WO2020177548A1

WO2020177548A1 - Blockchain authority control method and device

Info

Publication number: WO2020177548A1
Application number: PCT/CN2020/076086
Authority: WO
Inventors: 莫楠; 廖飞强; 白兴强; 李辉忠; 张开翔; 范瑞彬
Original assignee: 深圳前海微众银行股份有限公司
Priority date: 2019-03-05
Filing date: 2020-02-20
Publication date: 2020-09-10
Also published as: CN110008665A; CN110008665B

Abstract

Embodiments of the present invention relate to the technical field of science technology and finance, and provide a blockchain authority control method and device. The method comprises: obtaining a transaction request, the transaction request comprising transaction information and a transaction account, and then determining a table to be operated and operation content according to the transaction information; determining from a preset authority table an authorized account corresponding to said table, and executing the operation content in said table if it is determined that the transaction account matches the authorized account corresponding to said table. Because the authority of each account for tables in the blockchain is stored in an authority table in advance, when a transaction account initiate a transaction and needs to operate a table in the blockchain, the authority control of the blockchain can be achieved by querying the authority table to determine the operation authority and then performing the operation on the table. In the authority table, the authority of an account can be freely set and can be added or deleted according to needs, so that a more fine-grained control of the account authority can be achieved, compared with the role-based authority control, thereby facilitating the management of account authority.

Description

Method and device for controlling permission of blockchain

Cross references to related applications

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office, the application number is 201910163011.4, and the application name is "a method and device for controlling the authority of a blockchain" on March 5, 2019, the entire content of which is incorporated by reference In this application.

Technical field

The embodiments of the present invention relate to the field of technology and finance technology, and in particular to a method and device for controlling permissions of a blockchain.

Background technique

Blockchain is the use of block chain data structure to verify and store data, the use of distributed node consensus algorithms to generate and update data, the use of cryptography to ensure the security of data transmission and access, and the use of smart contracts composed of automated script codes. A new distributed infrastructure and calculation method for programming and manipulating data. For the public chain in the blockchain, there is no restriction on node joining, and the data on the chain is completely open, suitable for some publicization, and does not involve privacy information storage. But for private chains and consortium chains, because some private data storage is involved, it is necessary to control the permissions of the blockchain. At present, when controlling the authority of the alliance chain, the role corresponding to the account is determined through the preset first association relationship, and then the authority of the account is determined according to the preset authority of the role, and then based on the authority of the account, the corresponding interface is called to the blockchain. The Merkle tree of the main body of the block is operated to complete the transaction. In this method, the corresponding relationship between roles and permissions needs to be saved in advance, and at the same time, the account permissions are limited to the preset permissions of the role, resulting in insufficient fine-grained control of the account permissions.

Summary of the invention

Due to the problem that the account permissions in the current role-based permission control method are limited to the preset permissions of the role, and the control of the account permissions is not fine-grained enough, the embodiments of the present invention provide a blockchain permission control method and device.

On the one hand, an embodiment of the present invention provides a method for controlling permissions on a blockchain. Each block in the blockchain stores a ledger in the form of a table. The method includes:

Acquiring a transaction request, the transaction request including transaction information and a transaction account;

Determine the table to be operated and the operation content in the table to be operated according to the transaction information, the table to be operated is located in a block of the blockchain;

Determine the authority account corresponding to the table to be operated from the preset authority table;

When it is determined that the transaction account matches the authority account corresponding to the table to be operated, the operation content is executed in the table to be operated.

Since the authority table is preset and the authority of each account on the table in the blockchain is stored in the authority table, when the transaction account initiates a transaction and needs to operate the table in the blockchain, you can query the authority table to determine the operation authority and execute the table Operation to realize the authority control of the blockchain. Since the specific permissions of the account can be set freely in the permission table, and the account permissions can be added or deleted based on actual needs, compared with the role-based permission control, the control of the account permissions is more fine-grained and it is convenient to manage the account permissions. Secondly, because the data in the blockchain is stored in the form of a table, rather than based on the Merkle tree, compared to the direct role-based access control method to operate on the table in the blockchain, according to the permission table The method of operating the tables in the blockchain with account permissions has better results.

Optionally, the table to be operated is a system table or a user table, the system table is used to control the system functions of the blockchain, and the user table is used to control the business functions of the blockchain.

Optionally, before the determining the authority account corresponding to the table to be operated from the preset authority table, the method includes:

It is determined that the operation content is a write operation.

Optionally, after executing the operation content in the to-be-operation table, the method further includes:

Generating an operation record of the table to be operated, where the operation record includes an identifier of the table to be operated, operation content, and transaction account;

The operation record of the table to be operated is sent to other network nodes in the blockchain network, so that the other network node determines from the permission table the corresponding table to be operated according to the identifier of the table to be operated The authority account, when it is determined that the transaction account matches the authority account corresponding to the table to be operated, execute the operation content in the table to be operated.

By sending the operation record of the table to be operated to other network nodes, the other network nodes can verify the validity of the operation record of the table to be operated and execute the operation content, thereby realizing the synchronization of the table content in the blockchain network and ensuring Consistency and security of tables in the blockchain.

Optionally, it also includes:

The permission table is located in a block of the blockchain;

When the permission table is updated, the updated permission table takes effect in the next block of the current block.

On the one hand, an embodiment of the present invention provides a permission control device for a blockchain. Each block in the blockchain stores a ledger in the form of a table. The device includes:

The obtaining module is used to obtain a transaction request, the transaction request including transaction information and a transaction account;

The analysis module is used to determine the table to be operated and the content of the operation in the table to be operated according to the transaction information, the table to be operated is located in a block of the blockchain;

The screening module is used to determine the authority account corresponding to the table to be operated from the preset authority table;

The control module is configured to execute the operation content in the table to be operated when it is determined that the transaction account matches the authority account corresponding to the table to be operated.

Optionally, the screening module is also used to:

Before determining the permission account corresponding to the table to be operated from the preset permission table, it is determined that the operation content is a write operation.

Optionally, the control module is also used to:

After executing the operation content in the to-be-operated table, generate an operation record of the to-be-operated table, the operation record including the identifier of the to-be-operated table, the operation content and the transaction account;

Optionally, the screening module is also used to:

When the permission table is updated, the updated permission table takes effect in the next block of the current block, and the permission table is located in a block of the blockchain.

In one aspect, an embodiment of the present invention provides a computer device, including at least one processing unit and at least one storage unit, wherein the storage unit stores a computer program, and when the program is executed by the processing unit, The processing unit executes the steps of the permission control method of the blockchain.

On the one hand, an embodiment of the present invention provides a computer-readable medium that stores a computer program executable by a computer device. When the program runs on the computer device, the computer device executes the authority control of the blockchain. Method steps.

On the one hand, an embodiment of the present invention provides a computer program product, the computer program product includes a calculation program stored on a computer-readable medium, the computer program includes program instructions, when the program instructions are executed by a computer device , So that the computer equipment executes the steps of the blockchain permission control method.

In the embodiment of the present invention, since the authority table is preset and the authority of each account to the table in the blockchain is stored in the authority table, when the transaction account initiates a transaction and needs to operate the table in the blockchain, it can be determined by querying the authority table Operate permissions and perform operations on tables to achieve permission control on the blockchain. Since the specific permissions of the account can be set freely in the permission table, and the account permissions can be added or deleted based on actual needs, compared with the role-based permission control, the control of the account permissions is more fine-grained and it is convenient to manage the account permissions. Secondly, because the data in the blockchain is stored in the form of a table, rather than based on the Merkle tree, compared to the direct role-based access control method to operate on the table in the blockchain, according to the permission table The method of operating the tables in the blockchain with account permissions has better results.

Description of the drawings

In order to more clearly describe the technical solutions in the embodiments of the present invention, the following will briefly introduce the drawings needed in the description of the embodiments. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings may be obtained from these drawings without creative labor.

FIG. 1 is a schematic diagram of an application scenario provided by an embodiment of the present invention;

FIG. 2 is a schematic flowchart of a method for controlling permissions on a blockchain according to an embodiment of the present invention;

FIG. 3 is a schematic flowchart of a method for controlling permissions on a blockchain according to an embodiment of the present invention;

FIG. 4 is a schematic flowchart of a method for controlling permissions on a blockchain according to an embodiment of the present invention;

5 is a schematic structural diagram of a permission control device for a blockchain provided by an embodiment of the present invention;

Fig. 6 is a schematic structural diagram of a computer device provided by an embodiment of the present invention.

detailed description

In order to make the objectives, technical solutions and beneficial effects of the present invention clearer, the following further describes the present invention in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the present invention, but not to limit the present invention.

To facilitate understanding, the terms involved in the embodiments of the present invention are explained below.

Blockchain: Blockchain uses block-chain data structure to verify and store data, uses distributed node consensus algorithm to generate and update data, uses cryptography to ensure the security of data transmission and access, and is composed of automated script codes A new distributed infrastructure and calculation method for programming and manipulating data with smart contracts.

Consortium chain: The consortium chain is between a public chain and a private chain. Several organizations jointly maintain a block chain with an access mechanism. The generation of each block is determined by a preselected node.

Smart contract: A smart contract is a service program written in solidity language that implements specific logic, and is published on the alliance chain in a binary manner for contract participants to execute and call on the alliance chain.

Access control: A control mechanism for accessing blockchain functions is achieved by controlling access to the blockchain. For example, based on the distributed storage of the FISCO BCOS alliance chain platform, by controlling the access to tables in the blockchain To achieve access to blockchain functions.

The permission control method of the blockchain in the embodiment of the present invention can be applied to a blockchain network scenario. For example, in the consortium chain network as shown in FIG. 1, the consortium chain network includes multiple network nodes 101. The node 101 includes a block chain authority control device. The network node 101 may be a server or a server cluster composed of several servers, and the network nodes 101 are connected through a wireless network. Among the organizations that maintain the alliance chain, each organization corresponds to one or more network nodes 101, and the tables in each network node 101 in the alliance chain are synchronized in real time. For each network node, the institution initiates a transaction request through the transaction account in the network node 101. After receiving the transaction request, the network node 101 determines the table to be operated and the operation content in the table to be operated according to the transaction information. Then, the authority account corresponding to the table to be operated is determined from the preset authority table, and when it is determined that the transaction account matches the authority account corresponding to the table to be operated, the operation content is executed in the table to be operated. The network node 101 then generates the operation record of the table to be operated and sends the operation record of the table to be operated to other network nodes 101 in the blockchain network. The operation record includes the identifier of the table to be operated, operation content and transaction account. The other network nodes 101 determine the permission account corresponding to the table to be operated from the permission table according to the identifier of the table to be operated, and when it is determined that the transaction account matches the permission account corresponding to the table to be operated, the operation content is executed in the table to be operated.

Based on the application scenario diagram shown in FIG. 1, an embodiment of the present invention provides a flow of a blockchain permission control method, which can be executed by a blockchain permission control device, as shown in Figure 2, including The following steps:

Step S201: Obtain a transaction request.

Specifically, the transaction request is initiated by the transaction account, and the transaction request includes transaction information and the transaction account. Different transactions correspond to different transaction information. For example, when the transaction request is a deployment contract, the transaction information is the name of the table involved in deploying the contract, contract-related data, etc.

Step S202: Determine the table to be operated and the operation content in the table to be operated according to the transaction information.

The table to be operated is located in a block of the blockchain, and different transaction information corresponds to different tables to be operated. The table to be operated can be a system table or a user table. The system table is used to control the system functions of the blockchain, and the user table is used to control the business functions of the blockchain. As shown in Figure 3, the transaction account is based on the permissions in the permission table. Operate the system table of the blockchain to control the system functions of the blockchain. The transaction account operates the user table of the blockchain according to the permissions in the permission table to control the business functions of the blockchain.

Specifically, the system tables include _sys_tables_ table, _sys_cns_ table, _sys_miners_ table, _sys_config_ table, _sys_table_access_ table, etc.

The sys_tables_ table stores the table field information of all tables in the blockchain system, and all table field information needs to be stored in the _sys_tables_ table before table creation can be performed. Deploying the contract needs to establish the contract table, and the contract operation user table needs to create the user table first. Therefore, permission control acts on the _sys_tables_ table to control the deployment of the contract and the creation of the user table.

The _sys_cns_ table saves CNS information for deploying contracts in the blockchain using Contract Name Service (Contract Name Service, CNS for short). CNS information includes the contract name, contract version number, contract deployment address, and contract application binary interface (Application Binary Interfac, ABI for short). Using CNS to deploy contracts requires CNS information to be written into the _sys_cns_ table. Therefore, permission control acts on the _sys_cns_ table to control whether an account has the permission to deploy contracts using CNS.

The _sys_miners_ table stores the information of all node types in the blockchain. There are three types of nodes in the blockchain network, namely, accounting nodes, observation nodes, and free nodes. The conversion of these three types of node types can be realized by operating the _sys_miners_ table. Therefore, permission control acts on the _sys_miners_ table to control the type conversion of blockchain nodes.

The _sys_config_ table saves system configuration information in the blockchain, such as setting tx_count_limit (the upper limit of the number of transactions in the block) and tx_gas_limit (the upper limit of gas for transactions). Therefore, permission control acts on the _sys_config_ table to control the setting permissions of system configuration information.

The user table is a table related to the business, and the authority control acting on each user table will finely control the related business functions. Illustratively, the user table 1 is an operating user table of contract A, which includes a list of users who can operate contract A. Exemplarily, the user table 2 is a user table of loan services, which includes a list of users who can loan services.

Step S203: Determine the authority account corresponding to the table to be operated from the preset authority table.

Specifically, the permission table is used to store permission setting information, and the permission table also belongs to a system table. Before the alliance chain is formed, the permission control usage rules are determined. For example, a management node can be selected from the blockchain network, and then the account corresponding to the management node can be an administrator account. Only the administrator account can use the permission setting function, and the non-administrator account has no permission setting function. When setting an account's authority to a certain table, add the authority record corresponding to the account in the authority table. Optionally, the permission table is located in a block of the blockchain. When the permission table is updated, the updated permission table takes effect in the next block of the current block. For example, when a new permission record is added to the permission table, A new block is generated after the current block, and the new permission record is stored in the block body of the new block. For example, when the permission record A is modified in the permission table, a new block is generated after the current block, and the modified permission record A is stored in the block body of the new block.

Exemplarily, the embodiment of the present invention provides an example of a permission table, as shown in Table 1:

Table 1.

字段Field	类型Types of	是否为空Is it empty	主键Primary key	描述description
table_nametable_name	stringstring	否no	是Yes	表名称Table name
addressaddress	stringstring	否no	To	账户地址Account address
enable_numenable_num	stringstring	否no	To	生效区块高度Effective block height
_status__status_	stringstring	否no	To	状态字段Status field

It can be seen from Table 1 that in the permission table, a permission record includes table name, account name, effective block height, and status fields. Among them, the effective block height is the position and status of the effective block of the permission record in the blockchain. When the field is "0", it means that the authority record is in a normal effective state, and when the status field is "1", it means that the authority record is in an invalid state.

In specific implementation, a preset permission contract interface can be used to operate the permission table. Permission contract interfaces include insert interface, remove interface, queryByName interface, etc. The insert interface sets permission records through the table name and account address, and returns the number of records set. The set record will be saved in the permission table, and the same permission record is refused to be set repeatedly, that is, 0 is directly returned. The remove interface removes the set permission records through the table name and account address, and returns the number of removed records. The _status_ field of the record to be removed is set from "0" to "1", and the repeated removal of the same permission record is refused, that is, 0 is directly returned. The queryByName interface queries the set permission records through the table name, and the records are returned in the form of json strings. This interface is used to query the permission records.

For users, provide blockchain-adapted Java SDK end permission control API for developers to use. Provide command line tools for operators to use. The Java SDK side API and command line tool commands are as follows:

String add: This API calls the insert interface of the permission contract to set permission information. The corresponding command is addAuthority (abbreviated command is aa), and the parameters are the table name and account address.

String remove: This API calls the remove interface of the permission contract to remove permission records. The corresponding command is removeAuthority (abbreviated command is ra), and the parameters are the table name and account address.

List query: This API calls the queryByName interface of the permission contract to query permission information. The corresponding command is queryAuthority (the abbreviated command is qa), and the parameter is the table name.

Step S204, when it is determined that the transaction account matches the authority account corresponding to the table to be operated, the operation content is executed in the table to be operated.

In a possible implementation, when the operation content is a write operation, the authority account corresponding to the table to be operated is determined from the preset authority table, and when it is determined that the transaction account matches the authority account corresponding to the table to be operated, The write operation is performed in the table to be operated. When the operation content is a read operation, the read operation is performed in the table to be operated. Exemplarily, setting transaction account 1 needs to deploy a HelloWorld contract, and the network node receives a transaction request, and the transaction request includes the content of transaction account 1 and HelloWorld contract. When the network node determines that the transaction account 1 needs to write the contents of the HelloWorld contract into the _sys_tables_ table based on the transaction information, it queries the permission record of the _sys_tables_ table from the permission table to determine the permission account of the _sys_tables_ table. If trading account 1 is included in the authority account, write the content of the HelloWorld contract to the _sys_tables_ table, otherwise refuse to write the content of the HelloWorld contract to the _sys_tables_ table. When the network node determines that the transaction account 1 needs to read the content of the sys_tables_ table according to the transaction information, it directly reads the content of the sys_tables_ table.

In a possible implementation, when the operation content is a write operation or a read operation, the authority account corresponding to the table to be operated is determined from the preset authority table, and when it is determined that the transaction account matches the authority account corresponding to the table to be operated, Perform a write operation or a read operation in the table to be operated. Specifically, the permission table corresponding to the read operation and the permission table corresponding to the write operation can be preset. When the operation content is a write operation, the authorization account corresponding to the table to be operated is determined from the authorization table corresponding to the write operation, and when it is determined that the transaction account matches the authorization account corresponding to the table to be operated, the write operation is performed in the table to be operated. When the operation content is a read operation, the authorization account corresponding to the table to be operated is determined from the authorization table corresponding to the read operation, and when it is determined that the transaction account matches the authorization account corresponding to the table to be operated, the read operation is performed in the table to be operated.

Optionally, after the operation content is executed in the table to be operated, an operation record of the table to be operated is generated, the operation record includes the identifier of the table to be operated, the operation content and the transaction account, and the operation record of the table to be operated is sent to the blockchain network Other network nodes, other network nodes determine the permission account corresponding to the table to be operated from the permission table according to the identifier of the table to be operated, and when it is determined that the transaction account matches the permission account corresponding to the table to be operated, the operation content is executed in the table to be operated .

In specific implementation, the tables of each network node in the blockchain network are synchronized in real time. When a network node performs a write operation in the table to be operated and changes the content in the table to be operated, it needs to synchronize the changed content in the table to be operated to other network nodes in the blockchain network. When other network nodes receive the operation record of the operation table, they first need to verify the legitimacy of the operation record of the operation table. Specifically, according to the identifier of the table to be operated in the operation record, determine the permission corresponding to the table to be operated from the permission table. Account, when it is determined that the transaction account matches the authority account corresponding to the table to be operated, the operation record is determined to be legal, and then the operation content is executed in the table to be operated, so as to synchronize the content of the table in the blockchain network and ensure that the blockchain is Consistency and safety of the table.

In order to better explain the embodiments of the present invention, the following describes a block chain permission control method provided by the embodiments of the present invention in combination with specific implementation scenarios. The method is executed by a network node. As shown in FIG. 4, the method includes the following step:

Step S401: Obtain a transaction request of the transaction account.

Step S402: Determine the list to be operated and the content of the operation according to the transaction request.

The table to be operated can be a system table or a user table.

Step S403: It is judged whether the operation content is a write operation, if not, step S404 is executed, otherwise, step S405 is executed.

Step S404, obtain the query result.

In step S405, it is judged whether there is a permission record cache, if yes, step S406 is executed, otherwise, step S409 is executed.

Specifically, when a certain permission record has been queried in the permission table before, the permission record can be cached, so when a request for querying permission records is received, the cache can be directly queried instead of querying the permission table every time , Thereby improving query efficiency.

In step S406, it is judged whether the transaction account has authority, if so, step S407 is executed, otherwise, step S408 is executed.

Step S407, perform a write operation.

Step S408: Reject the write operation.

Step S409, query the permission table.

The following is an example based on specific implementation scenarios. For system tables, set the transaction account 1 to have write permission to _sys_tables_ through the command tool aa in advance. The network node receives the transaction request. The transaction request deploys the HelloWorld contract for transaction account 1. The transaction to deploy the contract needs to write to the _sys_tables_ table. The network node queries the permission record of the _sys_tables_ table in the permission table, and determines the permission account of the _sys_tables_ table from the permission record. Then compare trading account 1 with the authority account of the _sys_tables_ table. When the comparison result is that the transaction account 1 is the authority account of the _sys_tables_ table, write the relevant content of the HelloWorld contract into the _sys_tables_ table to deploy The contract is successful. When the network node receives a transaction request, the transaction request deploys the HelloWorld contract for transaction account 2. The transaction to deploy the contract needs to write to the _sys_tables_ table. The network node queries the permission record of the _sys_tables_ table in the permission table, and determines the permission account of the _sys_tables_ table from the permission record. Then compare trading account 2 with the authority account of the _sys_tables_ table. When the comparison result is that the transaction account 2 is not the authority account of the _sys_tables_ table, the transaction account 2 is not allowed to write the relevant content of the HelloWorld contract into _sys_tables _ Table, thus the deployment contract failed.

For the user table, set the transaction account 2 to have the write permission to the user table A through the command tool aa in advance. The user table A is the operation user table of the HelloWorld contract. The network node receives the transaction request. The transaction request adds the operating user mm of the HelloWorld contract to the transaction account 2 and needs to write to the user table A. The network node queries the permission record of user table A in the permission table, and determines the permission account of user table A from the permission record. Then the transaction account 2 is compared with the authority account of the user table A, and when the comparison result is that the transaction account 2 is the authority account of the user table A, the relevant information of the user mm is written into the user table A. When the network node receives a transaction request, the transaction request adds the operating user nn of the HelloWorld contract to the transaction account 3, and the user table A needs to be written. The network node queries the permission record of user table A in the permission table, and determines the permission account of user table A from the permission record. Then compare the transaction account 3 with the authority account of the user table A. When the comparison result is that the transaction account 3 is not the authority account of the user table A, the addition fails.

Based on the same technical concept, an embodiment of the present invention provides a block chain permission control device. As shown in FIG. 5, the device 500 includes:

The obtaining module 501 is configured to obtain a transaction request, the transaction request including transaction information and a transaction account;

The analysis module 502 is configured to determine the table to be operated and the operation content in the table to be operated according to the transaction information, the table to be operated is located in a block of the blockchain;

The screening module 503 is configured to determine the authority account corresponding to the table to be operated from the preset authority table;

The control module 504 is configured to execute the operation content in the table to be operated when it is determined that the transaction account matches the authority account corresponding to the table to be operated.

Optionally, the screening module 503 is further configured to:

Optionally, the control module 504 is further configured to:

Optionally, the screening module 503 is further configured to:

Based on the same technical concept, an embodiment of the present invention provides a computer device. As shown in FIG. 6, it includes at least one processor 601 and a memory 602 connected to the at least one processor. The embodiment of the present invention does not limit the processor. For the specific connection medium between the 601 and the memory 602, the connection between the processor 601 and the memory 602 in FIG. 6 is taken as an example. The bus can be divided into address bus, data bus, control bus, etc.

In the embodiment of the present invention, the memory 602 stores instructions that can be executed by at least one processor 601. By executing the instructions stored in the memory 602, the at least one processor 601 can execute the aforementioned blockchain permission control method. step.

Among them, the processor 601 is the control center of the computer equipment, which can use various interfaces and lines to connect to various parts of the computer equipment, and control the authority by running or executing instructions stored in the memory 602 and calling data stored in the memory 602 . Optionally, the processor 601 may include one or more processing units, and the processor 601 may integrate an application processor and a modem processor. The application processor mainly processes the operating system, user interface, and application programs, etc. The adjustment processor mainly deals with wireless communication. It can be understood that the foregoing modem processor may not be integrated into the processor 601. In some embodiments, the processor 601 and the memory 602 may be implemented on the same chip, and in some embodiments, they may also be implemented on separate chips.

The processor 601 may be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application specific integrated circuit (ASIC), a field programmable gate array or other programmable logic devices, discrete gates or transistors Logic devices and discrete hardware components can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present invention. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the embodiments of the present invention may be directly embodied as being executed and completed by a hardware processor, or executed and completed by a combination of hardware and software modules in the processor.

The memory 602, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs and modules. The memory 602 may include at least one type of storage medium, for example, it may include flash memory, hard disk, multimedia card, card-type memory, random access memory (Random Access Memory, RAM), static random access memory (Static Random Access Memory, SRAM), Programmable Read Only Memory (PROM), Read Only Memory (ROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), magnetic memory, disk , CD, etc. The memory 602 is any other medium that can be used to carry or store desired program codes in the form of instructions or data structures and that can be accessed by a computer, but is not limited thereto. The memory 602 in the embodiment of the present invention may also be a circuit or any other device capable of realizing a storage function, for storing program instructions and/or data.

Based on the same inventive concept, the embodiments of the present invention provide a computer-readable medium that stores a computer program executable by a computer device. When the program runs on the computer device, the computer device executes the blockchain Steps of the permission control method.

Based on the same inventive concept, the embodiments of the present invention provide a computer program product. The computer program product includes a calculation program stored on a computer-readable medium. The computer program includes program instructions. When executed, the computer equipment is made to execute the steps of the permission control method of the blockchain.

Those skilled in the art should understand that the embodiments of the present invention may be provided as methods or computer program products. Therefore, the present invention may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

The present invention is described with reference to flowcharts and/or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and/or block in the flowchart and/or block diagram, and the combination of processes and/or blocks in the flowchart and/or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing equipment to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing equipment are generated It is a device that realizes the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.

These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing equipment to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction device. The device implements the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.

These computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operation steps are executed on the computer or other programmable equipment to produce computer-implemented processing, so as to execute on the computer or other programmable equipment. The instructions provide steps for implementing functions specified in a flow or multiple flows in the flowchart and/or a block or multiple blocks in the block diagram.

Although the preferred embodiments of the present invention have been described, those skilled in the art can make additional changes and modifications to these embodiments once they learn the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present invention.

Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. In this way, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalent technologies, the present invention is also intended to include these modifications and variations.

Claims

A method for controlling permissions of a blockchain, characterized in that each block in the blockchain stores a ledger in the form of a table, and the method includes:

Acquiring a transaction request, the transaction request including transaction information and a transaction account;

Determine the table to be operated and the operation content in the table to be operated according to the transaction information, the table to be operated is located in a block of the blockchain;

Determine the authority account corresponding to the table to be operated from the preset authority table;

When it is determined that the transaction account matches the authority account corresponding to the table to be operated, the operation content is executed in the table to be operated.
The method according to claim 1, wherein the table to be operated is a system table or a user table, the system table is used to control system functions of the blockchain, and the user table is used to control the The business function of the blockchain.
8. The method according to claim 1, wherein before the determining from the preset permission table the permission account corresponding to the table to be operated, the method comprises:

It is determined that the operation content is a write operation.
The method according to claim 1, wherein after executing the operation content in the to-be-operation table, the method further comprises:

Generating an operation record of the table to be operated, where the operation record includes an identifier of the table to be operated, operation content, and transaction account;

The operation record of the table to be operated is sent to other network nodes in the blockchain network, so that the other network node determines from the permission table the corresponding table to be operated according to the identifier of the table to be operated The authority account, when it is determined that the transaction account matches the authority account corresponding to the table to be operated, execute the operation content in the table to be operated.
The method according to any one of claims 1 to 4, further comprising:

The permission table is located in a block of the blockchain;

When the permission table is updated, the updated permission table takes effect in the next block of the current block.
A permission control device for a block chain, characterized in that each block in the block chain stores a ledger in the form of a table, and the device includes:

The obtaining module is used to obtain a transaction request, the transaction request including transaction information and a transaction account;

The analysis module is used to determine the table to be operated and the content of the operation in the table to be operated according to the transaction information, the table to be operated is located in a block of the blockchain;

The screening module is used to determine the authority account corresponding to the table to be operated from the preset authority table;

The control module is configured to execute the operation content in the table to be operated when it is determined that the transaction account matches the authority account corresponding to the table to be operated.
The device according to claim 6, wherein the table to be operated is a system table or a user table, the system table is used to control the system functions of the blockchain, and the user table is used to control the The business function of the blockchain.
The device according to claim 6, wherein the screening module is further used for:

Before determining the permission account corresponding to the table to be operated from the preset permission table, it is determined that the operation content is a write operation.
A computer device, which is characterized by comprising at least one processing unit and at least one storage unit, wherein the storage unit stores a computer program, and when the program is executed by the processing unit, the processing unit executes The steps of the method according to any one of claims 1 to 5.
A computer-readable medium, characterized in that it stores a computer program that can be executed by a computer device, and when the program runs on a computer device, the computer device executes the method described in any one of claims 1 to 5 step.
A computer program product, characterized in that the computer program product includes a calculation program stored on a computer-readable medium, the computer program includes program instructions, and when the program instructions are executed by a computer device, the computer The device executes the steps of any one of claims 1 to 5.