a blockchain network, including:
  • a transaction is generated and sent when the account rights include permission to generate a transaction.
  • a blockchain authority control apparatus including:
  • An information receiving module configured to receive target information sent by the node device
  • An account address obtaining module configured to acquire an account address of an account configured by the node device
  • the account privilege obtaining module is configured to acquire, according to the account address, an account privilege corresponding to the account address from a preset block in which the account privilege corresponding to the account address and the account address is stored;
  • the processing module is configured to perform corresponding processing on the target information according to the account authority.
  • a fourth aspect provides a block chain authority control apparatus, which is applied to a node device in a blockchain network, and includes:
  • a transaction generation request receiving module configured to acquire an account address of the configured account when receiving the transaction generation request
  • An account authority obtaining module configured to store an account address and according to the account address In the block corresponding to the account authority, the account authority corresponding to the account address is obtained;
  • a transaction generation module is configured to generate and send a transaction when the account rights include permission to generate a transaction.
  • a computer program product comprising a computer program executable by a programmable device, the computer program having, when executed by the programmable device, for performing the first aspect described above The code part of the method.
  • a sixth aspect a non-transitory computer readable storage medium comprising one or more programs for performing the method of the above first aspect .
  • a node device including:
  • One or more processors for executing a program in the non-transitory computer readable storage medium.
  • a computer program product comprising a computer program executable by a programmable device, the computer program having, when executed by the programmable device, for performing the second aspect described above The code part of the method.
  • a ninth aspect a non-transitory computer readable storage medium comprising one or more programs for performing the method of the second aspect above .
  • a node device including:
  • One or more processors for executing a program in the non-transitory computer readable storage medium.
  • Each node device in the present disclosure is configured with a corresponding account, and by controlling the rights of the account, the permissions of different node devices can be restricted to ensure the security and hiddenness of the blockchain data.
  • Private on the other hand, by controlling the access rights of the account configured by the node device, the blockchain can become a private chain network, preventing the unrelated nodes from accessing the network and improving the security of the blockchain;
  • the transaction sent by the node device of the account management authority can realize the setting of the account authority, and record the account address and authority corresponding to each account into the blockchain, so that the permissions of each account can be queried in the blockchain, Prevent account permissions from being tampered with to ensure the security of the blockchain.
  • FIG. 1 is a schematic diagram of a blockchain network according to an embodiment of the present disclosure
  • FIG. 2 is a schematic structural diagram of a node device according to an embodiment of the present disclosure
  • FIG. 3 is a schematic flow chart of a blockchain authority control method according to an embodiment of the present disclosure.
  • FIG. 4 is a schematic flow chart of a correspondence relationship between an account address and an account authority according to an embodiment of the present disclosure
  • FIG. 5 is a schematic diagram of establishing a network connection between node devices according to an embodiment of the present disclosure
  • FIG. 6 is a schematic diagram of a node device verifying a transaction according to an embodiment of the present disclosure
  • FIG. 7 is a schematic diagram of a data structure of a block header of a block according to an embodiment of the present disclosure.
  • FIG. 8 is a schematic diagram of a verification process of a received block by a node device according to an embodiment of the present disclosure
  • FIG. 9 is a block diagram of a blockchain authority control apparatus according to an embodiment of the present disclosure.
  • FIG. 10 is a block diagram of a blockchain authority control apparatus according to another embodiment of the present disclosure.
  • FIG. 11 is a block diagram of an apparatus for a blockchain authority control method, according to an exemplary embodiment.
  • Blockchain node A blockchain is a decentralized distributed database system in which all nodes in a blockchain network participate in maintenance. It is composed of a series of data blocks generated by cryptography. Each data block is A block in a blockchain. According to the order of the generation time, the blocks are linked together in an orderly manner to form a data chain, which is aptly called a blockchain.
  • a node in a blockchain network may be referred to as a blockchain node, wherein the blockchain network is based on a P2P (Peer to Peer) network, and each P2P network node participating in the transaction and block storage, verification, and forwarding is Is a node in a blockchain network.
  • P2P Peer to Peer
  • the user identity in the blockchain can be represented by a public key or an account address generated based on the public key, and the public key and the private key appear in pairs, wherein the private key is mastered by the user and not issued to the above.
  • the public key or the above account address can be freely posted in the blockchain network.
  • the public key can be the above account address through a specific hash and encoding. It is worth mentioning that there is no one-to-one correspondence between user identity and blockchain nodes. Users can use their own private key on any blockchain node.
  • Blockchain data write The blockchain node writes data to the blockchain by issuing a transaction to the blockchain network.
  • the transaction includes: the blockchain node performs a digital signature on the generated transaction data packet according to a preset transaction data format, and uses the private key of the blockchain node to perform the digital signature on the transaction data packet, and the digital signature is used to prove the User of the blockchain node Identity; then, after the transaction is posted to the blockchain network, it is recorded in the block by the “miners” in the blockchain network (ie, the blockchain nodes that implement the Poof (Proof Of Work) consensus competition mechanism). a new block generated in the chain, and the new block is released into the blockchain network, and the transaction recorded by the new block after the new block and the other blockchain nodes recorded in the new block are verified and accepted.
  • the new block in the blockchain is periodically generated by the above-mentioned “miners” by implementing a consensus competition mechanism such as PoW or PoS, so the time interval for generating new blocks is usually related to the above-mentioned preset technical requirements, and the settings are different.
  • the default technical requirements can change the time interval at which the blockchain generates new blocks.
  • FIG. 1 is a schematic diagram of a blockchain network according to an embodiment of the present disclosure.
  • the blockchain network 100 includes: one or more node devices, which may be implemented in various forms, for example, may include, for example, a mobile phone, a smart phone, a notebook computer, a digital broadcast receiver, a PDA (Personal Digital Assistant), PAD (tablet), PMP (portable multimedia player), server, mining machine, etc.
  • node devices may include, for example, a mobile phone, a smart phone, a notebook computer, a digital broadcast receiver, a PDA (Personal Digital Assistant), PAD (tablet), PMP (portable multimedia player), server, mining machine, etc.
  • each node device is configured with a corresponding account, and by controlling the rights of the account, the permissions of different node devices can be restricted to ensure the security and privacy of the blockchain data.
  • the blockchain can be made into a private chain network, preventing unrelated nodes from accessing the network and improving the security of the blockchain.
  • FIG. 2 is a schematic structural diagram of a node device according to an embodiment of the present disclosure.
  • the node device 200 includes a receiving unit 201, a processing unit 202, a storage unit 203, a transmitting unit 204, and the like.
  • the receiving unit 201 is configured to perform information reception via one or more network protocols via one or more network protocols.
  • the received information may include: transactions, new blocks, and the like.
  • the processing unit 202 is configured to perform information processing, for example, when the receiving unit 201 receives the blockchain transaction, determines data included in the transaction, verifies the legitimacy of the transaction, and the like. In some embodiments, the processing unit 202 is further configured to generate an account address, for example, using the inclusion included The public key in the transaction request, generate an account address, or generate an account address according to the set rules.
  • the storage unit 203 is configured to perform information storage, for example, storing rules and algorithms for authorizing transactions, storing blockchains, and the like.
  • the sending unit 204 is configured to perform information transmission by using one or more network protocols via one or more networks.
  • the information sent may include: transactions, new blocks, and various requests (eg, connection requests) and the like.
  • the blockchain authority control method includes the following steps:
  • step 301 the target information transmitted by the node device is received.
  • the target information includes: a network connection request, a transaction, a block, and the like.
  • step 302 an account address of an account configured by the node device is obtained.
  • step 303 according to the account address, the account authority corresponding to the account address is obtained from the preset block in which the account right corresponding to the account address and the account address is stored.
  • the account rights corresponding to the account address and the account address are stored in a predetermined block.
  • the correspondence between the account address and the account authority may be stored in the initiating block (ie, the preset block), so that the node device can perform the initialization in the initial block and synchronize the initiating block to the initiating block. Inquire.
  • the account authority and account authority of the node device may also be written into the preset block according to the flow shown in FIG. 4.
  • step 304 the target information is processed correspondingly according to the account authority.
  • the processing method of the target information is different according to the difference of the target information and the account authority.
  • the processing according to the account authority may include responding to the network connection. Request, make a network connection.
  • FIG. 4 a correspondence relationship between an account address and an account authority is written in an embodiment of the present disclosure. Schematic diagram of the block.
  • step 401 the target node device receives the account address sent by the node device to which the rights are to be assigned.
  • the target node device is a node device configured with an account having account management authority.
  • the target node device in the blockchain network in order to ensure that the target node device in the blockchain network can perform the process of assigning the account rights, in the creation zone, at least one account with the account management authority should be recorded, so that the account is configured.
  • the node device can write the account rights of each account into the blockchain by publishing the transaction to the blockchain network.
  • the account address is generated by the node device configured with the account to be assigned rights and sent to the target node device.
  • a node device configured with a rights account to be assigned may generate an account address based on the public key.
  • the target node device determines the rights of the node device configured with the rights account to be assigned.
  • the rights of the account may be assigned to the account by the node device having the account management rights according to the role of the account.
  • the rights of all accounts may be set in the initiating block or a specific block, and thus, it is only necessary to perform an inquiry according to the account address to the initiating block or the characteristic block to determine the rights account to be assigned. Permissions.
  • step 403 the target node device issues a transaction including the account address and rights of the rights account to be assigned to the blockchain network.
  • step 404 the node devices in the blockchain network perform mining and record transactions into the blockchain.
  • the account address and the right of the account are recorded in the blockchain block in the form of a transaction, and the block is the preset block in the above step 303.
  • the node device If a node device is configured with an account that has been recorded in the blockchain, the node device has the rights of the configured account and can perform operations within the scope of the authority. Referring to Table 1, the account rights that the node device can include are according to an embodiment of the present disclosure.
  • the node device with the account management authority can also modify the rights of the account by issuing a transaction.
  • the transaction sent by the node device with the account management authority can realize the setting of the account authority, and record the account address and authority corresponding to each account into the blockchain, so that the permissions of each account can be
  • the query in the blockchain can prevent account permissions from being tampered with and ensure the security of the blockchain.
  • Node devices join the blockchain network (ie, establish connections with nodes in the blockchain network)
  • a node device if a node device is configured with an account having network connection rights, the node device can join the blockchain network.
  • a node device that is not joined to the blockchain network but is configured with an account with network connection rights may send a connection request to the node device in the blockchain network to join the blockchain network.
  • the node device sends a network connection request, it needs to provide the connected node device (ie, a node device in the blockchain network) with its Proof of network access rights.
  • the target information in step 301 above is a network connection request.
  • the node device that initiates the network connection request initiates a network connection request to the connected node device, where the network connection request includes: a public key corresponding to the account address of the account.
  • step 502 after the connected node device receives the connection request, the connected node obtains the account address of the node device that initiated the connection request according to the public key.
  • step 503 the connected node device queries whether the authority corresponding to the account address is recorded in the blockchain according to the account address, and determines whether the network connection authority is included in the recorded permission.
  • step 504 If the privilege corresponding to the account address includes the network connection privilege, proceed to step 504; if the privilege record corresponding to the account address is not queried or the privilege corresponding to the account address does not include the network connection privilege, the process ends.
  • the connected node device sends an authentication request to the initiating connection node device, where the authentication request includes at least: an authentication code.
  • the authentication code is used to further confirm the identity of the device that initiates the connection, and the authentication code can be any number or a picture containing numbers.
  • step 505 the initiating connection node device signs the authentication code by using the private key corresponding to the account address, and then sends the authentication code to the connected node device.
  • step 506 the connected node device verifies the correctness of the signature. If the verification passes, the network connection (P2P connection) process is performed; if the verification fails, the process ends, and the sending connection node device cannot join the blockchain network. .
  • P2P connection P2P connection
  • the connected node device verifies the correctness of the signature using the public key.
  • the network connection (P2P connection) process may establish a P2P connection for the initiating connection node device to communicate with the connected node device by "handshake" to cause the initiating connection node device to join the blockchain network.
  • the node device having the network connection authority can access the blockchain network, thereby improving the security of the blockchain.
  • the target information is a transaction.
  • the node device After receiving the transaction sent by the other node device, the node device verifies the account authority of the sender node device of the transaction, in addition to whether the signature of the transaction is correct, whether the transfer party of the transaction has sufficient balance, and the like.
  • the processing unit of the node device may query, from the blockchain stored by the storage unit, whether the authority of the sender node device includes the rights corresponding to the received transaction, to perform the authority of the sender node device. verification.
  • the node device forwards and stores the transaction, and if any verification fails, the node device discards the transaction. Trading, no storage and forwarding work.
  • the processing unit of the node device queries, from the blockchain stored by the storage unit, whether the right of the recipient account includes receiving the transfer, and if the right of the recipient account includes receiving the transfer, forwarding and storing the transaction; if any verification fails, The node device discards the transaction and does not store and forward it.
  • the node device when receiving the transaction, verifies the account authority, and performs transaction forwarding and caching according to the verification result, which can filter out transactions generated by the unprivileged account, thereby improving network efficiency.
  • a tile can only be generated by a node device configured with a block to generate a rights account.
  • the node device determines whether the account configured by itself has the right to generate the block. If the permission of the block is not generated, the work of generating the block is not started. If there is permission to generate a block, an algorithm such as PoW or POS is executed to generate a new block, and the generated block is sent to the blockchain network.
  • an algorithm such as PoW or POS is executed to generate a new block, and the generated block is sent to the blockchain network.
  • a field for storing the producer information for generating the new block is added to the block header of the block.
  • the producer information includes at least: a public key corresponding to an account address of an account configured by the node device that generates the new block, and a signature of the new block header data.
  • the above generator information is stored in the new field of the new block, and then sent to the blockchain network.
  • FIG. 7 is a schematic diagram of a data structure of a block header of an exemplary embodiment.
  • other fields may be actually performed according to the blockchain. Select settings.
  • the target information is a block
  • the process of verifying the block by the node device receiving the block includes:
  • step 801 the node device that received the new block obtains the account address using the public key in the block header of the new block.
  • step 802 the blockchain is queried to verify whether the account address has the right to generate a block; if there is permission to generate the block, step 803 is performed; if there is no permission to generate the block, the new block is invalid. .
  • step 803 the signature of the new block header is verified according to the public key. If the verification fails, the new block is determined to be an illegal block. If the verification is passed, step 804 is performed.
  • step 804 it is verified whether the PoW or PoS of the new block is correct, and whether each transaction recorded by the new block is legal; if any verification fails, it is determined that the block is illegal; if the verification passes, then it is determined This new block is a legal block.
  • the new block if the new block is invalid, the new block is discarded, and no storage and forwarding are performed; if the new block is legal, the new block is stored and forwarded.
  • steps 801 - 803 and the execution sequence of step 804 can be exchanged, that is, step 804 is performed first, then steps 801 - 803 are performed, or step 804 and steps are performed.
  • 801 - Step 803 can be performed at the same time, and the embodiment of the present disclosure does not limit this.
  • the verification of the block generator can be implemented, the generation of the illegal block is avoided, and the security is improved.
  • the node device when receiving the transaction generation request, the node device first determines whether the configured account has the right to generate the corresponding transaction, and if so, generates a transaction and sends the message, if not, prompts or reports an error. After termination.
  • the processing unit of the node device queries, according to the blockchain stored in the storage unit, whether the configured account has the right to generate and send a corresponding transaction, and the corresponding transaction may include: account management, deploying a smart contract, calling Transactions such as smart contracts, originating transfers and digital currency issuance.
  • the node device should also verify that the recipient account of the transfer transaction has permission to receive the transfer.
  • the processing unit of the node device verifies whether the recipient account has the right to receive the transfer according to the blockchain stored in the storage unit according to the account address of the receiver of the transaction. When the transaction originator has the right to initiate the transfer and the recipient account has the right to receive the transfer, the node device sends the transfer transaction.
  • the node having the right to send the transaction can send the related transaction, and the transaction transmission authority can be determined from the source of the transaction, and the transaction processing efficiency and network efficiency of other node devices are improved.
  • the roles of the account include: an administrative account, a currency issuance account, a supervisory account, a bank, a depositor.
  • the permissions corresponding to each role are shown in Table 2.
  • the node device configured with the management account receives the account address sent by the node device configured with the account to be assigned rights, and then sets the permission for the account to be assigned according to the role of the account.
  • the node device that manages the account is configured, and the rights include: network connection, account rights management, block generation, and the like.
  • the node device configured with the management account receives the account address, and can set the authority according to the preset allocation rule.
  • the preset allocation rule may be a correspondence between an account address and an account role, whereby the account role may be determined according to the account address, and the corresponding authority may be further determined.
  • the node device of the corresponding account is configured, that is, has the corresponding blockchain authority.
  • a node device configured with an account with digital currency issuance authority may issue a digital currency by issuing a transaction.
  • the published transaction includes at least the following information: the amount of digital currency issued, the owner's account of the digital currency issued.
  • the node devices in the blockchain network verify the transaction.
  • the content of the verification includes at least: whether the publishing account of the transaction has the issuing authority of the digital currency, and whether the signature of the transaction is correct.
  • the roles of the account include: an administrative account, an identity issuing account, an authenticator user account, an authenticated user account.
  • the permissions corresponding to each role are shown in Table 3.
  • Account role Permission Management account Network connection account rights management, block generation ID release account Network connectivity, block generation, deployment of smart contracts, calling smart contracts Authenticator user account Network connection, calling smart contracts, block generation Certified party user account Network connection, calling smart contracts, block generation
  • the node device configured with the management account receives the account address sent by the node device configured with the account to be assigned rights, and then sets the rights to be assigned to the rights account according to the role of the account.
  • the node device that manages the account is configured, and the rights include: network connection, account rights management, block generation, and the like.
  • the node device configured with the management account receives the account address, and can set the authority according to the preset allocation rule.
  • the preset allocation rule may be a correspondence between an account address and an account role, whereby the account role may be determined according to the account address, and the corresponding authority may be further determined.
  • the node device of the corresponding account is configured, that is, has the corresponding blockchain authority.
  • the node device configured with the identity verification publishing account may issue a smart contract for recording the identity information of the user account, and is responsible for writing the identity information of the user account to the smart contract.
  • the node device configured with the authenticator user account can read the identity information of the authenticated user account from the smart contract, and authenticate the authenticated party based on the information.
  • the node device configured with the authenticated user account can generate an account address, notify the identity certificate issuing account of the identity information such as the address and the public key, and record the identity information into the smart contract through the identity verification issuing account.
  • the embodiment can implement identity authentication, establish a blockchain for identity authentication, and ensure the security of the blockchain data.
  • an embodiment of the present disclosure further provides a blockchain authority control apparatus.
  • the blockchain authority control device 900 includes:
  • the information receiving module 901 is configured to receive target information sent by the node device
  • the account address obtaining module 902 is configured to acquire an account address of an account configured by the node device;
  • the account right obtaining module 903 is configured to obtain, according to the account address, an account right corresponding to the account address from a preset block in which the account address and the account right corresponding to the account address are stored;
  • the processing module 904 is configured to perform corresponding processing on the target information according to the account authority.
  • the apparatus 900 further includes:
  • An account address receiving module configured to receive an account address of the configured account sent by the node device
  • a rights allocation module configured to allocate account rights for the configured account
  • a transaction issuance module configured to issue a transaction including an account address and an account right of the configured account to a blockchain network, the transaction being used to store an account address and an account right of an account configured by the node device to In the preset block.
  • the target information is a network connection request
  • the network connection request includes: a public key of an account configured by the node device;
  • the account address obtaining module 902 is configured to obtain the account address of the configured account according to the public key.
  • the processing module 904 includes:
  • the authentication request sending sub-module is configured to send an authentication request to the node device when the account right corresponding to the account address includes a network connection right, where the authentication request includes at least: an authentication code;
  • a signature submodule configured to receive a signature of the authentication code by the node device using a private key corresponding to the account address of the configured account
  • a verification submodule configured to verify the signature according to a public key corresponding to the account address
  • a connection establishment submodule is configured to establish a network connection with the node device when the verification of the signature is passed.
  • the target information is a transaction
  • the processing module includes:
  • the transaction processing sub-module is configured to forward and store the received transaction when the account rights of the account configured by the node device include the right to generate a transaction.
  • the target information is a transfer transaction
  • the transfer transaction includes at least: an account address of the recipient account
  • the processing module includes:
  • a receiver account permission obtaining submodule configured to: when an account right of an account configured by the node device includes a right to initiate a transfer, according to an account address of the recipient account, an account address from which the recipient account is stored Obtaining an account right corresponding to an account address of the recipient account in a block corresponding to the account authority;
  • the transfer transaction processing sub-module is configured to forward and store the transfer transaction when the account right corresponding to the account address of the recipient account includes the right to receive the transfer.
  • the target information is a block created by the node device, and a block header of the block includes a field for recording a signature of a public key and a block header data;
  • the account address obtaining module is configured to acquire the account address according to a public key in a block header of the block.
  • the processing module includes:
  • the block processing sub-module is configured to forward and store the received block when the account rights of the account configured by the node device include the permission to generate the block.
  • an embodiment of the present disclosure further provides a blockchain authority control apparatus.
  • the blockchain authority control device 1000 includes:
  • the transaction generation request receiving module 1001 is configured to acquire the transaction when receiving the transaction generation request Configure the account address of the account;
  • the account privilege obtaining module 1002 is configured to acquire, according to the account address, an account privilege corresponding to the account address from a block in which the account address and the account privilege correspondence are stored;
  • the transaction generation module 1003 is configured to generate and send a transaction when the account rights include rights to generate a transaction.
  • the transaction is a transfer transaction; the device further comprising:
  • the receiver conversion authority obtaining module is configured to obtain, according to the account address of the receiver account, the block from which the account address of the receiver account and the account authority are stored, when the account authority includes the authority to generate the transaction Account authority of the account address of the recipient account;
  • the transfer transaction generation module is configured to generate and transmit the transfer transaction when the account rights of the recipient account include the right to receive the transfer.
  • FIG. 11 is a block diagram of an apparatus 1100 for a blockchain authority control method, which may be a node device in a blockchain, according to an exemplary embodiment.
  • the apparatus 1100 can include a processor 1101, a memory 1102, a multimedia component 1103, an input/output (I/O) interface 1104, and a communication component 1105.
  • the processor 1101 is configured to control the overall operation of the device 110 to complete all or part of the steps of the blockchain authority control method described above.
  • the memory 1102 is for storing operating systems, various types of data to support operations at the device 1100, such as instructions for any application or method for operation on the device 1100, and application-related data.
  • the memory 1102 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as a static random access memory (SRAM), an electrically erasable programmable read only memory ( Electrically Erasable Programmable Read-Only Memory (EEPROM), erasable programmable read-only memory (Erasable Programmable Read-Only Memory, EPROM for short), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), Magnetic Memory, Flash Memory, Disk Or a disc.
  • SRAM static random access memory
  • EEPROM Electrically Erasable Programmable Read-Only Memory
  • PROM Programmable Read-Only Memory
  • ROM Read-Only Memory
  • the multimedia component 1103 can include a screen and an audio component.
  • the screen may be, for example, a touch screen, and the audio component is used to output and/or input an audio signal.
  • the audio component can include a microphone for receiving an external audio signal.
  • the received audio signal may be further stored in memory 1102 or transmitted via communication component 1105.
  • the audio component also includes at least one speaker for outputting an audio signal.
  • the I/O interface 1104 provides an interface between the processor 1101 and other interface modules.
  • the other interface modules may be keyboards, mice, buttons, and the like. These buttons can be virtual buttons or physical buttons.
  • Communication component 1105 is used for wired or wireless communication between the device 110 and other devices. Wireless communication, such as Wi-Fi, Bluetooth, Near Field Communication (NFC), 2G, 3G or 4G, or a combination of one or more of them, so the corresponding communication component 1105 can include: Wi-Fi module, Bluetooth module, NFC module.
  • the device 1100 may be configured by one or more Application Specific Integrated Circuits (ASICs), Digital Signal Processors (DSPs), and digital signal processing devices (Digital Signal Processors).
  • ASICs Application Specific Integrated Circuits
  • DSPs Digital Signal Processors
  • Digital Signal Processors Digital Signal Processors
  • DSPD Processing Device
  • PLD Programmable Logic Device
  • FPGA Field Programmable Gate Array
  • a computer program product comprising a computer program executable by a programmable device, the computer program having when executed by the programmable device A code portion for performing the above-described blockchain authority control method.
  • non-transitory computer readable storage medium comprising instructions, such as a memory 1102 comprising instructions executable by processor 1101 of apparatus 1100 to perform the blockchain described above Access control method.
  • the non-transitory computer readable storage medium can be a ROM, a Random Access Memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, and an optical data storage device.
  • Any process or method description in the flowcharts or otherwise described in the embodiments of the invention may be understood to represent code that includes one or more executable instructions for implementing the steps of a particular logical function or process. Modules, segments or portions, and the scope of the embodiments of the invention includes additional implementations, in which the functions may be performed in a substantially simultaneous manner or in an inverse order depending on the functions involved, in the order shown or discussed. This should be understood by those skilled in the art of the embodiments of the present invention.

Abstract

本公开公开了一种区块链权限控制方法、装置及节点设备，所述方法包括：接收节点设备发送的目标信息；获取所述节点设备所配置账户的账户地址；根据所述账户地址，从存储有所述账户地址和所述账户地址对应的账户权限的预设区块中，获取所述账户地址对应的账户权限；根据所述账户权限，对所述目标信息进行相应的处理。本公开每个节点设备配置有相应的账户，通过对账户进行权限控制，可实现将不同的节点设备的权限进行限制，以保证区块链数据的安全性和隐私性。

Description

区块链权限控制方法、装置及节点设备 技术领域
本发明涉及区块链技术领域，尤其涉及一种区块链权限控制方法、装置及节点设备。
背景技术
区块链是由区块链网络中所有节点共同参与维护的去中心化分布式数据库系统，它是由一系列基于密码学方法产生的数据块组成，每个数据块即为区块链中的一个区块。根据产生时间的先后顺序，区块被有序地链接在一起，形成一个数据链条，被形象地称为区块链。区块链有其特有的区块产生、交易产生和验证协议，具有不可篡改、不可伪造和完全可追溯等安全特性。
区块链网络基于P2P网络，每个参与交易和区块存储、验证、转发的P2P网络节点都是一个区块链网络中的节点。区块链数据对每个节点是完全公开的，节点可以随意查看任何一个区块任意一笔交易的信息。
由上，相关技术中的区块链，由于节点加入链不受限制，链上的数据完全开放，适合于一些公众化的、不涉及隐私的信息存储，但是并不适合于区块链上的数据具有隐私性的信息存储，不能实现对账户的区块链操作进行限制。
发明内容
为克服相关技术中存在的问题，本发明提供一种区块链权限控制方法、装置及节点设备。
其中，第一方面，提供一种区块链权限控制方法，包括：
接收节点设备发送的目标信息；
获取所述节点设备所配置账户的账户地址；
根据所述账户地址，从存储有所述账户地址和所述账户地址对应的账户权限的预设区块中，获取所述账户地址对应的账户权限；
根据所述账户权限，对所述目标信息进行相应的处理。
第二方面，提供一种区块链权限控制方法，应用于区块链网络中的节点设备，包括：
接收到交易产生请求时，获取所配置账户的账户地址；
根据所述账户地址，从存储有账户地址和账户权限对应关系的区块中，获取所述账户地址对应的账户权限；
当所述账户权限包括产生交易的权限时，产生并发送交易。
第三方面，提供一种区块链权限控制装置，包括：
信息接收模块，被配置为接收节点设备发送的目标信息；
账户地址获取模块，被配置为获取所述节点设备所配置账户的账户地址；
账户权限获取模块，被配置为根据所述账户地址，从存储有所述账户地址和所述账户地址对应的账户权限的预设区块中，获取所述账户地址对应的账户权限；
处理模块，被配置为根据所述账户权限，对所述目标信息进行相应的处理。
第四方面，提供一种区块链权限控制装置，应用于区块链网络中的节点设备，包括：
交易产生请求接收模块，被配置为接收到交易产生请求时，获取所配置账户的账户地址；
账户权限获取模块，被配置为根据所述账户地址，从存储有账户地址和 账户权限对应关系的区块中，获取所述账户地址对应的账户权限；
交易产生模块，被配置为在所述账户权限包括产生交易的权限时，产生并发送交易。
第五方面，提供一种计算机程序产品，所述计算机程序产品包含能够由可编程的装置执行的计算机程序，所述计算机程序具有当由所述可编程的装置执行时用于执行上述第一方面的方法的代码部分。
第六方面，提供一种非临时性计算机可读存储介质，所述非临时性计算机可读存储介质中包括一个或多个程序，所述一个或多个程序用于执行上述第一方面的方法。
第七方面，提供一种节点设备，包括：
上述第六方面的非临时性计算机可读存储介质；以及
一个或者多个处理器，用于执行所述非临时性计算机可读存储介质中的程序。
第八方面，提供一种计算机程序产品，所述计算机程序产品包含能够由可编程的装置执行的计算机程序，所述计算机程序具有当由所述可编程的装置执行时用于执行上述第二方面的方法的代码部分。
第九方面，提供一种非临时性计算机可读存储介质，所述非临时性计算机可读存储介质中包括一个或多个程序，所述一个或多个程序用于执行上述第二方面的方法。
第十方面，提供一种节点设备，包括：
上述第九方面的非临时性计算机可读存储介质；以及
一个或者多个处理器，用于执行所述非临时性计算机可读存储介质中的程序。
本公开中每个节点设备配置有相应的账户，通过对账户进行权限控制，可实现将不同的节点设备的权限进行限制，以保证区块链数据的安全性和隐 私性；另一方面，通过对节点设备所配置账户的接入权限进行控制，可让区块链成为私有链网络，防止不相关节点接入网络，提高区块链的安全性；且通过具有账户管理权限的节点设备发送的交易，可实现对账户权限的设置，将各个账户对应的账户地址和权限记录到区块链中，使得每个账户的权限可在区块链中查询得到，可防止账户权限被篡改，保证区块链的安全性。
应当理解的是，以上的一般描述和后文的细节描述仅是示例性和解释性的，并不能限制本发明。
本发明的其他特征和优点将在随后的具体实施方式部分予以详细说明。
附图说明
此处的附图被并入说明书中并构成本说明书的一部分，示出了符合本发明的实施例，并与说明书一起用于解释本发明的原理。
图1是本公开一实施例的区块链网络的示意图；
图2是本公开一实施例的节点设备的结构示意图；
图3是本公开一实施例的区块链权限控制方法的流程示意图；
图4是本公开一实施例的账户地址和账户权限的对应关系写入区块的流程示意图；
图5是本公开一实施例的节点设备间建立网络连接的示意图；
图6是本公开一实施例的节点设备对交易进行验证的示意图；
图7是本公开一实施例的区块的区块头的数据结构示意图；
图8是本公开一实施例的节点设备对接收到的区块的验证流程示意图；
图9是本公开一实施例的区块链权限控制装置的框图；
图10是本公开另一实施例的区块链权限控制装置的框图；
图11是根据一示例性实施例示出的一种用于区块链权限控制方法的装置的框图。
具体实施方式
以下结合附图对本公开的具体实施方式进行详细说明。应当理解的是，此处所描述的具体实施方式仅用于说明和解释本公开，并不用于限制本公开。
在对本公开提供的区块链权限控制方法、装置及节点设备进行说明之前，先对本公开各个实施例所涉及的区块链进行介绍。
区块链节点：区块链是由区块链网络中所有节点共同参与维护的去中心化分布式数据库系统，它是由一系列基于密码学方法产生的数据块组成，每个数据块即为区块链中的一个区块。根据产生时间的先后顺序，区块被有序地链接在一起，形成一个数据链条，被形象地称为区块链。下面对区块链网络的一些概念进行介绍。
区块链网络中的节点可以称为区块链节点，其中区块链网络基于P2P(Peer to Peer，对等网络)网络，每个参与交易和区块存储、验证、转发的P2P网络节点都是一个区块链网络中的节点。
用户身份：区块链中的用户身份可以使用公钥或者是根据该公钥生成的账户地址表示，并且公钥和私钥是成对出现的，其中私钥由用户掌握而不发布到上述的区块链网络中，公钥或者上述的账户地址可随意发布在区块链网络中。其中，公钥可以通过特定的哈希和编码后成为上述的账户地址。值得一提的是，用户身份和区块链节点不存在一一对应关系，用户可以在任意一个区块链节点上使用自己的私钥。
区块链数据写入：由区块链节点通过向区块链网络发布交易(Transaction)实现向区块链写入数据。该交易包括：区块链节点按照预设的交易数据格式对生成的交易数据包，以及利用该区块链节点自己的私钥对该交易数据包进行的数字签名，该数字签名用于证明该区块链节点的用户的 身份；而后，该交易被发布到区块链网络后，被区块链网络中的“矿工”(即执行PoW(Proof Of Work，工作证明)共识竞争机制的区块链节点)记录入区块链中产生的新区块，并将该新区块发布到区块链网络中，在该新区块以及该新区块所记录的交易其他区块链节点验证通过和接受后，该新区块所记录的交易即被写入区块链。其中，区块链中的新区块是由上述的“矿工”通过执行PoW或PoS等共识竞争机制而定期产生的，因此产生新区块的时间间隔通常和上述的预设技术要求相关，通过设置不同的预设技术要求可以改变区块链产生新区块的时间间隔。
参见图1为本公开一实施例的区块链网络的示意图。
区块链网络100中包括：一个或多个节点设备，这些节点设备可以各种形式来实施，例如，可以包括诸如手机、智能电话、笔记本电脑、数字广播接收器、PDA(个人数字助理)、PAD(平板电脑)、PMP(便携式多媒体播放器)、服务器、矿机等。
在本公开的实施例中，每个节点设备配置有相应的账户，通过对账户进行权限控制，可实现将不同的节点设备的权限进行限制，以保证区块链数据的安全性和隐私性。另一方面，通过对节点设备所配置账户的接入权限进行控制，可让区块链成为私有链网络，防止不相关节点接入网络，提高区块链的安全性。
参见图2为本公开一实施例的节点设备的结构示意图。节点设备200包括：接收单元201、处理单元202、存储单元203和发送单元204等。
接收单元201，被配置为通过一个或多个网络，经由一个或多个网络协议，进行信息接收。接收的信息可包括：交易、新区块等。
处理单元202，被配置为进行信息处理，例如，当接收单元201接收到区块链交易时，确定交易中包含的数据，验证交易的合法性等。在一些实施例中，处理单元202，还被配置为生成账户地址，例如，利用包含在接收到 的交易请求中的公钥，生成账户地址，或根据设定的规则生成账户地址。
存储单元203，被配置为进行信息存储，例如，存储用于授权交易的规则和算法、存储区块链等。
发送单元204，被配置为经由一个或多个网络，采用一个或多个网络协议，进行信息发送。发送的信息可包括：交易、新区块以及各种请求(例如，连接请求)等。
参见图3，为本公开一实施例的区块链权限控制方法的流程示意图。该区块链权限控制方法包括以下步骤：
在步骤301中，接收节点设备发送的目标信息。
在本公开的实施例中，目标信息包括：网络连接请求，交易，以及区块等等。
在步骤302中，获取节点设备所配置账户的账户地址。
在步骤303中，根据账户地址，从存储有账户地址和账户地址对应的账户权限的预设区块中，获取账户地址对应的账户权限。
在本公开的实施例中，账户地址和账户地址对应的账户权限，被存储到一预设区块中。在一个实施例中，可将账户地址和账户权限的对应关系存储到创始区块(即预设区块)中，使得节点设备在初始化，同步了创始区块后即可到创始区块中进行查询。在另一些实施例中，还可按照图4所示的流程将节点设备的账户权限和账户权限写入到预设区块中。
在步骤304中，根据账户权限，对目标信息进行相应的处理。
在本公开的实施例中，根据目标信息的不同，以及账户权限的不同，对目标信息的处理方式即不相同，例如，对于网络连接请求，根据账户权限对其进行的处理可包括响应网络连接请求，进行网络连接。
账户地址和账户权限的对应关系写入区块
参见图4，为本公开一实施例的账户地址和账户权限的对应关系写入区 块的流程示意图。
在步骤401中，目标节点设备接收待分配权限的节点设备发送的账户地址。
在本公开的一实施例中，目标节点设备为配置了具有账户管理权限的账户的节点设备。在一个实施例中，为了保证区块链网络中有目标节点设备可执行账户权限分配的处理，在创世区块中，至少应记录一个具有账户管理权限的账户的信息，使得配置该账户的节点设备，可通过向区块链网络中发布交易，实现将各账户的账户权限写入到区块链中。
账户地址，是由配置了待分配权限账户的节点设备生成并发送给目标节点设备的。在一个实施例中，配置了待分配权限账户的节点设备可根据公钥生成账户地址。
在步骤402中，目标节点设备确定配置了待分配权限账户的节点设备的权限。
在一个实施例中，账户的权限可为有账户管理权限的节点设备根据账户的角色为账户分配的。或者，也可是在创始区块或一特定区块中将所有账户的权限设定好，由此，只需要根据账户地址到创始区块或特征区块进行查询，即可确定待分配权限账户的权限。
在步骤403中，目标节点设备向区块链网络发布包括待分配权限账户的账户地址和权限的交易。
在步骤404中，区块链网络中的节点设备，进行挖矿，将交易记录到区块链中。
由此，使得账户的账户地址和权限以交易的形式记录在区块链的区块中，该区块即为上述步骤303中的预设区块。某个节点设备配置了已记录到区块链中的账户，则该节点设备就具有了所配置账户的权限，可以进行权限范围内的操作。参见表1，为本公开一实施例的节点设备可包括的账户权限。
表1
Figure PCTCN2016113739-appb-000001
通过上述步骤将账户的权限存储到区块链中的区块后，具有账户管理权限的节点设备，还可通过发布交易的方式，对账户的权限进行修改。
本公开实施例中，通过具有账户管理权限的节点设备发送的交易，可实现对账户权限的设置，将各个账户对应的账户地址和权限记录到区块链中，使得每个账户的权限可在区块链中查询得到，可防止账户权限被篡改，保证区块链的安全性。
节点设备加入到区块链网络(即与区块链网络中的节点建立连接)
在本公开的实施例中，若某个节点设备被配置了具有网络连接权限的账户，则这个节点设备可加入到区块链网络。在一个实施例中，未加入到区块链网络但被配置了具有网络连接权限的账户的节点设备可向区块链网络中的节点设备，发送连接请求以加入到区块链网络。当节点设备发送网络连接请求时，需向被连接的节点设备(即区块链网络中的一节点设备)提供其具 有网络连接权限的证明。
参见图5，在一个实施例中，上述步骤301中的目标信息为网络连接请求。在步骤501中，发起网络连接请求的节点设备向被连接节点设备发起网络连接请求，网络连接请求中包括：账户的账户地址所对应的公钥。
在步骤502中，被连接节点设备收到连接请求后，根据公钥获取发起连接请求的节点设备的账户地址。
在步骤503中，被连接节点设备根据账户地址，查询区块链中是否记录了该账户地址所对应的权限，并判断所记录权限中是否包括网络连接权限。
如果该账户地址对应的权限包括网络连接权限，则继续执行步骤504；如果未查询到该账户地址对应的权限记录或该账户地址对应的权限不包括网络连接权限，则流程结束。
在步骤504中，被连接节点设备向发起连接节点设备发送认证请求，认证请求中至少包括：认证码。认证码用于进一步确认发起连接节点设备的身份，认证码可为任意数字或包含数字的图片等。
在步骤505中，发起连接节点设备使用账户地址所对应的私钥对认证码进行签名后，发送给被连接节点设备。
在步骤506中，被连接节点设备验证签名的正确性，如果验证通过，则执行网络连接(P2P连接)过程；如果验证不通过，则流程结束，发送连接节点设备不能加入到区块链网络中。
在一个实施例中，被连接节点设备使用公钥验证签名的正确性。
在一个实施例中，网络连接(P2P连接)过程可为发起连接节点设备与被连接节点设备通过“握手”通信，建立P2P连接，以使发起连接节点设备加入到区块链网络中。
由此，在本公开实施例中，具有网络连接权限的节点设备，才能接入到区块链网络中，可提高区块链的安全性。
交易验证
参见图6，在该实施例中，目标信息为交易。节点设备接收到其它节点设备发送的交易后，除进行该交易的签名是否正确、该交易的转账方是否具有足够的余额等验证外，还对交易的发送方节点设备的账户权限进行验证。
在一个实施例中，节点设备的处理单元可从存储单元存储的区块链中，查询发送方节点设备的权限是否包括与接收到的交易相对应的权限，以对发送方节点设备的权限进行验证。当所有验证(包括交易签名是否正确、交易的转账方是否具有足够的余额、是否具有相应权限等等)通过，则节点设备转发并存储该交易，如果任一验证不通过，则节点设备丢弃该交易，不进行存储和转发工作。
在一个实施例中，如果节点设备接收到的交易为转账交易，则除了上述的验证外，还需要对接收方账户的权限进行验证。节点设备的处理单元从存储单元存储的区块链中，查询接收方账户的权限是否包括接收转账，若接收方账户的权限包括接收转账，则转发并存储交易；如果任一验证不通过，则节点设备丢弃该交易，不进行存储和转发。
在本公开实施例中，节点设备在接收到交易时，对账户权限进行验证，并根据验证结果进行交易转发和缓存，可过滤掉不具权限的账户所产生的交易，可提高网络效率。
区块产生与验证
在本公开的一实施例中，区块只能由配置了区块产生权限账户的节点设备产生。
区块产生过程中，节点设备判断自身所配置的账户是否具有产生区块的权限，如果没有产生区块的权限，则不启动产生区块的工作。如果有产生区块的权限，则执行PoW或POS等算法，以产生新的区块，并将产生的区块发送到区块链网络中。
参见图7，在一个实施例中，为了可对产生区块的账户权限进行验证，在区块的区块头中，增加一用于存储产生新区块的产生者信息的字段。产生者信息至少包括：产生新区块的节点设备所配置账户的账号地址所对应的公钥，以及新区块头部数据的签名。
当任一节点设备成功挖矿后，将上述的产生者信息存储到新区块的新增字段中后，发送到区块链网络中。
应理解，图7所示为一示例性实施例的区块头的数据结构示意图，区块头中除了一个或两个字段用于存储上述的产生者信息外，其它的字段可根据区块链实际进行选择设置。
参见图8，在本公开的一实施例中，目标信息为区块，接收到区块的节点设备对区块的验证过程包括：
在步骤801中，接收到新区块的节点设备，使用新区块的区块头中的公钥，获取账户地址。
在步骤802中，查询区块链，验证该账户地址是否具有产生区块的权限；若具有产生区块的权限，则执行步骤803；若不具有产生区块的权限，则该新区块不合法。
在步骤803中，根据公钥对新区块头的签名进行验证，若验证不通过，则确定该新区块为不合法区块；若验证通过，则执行步骤804。
在步骤804中，验证新区块的PoW或PoS是否正确，以及验证新区块所记录的每个交易是否合法；若任一验证不通过，则确定该区块不合法；若验证均通过，则确定该新区块为合法区块。
在本公开的实施例中，若新区块不合法，则将新区块丢弃，不进行存储和转发；若新区块合法，则进行存储和转发。
应理解，上述步骤801-步骤803，以及步骤804的执行顺序可交换，即先执行步骤804，再执行步骤801-步骤803，或者上述步骤804，以及步骤 801-步骤803可同时执行，本公开实施例对此不作限制。
本公开实施例，通过在区块头中增加存储产生者信息的字段，可实现对区块产生者的验证，避免不合法区块的产生，提高安全性。
交易产生
在本公开的一实施例中，节点设备在接收到交易产生请求时，首先，会判断所配置的账户是否具有产生相应交易的权限，如果有，则产生交易并发送，如果没有则提示或报错后终止。
在一个实施例中，节点设备的处理单元根据存储单元中存储的区块链，查询所配置的账户是否具有产生和发送相应交易的权限，这些相应交易可包括：账户管理、部署智能合约、调用智能合约、发起转账和数字货币发行等交易。在一个实施例中，如果交易为发起转账的交易，则节点设备还应验证转账交易的接收方账户，是否具有接收转账的权限。节点设备的处理单元根据存储单元中存储的区块链，根据交易的接收方账方的账户地址，验证接收方账户是否具有接收转账的权限。当交易发起方具有发起转账的权限，且接收方账户具有接收转账的权限时，节点设备发送转账交易。
在本公开实施例中，具有发送交易权限的节点才可发送相关交易，可从交易产生的源头即确定交易发送权限，提高其它节点设备对交易处理效率和网络效率。
在本公开的一实施例中，账户的角色包括：管理账户、货币发行账户、监管账户、银行、储户。各个角色所对应的权限参见表2所示。
表2
Figure PCTCN2016113739-appb-000002
Figure PCTCN2016113739-appb-000003
配置了管理账户的节点设备，接收到配置了待分配权限账户的节点设备发送的账户地址，则根据账户的角色，对待分配权限账户进行权限设置。
在该实施例中，配置了管理账户的节点设备，具有的权限包括：网络连接、账户权限管理、区块产生等。配置了管理账户的节点设备接收到账户地址，可根据预设的分配规则，对其进行权限设置。例如，预设的分配规则可为账户地址与账户角色的对应关系，由此，根据账户地址，可确定账户角色，进一步可确定其对应的权限。
账户的权限被确定后，配置了相应账户的节点设备，即具有相应的区块链权限。在一个实施例中，配置了具有数字货币发行权限的账户的节点设备，可通过发布交易的方式，进行数字货币的发行。发布的交易至少包括以下信息：发行的数字货币量、所发行数字货币的所有者账户。交易发布到区块链网络后，区块链网络中的节点设备对交易进行验证。验证的内容至少包括：交易的发布账户是否具有数字货币的发行权限、交易的签名是否正确。由此，通过上述区块链权限控制方法，可实现数字货币的发行，以及各个账户的权限设置；可建立用于进行数字货币发行的区块链，保证区块链数据的安全性。
在本公开的另一实施例中，账户的角色包括：管理账户、身份证明发布账户、认证方用户账户、被认证方用户账户。各个角色所对应的权限参见表3所示。
表3
账户角色 权限
管理账户 网络连接、账户权限管理、区块产生
身份证明发布账户 网络连接、区块产生、部署智能合约、调用智能合约
认证方用户账户 网络连接、调用智能合约、区块产生
被认证方用户账户 网络连接、调用智能合约、区块产生
和上一实施例相同，配置了管理账户的节点设备，接收到配置了待分配权限账户的节点设备发送的账户地址，则根据账户的角色，对待分配权限账户进行权限设置。在该实施例中，配置了管理账户的节点设备，具有的权限包括：网络连接、账户权限管理、区块产生等。
配置了管理账户的节点设备接收到账户地址，可根据预设的分配规则，对其进行权限设置。例如，预设的分配规则可为账户地址与账户角色的对应关系，由此，根据账户地址，可确定账户角色，进一步可确定其对应的权限。
账户的权限被确定后，配置了相应账户的节点设备，即具有相应的区块链权限。配置了身份证明发布账户的节点设备，可发布用于记录用户账户身份信息的智能合约，并负责向该智能合约中写入用户账户的身份信息。配置了认证方用户账户的节点设备，可从智能合约中读取被认证方用户账户的身份信息，并基于此信息对被认证方进行认证。配置了被认证方用户账户的节点设备，可产生账户地址，把地址和公钥等身份信息告知身份证明发布账户，通过身份证明发布账户将身份信息记录到智能合约中。
由此，该实施例可实现身份认证，建立用于进行身份认证的区块链，保证区块链数据的安全性。
参见图9，相应的，本公开实施例还提供一种区块链权限控制装置。该区块链权限控制装置900包括：
信息接收模块901，被配置为接收节点设备发送的目标信息；
账户地址获取模块902，被配置为获取所述节点设备所配置账户的账户地址；
账户权限获取模块903，被配置为根据所述账户地址，从存储有所述账户地址和所述账户地址对应的账户权限的预设区块中，获取所述账户地址对应的账户权限；
处理模块904，被配置为根据所述账户权限，对所述目标信息进行相应的处理。
在一个实施例中，装置900还包括：
账户地址接收模块，被配置为接收所述节点设备发送的所配置账户的账户地址；
权限分配模块，被配置为为所述所配置账户分配账户权限；
交易发布模块，被配置为向区块链网络发布包括所述所配置账户的账户地址和账户权限的交易，所述交易用于将所述节点设备所配置账户的账户地址和账户权限存储到所述预设区块中。
在一个实施例中，所述目标信息为网络连接请求，所述网络连接请求中包括：所述节点设备所配置账户的公钥；
所述账户地址获取模块902，被配置为根据所述公钥，获取所述所配置账户的所述账户地址。
在一个实施例中，处理模块904包括：
认证请求发送子模块，被配置为在所述账户地址所对应的账户权限包括网络连接权限时，向所述节点设备发送认证请求，所述认证请求中至少包括：认证码；
签名子模块，被配置为接收所述节点设备使用所配置账户的所述账户地址所对应的私钥对所述认证码的签名；
验证子模块，被配置为根据所述账户地址对应的公钥验证所述签名；
连接建立子模块，被配置为在所述签名的验证通过时，与所述节点设备建立网络连接。
在一个实施例中，所述目标信息为交易；
所述处理模块包括：
交易处理子模块，被配置为在所述节点设备所配置账户的账户权限包括产生交易的权限时，对接收到的所述交易进行转发和存储。
在一个实施例中，所述目标信息为转账交易，所述转账交易中至少包括：接收方账户的账户地址；
所述处理模块包括：
接收方账户权限获取子模块，被配置为在所述节点设备所配置账户的账户权限包括发起转账的权限时，根据所述接收方账户的账户地址，从存储有所述接收方账户的账户地址和账户权限对应关系的区块中获取所述接收方账户的账户地址所对应的账户权限；
转账交易处理子模块，被配置为在所述接收方账户的账户地址所对应的账户权限包括接收转账的权限时，对所述转账交易进行转发和存储。
在一个实施例中，所述目标信息为所述节点设备创建的区块，所述区块的区块头中包括用于记录公钥和区块头部数据的签名的字段；
所述账户地址获取模块，被配置为根据所述区块的区块头中的公钥，获取所述账户地址。
在一个实施例中，所述处理模块包括：
区块处理子模块，被配置为在所述节点设备所配置账户的账户权限包括产生区块的权限时，对接收到的区块进行转发和存储。
参见图10，相应的，本公开实施例还提供一种区块链权限控制装置。该区块链权限控制装置1000包括：
交易产生请求接收模块1001，被配置为接收到交易产生请求时，获取所 配置账户的账户地址；
账户权限获取模块1002，被配置为根据所述账户地址，从存储有账户地址和账户权限对应关系的区块中，获取所述账户地址对应的账户权限；
交易产生模块1003，被配置为在所述账户权限包括产生交易的权限时，产生并发送交易。
在一个实施例中，所述交易为转账交易；所述装置还包括：
接收方转换权限获取模块，被配置为在所述账户权限包括产生交易的权限时，根据接收方账户的账户地址，从存储有所述接收方账户的账户地址和账户权限对应关系的区块获取所述接收方账户的账户地址的账户权限；
转账交易产生模块，被配置为在所述接收方账户的账户权限包括接收转账的权限时，产生并发送所述转账交易。
关于上述实施例中的装置，其中各个模块执行操作的具体方式已经在有关该方法的实施例中进行了详细描述，此处将不做详细阐述说明。
图11是根据一示例性实施例示出的一种用于区块链权限控制方法的装置1100的框图，该装置1100可以是区块链中的节点设备。如图11所示，该装置1100可以包括：处理器1101，存储器1102，多媒体组件1103，输入/输出(I/O)接口1104，以及通信组件1105。
其中，处理器1101用于控制该装置110的整体操作，以完成上述的区块链权限控制方法中的全部或部分步骤。存储器1102用于存储操作系统，各种类型的数据以支持在该装置1100的操作，这些数据的例如可以包括用于在该装置1100上操作的任何应用程序或方法的指令，以及应用程序相关的数据。该存储器1102可以由任何类型的易失性或非易失性存储设备或者它们的组合实现，例如静态随机存取存储器(Static Random Access Memory，简称SRAM)，电可擦除可编程只读存储器(Electrically Erasable Programmable Read-Only Memory，简称EEPROM)，可擦除可编程只读存储 器(Erasable Programmable Read-Only Memory，简称EPROM)，可编程只读存储器(Programmable Read-Only Memory，简称PROM)，只读存储器(Read-Only Memory，简称ROM)，磁存储器，快闪存储器，磁盘或光盘。
多媒体组件1103可以包括屏幕和音频组件。其中屏幕例如可以是触摸屏，音频组件用于输出和/或输入音频信号。例如，音频组件可以包括一个麦克风，麦克风用于接收外部音频信号。所接收的音频信号可以被进一步存储在存储器1102或通过通信组件1105发送。音频组件还包括至少一个扬声器，用于输出音频信号。I/O接口1104为处理器1101和其他接口模块之间提供接口，上述其他接口模块可以是键盘，鼠标，按钮等。这些按钮可以是虚拟按钮或者实体按钮。通信组件1105用于该装置110与其他设备之间进行有线或无线通信。无线通信，例如Wi-Fi，蓝牙，近场通信(Near Field Communication，简称NFC)，2G、3G或4G，或它们中的一种或几种的组合，因此相应的该通信组件1105可以包括：Wi-Fi模块，蓝牙模块，NFC模块。
在一示例性实施例中，装置1100可以被一个或多个应用专用集成电路(Application Specific Integrated Circuit，简称ASIC)、数字信号处理器(Digital Signal Processor，简称DSP)、数字信号处理设备(Digital Signal Processing Device，简称DSPD)、可编程逻辑器件(Programmable Logic Device，简称PLD)、现场可编程门阵列(Field Programmable Gate Array，简称FPGA)、控制器、微控制器、微处理器或其他电子元件实现，用于执行上述的区块链权限控制方法。
在另一示例性实施例中，还提供了一种计算机程序产品，所述计算机程序产品包含能够由可编程的装置执行的计算机程序，所述计算机程序具有当由所述可编程的装置执行时用于执行上述的区块链权限控制方法的代码部分。
在另一示例性实施例中，还提供了一种包括指令的非临时性计算机可读存储介质，例如包括指令的存储器1102，上述指令可由装置1100的处理器1101执行以完成上述的区块链权限控制方法。示例地，该非临时性计算机可读存储介质可以是ROM、随机存取存储器(Random Access Memory，简称RAM)、CD-ROM、磁带、软盘和光数据存储设备等。
流程图中或在本发明的实施例中以其他方式描述的任何过程或方法描述可以被理解为，表示包括一个或更多个用于实现特定逻辑功能或过程的步骤的可执行指令的代码的模块、片段或部分，并且本发明实施方式的范围包括另外的实现，其中可以不按所示出或讨论的顺序，包括根据所涉及的功能按基本同时的方式或按相反的顺序，来执行功能，这应被本发明的实施例所述技术领域的技术人员所理解。
以上结合附图详细描述了本发明的优选实施方式，但是，本发明并不限于上述实施方式中的具体细节，在本发明的技术构思范围内，可以对本发明的技术方案进行多种简单变型，这些简单变型均属于本发明的保护范围。

Claims (26)

  1. 一种区块链权限控制方法，其特征在于，包括：
    接收节点设备发送的目标信息；
    获取所述节点设备所配置账户的账户地址；
    根据所述账户地址，从存储有所述账户地址和所述账户地址对应的账户权限的预设区块中，获取所述账户地址对应的账户权限；
    根据所述账户权限，对所述目标信息进行相应的处理。
  2. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    接收所述节点设备发送的所配置账户的账户地址；
    为所述所配置账户分配账户权限；
    向区块链网络发布包括所述所配置账户的账户地址和账户权限的交易，所述交易用于将所述节点设备所配置账户的账户地址和账户权限存储到所述预设区块中。
  3. 根据权利要求1所述的方法，其特征在于，所述目标信息为网络连接请求，所述网络连接请求中包括：所述节点设备所配置账户的公钥；
    所述获取所述节点设备所配置账户的账户地址的步骤包括：
    根据所述公钥，获取所述所配置账户的所述账户地址。
  4. 根据权利要求3所述的方法，其特征在于，所述根据所述账户权限，对所述目标信息进行相应的处理的步骤包括：
    当所述账户地址所对应的账户权限包括网络连接权限时，向所述节点设备发送认证请求，所述认证请求中至少包括：认证码；
    接收所述节点设备使用所配置账户的所述账户地址所对应的私钥对所 述认证码的签名；
    根据所述账户地址对应的公钥验证所述签名；
    当所述签名的验证通过时，与所述节点设备建立网络连接。
  5. 根据权利要求1所述的方法，其特征在于，所述目标信息为交易；
    所述根据所述账户权限，对所述目标信息进行相应的处理的步骤包括：
    当所述节点设备所配置账户的账户权限包括产生交易的权限时，对接收到的所述交易进行转发和存储。
  6. 根据权利要求1所述的方法，其特征在于，所述目标信息为转账交易，所述转账交易中至少包括：接收方账户的账户地址；
    所述根据所述账户权限，对所述目标信息进行相应的处理的步骤包括：
    当所述节点设备所配置账户的账户权限包括发起转账的权限时，根据所述接收方账户的账户地址，从存储有所述接收方账户的账户地址和账户权限对应关系的区块中获取所述接收方账户的账户地址所对应的账户权限；
    当所述接收方账户的账户地址所对应的账户权限包括接收转账的权限时，对所述转账交易进行转发和存储。
  7. 根据权利要求1所述的方法，其特征在于，所述目标信息为所述节点设备创建的区块，所述区块的区块头中包括用于记录公钥和区块头部数据的签名的字段；
    所述获取所述节点设备所配置账户的账户地址的步骤包括：
    根据所述区块的区块头中的公钥，获取所述账户地址。
  8. 根据权利要求7所述的方法，其特征在于，所述根据所述账户权限， 对所述目标信息进行相应的处理的步骤包括：
    当所述节点设备所配置账户的账户权限包括产生区块的权限时，对接收到的区块进行转发和存储。
  9. 一种区块链权限控制方法，应用于区块链网络中的节点设备，其特征在于，包括：
    接收到交易产生请求时，获取所配置账户的账户地址；
    根据所述账户地址，从存储有账户地址和账户权限对应关系的区块中，获取所述账户地址对应的账户权限；
    当所述账户权限包括产生交易的权限时，产生并发送交易。
  10. 根据权利要求9所述的方法，其特征在于，所述交易为转账交易；
    所述方法还包括：
    当所述账户权限包括产生交易的权限时，根据接收方账户的账户地址，从存储有所述接收方账户的账户地址和账户权限对应关系的区块获取所述接收方账户的账户地址的账户权限；
    当所述接收方账户的账户权限包括接收转账的权限时，产生并发送所述转账交易。
  11. 一种区块链权限控制装置，其特征在于，包括：
    信息接收模块，被配置为接收节点设备发送的目标信息；
    账户地址获取模块，被配置为获取所述节点设备所配置账户的账户地址；
    账户权限获取模块，被配置为根据所述账户地址，从存储有所述账户地址和所述账户地址对应的账户权限的预设区块中，获取所述账户地址对应的 账户权限；
    处理模块，被配置为根据所述账户权限，对所述目标信息进行相应的处理。
  12. 根据权利要求11所述的装置，其特征在于，所述装置还包括：
    账户地址接收模块，被配置为接收所述节点设备发送的所配置账户的账户地址；
    权限分配模块，被配置为为所述所配置账户分配账户权限；
    交易发布模块，被配置为向区块链网络发布包括所述所配置账户的账户地址和账户权限的交易，所述交易用于将所述节点设备所配置账户的账户地址和账户权限存储到所述预设区块中。
  13. 根据权利要求11所述的装置，其特征在于，所述目标信息为网络连接请求，所述网络连接请求中包括：所述节点设备所配置账户的公钥；
    所述账户地址获取模块，被配置为根据所述公钥，获取所述所配置账户的所述账户地址。
  14. 根据权利要求13所述的装置，其特征在于，所述处理模块包括：
    认证请求发送子模块，被配置为在所述账户地址所对应的账户权限包括网络连接权限时，向所述节点设备发送认证请求，所述认证请求中至少包括：认证码；
    签名子模块，被配置为接收所述节点设备使用所配置账户的所述账户地址所对应的私钥对所述认证码的签名；
    验证子模块，被配置为根据所述账户地址对应的公钥验证所述签名；
    连接建立子模块，被配置为在所述签名的验证通过时，与所述节点设备 建立网络连接。
  15. 根据权利要求11所述的装置，其特征在于，所述目标信息为交易；
    所述处理模块包括：
    交易处理子模块，被配置为在所述节点设备所配置账户的账户权限包括产生交易的权限时，对接收到的所述交易进行转发和存储。
  16. 根据权利要求11所述的装置，其特征在于，所述目标信息为转账交易，所述转账交易中至少包括：接收方账户的账户地址；
    所述处理模块包括：
    接收方账户权限获取子模块，被配置为在所述节点设备所配置账户的账户权限包括发起转账的权限时，根据所述接收方账户的账户地址，从存储有所述接收方账户的账户地址和账户权限对应关系的区块中获取所述接收方账户的账户地址所对应的账户权限；
    转账交易处理子模块，被配置为在所述接收方账户的账户地址所对应的账户权限包括接收转账的权限时，对所述转账交易进行转发和存储。
  17. 根据权利要求11所述的装置，其特征在于，所述目标信息为所述节点设备创建的区块，所述区块的区块头中包括用于记录公钥和区块头部数据的签名的字段；
    所述账户地址获取模块，被配置为根据所述区块的区块头中的公钥，获取所述账户地址。
  18. 根据权利要求17所述的装置，其特征在于，所述处理模块包括：
    区块处理子模块，被配置为在所述节点设备所配置账户的账户权限包括 产生区块的权限时，对接收到的区块进行转发和存储。
  19. 一种区块链权限控制装置，应用于区块链网络中的节点设备，其特征在于，包括：
    交易产生请求接收模块，被配置为接收到交易产生请求时，获取所配置账户的账户地址；
    账户权限获取模块，被配置为根据所述账户地址，从存储有账户地址和账户权限对应关系的区块中，获取所述账户地址对应的账户权限；
    交易产生模块，被配置为在所述账户权限包括产生交易的权限时，产生并发送交易。
  20. 根据权利要求19所述的方法，其特征在于，所述交易为转账交易；
    所述装置还包括：
    接收方转换权限获取模块，被配置为在所述账户权限包括产生交易的权限时，根据接收方账户的账户地址，从存储有所述接收方账户的账户地址和账户权限对应关系的区块获取所述接收方账户的账户地址的账户权限；
    转账交易产生模块，被配置为在所述接收方账户的账户权限包括接收转账的权限时，产生并发送所述转账交易。
  21. 一种计算机程序产品，其特征在于，所述计算机程序产品包含能够由可编程的装置执行的计算机程序，所述计算机程序具有当由所述可编程的装置执行时用于执行权利要求1至8中任一项所述的方法的代码部分。
  22. 一种非临时性计算机可读存储介质，其特征在于，所述非临时性计算机可读存储介质中包括一个或多个程序，所述一个或多个程序用于执行权 利要求1至8中任一项所述的方法。
  23. 一种节点设备，其特征在于，包括：
    权利要求22中所述的非临时性计算机可读存储介质；以及
    一个或者多个处理器，用于执行所述非临时性计算机可读存储介质中的程序。
  24. 一种计算机程序产品，其特征在于，所述计算机程序产品包含能够由可编程的装置执行的计算机程序，所述计算机程序具有当由所述可编程的装置执行时用于执行权利要求9至10中任一项所述的方法的代码部分。
  25. 一种非临时性计算机可读存储介质，其特征在于，所述非临时性计算机可读存储介质中包括一个或多个程序，所述一个或多个程序用于执行权利要求9至10中任一项所述的方法。
  26. 一种节点设备，其特征在于，包括：
    权利要求25中所述的非临时性计算机可读存储介质；以及
    一个或者多个处理器，用于执行所述非临时性计算机可读存储介质中的程序。
PCT/CN2016/113739 2016-12-30 2016-12-30 区块链权限控制方法、装置及节点设备 WO2018120121A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
CN201680002973.6A CN106796685A (zh) 2016-12-30 2016-12-30 区块链权限控制方法、装置及节点设备
PCT/CN2016/113739 WO2018120121A1 (zh) 2016-12-30 2016-12-30 区块链权限控制方法、装置及节点设备
US16/239,359 US11558177B2 (en) 2016-12-30 2019-01-03 Block chain permission control method, device, and node apparatus

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2016/113739 WO2018120121A1 (zh) 2016-12-30 2016-12-30 区块链权限控制方法、装置及节点设备

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/239,359 Continuation US11558177B2 (en) 2016-12-30 2019-01-03 Block chain permission control method, device, and node apparatus

Publications (1)

Publication Number Publication Date
WO2018120121A1 true WO2018120121A1 (zh) 2018-07-05

Family

ID=58952278

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/113739 WO2018120121A1 (zh) 2016-12-30 2016-12-30 区块链权限控制方法、装置及节点设备

Country Status (3)

Country Link
US (1) US11558177B2 (zh)
CN (1) CN106796685A (zh)
WO (1) WO2018120121A1 (zh)

Cited By (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109493210A (zh) * 2018-09-27 2019-03-19 深圳壹账通智能科技有限公司 基于区块链的还款对账方法、装置、设备及可读存储介质
CN109903025A (zh) * 2019-02-11 2019-06-18 杭州复杂美科技有限公司 红包处理方法、设备和存储介质
CN109922039A (zh) * 2019-01-14 2019-06-21 湘潭大学 一种基于区块链技术的半中心化的身份管理方法
CN109934566A (zh) * 2019-02-11 2019-06-25 杭州复杂美科技有限公司 红包处理方法、设备和存储介质
CN110009347A (zh) * 2019-03-20 2019-07-12 深圳前海微众银行股份有限公司 一种区块链交易信息审计的方法及装置
CN110188109A (zh) * 2019-04-03 2019-08-30 阿里巴巴集团控股有限公司 基于区块链的信息管理方法、装置和设备以及存储介质
CN112241888A (zh) * 2019-07-19 2021-01-19 傲为信息技术(江苏)有限公司 基于公链的地址管理系统
CN113114465A (zh) * 2021-03-19 2021-07-13 青岛海尔科技有限公司 归属权限的处理方法及装置、存储介质、电子装置

Families Citing this family (82)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106845960B (zh) * 2017-01-24 2018-03-20 上海壹账通区块链科技有限公司 基于区块链的安全交易方法及系统
US10826681B1 (en) 2017-03-24 2020-11-03 Open Invention Network Llc Blockchain node initialization
AU2018278351A1 (en) 2017-06-01 2020-01-23 Schvey, Inc. d/b/a/ Axoni Distributed privately subspaced blockchain data structures with secure access restriction management
TWI632507B (zh) * 2017-06-03 2018-08-11 蔡政育 實物履歷識別碼之輸出系統
US10721507B2 (en) * 2017-06-06 2020-07-21 Linius (Aust) Pty Ltd. Systems and methods of content transaction consensus
CN107332835A (zh) * 2017-06-26 2017-11-07 深圳前海华深安信物联技术有限公司 一种仓单系统中区块链的创建方法
GB201710283D0 (en) * 2017-06-28 2017-08-09 Nchain Holdings Ltd Computer-implemented system and method
CN109241726B (zh) * 2017-07-10 2021-05-11 上海策赢网络科技有限公司 一种用户权限控制方法及装置
CN107480990B (zh) * 2017-08-01 2021-02-26 中国联合网络通信集团有限公司 区块链记账方法及装置
WO2019078879A1 (en) 2017-10-20 2019-04-25 Hewlett Packard Enterprise Development Lp PERMISSIONS FROM ENTITIES AND ACCESSING INFORMATION
US11604890B2 (en) * 2017-10-20 2023-03-14 Hewlett Packard Enterprise Development Lp Accessing information based on privileges
CN107911373B (zh) * 2017-11-24 2019-09-06 中钞信用卡产业发展有限公司杭州区块链技术研究院 一种区块链权限管理方法及系统
CN108235806B (zh) * 2017-12-28 2020-10-02 深圳达闼科技控股有限公司 安全访问区块链的方法、装置、系统、存储介质及电子设备
CN108390848B (zh) * 2017-12-29 2020-11-17 北京世纪互联宽带数据中心有限公司 一种信息见证方法及装置
CN108833460B (zh) * 2018-04-10 2021-05-25 平安科技（深圳）有限公司 基于区块链的音乐发布方法、装置及终端设备
US20210042295A1 (en) * 2018-04-25 2021-02-11 Simplecredit Micro-Lending Co., Ltd. Blockchain-based data management method and related system
CN108632268B (zh) * 2018-04-28 2021-04-09 腾讯科技（深圳）有限公司 区块链访问的鉴权方法和装置、存储介质、电子装置
CN108809625A (zh) * 2018-05-21 2018-11-13 爱图智能（深圳）有限公司 一种基于区块链的智能家居控制系统、方法及装置
CN110545397B (zh) * 2018-05-28 2021-07-02 中国移动通信有限公司研究院 一种小区智能化管理方法、设备、介质和系统
CN108769186B (zh) * 2018-05-28 2021-11-23 中国联合网络通信集团有限公司 业务权限控制方法及装置
CN108768672B (zh) * 2018-05-31 2021-10-08 中国联合网络通信集团有限公司 数据处理方法、装置及存储介质
CN109102269B (zh) * 2018-06-13 2022-03-22 湖南搜云网络科技股份有限公司 基于区块链的转账方法及装置、区块链节点及存储介质
US11061886B2 (en) * 2018-06-28 2021-07-13 Blockchain Integrated Partners, Llc Systems and methods for data validation and assurance
CN109241763B (zh) * 2018-07-04 2020-03-24 青岛闪收付信息技术有限公司 基于权限下发的区块生成方法
CN109194485A (zh) * 2018-08-21 2019-01-11 甲骨文科技时代（深圳）有限公司 一种多类型网络节点的组网方法
CN109150607A (zh) * 2018-08-22 2019-01-04 中链科技有限公司 用于区块链网络的分级管控方法及装置
CN109257341B (zh) * 2018-09-04 2021-04-06 广州矩阵信息科技有限公司 一种区块链地址的管理方法和设备
CN109583184B (zh) * 2018-10-09 2020-08-04 阿里巴巴集团控股有限公司 身份验证方法及装置和电子设备
CN110692078B (zh) * 2018-10-10 2023-07-25 王成 基于区块链的交易数据处理方法、设备和存储介质
CN109391617B (zh) * 2018-10-15 2021-01-12 天津理工大学 一种基于区块链的网络设备配置管理方法及客户端
CN109474584B (zh) * 2018-10-29 2021-12-07 中化能源科技有限公司 一种基于规则的区块链网络自动许可加入方法
CN109660514B (zh) * 2018-11-15 2020-06-09 苏宁易购集团股份有限公司 一种智能设备系统的实现方法、智能设备控制方法及系统
CN109379381B (zh) * 2018-12-07 2021-06-15 深圳市智税链科技有限公司 区块链系统的数据管理方法、装置、介质及电子设备
CN109447811B (zh) * 2018-12-07 2024-01-02 深圳市智税链科技有限公司 在区块链网络中查询交易信息的方法、记账节点和介质
CN109784020A (zh) * 2019-02-15 2019-05-21 上海优扬新媒信息技术有限公司 一种区块链权限管理方法及装置
CN110008665B (zh) * 2019-03-05 2024-02-06 深圳前海微众银行股份有限公司 一种区块链的权限控制方法及装置
EP3935591A1 (en) * 2019-03-06 2022-01-12 British Telecommunications public limited company Transaction verification of distributed ledgers
US11012506B2 (en) * 2019-03-15 2021-05-18 Microsoft Technology Licensing, Llc Node and cluster management on distributed self-governed ecosystem
CN113726751B (zh) * 2019-03-26 2023-08-18 创新先进技术有限公司 一种块链式账本中的权重管理方法、装置及设备
US11151261B2 (en) * 2019-04-03 2021-10-19 Cisco Technology, Inc. Blockchain system with severable data and cryptographic proof
CN110113380A (zh) * 2019-04-08 2019-08-09 中科云创（北京）科技有限公司 适用于区块链结合时序数据库的数据传输方法及系统
CN109981680B (zh) * 2019-04-08 2021-08-24 上海人行道网络信息技术有限公司 一种访问控制实现方法、装置、计算机设备及存储介质
CN110222053B (zh) * 2019-05-21 2023-03-21 深圳壹账通智能科技有限公司 一种基于区块链的溯源数据的获取方法及相关设备
CN110290111B (zh) * 2019-05-29 2022-11-04 达闼机器人股份有限公司 操作权限管理方法、装置及区块链节点、存储介质
CN110266872B (zh) * 2019-05-30 2021-05-11 世纪龙信息网络有限责任公司 通讯录数据的管控方法、装置及云通讯录系统、计算机设备、计算机可读存储介质
EP3688710B1 (en) * 2019-06-28 2022-05-25 Advanced New Technologies Co., Ltd. System and method for blockchain address mapping
CN110311790B (zh) * 2019-06-28 2020-07-28 阿里巴巴集团控股有限公司 一种跨链发送可认证消息的方法和装置
CN110471928B (zh) * 2019-07-08 2022-06-21 上海数据交易中心有限公司 数据流通系统
US11252166B2 (en) 2019-07-31 2022-02-15 Advanced New Technologies Co., Ltd. Providing data authorization based on blockchain
US11251963B2 (en) 2019-07-31 2022-02-15 Advanced New Technologies Co., Ltd. Blockchain-based data authorization method and apparatus
US11797564B2 (en) 2019-08-02 2023-10-24 EMC IP Holding Company LLC System and method for data registration
US11645398B2 (en) * 2019-08-02 2023-05-09 EMC IP Holding Company LLC System and method for data registration and access
CN110493220B (zh) * 2019-08-16 2021-05-25 腾讯科技（深圳）有限公司 一种基于区块链的数据共享方法、设备及存储介质
CN110458566B (zh) * 2019-08-20 2024-02-23 深圳市迅雷网络技术有限公司 一种区块链的账户地址生成方法、系统、装置及计算机可读存储介质
CN110516474A (zh) * 2019-08-27 2019-11-29 腾讯科技（深圳）有限公司 区块链网络中的用户信息处理方法、装置、电子设备及存储介质
CN110503554B (zh) * 2019-08-27 2022-04-05 腾讯科技（深圳）有限公司 一种智能合约处理方法、装置、区块链节点设备及介质
CN110474763B (zh) * 2019-08-28 2021-04-06 蒋勇 一种基于链的身份保护方法
CN110533403A (zh) * 2019-08-30 2019-12-03 腾讯科技（深圳）有限公司 一种消费处理的方法以及相关装置
CN110401534A (zh) * 2019-09-04 2019-11-01 朱子腾 基于无币区块链的账号体系
CN111213173B (zh) * 2019-09-11 2023-11-17 创新先进技术有限公司 用于控制对数字资产的限制的系统和方法
CN112543103A (zh) * 2019-09-23 2021-03-23 百度在线网络技术（北京）有限公司 账户地址的生成方法和校验方法、装置、设备和介质
CN110839071B (zh) * 2019-11-05 2023-02-14 腾讯科技（深圳）有限公司 一种基于区块链的信息存储方法、设备及存储介质
CN110992029A (zh) * 2019-12-02 2020-04-10 中国科学院计算技术研究所 一种区块链管理系统及方法
CN111190959A (zh) * 2019-12-13 2020-05-22 广东文储区块链科技有限公司 一种区块链去中心化存储基于数据的加密方法及系统
US11310051B2 (en) 2020-01-15 2022-04-19 Advanced New Technologies Co., Ltd. Blockchain-based data authorization method and apparatus
CN111309812A (zh) * 2020-03-11 2020-06-19 深圳市网心科技有限公司 基于区块链的函件传输方法及相关设备
CN111695996B (zh) * 2020-05-12 2024-02-20 成都芯域矩阵科技有限公司 一种基于预交诚意金的区块链共识方法及系统
CN111741015A (zh) * 2020-07-21 2020-10-02 百度在线网络技术（北京）有限公司 区块链网络中操作处理方法、装置、设备和介质
CN112104719B (zh) * 2020-09-03 2021-07-27 腾讯科技（深圳）有限公司 一种基于区块链网络的数据处理方法、装置及存储介质
CN112395570B (zh) * 2020-10-30 2024-02-27 迅鳐成都科技有限公司 一种联盟链智能合约调用权限控制方法、系统及存储介质
CN112527892B (zh) * 2020-11-25 2022-12-27 福建师范大学 一种基于区块链的安全众包任务发放方法及终端
CN112632121B (zh) * 2020-12-15 2024-04-16 京东科技控股股份有限公司 区块链数据获取方法和装置
CN112527460A (zh) * 2020-12-17 2021-03-19 山大地纬软件股份有限公司 一种控制区块链底层资产数据状态一致性的方法及系统
CN112667977A (zh) * 2020-12-29 2021-04-16 齐鲁工业大学 面向智慧城市的区块链身份认证和访问控制方法及系统
CN112804322B (zh) * 2021-01-11 2022-06-28 杭州复杂美科技有限公司 区块生成方法、计算机设备和存储介质
EP4082155A4 (en) * 2021-01-11 2023-12-06 Micro Focus LLC BLOCKCHAIN AUDIT SYSTEM AND PROCEDURES
CN112950208A (zh) * 2021-03-29 2021-06-11 建信金融科技有限责任公司 一种基于区块链的账务信息处理方法和装置
CN113011882A (zh) * 2021-04-23 2021-06-22 上海和数软件有限公司 一种基于区块链的电力数据信息查询系统、电子设备及介质
CN113761581A (zh) * 2021-09-24 2021-12-07 支付宝(杭州)信息技术有限公司 区块链中的权限管控方法、装置和电子设备
CN113949632B (zh) * 2021-12-21 2022-06-28 北京溪塔科技有限公司 一种区块链的节点动态配置方法及装置
WO2023156667A1 (en) * 2022-02-21 2023-08-24 Nchain Licensing Ag Computer implemented method and system for the provision of access to a plurality of functions and applications associated with a blockchain
CN117709947B (zh) * 2024-02-05 2024-04-19 广东通莞科技股份有限公司 基于区块链的pos机结算权限管理方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105976232A (zh) * 2016-06-24 2016-09-28 深圳前海微众银行股份有限公司 资产交易方法和装置
CN105975868A (zh) * 2016-04-29 2016-09-28 杭州云象网络技术有限公司 一种基于区块链的证据保全方法及装置
CN106100981A (zh) * 2016-08-22 2016-11-09 布比（北京）网络技术有限公司 社交网络数据交互方法及装置
US20160358135A1 (en) * 2015-06-05 2016-12-08 DiQi, Inc. Digital currency management method and digital currency node apparatus

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10511573B2 (en) * 1998-10-30 2019-12-17 Virnetx, Inc. Agile network protocol for secure communications using secure domain names
US6826616B2 (en) * 1998-10-30 2004-11-30 Science Applications International Corp. Method for establishing secure communication link between computers of virtual private network
US6502135B1 (en) * 1998-10-30 2002-12-31 Science Applications International Corporation Agile network protocol for secure communications with assured system availability
US7418504B2 (en) * 1998-10-30 2008-08-26 Virnetx, Inc. Agile network protocol for secure communications using secure domain names
US20160267065A1 (en) * 2013-10-25 2016-09-15 Leonard L. Drey Method of Governing Content Presentation of Multi-Page Electronic Documents
US10853592B2 (en) * 2015-02-13 2020-12-01 Yoti Holding Limited Digital identity system
US10594484B2 (en) * 2015-02-13 2020-03-17 Yoti Holding Limited Digital identity system
US10692085B2 (en) * 2015-02-13 2020-06-23 Yoti Holding Limited Secure electronic payment
CN105488431B (zh) * 2015-11-30 2019-12-13 布比（北京）网络技术有限公司 区块链系统权限管理方法和装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20160358135A1 (en) * 2015-06-05 2016-12-08 DiQi, Inc. Digital currency management method and digital currency node apparatus
CN105975868A (zh) * 2016-04-29 2016-09-28 杭州云象网络技术有限公司 一种基于区块链的证据保全方法及装置
CN105976232A (zh) * 2016-06-24 2016-09-28 深圳前海微众银行股份有限公司 资产交易方法和装置
CN106100981A (zh) * 2016-08-22 2016-11-09 布比（北京）网络技术有限公司 社交网络数据交互方法及装置

Cited By (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109493210A (zh) * 2018-09-27 2019-03-19 深圳壹账通智能科技有限公司 基于区块链的还款对账方法、装置、设备及可读存储介质
CN109922039B (zh) * 2019-01-14 2021-05-07 湘潭大学 一种基于区块链技术的半中心化的身份管理方法
CN109922039A (zh) * 2019-01-14 2019-06-21 湘潭大学 一种基于区块链技术的半中心化的身份管理方法
CN109903025B (zh) * 2019-02-11 2023-01-13 杭州复杂美科技有限公司 红包处理方法、设备和存储介质
CN109934566A (zh) * 2019-02-11 2019-06-25 杭州复杂美科技有限公司 红包处理方法、设备和存储介质
CN109903025A (zh) * 2019-02-11 2019-06-18 杭州复杂美科技有限公司 红包处理方法、设备和存储介质
CN109934566B (zh) * 2019-02-11 2023-04-14 杭州复杂美科技有限公司 红包处理方法、设备和存储介质
CN110009347A (zh) * 2019-03-20 2019-07-12 深圳前海微众银行股份有限公司 一种区块链交易信息审计的方法及装置
CN110188109A (zh) * 2019-04-03 2019-08-30 阿里巴巴集团控股有限公司 基于区块链的信息管理方法、装置和设备以及存储介质
CN110188109B (zh) * 2019-04-03 2023-10-31 创新先进技术有限公司 基于区块链的信息管理方法、装置和设备以及存储介质
CN112241888A (zh) * 2019-07-19 2021-01-19 傲为信息技术(江苏)有限公司 基于公链的地址管理系统
CN112241888B (zh) * 2019-07-19 2024-03-26 傲为有限公司 基于公链的地址管理系统
CN113114465A (zh) * 2021-03-19 2021-07-13 青岛海尔科技有限公司 归属权限的处理方法及装置、存储介质、电子装置

Also Published As

Publication number Publication date
CN106796685A (zh) 2017-05-31
US20190140822A1 (en) 2019-05-09
US11558177B2 (en) 2023-01-17

Similar Documents

Publication Publication Date Title
WO2018120121A1 (zh) 区块链权限控制方法、装置及节点设备
US11038682B2 (en) Communication method, apparatus and system, electronic device, and computer readable storage medium
JP6705064B1 (ja) ブロックチェーンノード通信方法および装置
WO2020192743A1 (zh) 权限管理方法、权限验证方法和相关装置
WO2021023200A1 (zh) 跨链交易方法、装置、多区块链系统及计算设备
US11159307B2 (en) Ad-hoc trusted groups on a blockchain
WO2018112940A1 (zh) 区块链节点的业务执行方法、装置及节点设备
US20220294622A1 (en) Methods and systems to establish trusted peer-to-peer communications between nodes in a blockchain network
WO2019127278A1 (zh) 安全访问区块链的方法、装置、系统、存储介质及电子设备
US10972448B2 (en) Technologies for data broker assisted transfer of device ownership
WO2018119585A1 (zh) 区块链的权限控制方法、装置、系统及节点设备
TW202044087A (zh) 提高區塊鏈網路與外部資料源之間的通信的完整性
JP2020528695A (ja) ハード／ソフトトークン検証を介したブロックチェーン認証
KR20190111042A (ko) 블록체인 노드들 간의 통신을 위한 방법, 장치와 전자 디바이스, 및 블록체인 기반 인증서 관리를 위한 방법, 장치와 전자 디바이스
CN110537346A (zh) 安全去中心化域名系统
WO2021169107A1 (zh) 一种网络身份保护方法、装置及电子设备和存储介质
CN110177124B (zh) 基于区块链的身份认证方法及相关设备
WO2019110018A1 (zh) 通信网络系统的消息验证方法、通信方法和通信网络系统
KR102209987B1 (ko) 블록체인 및 스마트 컨트랙트 기반 인증서 상태 관리 장치 및 방법
JP2017208085A (ja) 暗号通貨ベースのイベント参加検証
CN102077506A (zh) 用于对等存储系统的安全结构
WO2009089764A1 (fr) Système et procédé d'authentification de réseau sécurisé
US20200160340A1 (en) Distributed fraud detection system within mesh networks
US20200175505A1 (en) System and method for creating a secure mesh network utilizing the blockchain
CN111709053B (zh) 基于松散耦合交易网络的作业方法及作业装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16925086

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC , EPO FORM 1205A DATED 30.10.19.

122 Ep: pct application non-entry in european phase

Ref document number: 16925086

Country of ref document: EP

Kind code of ref document: A1