WO2020199708A1 - 一种针对授时证书生成请求的监控方法、装置及设备 - Google Patents

一种针对授时证书生成请求的监控方法、装置及设备 Download PDF

Info

Publication number
WO2020199708A1
WO2020199708A1 PCT/CN2020/070953 CN2020070953W WO2020199708A1 WO 2020199708 A1 WO2020199708 A1 WO 2020199708A1 CN 2020070953 W CN2020070953 W CN 2020070953W WO 2020199708 A1 WO2020199708 A1 WO 2020199708A1
Authority
WO
WIPO (PCT)
Prior art keywords
block
data
data block
time
time service
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2020/070953
Other languages
English (en)
French (fr)
Inventor
杨新颖
杜华兵
俞本权
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Advanced New Technologies Co Ltd
Original Assignee
Advanced New Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Advanced New Technologies Co Ltd filed Critical Advanced New Technologies Co Ltd
Priority to US16/812,211 priority Critical patent/US10979233B2/en
Publication of WO2020199708A1 publication Critical patent/WO2020199708A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3297—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving time stamps, e.g. generation of time stamps
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/50—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using hash chains, e.g. blockchains or hash trees

Definitions

  • the embodiments of this specification relate to the field of information technology, and in particular to a monitoring method, device, and equipment for a time service certificate generation request.
  • time-justice agency can obtain a time-determining certificate to determine the generation time of some accounts.
  • the time stamp in the time service certificate is monotonically increasing, but some data blocks corresponding to the time service certificate may not necessarily increase monotonically.
  • the purpose of the embodiments of this application is to provide a monitoring solution for the time service certificate generation request, so as to realize the generation of more rigorous time service certificates.
  • a monitoring method for generating requests for time service certificates is applied to a centralized database service provider that stores data through multiple data blocks, including:
  • each data block contains at least one data record, and each data block contains the hash value of the previous data block and the data record contained in it.
  • the hash value of the own data block and the block height of the data block increase monotonically based on the sequence of the block time.
  • the embodiment of this specification also provides a monitoring device for a time service certificate generation request, which is applied to a centralized database service provider that stores data through multiple data blocks, including:
  • the block height determination module determines the starting block height H1 and the ending block height H2 of the target ledger corresponding to this request when a request for generating a timing certificate is detected,
  • the judging module judges whether the H1 is greater than the timed block height H maintained by the database service provider, if H1>H, execute the request to generate the time service certificate this time, otherwise, do not execute;
  • the value change module determines that the time service certificate generated by the trusted time service institution for this request has been received, and the value of the height H of the time service block is changed to H2 to determine whether the next time service certificate generation request carried out;
  • each data block contains at least one data record, and each data block contains the hash value of the previous data block and the data record contained in it.
  • the hash value of the own data block and the block height of the data block increase monotonically based on the sequence of the block time.
  • the database service provider maintains a time-served block height H that is used to identify data blocks that have passed the time-service certification. Whenever the time fair organization returns the time-serving certificate, the time-serving block height will be taken.
  • the value advancement is the maximum block height of this time service authentication, and when the next time service authentication is requested, the minimum block height must be greater than the time service block height, so as to ensure that the block height of the ledger corresponding to the generated series of time service certificates is also monotonically increasing ( That is, the maximum block height of the previous ledger is smaller than the minimum block height of the next ledger), which realizes more rigorous management and use of the ledger based on the timing certificate.
  • Figure 1 is a schematic diagram of the system architecture involved in the current technology
  • FIG. 2 is a schematic diagram of a pseudo chain provided by an embodiment of this specification
  • FIG. 3 is a schematic diagram of a process for generating a time service certificate provided by an embodiment of the specification
  • FIG. 4 is a schematic diagram of the corresponding relationship between a time service certificate and an account book provided by an embodiment of the specification
  • FIG. 5 is a schematic flowchart of a monitoring method for a time service certificate generation request provided by an embodiment of this specification
  • FIG. 6 is a schematic structural diagram of a monitoring device for generating requests for time service certificates in a blockchain ledger provided by an embodiment of the specification;
  • FIG. 7 is a schematic structural diagram of a device for configuring the method of the embodiment of this specification.
  • FIG. 8 is a schematic diagram of the structure of a time service certificate provided by an embodiment of the specification.
  • FIG. 1 is a schematic diagram of the system architecture involved in the current technology.
  • the database service provider when the user is an application server, can be the database server shown in Figure 1; and when the user is a client personal user, the database service provider can also be an application server.
  • the server and database server constitute the whole of the server.
  • the storage of data is done on the database service provider, and the operations on the data (including additions, deletions, changes, etc.) are also performed on the database service provider based on user instructions.
  • the database service provider in this specification provides data services in a centralized manner.
  • data blocks can be generated in advance in the following ways:
  • the data records to be stored can be various consumption records of individual users of the client, or can be business results, intermediate states, and operation records generated when the application server executes business logic based on user instructions.
  • Specific business scenarios can include consumption records, audit logs, supply chains, government supervision records, medical records, and so on.
  • each data record to be written in the data block is determined, and the Nth data block including the hash value of the data block and the data record is generated.
  • the preset block conditions include: the number of data records to be stored reaches the number threshold, for example, every time one thousand data records are received, a new data block is generated and one thousand data records are written into the block; or , The time interval from the last block formation time reaches the time threshold, for example, every 5 minutes, a new data block is generated, and the data records received within these 5 minutes are written into the block.
  • the N here refers to the serial number of the data block.
  • the data block is in the form of a block chain, which is arranged sequentially based on the order of the block time, and has a strong timing characteristic.
  • the block height of the data block increases monotonically based on the sequence of the block time.
  • the block height can be a sequence number, at this time the block height of the Nth data block is N; the block height can also be generated in other ways.
  • the data block at this time is the initial data block.
  • the current data block (the first data block) can be generated based on the hash value of the previous data block (that is, the N-1th data block). For example, a feasible way is to determine the hash value of each data record to be written in the Nth block, and generate a Merck according to the sequence in the block.
  • Merkel tree splicing the root hash value of the Merkel tree and the hash value of the previous data block together, again using the hash algorithm to generate the hash value of the current block, and can also be based on the root of the Merkel tree
  • the hash value and some other metadata (such as the version number, the generation timestamp of the data block, etc.) generate the current fast hash value.
  • the string is hashed to generate the hash value of the data block.
  • each data block is determined by a hash value
  • the hash value of the data block is determined by the content and sequence of the data records in the data block and the hash value of the previous data block.
  • the user can initiate verification based on the hash value of the data block or the hash value of the data record at any time. Any modification of the data block (including the modification of the data record content or sequence in the data block) will result in the calculation during verification.
  • the hash value of the data block is inconsistent with the hash value when the data block is generated, resulting in verification failure, thus realizing non-tampering under centralization.
  • FIG. 2 is a schematic diagram of a pseudo chain provided by an embodiment of this specification.
  • the blocking method of the data block is the same as the aforementioned blocking method.
  • time service authentication can also be performed on the ledger, as shown in FIG. 3, which is a schematic diagram of a process for generating a time service certificate provided by the embodiment of this specification, including the following steps:
  • S301 Determine a target ledger that needs time service authentication, where the target ledger contains at least one data block or multiple data blocks with high continuous blocks.
  • each data block contains at least one data record, and each data block contains the hash value of the previous data block and its own
  • the data record determines the hash value of its own data block, and the block height of the data block increases monotonically based on the sequence of the block time.
  • the server first determines from the data blocks that have been generated and stored, a section of the ledger that needs time service authentication, which should contain at least one data block, or multiple blocks of highly continuous data.
  • the manner of determination can be specified based on user operations. For example, the user initiates a timing instruction, which contains the starting block height and the number of blocks required for timing authentication; the partial ledger is used as the target ledger.
  • the target account does not need to be specified by the user, and the service party automatically performs it based on preset business logic. For example, from the finest granularity, each data block can be applied for timing. In this way, the root hash of the Merkel tree of part of the ledger is the block hash value of the data block. This way can protect the authenticity of the ledger (that is, each data block) to the greatest extent. Due to the high frequency of data block generation, this method will have a relatively large cost for both the time service center and the server.
  • An optional method is to set a certain preset time service condition, and initiate a time service request when the certain preset time service condition is met.
  • the preset time-serving condition may be: the number of data blocks to be time-served and authenticated reaches the threshold, or the time interval since the last time-service authentication has reached the time Threshold.
  • S303 Generate a Merkel tree corresponding to the target ledger according to the block height order of the data blocks in the target ledger, and determine the root hash of the Merkel tree based on the block hash of each data block.
  • S305 Use the root hash of the Merkel tree as the root hash of the target ledger, and send the root hash and related information of the data block to a time justice agency, where the related information of the data block includes The start block height and the end block height.
  • the time fairness agency can be, for example, the national time service center, or a corresponding time service agency authorized by the national time service center.
  • the time justice agency receives the above information, it gives a trusted timestamp, and performs digital signature authentication on the trusted timestamp, and generates a time service certificate containing the trusted timestamp and digital signature.
  • the time service certificate may also contain the above
  • the method of digital signature is conventional private key encryption and public key decryption.
  • FIG. 8 is a schematic diagram of the structure of a time service certificate provided by an embodiment of this specification.
  • Timing certificate corresponding to the target ledger returned by a time justice agency, where the timing certificate includes the starting block height, ending block height, credible timestamp, and the target ledger of the target ledger.
  • the root hash The root hash.
  • the database server can receive a series of trusted timing certificates containing the signature of the time fair agency, and each timing certificate contains a trusted timestamp and corresponds to a section of the ledger.
  • a timing certificate can prove that the corresponding part of the ledger was generated before the trusted timestamp. You can clearly know which part of the account book is through the relevant information in the time service certificate.
  • the database server can manage and verify a series of timing certificates accordingly. For example, the database server can sequentially number each time service certificate. Build a database or index on time service certificates.
  • the database or index contains a correspondence table of the starting data block height, the ending data block height, the root hash value of the partial account book corresponding to the timing certificate and the timing certificate number.
  • the generated timing authentication request contains the root hash of the target ledger and related information of the data block.
  • the ledger corresponding to a time service certificate can be specified by the user or determined based on certain business logic.
  • the trusted timestamp in the time service certificate is given by the time justice agency. Therefore, the following situation may occur: the trusted timestamp in the time service certificate is monotonically increasing, but the block height of the part of the ledger corresponding to the time service certificate is not monotonously increasing, and there may be partial overlap or even lag.
  • FIG. 4 is a schematic diagram of a corresponding relationship between a time service certificate and an account book provided by an embodiment of this specification.
  • time service certificate 1, time service certificate 2, and time service certificate 2 are generated in sequence, so the trusted timestamps T1, T2, and T3 are also arranged in order, but the ledger corresponding to each time service certificate is indeed due to the user's instruction or network Due to delays, failures, etc., partial overlap or even lag occurs.
  • the time service certificate issued by the time-based fairness agency can be used as a kind of credential for account book verification.
  • the sequence of data blocks is dependent. Therefore, when the time stamp of the time service certificate is monotonically increasing but the corresponding ledger is not monotonously increasing, the efficiency and accuracy of the ledger verification will be reduced, and the ledger management will be inconvenient.
  • the embodiment of this specification also provides a monitoring method for time service certificate generation requests, which is applied to a centralized database service provider that stores data through multiple data blocks, as shown in FIG. 5, which is the specification.
  • the flow diagram of the monitoring method for the time service certificate generation request provided by the embodiment includes:
  • S503 Determine whether the H1 is greater than the timing block height H maintained by the database service provider, if H1>H, execute the request for generating the timing certificate this time, otherwise, do not execute;
  • the first time service authentication you can arbitrarily specify an initial block height greater than 0, and all time service authentication can be realized.
  • H1 H+1 needs to be satisfied; when the block height is a large integer converted based on the block time, it needs to satisfy that there is no other block height between H1 and H.
  • S505 It is determined that the time service certificate generated by the trusted time service institution for this request has been received, and the value of the height H of the time service block is changed to H2, so as to be used to determine whether the next time service certificate generation request is executed.
  • the value of the height H of the time service block is a dynamic value that continuously increases with the generation of the time service certificate. It indicates that the ledger before the timing block height H has partially or completely passed the timing certification, and the certified ledger can be given by a series of generated timing certificates. At this time, if a new timing certificate needs to be regenerated, the minimum block height of the to-be-served account book at this time should be greater than the timing block height H. In this way, it can be ensured that the time service certificate with the credible time stamp is earlier, the corresponding part of the ledger is also ahead, and the part of the ledger corresponding to each time service certificate will not overlap.
  • the public key decryption can be used to decrypt and verify the digital signature of the time fair authority contained in the time service certificate.
  • the database service provider maintains a timing block height H to identify the data block that has passed the timing authentication.
  • the time justice agency returns the time service certificate
  • the value of the time service block height will be promoted to the maximum block height of this time service certification, and when the next time service certification is requested, the minimum block height must be greater than the time service block height to ensure
  • the ledger corresponding to the timing certificate is also monotonically increasing (that is, the maximum block height of the previous ledger is less than the minimum block height of the following ledger), which realizes more rigorous management and use of the ledger based on the timing certificate.
  • the embodiment of this specification also provides a monitoring device for the time service certificate generation request, as shown in FIG. 6, which is a block chain ledger provided by the embodiment of this specification for monitoring the time service certificate generation request
  • FIG. 6 is a block chain ledger provided by the embodiment of this specification for monitoring the time service certificate generation request
  • the structure diagram of the device including:
  • the block height determining module 601 when detecting a request for generating a time service certificate, determines the starting block height H1 and the ending block height H2 of the target ledger corresponding to this request,
  • the judging module 603 judges whether the H1 is greater than the timed block height H maintained by the database service provider, if H1>H, execute the request to generate the time service certificate this time, otherwise, do not execute;
  • the value change module 605 determines that the time service certificate generated by the trusted time service institution for this request has been received, and changes the value of the height H of the time service block to H2, so as to be used to determine the next time service certificate generation request Whether to execute
  • each data block contains at least one data record, and each data block contains the hash value of the previous data block and the data record contained in it.
  • the hash value of the own data block and the block height of the data block increase monotonically based on the sequence of the block time.
  • the device further includes a timing certificate generation module 607, which determines a target ledger that requires timing authentication, and the target ledger contains at least one data block or a plurality of highly continuous data blocks; according to the target ledger According to the order of the block height of the data blocks, a Merkel tree corresponding to the target ledger is generated, and the root hash of the Merkel tree is determined based on the block hash of each data block;
  • the related information of the hash and data block is sent to the time justice agency, where the related information of the data block includes the start block height H1, the end block height H2 or the number of data blocks; the information returned by the receiving time justice agency corresponds to all
  • the time service certificate of the target ledger that includes a trusted timestamp and a signature of a time fair organization, wherein the time service certificate includes the root hash of the Merkel tree and related information of the data block.
  • the device further includes a data block generation module 609, which receives the data records to be stored, and determines the hash value of each data record; when the preset blocking condition is reached, determines the data to be written in the data block Record, generate the Nth data block containing the hash value of the data block and the data record, including:
  • the hash value and block height of the initial data block are given based on a preset method; when N>1, according to the data records in the data block to be written and the hash value of the N-1th data block The value determines the hash value of the Nth data block, and generates the Nth data block that contains the hash value of the Nth data block, each data record and the block time of the data block, where the block height of the data block is based on The order of block time increases monotonically.
  • the preset blocking condition includes: the number of data records to be stored reaches the number threshold; or, the time interval from the last blocking time reaches the time threshold.
  • timing certificate generation module 607 determines each newly generated data block as the target ledger; or, based on the start block height and the end block height determined by the user's instruction, determines the target ledger that requires timing authentication .
  • the timing certificate generation module 607 takes a newly generated ledger that meets the preset conditions of the timing as the target ledger, and the preset timing conditions include: when the newly generated data block reaches the number threshold; or, the distance from the last time The time interval for time service authentication has reached the time threshold.
  • the embodiment of the specification also provides a computer device, which at least includes a memory, a processor, and a computer program stored in the memory and capable of running on the processor, wherein the processor implements the program shown in FIG. 5 when the program is executed.
  • a monitoring method for generating requests for time service certificates is also provided.
  • FIG. 7 shows a more specific hardware structure diagram of a computing device provided by an embodiment of this specification.
  • the device may include a processor 1010, a memory 1020, an input/output interface 1030, a communication interface 1040, and a bus 1050.
  • the processor 1010, the memory 1020, the input/output interface 1030 and the communication interface 1040 realize the communication connection between each other in the device through the bus 1050.
  • the processor 1010 may be implemented in a general-purpose CPU (Central Processing Unit, central processing unit), microprocessor, application specific integrated circuit (Application Specific Integrated Circuit, ASIC), or one or more integrated circuits for execution related Program to implement the technical solutions provided in the embodiments of this specification.
  • a general-purpose CPU Central Processing Unit, central processing unit
  • microprocessor microprocessor
  • application specific integrated circuit Application Specific Integrated Circuit, ASIC
  • ASIC Application Specific Integrated Circuit
  • the memory 1020 may be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory, random access memory), static storage device, dynamic storage device, etc.
  • the memory 1020 may store an operating system and other application programs. When the technical solutions provided in the embodiments of the present specification are implemented through software or firmware, related program codes are stored in the memory 1020 and called and executed by the processor 1010.
  • the input/output interface 1030 is used to connect an input/output module to realize information input and output.
  • the input/output/module can be configured in the device as a component (not shown in the figure), or can be connected to the device to provide corresponding functions.
  • the input device may include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and an output device may include a display, a speaker, a vibrator, an indicator light, and the like.
  • the communication interface 1040 is used to connect a communication module (not shown in the figure) to realize the communication interaction between the device and other devices.
  • the communication module can realize communication through wired means (such as USB, network cable, etc.), or through wireless means (such as mobile network, WIFI, Bluetooth, etc.).
  • the bus 1050 includes a path to transmit information between various components of the device (for example, the processor 1010, the memory 1020, the input/output interface 1030, and the communication interface 1040).
  • the device may also include the necessary equipment for normal operation.
  • the above-mentioned device may also include only the components necessary to implement the solutions of the embodiments of the present specification, rather than all the components shown in the figures.
  • the embodiment of the present specification also provides a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, the monitoring method for a time service certificate generation request shown in FIG. 5 is implemented.
  • Computer-readable media include permanent and non-permanent, removable and non-removable media, and information storage can be realized by any method or technology.
  • the information can be computer-readable instructions, data structures, program modules, or other data.
  • Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, CD-ROM, digital versatile disc (DVD) or other optical storage, Magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media can be used to store information that can be accessed by computing devices. According to the definition in this article, computer-readable media does not include transitory media, such as modulated data signals and carrier waves.
  • a typical implementation device is a computer.
  • the specific form of the computer can be a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email receiving and sending device, and a game control A console, a tablet computer, a wearable device, or a combination of any of these devices.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

公开了一种针对授时证书生成请求的监控方法、装置及设备。通过本说明书实施例所提供的方案，数据库服务提供方维护一个用于标识已经通过授时认证的数据块的已授时块高H，每次当时间公正机构返回授时认证之后，即将已授时块高的取值推进为本次授时认证的最大块高，并且，在下一次请求授时认证时，最小块高必须大于已授时块高。

Description

一种针对授时证书生成请求的监控方法、装置及设备 技术领域
本说明书实施例涉及信息技术领域，尤其涉及一种针对授时证书生成请求的监控方法、装置及设备。
背景技术
在数据库服务提供方，可以通过块以链式账本的方式对数据记录进行中心化的存储。此时，为了避免用户和服务方联合起来对伪造虚假的账本，可以通过时间公正机构获取确定授时证书，用于确定部分账本的生成时间。在这个过程中，授时证书中的时间戳是单调递增的，但授时证书对应的部分数据块却不一定单调递增。
基于此，需要一种在块链式账本中针对授时证书生成请求的监控方案，以实现生成更严谨的授时证书。
发明内容
本申请实施例的目的是提供针对授时证书生成请求的监控方案，以实现生成更严谨的授时证书。
为解决上述技术问题，本申请实施例是这样实现的：
一种针对授时证书生成请求的监控方法，应用于通过多个数据块存储数据的中心化的数据库服务提供方中，包括：
当检测到生成授时证书的请求时，确定本次请求中所对应的目标账本的起始块高H1和的结束块高H2；
判断所述H1是否大于数据库服务提供方所维护的已授时块高H，若H1>H，执行本次生成授时证书的请求，否则，不执行；
确定已经接收到可信授时机构对于本次请求所生成的的授时证书，将所述已授时块高H的值变更为H2，以便用于判断下一次生成授时证书的请求是否执行；
在所述块链式账本中，除初始数据块以外，每一数据块中包含至少一条数据记录，每一数据块中包含由前一数据块的哈希值和自身所包含的数据记录确定的自身数据块 的哈希值，数据块的块高基于成块时间的先后顺序单调递增。
对应的，本说明书实施例还提供一种针对授时证书生成请求的监控装置，应用于通过多个数据块存储数据的中心化的数据库服务提供方中，包括：
块高确定模块，当检测到生成授时证书的请求时，确定本次请求中所对应的目标账本的起始块高H1和的结束块高H2，
判断模块，判断所述H1是否大于数据库服务提供方所维护的已授时块高H，若H1>H，执行本次生成授时证书的请求，否则，不执行；
取值变更模块，确定已经接收到可信授时机构对于本次请求所生成的的授时证书，将所述已授时块高H的值变更为H2，以便用于判断下一次生成授时证书的请求是否执行；
在所述块链式账本中，除初始数据块以外，每一数据块中包含至少一条数据记录，每一数据块中包含由前一数据块的哈希值和自身所包含的数据记录确定的自身数据块的哈希值，数据块的块高基于成块时间的先后顺序单调递增。
通过本说明书实施例所提供的方案，数据库服务提供方维护一个用于标识已经通过授时认证的数据块的已授时块高H，每当时间公正机构返回授时证书之后，即将已授时块高的取值推进为本次授时认证的最大块高，并且，在下一次请求授时认证时，最小块高必须大于已授时块高，从而保证生成的一系列授时证书所对应的账本的块高也是单调递增(即前一账本的最大块高小于后一账本的最小块高)，实现基于授时证书对账本更严谨的管理和使用。
应当理解的是，以上的一般描述和后文的细节描述仅是示例性和解释性的，并不能限制本说明书实施例。
此外，本说明书实施例中的任一实施例并不需要达到上述的全部效果。
附图说明
为了更清楚地说明本说明书实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本说明书实施例中记载的一些实施例，对于本领域普通技术人员来讲，还可以根据这些附图获得其他的附图。
图1为当前技术中所涉及的系统架构的示意图；
图2为本说明书实施例所提供的一种伪链的示意图；
图3为本说明书实施例所提供的生成授时证书的一种流程示意图；
图4为本说明书实施例所提供的一种授时证书和账本的对应关系的示意图；
图5为本说明书实施例所提供的针对授时证书生成请求的监控方法的流程示意图；
图6为本说明书实施例提供的一种块链式账本中的授时证书生成请求的监控装置的结构示意图；
图7是用于配置本说明书实施例方法的一种设备的结构示意图；
图8为本说明书实施例所提供的一种授时证书的结构示意图。
具体实施方式
为了使本领域技术人员更好地理解本说明书实施例中的技术方案，下面将结合本说明书实施例中的附图，对本说明书实施例中的技术方案进行详细地描述，显然，所描述的实施例仅仅是本说明书的一部分实施例，而不是全部的实施例。基于本说明书中的实施例，本领域普通技术人员所获得的所有其他实施例，都应当属于保护的范围。
首先需要说明的是，在当前的服务器架构中，数据库服务器可以是直接对接的客户端个人用户，也可以是由一些应用服务器对接客户端个人用户，而数据库服务器则对接所述应用服务器。如图1所示，图1为当前技术中所涉及的系统架构的示意图。
因此，在本说明书实施例中，当用户是应用服务器时，数据库服务提供方可以是图1中所示的数据库服务器；而在用户是客户端个人用户时，数据库服务提供方也可以是由应用服务器和数据库服务器构成的服务端整体。但无论在哪种情形下，对于数据的存储都是在数据库服务提供方完成，而对于数据的操作(包括增删改查等等)也是基于用户的指令在数据库服务提供方进行。换言之，本说明书中的数据库服务提供方是以中心化的形式提供数据服务。
在本说明书实施例所涉及中心化的数据库系统中，数据块可以通过如下方式预先生成：
接收待存储的数据记录，确定各数据记录的哈希值。此处的待存储的数据记录，可以是客户端个人用户的各种消费记录，也可以是应用服务器基于用户的指令，在执行业务逻辑时产生的业务结果、中间状态以及操作记录等等。具体的业务场景可以包括消 费记录、审计日志、供应链条、政府监管记录、医疗记录等等。
当达到预设的成块条件时，确定待写入数据块中的各数据记录，生成包含数据块的哈希值和数据记录的第N个数据块。
所述预设的成块条件包括：待存储的数据记录数量达到数量阈值，例如，每接收到一千条数据记录时，生成一个新数据块，将一千条数据记录写入块中；或者，距离上一次成块时刻的时间间隔达到时间阈值，例如，每隔5分钟，生成一个新数据块，将在这5分钟内接收到的数据记录写入块中。
此处的N指的是数据块的序号，换言之，在本说明书实施例中，数据块是以块链的形式，基于成块时间的顺序先后排列，具有很强的时序特征。其中，数据块的块高基于成块时间的先后顺序单调递增。块高可以是序号，此时第N个数据块的块高即为N；块高也可以其它方式生成。
当N＝1时，即此时的数据块为初始数据块。初始数据块的哈希值和块高基于预设方式给定。例如，初始数据块中不包含数据记录，哈希值则为任一给定的哈希值，块高blknum＝0；又例如，初始数据块的生成触发条件与其它数据块的触发条件一致，但是初始数据块的哈希值由对初始数据块中的所有内容取哈希确定。
当N>1时，由于前一数据块的内容和哈希值已经确定，则此时，可以基于前一数据块(即第N－1个数据块)的哈希值生成当前数据块(第N个数据块)的哈希值，例如，一种可行的方式为，确定每一条将要写入第N个块中的数据记录的哈希值，按照在块中的排列顺序，生成一个默克尔树，将默克尔树的根哈希值和前一数据块的哈希值拼接在一起，再次采用哈希算法，生成当前块的哈希值，以及还可以根据默克尔树的根哈希值和其它一些元数据(例如版本号、数据块的生成时间戳等等)生成当前快的哈希值。又例如，还可以按照块中数据记录的顺序进行拼接并取哈希得到整体数据记录的哈希值，拼接前一数据块的哈希值和整体数据记录的哈希值，并对拼接得到的字串进行哈希运算，生成数据块的哈希值。
通过前述的数据块的生成方式，每一个数据块通过哈希值确定，数据块的哈希值由数据块中的数据记录的内容、顺序以及前一数据块的哈希值决定。用户可以随时基于数据块的哈希值或者数据记录的哈希值发起验证，对于数据块中任何内容(包括对于数据块中数据记录内容或者顺序的修改)的修改都会造成在验证时计算得到的数据块的哈希值和数据块生成时的哈希值不一致，而导致验证失败，从而实现了中心化下的不可篡 改。
在上述方式中，仍然有可能用户和服务方联合起来对于部分数据块进行了伪造，重新生成一条相关的伪链，从而形成一个与原账本部分相同的新的账本，以躲避相关的审计和验证。如图2所示，图2为本说明书实施例所提供的一种伪链的示意图。在生成伪链的过程中，数据块的成块方式和前述的成块方式相同。
在该示意图中，在账本已经记录了很多数据块之后，业务方认为第1000个数据块中的数据记录有问题，因此，为了不暴露该问题，其和数据库服务方联合起来，从第1000个数据块开始对数据块进行了替换，重新生成一个新的第1000个数据块，接在第999个数据块之后，形成一条与原账本部分相同的伪链，以躲避验证和审计，而在外部第三方而言并不能识别出伪链和真链。
因此，在本说明书实施例中还可以对账本进行授时认证，如图3所示，图3为本说明书实施例所提供的生成授时证书的一种流程示意图，包括如下步骤：
S301，确定需要进行授时认证的目标账本，所述目标账本中至少包含一个数据块，或者多个块高连续的数据块。
如前所述，在所述链式账本中，除初始数据块以外，每一数据块中包含至少一条数据记录，每一数据块中包含由前一数据块的哈希值和自身所包含的数据记录确定的自身数据块的哈希值，数据块的块高基于成块时间的先后顺序单调递增。
具体而言，服务方首先从已经生成并存储的数据块中确定出需要进行授时认证的一段账本，其中至少应该包含一个数据块，或者多个块高连续的数据块。确定的方式可以基于用户操作进行指定，例如，用户发起授时指令，指令中包含需要进行授时认证的起始块高和块数量；将所述部分账本作为目标账本。
目标账户也可以是无需用户指定，服务方基于预设的业务逻辑自动进行。例如，从最细粒度上，可以每一个数据块都去申请授时。在这种方式下，部分账本的默克尔树的根哈希即为该数据块的块哈希值，该方式可以最大程度的对账本(即各数据块)进行真实性的保护。由于数据块的出块频率较高，这种方式无论对于授时中心，还是对于服务方而言，成本开销都会比较大。
一种可选的方式为，设置一定的授时预设条件，当满足一定的授时预设条件时，发起授时请求。在新生成的数据块都认为是待授时认证的数据块时，所述的授时预设条件可以是：待授时认证的数据块达到数量阈值，或者，距离上一次授时认证的时间间隔 已经到达时间阈值。
S303，按照所述目标账本中数据块的块高的顺序，生成对应于所述目标账本的默克尔树，基于各数据块的块哈希确定所述默克尔树的根哈希。
由于链式账本的前后依存性，此处生成的默克尔树只需按照各数据块的顺序进行生成即可。具体的根哈希的计算方式即为常规的计算方式，此处不再赘述。
S305，将所述默克尔树的根哈希作为目标账本的根哈希，将所述根哈希和数据块的相关信息发送至时间公正机构，其中，所述数据块的相关信息包括起始块高和结束块高。
时间公正机构可以是诸如国家授时中心，或者国家授时中心所授权的相应授时机构。时间公正机构接收到上述信息，即给出一个可信时间戳，并且对可信时间戳进行数字签名认证，生成一个包含可信时间戳和数字签名的授时证书，其中授时证书中还可以包含上述数据块的相关信息，数字签名的方式为常规的私钥加密、公钥解密即可。如图8所示，图8为本说明书实施例所提供的一种授时证书的结构示意图。
S307，接收时间公正机构所返回的对应于所述目标账本的授时证书，其中，所述授时证书中包括所述目标账本的起始块高、结束块高、可信时间戳和所述目标账本的根哈希。
从而，数据库服务方可以接收到一连串的包含时间公正机构签名的可信授时证书，每一个授时证书中包含一个可信时间戳，且对应于一段账本。一个授时证书可以证明其对应的部分账本是在该可信时间戳之前生成的。通过授时证书中的相关信息可以明确的知道是哪部分账本。数据库服务方可以对一系列的授时证书进行相应的管理，以及验证。例如，数据库服务方可以对每个授时证书进行顺序编号。建立一个关于授时证书的数据库或者索引。在数据库或者索引中包含有起始数据块高、结束数据块高、授时证书对应的部分账本的根哈希值和授时证书编号的对应关系表。
上述生成授时证书过程中的S301至S305，均可以视为是生成授时认证请求的一部分。生成的授时认证请求中包含了目标账本的根哈希和数据块的相关信息。
在上述授时证书的生成过程中，一个授时证书所对应的账本可以基于用户指定，也可以基于一定的业务逻辑确定。而授时证书中的可信时间戳则是由时间公正机构所给定的。因此，有可能发生如下情形：授时证书中的可信时间戳是单调递增的，而授时证书所对应的部分账本的块高却不是单调递增，有可能存在部分重叠，甚至滞后。如图4 所示，图4为本说明书实施例所提供的一种授时证书和账本的对应关系的示意图。
在该示意图中，授时证书1、授时证书2和授时证书2依序生成，因此可信时间戳T1、T2和T3也是依序排列，但是各授时证书对应的账本确因为用户的指令，或者网络延迟故障等等原因，发生部分重叠甚至至滞后。
在本说明书实施例中，基于时间公正机构授时的授时证书可以作为账本验证时的一种凭据。在块链式的账本验证中，数据块的先后顺序是存在依赖性的。因此，在授时证书的时间戳单调递增而对应的账本却不是单调递增的时候，会降低账本验证的效率和准确性，以及，给账本管理带来不便。
基于此，本说明书实施例还提供一种针对授时证书生成请求的监控方法，应用于通过多个数据块存储数据的中心化的数据库服务提供方中，如图5所示，图5为本说明书实施例所提供的针对授时证书生成请求的监控方法的流程示意图，包括：
S501，当检测到生成授时证书的请求时，确定本次请求中所对应的目标账本的起始块高H1和的结束块高H2。
如前所述，授时证书的请求可以是基于用户的指令所确定，例如，用户指定对前一万个数据块进行授时认证，则此时H1＝1，H2＝1000。相应的，用户还可以通过操作指令对目标账本中的起始块高和的结束块高进行确定，例如，用户输入授时认证指令TIME ID：(1000,1999)，则，此时的H1＝1000，H2＝1999。
S503，判断所述H1是否大于数据库服务提供方所维护的已授时块高H，若H1>H，执行本次生成授时证书的请求，否则，不执行；
对于初始的已授时块高H，可以设定为H＝0。即，此时对于该账本还没有进行过任何一次授时证书的生成。换言之，在第一次授时认证时，可以随意的指定一个大于0的初始块高，均可以实现授时认证。通常而言，为保证对账本的全量数据块均实现授时认证，第一次的起始块高H1＝1。
在随后任一授时认证过程中，则需要判断本次的起始块高H1是否大于H。一般而言，如果一个账本无需全量授时，则只需要H1大于H即可。
若需要对于全量账本进行授时认证，则还需要保持H1和H的连续性。在块高为自然数时，此时则需要满足H1＝H+1；在块高为基于成块时间所转换得到的大整型时，则需要满足H1和H之间不存在其它块高。
S505，确定已经接收到可信授时机构对于本次请求所生成的授时证书，将所述已授时块高H的值变更为H2，以便用于判断下一次生成授时证书的请求是否执行。
换言之，已授时块高H的值是一个随着授时证书的生成而不断增加的动态值。它表明，在已授时块高H之前的账本已经部分或者全部的通过了授时认证，通过认证的账本可以由已经生成的一系列授时证书给定。此时，如果需要重新生成新的授时证书，此时的待授时账本的最小块高应该大于该已授时块高H。在这种方式下，可以保证可信时间戳靠前的授时证书，所对应的部分账本也靠前，并且，各授时证书所对应的部分账本不会发生重叠。
此外，在确定已经接收到授时证书之前，还可以公钥解密对授时证书所包含的时间公正机构的数字签名进行解密校验。
通过本说明书实施例所提供的方案，数据库服务提供方通过维护一个已授时块高H，用于标识已经通过授时认证的数据块。每当时间公正机构返回授时证书之后，即将已授时块高的取值推进为本次授时认证的最大块高，并且，在下一次请求授时认证时，最小块高必须大于已授时块高，从而保证授时证书所对应的账本也是单调递增(即前一账本的最大块高小于后一账本的最小块高)，实现基于授时证书对账本更严谨的管理和使用。
对应的，本说明书实施例还提供一种针对授时证书生成请求的监控装置，如图6所示，图6为本说明书实施例提供的一种块链式账本中的针对授时证书生成请求的监控装置的结构示意图，包括：
块高确定模块601，当检测到生成授时证书的请求时，确定本次请求中所对应的目标账本的起始块高H1和的结束块高H2，
判断模块603，判断所述H1是否大于数据库服务提供方所维护的已授时块高H，若H1>H，执行本次生成授时证书的请求，否则，不执行；
取值变更模块605，确定已经接收到可信授时机构对于本次请求所生成的的授时证书，将所述已授时块高H的值变更为H2，以便用于判断下一次生成授时证书的请求是否执行；
在所述块链式账本中，除初始数据块以外，每一数据块中包含至少一条数据记录，每一数据块中包含由前一数据块的哈希值和自身所包含的数据记录确定的自身数据块的哈希值，数据块的块高基于成块时间的先后顺序单调递增。
进一步地，所述装置还包括授时证书生成模块607，确定需要进行授时认证的目标账本，所述目标账本中至少包含一个数据块，或者多个块高连续的数据块；按照所述目标账本中数据块的块高的顺序，生成对应于所述目标账本的默克尔树，基于各数据块的块哈希确定所述默克尔树的根哈希；将所述默克尔树的根哈希和数据块的相关信息发送至时间公正机构，其中，所述数据块的相关信息包括起始块高H1、结束块高H2或者数据块的数量；接收时间公正机构所返回的对应于所述目标账本的包含可信时间戳和时间公正机构签名的授时证书，其中，所述授时证书中包含所述默克尔树的根哈希和数据块的相关信息。
进一步地，所述装置还包括数据块生成模块609，接收待存储的数据记录，确定各数据记录的哈希值；当达到预设的成块条件时，确定待写入数据块中的各数据记录，生成包含数据块的哈希值和数据记录的第N个数据块，具体包括：
当N＝1时，初始数据块的哈希值和块高基于预设方式给定；当N>1时，根据待写入数据块中的各数据记录和第N－1个数据块的哈希值确定第N个数据块的哈希值，生成包含第N个数据块的哈希值、各数据记录和数据块的成块时间的第N个数据块，其中，数据块的块高基于成块时间的先后顺序单调递增。
进一步地，在所述装置中，所述预设的成块条件包括：待存储的数据记录数量达到数量阈值；或者，距离上一次成块时刻的时间间隔达到时间阈值。
进一步地，所述授时证书生成模块607，将每一个新出的数据块确定为目标账本；或者，基于用户的指令所确定的起始块高和结束块高，确定需要进行授时认证的目标账本。
进一步地，所述授时证书生成模块607，将符合授时预设条件内的新生成的账本作为目标账本，所述授时预设条件包括：新生成的数据块达到数量阈值时；或者，距离上一次授时认证的时间间隔已经到达时间阈值。
本说明书实施例还提供一种计算机设备，其至少包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，其中，处理器执行所述程序时实现图5所示的一种针对授时证书生成请求的监控方法。
图7示出了本说明书实施例所提供的一种更为具体的计算设备硬件结构示意图，该设备可以包括：处理器1010、存储器1020、输入/输出接口1030、通信接口1040和总线1050。其中处理器1010、存储器1020、输入/输出接口1030和通信接口1040通过 总线1050实现彼此之间在设备内部的通信连接。
处理器1010可以采用通用的CPU(Central Processing Unit，中央处理器)、微处理器、应用专用集成电路(Application Specific Integrated Circuit，ASIC)、或者一个或多个集成电路等方式实现，用于执行相关程序，以实现本说明书实施例所提供的技术方案。
存储器1020可以采用ROM(Read Only Memory，只读存储器)、RAM(Random Access Memory，随机存取存储器)、静态存储设备，动态存储设备等形式实现。存储器1020可以存储操作系统和其他应用程序，在通过软件或者固件来实现本说明书实施例所提供的技术方案时，相关的程序代码保存在存储器1020中，并由处理器1010来调用执行。
输入/输出接口1030用于连接输入/输出模块，以实现信息输入及输出。输入输出/模块可以作为组件配置在设备中(图中未示出)，也可以外接于设备以提供相应功能。其中输入设备可以包括键盘、鼠标、触摸屏、麦克风、各类传感器等，输出设备可以包括显示器、扬声器、振动器、指示灯等。
通信接口1040用于连接通信模块(图中未示出)，以实现本设备与其他设备的通信交互。其中通信模块可以通过有线方式(例如USB、网线等)实现通信，也可以通过无线方式(例如移动网络、WIFI、蓝牙等)实现通信。
总线1050包括一通路，在设备的各个组件(例如处理器1010、存储器1020、输入/输出接口1030和通信接口1040)之间传输信息。
需要说明的是，尽管上述设备仅示出了处理器1010、存储器1020、输入/输出接口1030、通信接口1040以及总线1050，但是在具体实施过程中，该设备还可以包括实现正常运行所必需的其他组件。此外，本领域的技术人员可以理解的是，上述设备中也可以仅包含实现本说明书实施例方案所必需的组件，而不必包含图中所示的全部组件。
本说明书实施例还提供一种计算机可读存储介质，其上存储有计算机程序，该程序被处理器执行时实现图5所示的一种针对授时证书生成请求的监控方法。
计算机可读介质包括永久性和非永久性、可移动和非可移动媒体可以由任何方法或技术来实现信息存储。信息可以是计算机可读指令、数据结构、程序的模块或其他数据。计算机的存储介质的例子包括，但不限于相变内存(PRAM)、静态随机存取存储器(SRAM)、动态随机存取存储器(DRAM)、其他类型的随机存取存储器(RAM)、 只读存储器(ROM)、电可擦除可编程只读存储器(EEPROM)、快闪记忆体或其他内存技术、只读光盘只读存储器(CD-ROM)、数字多功能光盘(DVD)或其他光学存储、磁盒式磁带，磁带磁磁盘存储或其他磁性存储设备或任何其他非传输介质，可用于存储可以被计算设备访问的信息。按照本文中的界定，计算机可读介质不包括暂存电脑可读媒体(transitory media)，如调制的数据信号和载波。
通过以上的实施方式的描述可知，本领域的技术人员可以清楚地了解到本说明书实施例可借助软件加必需的通用硬件平台的方式来实现。基于这样的理解，本说明书实施例的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品可以存储在存储介质中，如ROM/RAM、磁碟、光盘等，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本说明书实施例各个实施例或者实施例的某些部分所述的方法。
上述实施例阐明的系统、方法、模块或单元，具体可以由计算机芯片或实体实现，或者由具有某种功能的产品来实现。一种典型的实现设备为计算机，计算机的具体形式可以是个人计算机、膝上型计算机、蜂窝电话、相机电话、智能电话、个人数字助理、媒体播放器、导航设备、电子邮件收发设备、游戏控制台、平板计算机、可穿戴设备或者这些设备中的任意几种设备的组合。
本说明书中的各个实施例均采用递进的方式描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。尤其，对于方法实施例而言，由于其基本相似于方法实施例，所以描述得比较简单，相关之处参见方法实施例的部分说明即可。以上所描述的方法实施例仅仅是示意性的，其中所述作为分离部件说明的模块可以是或者也可以不是物理上分开的，在实施本说明书实施例方案时可以把各模块的功能在同一个或多个软件和/或硬件中实现。也可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。本领域普通技术人员在不付出创造性劳动的情况下，即可以理解并实施。
以上所述仅是本说明书实施例的具体实施方式，应当指出，对于本技术领域的普通技术人员来说，在不脱离本说明书实施例原理的前提下，还可以做出若干改进和润饰，这些改进和润饰也应视为本说明书实施例的保护范围。

Claims (13)

  1. 一种针对授时证书生成请求的监控方法，应用于通过多个数据块存储数据的中心化的数据库服务提供方中，包括：
    当检测到生成授时证书的请求时，确定本次请求中所对应的目标账本的起始块高H1和的结束块高H2；
    判断所述H1是否大于数据库服务提供方所维护的已授时块高H，若H1>H，执行本次生成授时证书的请求，否则，不执行；
    确定已经接收到可信授时机构对于本次请求所生成的的授时证书，将所述已授时块高H的值变更为H2，以便用于判断下一次生成授时证书的请求是否执行；
    在所述块链式账本中，除初始数据块以外，每一数据块中包含至少一条数据记录，每一数据块中包含由前一数据块的哈希值和自身所包含的数据记录确定的自身数据块的哈希值，数据块的块高基于成块时间的先后顺序单调递增。
  2. 如权利要求1所述的方法，所述授时证书，通过如下方式生成：
    确定需要进行授时认证的目标账本，所述目标账本中至少包含一个数据块，或者多个块高连续的数据块；
    按照所述目标账本中数据块的块高的顺序，生成对应于所述目标账本的默克尔树，基于各数据块的块哈希确定所述默克尔树的根哈希；
    将所述默克尔树的根哈希和数据块的相关信息发送至时间公正机构，其中，所述数据块的相关信息包括起始块高H1、结束块高H2或者数据块的数量；
    接收时间公正机构所返回的对应于所述目标账本的包含可信时间戳和时间公正机构签名的授时证书，其中，所述授时证书中包含所述默克尔树的根哈希和数据块的相关信息。
  3. 如权利要求2所述的方法，在中心化的数据库服务提供方，数据块通过如下方式预先生成：
    接收待存储的数据记录，确定各数据记录的哈希值；
    当达到预设的成块条件时，确定待写入数据块中的各数据记录，生成包含数据块的哈希值和数据记录的第N个数据块，具体包括：
    当N＝1时，初始数据块的哈希值和块高基于预设方式给定；
    当N>1时，根据待写入数据块中的各数据记录和第N－1个数据块的哈希值确定第N个数据块的哈希值，生成包含第N个数据块的哈希值、各数据记录和数据块的成块时间的第N个数据块，其中，数据块的块高基于成块时间的先后顺序单调递增。
  4. 如权利要求3所述的方法，所述预设的成块条件包括：
    待存储的数据记录数量达到数量阈值；或者，
    距离上一次成块时刻的时间间隔达到时间阈值。
  5. 如权利要求2所述的方法，确定需要进行授时认证的目标账本，包括：
    将每一个新出的数据块确定为目标账本；或者，
    基于用户的指令所确定的起始块高和结束块高，确定需要进行授时认证的目标账本。
  6. 如权利要求2所述的方法，确定需要进行授时认证的目标账本，包括：
    将符合授时预设条件内的新生成的账本作为目标账本，所述授时预设条件包括：新生成的数据块达到数量阈值时；或者，距离上一次授时认证的时间间隔已经到达时间阈值。
  7. 一种针对授时证书生成请求的监控装置，应用于通过多个数据块存储数据的中心化的数据库服务提供方中，包括：
    块高确定模块，当检测到生成授时证书的请求时，确定本次请求中所对应的目标账本的起始块高H1和的结束块高H2；
    判断模块，判断所述H1是否大于数据库服务提供方所维护的已授时块高H，若H1>H，执行本次生成授时证书的请求，否则，不执行；
    取值变更模块，确定已经接收到可信授时机构对于本次请求所生成的的授时证书，将所述已授时块高H的值变更为H2，以便用于判断下一次生成授时证书的请求是否执行；
    在所述块链式账本中，除初始数据块以外，每一数据块中包含至少一条数据记录，每一数据块中包含由前一数据块的哈希值和自身所包含的数据记录确定的自身数据块的哈希值，数据块的块高基于成块时间的先后顺序单调递增。
  8. 如权利要求7所述的装置，还包括授时证书生成模块，确定需要进行授时认证的目标账本，所述目标账本中至少包含一个数据块，或者多个块高连续的数据块；按照所述目标账本中数据块的块高的顺序，生成对应于所述目标账本的默克尔树，基于各数据块的块哈希确定所述默克尔树的根哈希；将所述默克尔树的根哈希和数据块的相关信息发送至时间公正机构，其中，所述数据块的相关信息包括起始块高H1、结束块高H2或者数据块的数量；接收时间公正机构所返回的对应于所述目标账本的包含可信时间戳和时间公正机构签名的的授时证书，其中，所述授时证书中包含所述默克尔树的根哈希和数据块的相关信息。
  9. 如权利要求8所述的装置，还包括数据块生成模块，接收待存储的数据记录， 确定各数据记录的哈希值；当达到预设的成块条件时，确定待写入数据块中的各数据记录，生成包含数据块的哈希值和数据记录的第N个数据块，具体包括：
    当N＝1时，初始数据块的哈希值和块高基于预设方式给定；
    当N>1时，根据待写入数据块中的各数据记录和第N－1个数据块的哈希值确定第N个数据块的哈希值，生成包含第N个数据块的哈希值、各数据记录和数据块的成块时间的第N个数据块，其中，数据块的块高基于成块时间的先后顺序单调递增。
  10. 如权利要求9所述的装置，所述预设的成块条件包括：待存储的数据记录数量达到数量阈值；或者，距离上一次成块时刻的时间间隔达到时间阈值。
  11. 如权利要求8所述的装置，所述授时证书生成模块，将每一个新出的数据块确定为目标账本；或者，基于用户的指令所确定的起始块高和结束块高，确定需要进行授时认证的目标账本。
  12. 如权利要求8所述的装置，所述授时证书生成模块，将符合授时预设条件内的新生成的账本作为目标账本，所述授时预设条件包括：新生成的数据块达到数量阈值时；或者，距离上一次授时认证的时间间隔已经到达时间阈值。
  13. 一种计算机设备，包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，其中，所述处理器执行所述程序时实现如权利要求1至6任一项所述的方法。
PCT/CN2020/070953 2019-04-04 2020-01-08 一种针对授时证书生成请求的监控方法、装置及设备 Ceased WO2020199708A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US16/812,211 US10979233B2 (en) 2019-04-04 2020-03-06 Monitoring time certificate generation requests

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910272452.8 2019-04-04
CN201910272452.8A CN110190963B (zh) 2019-04-04 2019-04-04 一种针对授时证书生成请求的监控方法、装置及设备

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/812,211 Continuation US10979233B2 (en) 2019-04-04 2020-03-06 Monitoring time certificate generation requests

Publications (1)

Publication Number Publication Date
WO2020199708A1 true WO2020199708A1 (zh) 2020-10-08

Family

ID=67714015

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/070953 Ceased WO2020199708A1 (zh) 2019-04-04 2020-01-08 一种针对授时证书生成请求的监控方法、装置及设备

Country Status (2)

Country Link
CN (1) CN110190963B (zh)
WO (1) WO2020199708A1 (zh)

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10979233B2 (en) 2019-04-04 2021-04-13 Advanced New Technologies Co., Ltd. Monitoring time certificate generation requests
CN110190963B (zh) * 2019-04-04 2020-09-01 阿里巴巴集团控股有限公司 一种针对授时证书生成请求的监控方法、装置及设备
SG11202002911UA (en) * 2019-09-02 2021-04-29 Advanced New Technologies Co Ltd Managing blockchain-based centralized ledger systems
CN110717196A (zh) * 2019-09-25 2020-01-21 支付宝(杭州)信息技术有限公司 一种证券交易数据的存储方法、装置及设备
CN110879687B (zh) * 2019-10-18 2021-03-16 蚂蚁区块链科技(上海)有限公司 一种基于磁盘存储的数据读取方法、装置及设备
CN112364389B (zh) * 2021-01-12 2021-04-06 支付宝(杭州)信息技术有限公司 一种基于可信账本数据库的业务记录授时方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20140222772A1 (en) * 2013-01-13 2014-08-07 Reduxio Systems Ltd. Storage system and methods for time continuum data retrieval
CN109120590A (zh) * 2018-07-03 2019-01-01 北京航空航天大学 基于区块链的数据可信共享交易系统
CN109255713A (zh) * 2018-11-12 2019-01-22 裴若含 一种区块链网络中某一时间段内记账权的获取方法
CN110190963A (zh) * 2019-04-04 2019-08-30 阿里巴巴集团控股有限公司 一种针对授时证书生成请求的监控方法、装置及设备

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR102026225B1 (ko) * 2017-01-19 2019-09-27 주식회사 케이티 블록 체인을 이용하여 데이터를 관리하는 장치 및 방법
CN108280328A (zh) * 2018-01-31 2018-07-13 北京安妮全版权科技发展有限公司 基于数字签名和授时的版权确权方法及装置
CN108540459B (zh) * 2018-03-22 2021-03-30 北京京东尚科信息技术有限公司 数据储存方法、装置、系统、电子设备及计算机可读介质
CN108984744B (zh) * 2018-07-16 2022-02-18 夸克链科技（深圳）有限公司 一种非主链区块自增长方法
CN109508984B (zh) * 2018-11-26 2021-09-07 中国科学院软件研究所 一种基于确定性共识与可信时间戳的区块链电子存证方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20140222772A1 (en) * 2013-01-13 2014-08-07 Reduxio Systems Ltd. Storage system and methods for time continuum data retrieval
CN109120590A (zh) * 2018-07-03 2019-01-01 北京航空航天大学 基于区块链的数据可信共享交易系统
CN109255713A (zh) * 2018-11-12 2019-01-22 裴若含 一种区块链网络中某一时间段内记账权的获取方法
CN110190963A (zh) * 2019-04-04 2019-08-30 阿里巴巴集团控股有限公司 一种针对授时证书生成请求的监控方法、装置及设备

Also Published As

Publication number Publication date
CN110190963B (zh) 2020-09-01
CN110190963A (zh) 2019-08-30

Similar Documents

Publication Publication Date Title
TWI727594B (zh) 塊鏈式帳本中的簽名驗證方法、系統、裝置及設備
US11283622B2 (en) Signature verification for a blockchain ledger
CN110457898B (zh) 基于可信执行环境的操作记录存储方法、装置及设备
CN110147685B (zh) 数据验证方法、系统、装置及设备
WO2020199708A1 (zh) 一种针对授时证书生成请求的监控方法、装置及设备
CN110347745B (zh) 一种块链式账本的授时认证方法、装置及设备
US10911251B2 (en) Blockchain ledger authentication
US10979233B2 (en) Monitoring time certificate generation requests
WO2020199711A1 (zh) 数据存储方法、系统、装置及设备
US10790968B2 (en) Ledger verification method and apparatus, and device
CN110266494B (zh) 一种块链式账本中的授时认证方法、装置及设备
WO2020199710A1 (zh) 一种账本的验证方法、装置及设备
WO2020258858A1 (zh) 块链式账本中的授权方法、系统、装置及设备
WO2020211493A1 (zh) 一种块链式账本中的数据验证方法、系统、装置及设备
WO2021000578A1 (zh) 一种块链式账本中的用户创建方法、装置及设备
CN111292082B (zh) 一种块链式账本中的公钥管理方法、装置及设备
CN112380573B (zh) 一种块链式账本中的数字签名方法、装置及设备
HK40045513B (zh) 一种块链式账本中的数字签名方法、装置及设备
HK40046899B (zh) 一种块链式账本的授时认证方法、装置及设备
HK40045513A (zh) 一种块链式账本中的数字签名方法、装置及设备
HK40029449B (zh) 一种块链式账本中的公钥管理方法、装置及设备
HK40029449A (zh) 一种块链式账本中的公钥管理方法、装置及设备
HK40046899A (zh) 一种块链式账本的授时认证方法、装置及设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20782880

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20782880

Country of ref document: EP

Kind code of ref document: A1