WO2020140931A1

WO2020140931A1 - Blockchain access control method and apparatus, and electronic device

Info

Publication number: WO2020140931A1
Application number: PCT/CN2020/070058
Authority: WO
Inventors: 张昇; 刘旭进
Original assignee: 菜鸟智能物流控股有限公司
Priority date: 2019-01-03
Filing date: 2020-01-02
Publication date: 2020-07-09
Also published as: CN111400727A; CN111400727B

Abstract

A blockchain access control method and apparatus, and an electronic device. The method comprises: establishing associated member identity information and organization identity information on a local device of an organization to be added to a blockchain; according to the member identity information, signing transaction data created by a member in the organization so as to generate signature information; and transmitting the transaction data, the organization identity information and the signature information to a common node or private node in the blockchain for identity verification, and sending the information to the blockchain. The method implements the decentralization of an organization by means of establishing associated organization identity information and member identity information for an organization to be added to a blockchain and the members thereof, and, when a member initiates a transaction by using the member identity information, corresponding organization identity information may be determined by using the association of the member identity information and organization identity information so as to verify the organization identity, thereby implementing access control for the blockchain.

Description

Block chain access control method and device and electronic equipment

This application requires the priority of the Chinese patent application with the application number 201910005782.0 and the invention titled "Blockchain Access Control Method and Device and Electronic Equipment" filed on January 03, 2019, the entire content of which is incorporated by reference in this application in.

Technical field

The present invention relates to the field of blockchain technology, and in particular, to a blockchain access control method and device, and electronic equipment.

Background technique

The alliance chain is a kind of blockchain technology, which is a blockchain jointly managed by several organizations or institutions. In the alliance chain, each organization (institution) needs to build one or more private nodes to facilitate its members to participate in the alliance chain. Therefore, only those organizations that have established private nodes can join the alliance chain, and do not have private nodes ( Without capacity building or unwillingness to build a private node), and unwilling to rely on other organizations with private nodes on the alliance chain, they are not eligible to join the alliance chain.

In the process of implementing the present invention, the inventor found that the prior art has at least the following problems: In the prior art, in order to enable members of organizations that are not qualified to join the alliance chain to participate in the alliance chain, the private node has an authentication center It is used to authorize members (users) belonging to organizations that are not qualified to join the alliance chain. Only authorized members can participate in the alliance chain.

Summary of the invention

Embodiments of the present invention provide a block chain access control method and device, and electronic equipment, to solve the defect in the prior art that an organization member must be authorized by the organization when accessing the alliance chain.

To achieve the above objective, an embodiment of the present invention provides a block chain access control method, including:

Establishing an associated identity information pair on the local device of the organization to be added to the blockchain, the identity information pair including member identity information and organization identity information, wherein the member identity information is associated with corresponding organization identity information;

Based on the member identity information, sign the transaction data generated by the members of the organization to generate signature information;

Transmitting the transaction data, the organization identity information, and the signature information to a public node in the blockchain or a private node in the blockchain, and the public node or private node performs identity verification After that, send to the blockchain.

An embodiment of the present invention also provides a block chain access control device, including:

The identity information establishment module is used to establish an associated identity information pair on the local device of the organization to be added to the blockchain. The identity information pair includes member identity information and organization identity information, wherein the member identity information is associated with each other Organizational identity information;

The signature information generation module is used to perform signature operations on the transaction data generated by the members of the organization according to the member identity information to generate signature information;

The access control module is used to transmit the transaction data, the organization identity information and the signature information to a public node in the blockchain or a private node in the blockchain. The public node or After the identity verification of the private node is passed, it is sent to the blockchain.

An embodiment of the present invention also provides an electronic device, including:

Memory for storing programs;

A processor, configured to run the program stored in the memory for:

The block chain access control method and device and electronic equipment provided in the embodiments of the present invention realize the qualification of joining the alliance chain by establishing associated organization identity information and member identity information for the organization and its members to be added to the blockchain The decentralization of the organization does not require organizations that are qualified to join the alliance chain to authorize members of organizations that are not qualified to join the alliance chain. When the member uses the member identity information to initiate a transaction, the association between the member identity information and the organization identity information is used , Can determine the corresponding organization identity information to verify the identity of the organization, and then achieve access control to the blockchain.

The above description is only an overview of the technical solutions of the present invention. In order to understand the technical means of the present invention more clearly, it can be implemented in accordance with the content of the specification, and in order to make the above and other objects, features and advantages of the present invention more obvious and understandable The specific embodiments of the present invention are listed below.

BRIEF DESCRIPTION

By reading the detailed description of the preferred embodiments below, various other advantages and benefits will become clear to those of ordinary skill in the art. The drawings are only for the purpose of showing the preferred embodiments, and are not considered to limit the present application. Furthermore, throughout the drawings, the same reference symbols are used to denote the same components. In the drawings:

1 is a system block diagram of a business system provided by an embodiment of the present invention;

2 is a flowchart of an embodiment of a method for access control of a blockchain provided by the present invention;

FIG. 3 is a flowchart of another embodiment of the block chain access control method provided by the present invention;

4 is a schematic structural diagram of an embodiment of a block chain access control device provided by the present invention;

5 is a schematic structural diagram of another embodiment of a block chain access control device provided by the present invention;

6 is a schematic structural diagram of an embodiment of an electronic device provided by the present invention.

detailed description

Hereinafter, exemplary embodiments of the present disclosure will be described in more detail with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

In the existing blockchain technology, only organizations that build private nodes can join the alliance chain, without private nodes (no capacity building, or unwillingness to build private nodes), and reluctance to rely on other owners of the alliance chain. Private node organizations are not eligible to join the alliance chain. In order to enable members of organizations that are not qualified to join the alliance chain to participate in the alliance chain, private nodes have a certification center for authorizing members (users) belonging to organizations that are not qualified to join the alliance chain, and only obtain authorization Members can participate in the alliance chain. Therefore, this application proposes a blockchain access control scheme, the main principles of which are: setting up a public node on the blockchain, and establishing an associated identity information pair on the local device of the organization to be added to the blockchain That is, establish organizational identity information for the organization, establish membership identity information for the members in the organization, and the member identity information is associated with the corresponding organizational identity information. When a member uses member identity information to initiate a transaction, the correlation between the member identity information and the organization identity information can be used to determine the corresponding organization identity information to verify the organization identity, thereby achieving access control to the blockchain. Therefore, the decentralization of the organization can be achieved, and when members access the blockchain, there is no need for the organization to authorize the members.

It should be noted that in the following description of the solution of the present invention, the private node refers to that the relevant organization that has the qualification to join the alliance chain needs to authorize and pass the private node to the members of the organization that does not have the qualification to join the alliance chain. Private nodes send transactions initiated by members of the organization to the blockchain. The public node refers to that members in related organizations that are not qualified to join the alliance chain do not need to be authorized by the private node of the organization that is qualified to join the alliance chain, but use the associated identity established by the solution of the present invention through the public node Information pair to verify the identity of the organization, so as to send transactions initiated by members of organizations that are not eligible to join the alliance chain to the blockchain through public nodes. Further, in the solution of the present invention, the nodes can be divided into two types: one type is a node (private node) established by an organization that has the ability to self-build a node; the other type is for a node that does not have capacity building or is unwilling to build a node Organizations, the nodes (public nodes) established by blockchain service providers for these organizations. In the solution of the present invention, the functions of the two types of nodes are the same, and both use the associated identity information pairs to verify the identity of the organization, and send transactions initiated by members of the organization to the blockchain.

The method provided by the embodiment of the present invention can be applied to any business system applied to the blockchain. FIG. 1 is a system block diagram of a business system provided by an embodiment of the present invention. The structure shown in FIG. 1 is only one example of a business system to which the technical solution of the present invention can be applied. As shown in FIG. 1, the business system includes an access control device. The device includes: an identity information establishment module, a signature information generation module, and an access control module, which can be used to execute the processing flow shown in FIGS. 2 and 3 described below. In this business system, first, an associated identity information pair is established on the local device of the organization to be added to the blockchain. The identity information pair includes member identity information and organization identity information, where the member identity information is associated with the corresponding organization Identity information; when a member initiates a transaction, the generated transaction data is signed according to the member identity information in the above identity information pair to generate signature information; then, the transaction data, organization identity information, and signature information are transmitted to The public node in the blockchain or the private node in the blockchain is sent to the blockchain after the identity verification by the public node or private node; finally, the corresponding node in the blockchain sends it to the public node or private node Identity verification; when the number of nodes with successful identity verification is greater than or equal to the preset number, the transaction results are stored to the nodes in the blockchain.

By establishing associated organization identity information and member identity information for organizations and their members to join the blockchain, the decentralization of organizations that are eligible to join the alliance chain can be achieved, and organizations that do not need to join the alliance chain are not required to join the alliance The member of the chain-qualified organization authorizes, when the member uses the member identity information to initiate a transaction, the association of the member identity information and the organization identity information can be used to determine the corresponding organization identity information to verify the organization identity, and then realize Access control to the blockchain.

The above embodiments are descriptions of the technical principles and exemplary application frameworks of the embodiments of the present invention. The following describes the specific technical solutions of the embodiments of the present invention in detail through multiple embodiments.

Example one

FIG. 2 is a flowchart of an embodiment of a block chain access control method provided by the present invention. The method may be executed by the above-mentioned business system, or may be a block chain service provider server device, or may be integrated in Devices or chips on these server devices. As shown in Figure 2, the access control method of the blockchain includes the following steps:

S201. Establish an associated identity information pair on the local device of the organization to be added to the blockchain.

In the embodiment of the present invention, first, an associated identity information pair needs to be established for the organization to be added to the blockchain. The established identity information pair includes the organization identity information established for the organization and the member identity information established for the members in the organization, wherein the member identity information is associated with the corresponding organization identity information.

S202. Perform signature operation on the transaction data generated by the members of the organization according to the member identity information to generate signature information.

In the embodiment of the present invention, when a member of the organization initiates a transaction, the generated transaction data may be signed according to the member identity information, thereby generating signature information.

S203: Transmit transaction data, organization identity information and signature information to a public node in the blockchain or a private node in the blockchain. After the public node or private node passes the identity verification, it is sent to the blockchain.

S204, the corresponding node in the blockchain authenticates the information sent by the public node or the private node.

S205: When the number of nodes with successful identity verification is greater than or equal to the preset number, store the transaction result to the nodes in the blockchain.

The block chain access control method provided by the embodiment of the present invention realizes the decentralization of organizations qualified to join the alliance chain by establishing associated organization identity information and member identity information for the organizations and their members to be added to the blockchain , No organization with qualification to join alliance chain is required to authorize members of organizations without qualification to join alliance chain. When members use member identity information to initiate transactions, the association of member identity information and organization identity information can be used to determine the corresponding organization Identity information, to verify the identity of the organization, and then achieve access control to the blockchain.

Example 2

FIG. 3 is a flowchart of another embodiment of a block chain access control method provided by the present invention. As shown in FIG. 3, on the basis of the embodiment shown in FIG. 2 above, the associated identity information pair established for the organization to be added to the blockchain and its members is an asymmetric key pair, where the member identity information It is the private key in the asymmetric key pair, and the organization identity information is the public key in the asymmetric key pair. Specifically, the block chain access control method provided in this embodiment may further include the following steps:

S301: Establish an asymmetric key pair on the local device of the organization to be added to the blockchain according to the elliptic curve encryption algorithm.

In an asymmetric encryption algorithm, an asymmetric key pair includes two keys: a public key (public key, that is, a public key) and a private key (private key, that is, a private key). The public key and private key are a pair. If the public key is used to encrypt data, only the corresponding private key can be used to decrypt. If the private key is used to encrypt data, then only the corresponding public key can be used to decrypt. In the solution of the present invention, the private key in the asymmetric key pair can be used to determine the characteristics of the corresponding public key, and the asymmetric key pair is used as the identity information pair of the organization and its members.

Specifically, in the embodiment of the present invention, an elliptic curve encryption algorithm (Elliptic curve encryption, ECC for short) can be used to establish an asymmetric key pair on the local device of the organization to be added to the blockchain, for example, the secp256k1 algorithm can be used . Of course, in the embodiment of the present invention, other encryption algorithms may also be used to obtain the asymmetric key pair, for example, RSA algorithm, Elgamal algorithm, knapsack algorithm, Rabin algorithm, D-H algorithm, etc.

In addition, in the embodiment of the present invention, the organization address of the organization may be added to the white list of the blockchain in advance, so as to subsequently perform identity authentication and admission permission. The details are as described in steps S302 and S303 below.

S302: According to the public key in the asymmetric key pair, generate an organization address for identifying the organization.

S303, register the organization address in the white list of the blockchain.

In the embodiment of the present invention, the public key is organizational identity information established for an organization and can represent the identity of the organization. Therefore, the organization address identifying the organization can be generated based on the public key assigned to the organization.

What needs to be explained here is:

If there are three members a, b, c in the organization; then

The asymmetric key pair corresponding to member a is (private key M1, public key N1);

The asymmetric key pair corresponding to member b is (private key M2, public key N2);

The asymmetric key pair corresponding to member c is (private key M3, public key N3);

In the above case, the organization corresponds to three public keys.

Therefore, an organization can also correspond to one or more organization addresses (calculated by each public key).

In the embodiment of the present invention, the hash value of the public key can be calculated first, and the array of the hash value of the public key and the network version number of the blockchain can be calculated; then, the array can be hashed to obtain the verification Code, and add the verification code to the above array; finally, the address array is added with the verification code to generate the organization address.

Specifically, in the embodiment of the present invention, the public key can be processed by the SHA-256 algorithm to obtain a 32-byte hash value, and then processed by the RIEPMD-160 algorithm to obtain a 20-byte hash value; then, at 20 words Add the network version number of the blockchain to the head of the hash value of the section to form a 21-byte array; after performing two hash calculations on the 21-byte array, use the first 4 bytes of the calculation result as The check code is added to the end of the 21-byte array to form a 25-byte array; finally, the 25-byte array is encoded using the Base58 algorithm to obtain the organization address.

S304: Calculate the hash value of the transaction data.

S305: Perform encryption processing on the hash value of the transaction data according to the private key, and encode the encryption processing result to generate signature information.

In the embodiment of the present invention, when a member in an organization initiates a transaction, the transaction data generated by the member in the organization is signed according to the private key to generate signature information. The hash value of the transaction data can be calculated first, and then the hash value of the transaction data is encrypted according to the private key, and the encryption processing result is encoded to generate signature information.

Specifically, in the embodiment of the present invention, the transaction data can be processed by the SHA-256 algorithm to obtain a 32-byte hash value; then, the elliptic curve digital signature is applied to the 32-byte hash value according to the private key The algorithm (EllipticCurveDigitalSignatureAlgorithm; referred to as: ECDSA) secp256k1 algorithm for signature processing, and Base64 encoding of the signature processing results to obtain signature information.

In the embodiment of the present invention, the process of sending transaction data, organization identity information and signature information to the blockchain through a public node for identity verification and access control can be described as steps S306 to S308 described below.

S306: Generate an identity verification public key based on the transaction data and signature information, and verify whether the generated identity verification public key is consistent with the public key in the received asymmetric key pair.

In the embodiment of the present invention, the identity verification public key can be derived from the transaction data and signature information, and the derived identity verification public key can be verified for consistency with the public key sent directly to the public node. If they match, the signature verification by. You can first decode the signature information and calculate the hash value of the transaction data; then, based on the decoded signature information and the hash value of the transaction data, generate an identity verification public key.

Specifically, in the embodiment of the present invention, the signature information can be Base64 decoded, and the transaction data can be processed by the SHA-256 algorithm to obtain a 32-byte hash value; then, the decoded signature information and the decoded signature information can be obtained by the ECDSA secp256k1 algorithm. The hash value of the transaction data is processed to obtain the identity verification public key.

S307: Generate an identity verification address based on the generated identity verification public key, and verify whether the identity verification address exists in the white list.

In the embodiment of the present invention, the operation of generating an identity verification address based on the generated identity verification public key is the same as the operation of generating an organization address based on the public key in step S302 above, and details are not described herein again. After the identity verification address is generated by the generated identity verification public key, verify whether the identity verification address exists in the white list to verify the identity of the organization in the smart contract.

S308: Perform decryption processing on the signature information according to the generated identity verification public key, and verify the consistency of the decrypted data and the transaction data.

In the embodiment of the present invention, the signature information is decrypted according to the generated identity verification public key, and the consistency between the decrypted data and the transaction data is verified, thereby verifying whether the transaction data initiated by the organization belongs to the block chain. Organization to prevent the organization from operating data from other organizations.

It should be noted that, in the embodiment of the present invention, at least one private node may be provided on the blockchain, and the private node has a certification center (CA center), which may be used to treat organizations that join the blockchain through the private node Authorized by members of. That is to say, in the embodiment of the present invention, an organization that has the ability to self-build a node can also authorize members through a self-built private node, and send transactions initiated by members of the organization to the blockchain through the private node.

The access control method of the blockchain provided by the embodiment of the present invention realizes the decentralization of organizations that are eligible to join the alliance chain by establishing asymmetric key pairs for the organizations and members to join the blockchain, without having to join the alliance Chain-qualified organizations authorize members of organizations that are not qualified to join the consortium chain. When members initiate transactions, they use private keys to sign transaction data, and use the correlation between private keys and public keys. According to the transaction data and signature information The public key representing the identity of the organization is pushed out to verify the identity of the organization, thereby achieving access control to the blockchain.

Example Three

FIG. 4 is a schematic structural diagram of an embodiment of a block chain access control device provided by the present invention, and can be used to execute the method steps shown in FIG. 2. As shown in FIG. 4, the access control device of the blockchain may include: an identity information establishment module 41, a signature information generation module 42, and an access control module 43.

Among them, the identity information establishment module 41 can be used to establish an associated identity information pair on the local device of the organization to be added to the blockchain, the identity information pair includes member identity information and organization identity information, wherein the member identity information is associated with For organization identity information; signature information generation module 42 can be used to sign transaction data generated by members of the organization based on member identity information to generate signature information; access control module 43 can be used to integrate transaction data and organization identity information The signature information is transmitted to a public node in the blockchain or a private node in the blockchain. After the identity verification is passed by the public node or the private node, it is sent to the blockchain.

In the embodiment of the present invention, first, the identity information establishing module 41 needs to establish an associated identity information pair for the organization to be added to the blockchain. The established identity information pair includes the organization identity information established for the organization and the member identity information established for the members in the organization. When a member of the organization initiates a transaction, the signature information generation module 42 may sign the generated transaction data according to the member identity information generated by the identity information establishment module 41, thereby generating signature information. The access control module 43 can transmit the transaction data generated by the organization members, the member identity information established by the identity information establishment module 41 for the organization members and the signature information generated by the signature information generation module 42 together to a public node or private in the blockchain Nodes are sent to the blockchain after being authenticated by public or private nodes.

The block chain access control device provided by the embodiment of the present invention realizes the decentralization of organizations qualified to join the consortium chain by establishing associated organization identification information and member identification information for the organizations and their members to be added to the block chain , No organization with qualification to join alliance chain is required to authorize members of organizations without qualification to join alliance chain. When members use member identity information to initiate transactions, the association of member identity information and organization identity information can be used to determine the corresponding organization Identity information, to verify the identity of the organization, and then achieve access control to the blockchain.

Example 4

FIG. 5 is a schematic structural diagram of another embodiment of a block chain access control device provided by the present invention, and can be used to execute the method steps shown in FIG. As shown in FIG. 5, on the basis of the embodiment shown in FIG. 4 above, the block chain access control device provided by the embodiment of the present invention may further include: an identity verification module 53 and a sending module 54.

Among them, the identity verification module 53 is set in the corresponding node in the blockchain to perform identity verification on the information sent by the public node or the private node; the sending module 54 is used when the number of nodes successfully authenticated is greater than or equal to the preset number, Store transaction results to nodes in the blockchain.

In addition, the identity information establishment module 41 establishes an associated asymmetric key pair for the organization to be added to the blockchain and its members, where the member identity information is the private key in the asymmetric key pair, The organization identity information is the public key in the asymmetric key pair.

Specifically, in the access control device of the blockchain provided by the embodiment of the present invention, the identity information establishment module 41 may be specifically used to establish an asymmetric key on the local device of the organization to be added to the blockchain according to the elliptic curve encryption algorithm Correct.

In an asymmetric encryption algorithm, an asymmetric key pair includes two keys: a public key (public key, that is, a public key) and a private key (private key, that is, a private key). The public key and private key are a pair. If the public key is used to encrypt data, only the corresponding private key can be used to decrypt. If the private key is used to encrypt data, then only the corresponding public key can be used to decrypt. In the solution of the present invention, the identity information establishment module 41 can determine the characteristics of the corresponding public key by using the private key in the asymmetric key pair, and uses the asymmetric key pair as the identity information pair of the organization and its members.

Specifically, in the embodiment of the present invention, the identity information establishment module 41 may use ECC to establish an asymmetric key pair on the local device of the organization to be added to the blockchain, for example, the secp256k1 algorithm may be used. Of course, in the embodiment of the present invention, other encryption algorithms may also be used to obtain the asymmetric key pair, for example, RSA algorithm, Elgamal algorithm, knapsack algorithm, Rabin algorithm, D-H algorithm, etc.

In addition, the access control device of the blockchain provided by the embodiment of the present invention may further include: an address generation module 51 and a registration module 52.

Among them, the address generation module 51 can be used to generate an organization address for identifying an organization based on the public key in the asymmetric key pair; the registration module 52 can be used to register the organization address in the blockchain whitelist.

In the embodiment of the present invention, the public key is the organization identity information established by the identity information establishment module 41 for the organization, and can represent the identity of the organization. Therefore, the address generation module 51 can generate an identity identifying the organization based on the public key assigned to the organization Organization address. The address generation module 51 can first calculate the hash value of the public key, and combine the hash value of the public key with the network version number of the blockchain; then, hash the array to obtain the verification code, and Add the verification code to the above array; finally, the address array is added with the verification code to generate the organization address.

Specifically, in the embodiment of the present invention, the address generation module 51 may use the SHA-256 algorithm to process the public key to obtain a 32-byte hash value, and then use the RIEPMD-160 algorithm to obtain a 20-byte hash value; then , Add the network version number of the blockchain to the head of the 20-byte hash value to form a 21-byte array; after performing two hash calculations on the 21-byte array, the first 4 of the calculation result will be Each byte is added as a check code to the end of the 21-byte array to form a 25-byte array; finally, the 25-byte array is encoded using the Base58 algorithm to obtain the organization address.

In addition, in the embodiment of the present invention, when a member of the organization initiates a transaction, the signature information generation module 42 may first calculate the hash value of the transaction data, and then encrypt the hash value of the transaction data according to the private key, and Encoding the encryption processing result to generate signature information.

Specifically, in the embodiment of the present invention, the signature information generation module 42 may perform SHA-256 algorithm processing on the transaction data to obtain a 32-byte hash value; then, the 32-byte hash value according to the private key The secp256k1 algorithm in ECDSA is used for signature processing, and the signature processing result is Base64 encoded to obtain signature information.

Further, the access control module 43 may be specifically used to generate an identity verification public key based on transaction data and signature information on a public node, and verify the generated identity verification key and the public key in the received asymmetric key pair Is consistent; used to generate an identity verification address based on the generated identity verification public key and verify that the identity verification address exists in the white list; and, used to decrypt signature information based on the generated identity verification public key, And verify the consistency of the decrypted data and transaction data.

In the embodiment of the present invention, the access control module 43 may derive the identity verification public key based on the transaction data and signature information, and perform consistency verification on the derived identity verification key and the public key directly sent to the public node. If they match, the signature verification is passed. The access control module 43 may first decode the signature information and calculate the hash value of the transaction data; then, based on the decoded signature information and the hash value of the transaction data, generate an identity verification public key.

Specifically, in the embodiment of the present invention, the access control module 43 may perform Base64 decoding on the signature information, and perform SHA-256 algorithm processing on the transaction data to obtain a 32-byte hash value; then, after decoding through the ECDSA secp256k1 algorithm The signature information and the hash value of the transaction data are processed to obtain the identity verification public key.

In the embodiment of the present invention, the process of the access control module 43 generating the identity verification address based on the public key is the same as the operation of the address generating module 51 generating the organization address based on the public key, and will not be repeated here. After generating the identity verification address through the public key, the access control module 43 verifies whether the identity verification address exists in the white list to verify the identity of the organization in the smart contract. Then, the access control module 43 can also decrypt the signature information according to the generated identity verification public key, and verify the consistency of the decrypted data and the transaction data, thereby verifying whether the transaction data initiated by the organization belongs in the blockchain The organization to prevent the organization from operating data from other organizations.

It should be noted that, in the embodiment of the present invention, at least one private node may also be provided on the blockchain, and the private node has an authentication center, which may be used to authorize members of the organization that joined the blockchain through the private node . That is to say, in the embodiment of the present invention, an organization that has the ability to self-build a node can also authorize members through a self-built private node, and send transactions initiated by members of the organization to the blockchain through the private node.

The block chain access control device provided by the embodiment of the present invention realizes the decentralization of organizations qualified to join the alliance chain by establishing asymmetric key pairs for the organizations and their members to be added to the blockchain, without having to join the alliance Chain-qualified organizations authorize members of organizations that are not qualified to join the consortium chain. When members initiate transactions, they use private keys to sign transaction data, and use the correlation between private keys and public keys. According to the transaction data and signature information The public key representing the identity of the organization is pushed out to verify the identity of the organization, thereby achieving access control to the blockchain.

Example 5

The above describes the internal functions and structure of the access control device of the blockchain, which can be implemented as an electronic device. 6 is a schematic structural diagram of an embodiment of an electronic device provided by the present invention. As shown in FIG. 6, the electronic device includes a memory 61 and a processor 62.

The memory 61 is used to store programs. In addition to the above-mentioned programs, the memory 61 may be configured to store various other data to support operations on the electronic device. Examples of these data include instructions for any application or method for operating on the electronic device, contact data, phone book data, messages, pictures, videos, etc.

The memory 61 may be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read only memory (EEPROM), erasable and removable Programmable read only memory (EPROM), programmable read only memory (PROM), read only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

The processor 62 is coupled to the memory 61 and executes the program stored in the memory 61 for:

Establish an associated identity information pair on the local device of the organization to be added to the blockchain. The identity information pair includes member identity information and organization identity information, where the member identity information association corresponds to the organization identity information;

According to the membership information, sign the transaction data generated by the members of the organization to generate signature information;

The transaction data, organization identity information and signature information are transmitted to public nodes in the blockchain or private nodes in the blockchain, and the identity verification by the public nodes or private nodes is passed to the blockchain.

Further, as shown in FIG. 6, the electronic device may further include: a communication component 63, a power component 64, an audio component 65, a display 66, and other components. Only some components are schematically shown in FIG. 6, which does not mean that the electronic device includes only the components shown in FIG.

The communication component 63 is configured to facilitate wired or wireless communication between the electronic device and other devices. Electronic devices can access wireless networks based on communication standards, such as WiFi, 2G or 3G, or a combination thereof. In an exemplary embodiment, the communication component 63 receives a broadcast signal or broadcast related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 63 further includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology, and other technologies.

The power supply component 64 provides power for various components of the electronic device. The power component 64 may include a power management system, one or more power sources, and other components associated with generating, managing, and distributing power for electronic devices.

The audio component 65 is configured to output and/or input audio signals. For example, the audio component 65 includes a microphone (MIC). When the electronic device is in an operation mode, such as a call mode, a recording mode, and a voice recognition mode, the microphone is configured to receive an external audio signal. The received audio signal may be further stored in the memory 61 or transmitted via the communication component 63. In some embodiments, the audio component 65 further includes a speaker for outputting audio signals.

The display 66 includes a screen, which may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touch, swipe, and gestures on the touch panel. The touch sensor may not only sense the boundary of the touch or sliding action, but also detect the duration and pressure related to the touch or sliding operation.

Persons of ordinary skill in the art may understand that all or part of the steps of the foregoing method embodiments may be completed by a program instructing relevant hardware. The aforementioned program may be stored in a computer-readable storage medium. When the program is executed, the steps including the foregoing method embodiments are executed; and the foregoing storage media include various media that can store program codes, such as ROM, RAM, magnetic disk, or optical disk.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention, rather than limiting it; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: The technical solutions described in the foregoing embodiments can still be modified, or some or all of the technical features can be equivalently replaced; and these modifications or replacements do not deviate from the essence of the corresponding technical solutions of the technical solutions of the embodiments of the present invention. range.

Claims

A block chain access control method, characterized in that the method includes:

Establishing an associated identity information pair on the local device of the organization to be added to the blockchain, the identity information pair including member identity information and organization identity information, wherein the member identity information is associated with corresponding organization identity information;

Based on the member identity information, sign the transaction data generated by the members of the organization to generate signature information;

Transmitting the transaction data, the organization identity information, and the signature information to a public node in the blockchain or a private node in the blockchain, and the public node or private node performs identity verification After that, send to the blockchain.
The access control method of the blockchain according to claim 1, further comprising:

The identity verification of the information sent by the public node or private node by the corresponding node in the blockchain;

When the number of nodes with successful identity verification is greater than or equal to the preset number, the transaction result is stored to the nodes in the blockchain.
The access control method of the blockchain according to claim 1, wherein the identity information pair is an asymmetric key pair, and the member identity information is a private key in the asymmetric key pair. The organization identity information is the public key in the asymmetric key pair.
The method for access control of a blockchain according to claim 3, wherein the establishment of the associated identity information pair on the local device of the organization to be added to the blockchain includes:

According to the elliptic curve encryption algorithm, the asymmetric key pair is established on the local device of the organization to be added to the blockchain.
The access control method of the blockchain according to claim 3, further comprising:

Generating an organization address for identifying the organization according to the public key in the asymmetric key pair;

Register the organization address in the whitelist of the blockchain.
The access control method of the blockchain according to claim 5, wherein the generating an organization address for identifying the organization according to the public key in the asymmetric key pair includes:

Calculating the hash value of the public key;

An array of the hash value of the public key and the network version number of the blockchain;

Performing hash calculation on the array to obtain a verification code;

Add the verification code to the array;

The address array is added with the verification code to generate the organization address.
The method for access control of a blockchain according to claim 3, wherein the signing of transaction data generated by members of the organization according to the member identity information to generate signature information includes:

Calculating the hash value of the transaction data;

Perform encryption processing on the hash value of the transaction data according to the private key, and encode the encryption processing result to generate the signature information.
The access control method of the blockchain according to claim 5, further comprising:

Generate an identity verification public key based on the transaction data and the signature information, and verify whether the generated identity verification public key is consistent with the public key in the received asymmetric key pair;

Generate an identity verification address based on the generated identity verification public key, and verify whether the identity verification address exists in the white list;

Decrypt the signature information according to the generated identity verification public key, and verify the consistency of the decrypted data and the transaction data.
The access control method of the blockchain according to claim 8, wherein the generating of the identity verification public key based on the transaction data and the signature information includes:

Decoding the signature information;

Calculating the hash value of the transaction data;

The identity verification public key is generated according to the decoded signature information and the hash value of the transaction data.
The access control method for a blockchain according to any one of claims 1 to 9, wherein the private node has an authentication center, which is used to treat the organization that joins the blockchain through the private node Members authorize.
A block chain access control device, characterized in that the device includes:

The identity information establishment module is used to establish an associated identity information pair on the local device of the organization to be added to the blockchain. The identity information pair includes member identity information and organization identity information, wherein the member identity information is associated with each other Organizational identity information;

The signature information generation module is used to perform signature operations on the transaction data generated by the members of the organization according to the member identity information to generate signature information;

The access control module is used to transmit the transaction data, the organization identity information and the signature information to a public node in the blockchain or a private node in the blockchain. The public node or After the identity verification of the private node is passed, it is sent to the blockchain.
The access control device for blockchain according to claim 11, further comprising:

An identity verification module, set in the corresponding node in the blockchain, is used for identity verification of the information sent by the public node or private node;

The sending module is used to store the transaction result to the nodes in the blockchain when the number of nodes with successful identity verification is greater than or equal to the preset number.
The access control device of the blockchain according to claim 11, wherein the identity information pair is an asymmetric key pair, and the member identity information is a private key in the asymmetric key pair. The organization identity information is the public key in the asymmetric key pair.
The access control device for a blockchain according to claim 13, wherein the identity information establishment module is specifically configured to establish the local device of the organization to be added to the blockchain according to an elliptic curve encryption algorithm Asymmetric key pair.
The access control device for blockchain according to claim 13, further comprising:

An address generation module, configured to generate an organization address for identifying the organization based on the public key in the asymmetric key pair;

The registration module is used to register the address of the organization in the white list of the blockchain.
The access control device of the blockchain according to claim 15, wherein the address generation module is specifically used to calculate the hash value of the public key; and is used to compare the hash value of the public key with An array composed of the network version numbers of the blockchain; used to hash the array to obtain a verification code; used to add the verification code to the array; and, used to The array added with the verification code performs address coding to generate the organization address.
The block chain access control device according to claim 13, wherein the signature information generation module is specifically used to calculate the hash value of the transaction data; The hash value of the transaction data is encrypted, and the encryption processing result is encoded to generate the signature information.
The access control device of the blockchain according to claim 15, wherein the access control module is specifically used to generate an identity verification publicity on the public node based on the transaction data and the signature information Key, and verify that the generated identity verification public key is consistent with the public key in the received asymmetric key pair; used to generate an identity verification address based on the generated identity verification public key and verify whether the identity verification address Exists in the white list; and is used to decrypt the signature information according to the generated identity verification public key and verify the consistency of the decrypted data and the transaction data.
The access control device of the blockchain according to claim 18, characterized in that, when the access control module generates an identity verification public key based on the transaction data and the signature information, it is specifically used to sign the signature Decode the information, calculate the hash value of the transaction data, and generate the identity verification public key based on the decoded signature information and the hash value of the transaction data.
The access control device for a blockchain according to any one of claims 11 to 19, wherein the private node has an authentication center for treating the organization that joins the blockchain through the private node Members authorize.
An electronic device, characterized in that it includes:

Memory for storing programs;

A processor, configured to run the program stored in the memory for:

Establishing an associated identity information pair on the local device of the organization to be added to the blockchain, the identity information pair including member identity information and organization identity information, wherein the member identity information is associated with corresponding organization identity information;

Based on the member identity information, sign the transaction data generated by the members of the organization to generate signature information;

Transmitting the transaction data, the organization identity information, and the signature information to a public node in the blockchain or a private node in the blockchain, and the public node or private node performs identity verification After that, send to the blockchain.