WO2020207233A1

WO2020207233A1 - Permission control method and apparatus for blockchain

Info

Publication number: WO2020207233A1
Application number: PCT/CN2020/080519
Authority: WO
Inventors: 胡朝新; 张俊麒; 陈浩; 苏小康; 张开翔; 范瑞彬
Original assignee: 深圳前海微众银行股份有限公司
Priority date: 2019-04-11
Filing date: 2020-03-20
Publication date: 2020-10-15
Also published as: CN110069908A

Abstract

Disclosed are a permission control method and apparatus for a blockchain, which relate to the technical field of fintech, and are used for solving the problem in the prior art of a rule storm occurring when the number of users and the volume of business grow rapidly. The method comprises: a verification authority receiving a verification request sent by a resource party, and if an authorization digest matching an authorization token in the verification request is found by means of a blockchain, sending a verification successful message to the resource party. An authorization token authorized by an authorization party is verified by means of a verification authority, so that the problem of a rule storm caused by overabundant permission rules configured on a blockchain can be prevented, and the privacy of the authorization token can be ensured. Moreover, since the authorization token stores a corresponding authorization digest by means of a blockchain, the problem of relatively low security of authorization caused by the possibility of an illegal behavior of an authorization party can also be prevented, and the security of the authorization token is ensured.

Description

Method and device for controlling permission of blockchain

Cross references to related applications

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office on April 11, 2019, the application number is 201910287244.5, and the application name is "a method and device for controlling the authority of a blockchain", the entire content of which is incorporated by reference In this application.

Technical field

The embodiments of the present invention relate to the technical field of Fintech, and in particular to a method and device for controlling permissions of a blockchain.

Background technique

With the development of computer technology, more and more technologies are applied in the financial field. The traditional financial industry is gradually changing to Fintech. Single sign-on technology is no exception, but due to the security and real-time requirements of the financial industry , But also higher requirements for technology.

Single sign-on (Single Sign-On, SSO) is a user authentication process that allows users to access different applications in the system after one authentication; there is no need to re-enter the user account when accessing each application And password.

SSO integrates user login and user account management in all domains within an enterprise, which can reduce the time it takes for users to log in in different systems, reduce the possibility of user login errors, and achieve security while avoiding processing and saving multiple sets The authentication information of system users reduces the time for system administrators to add, delete, and modify user permissions, and increase security. In addition, system administrators have better ways to manage users, such as directly banning users or deleting users, to cancel the user's access to all system resources.

At present, when controlling the authority of SSO, when the number of users and business volume is increasing rapidly, the problem of rule storm is prone to occur; in addition, the prior art provides authority management for users through the authorized party, and the authorized party is malicious Possibility, the security of authorization cannot be guaranteed.

Summary of the invention

Since the account permissions in the current role-based permission control method are limited to the preset permissions of the role, the problem of rule storms will occur when the number of users and business volume increase rapidly. The present invention provides a blockchain permission Control method and device.

In the first aspect, the present invention provides a permission control method for blockchain, including:

The verification agency receives the verification request sent by the resource party, and the verification request includes the authorization pass Token; the verification agency searches for the authorization digest matching the authorization Token through the blockchain, and finds the authorization digest that matches the authorization Token. After the authorization summary, a verification pass message is sent to the resource party; the block chain stores the authorization summary of the authorization token generated by each authorized party.

In the present invention, the authorization Token authorized by the authorized party is verified by the verification agency, instead of verifying the authorization rules in the prior art, it can avoid the rule storm problem caused by too many authorization rules on the blockchain, and can ensure the authorization of the Token. Privacy. In addition, because the authorization Token stores the corresponding authorization summary through the blockchain, it can also avoid the problem of low authorization security due to the possibility of the authorized party doing evil in the process of rights management for the user. Ensure the security of authorized tokens.

In a possible implementation manner, the method further includes: the verification agency receives an upload request sent by an authorized party, the upload request includes an authorization token; the verification agency verifies that the authorized party in the authorized token is legal and all If the authorization content in the authorization token includes authorized resources, the authorization summary of the authorization token is uploaded to the blockchain.

In the above implementation, the authorization token stores the corresponding authorization digest through the blockchain, and verifies the legality of the authorization token on the chain, so that the security of the authorization token can be guaranteed, and the authorization party can avoid the authorization management for the user. The possibility that the authorized party does evil in the way.

In a possible implementation manner, account information is also stored in the blockchain. The account information includes the corresponding relationship between the account and the attribute, and the corresponding relationship between the attribute and the resource authority; the verification agency verifies the authorization Token in the The authorizing party is legal, including: determining the attribute of the authorizing party according to the corresponding relationship between the account and the attribute, and determining whether the attribute of the authorizing party has the authorization token according to the corresponding relationship between the attribute and the resource authority If there is an access right of authorized content, it is determined that the authorized party of the authorized Token is legal.

In the foregoing implementation manner, by setting the corresponding relationship between the account and the attribute, and the corresponding relationship between the attribute and the resource authority, the verification agency can verify the authorization party's access authority according to the authorization party's attributes, reducing the complexity of the verification process; The permission rules corresponding to the accounts that need to be stored are reduced, and the problem of rule storms can be further avoided.

In a possible implementation manner, the authorization Token is generated by an authorization organization.

In the foregoing implementation manner, the authorization Token is generated by the authorization agency, which can prevent the authorized party from generating the authorization Token privately, thereby improving the security of the authorization Token.

In the second aspect, the present invention provides a method for controlling permissions of a blockchain, including:

The resource party obtains an access request for the first resource sent by the resource requester, the access request includes an authorization token, and the authorization Token includes an authorized party and authorized content; the resource party determines that the access request satisfies the access to the first resource. When the first access condition of the resource, the first resource is sent to the resource requester; the first access condition is that the authorization digest matching the authorization Token and the authorization Token are found through the blockchain The authorized party is legal and the authorized content in the authorized token includes the first resource; the block chain stores the authorization summary of the authorized token generated by each authorized party.

In the present invention, the resource requester carries the authorization Token in the access request, so that the resource party can perform multi-party verification of the authorization Token, such as verifying the legitimacy of the authorization Token, the authorization content of the authorization Token, and the authorization of the authorizing party. The party determines the authority by verifying the authorization token authorized by the authorizing party, instead of verifying authority rules in the prior art, which can not only avoid the rule storm caused by too many authority rules on the blockchain, but also ensure the privacy of the authorized token. It can also guarantee the validity of the verification results. In addition, since the authorization token stores the corresponding authorization digest through the blockchain and verifies the legality of the authorization token on the chain, the security of the authorization token can be guaranteed, and the authorization that the authorizing party has to manage permissions for users is avoided. The possibility of evil.

In a possible implementation manner, the access request further includes an authorized party signature, the authorized party signature is obtained by the authorized party signing the generated authorization token; the resource party determines that the access request satisfies the access to the Before the access condition of the first resource, it is also determined by the authorizing party's signature that the authorization Token is issued by the authorizing party.

In the foregoing implementation manner, by digitally signing the authorized token, the security of the authorized token can be further improved.

In a possible implementation manner, before the resource party determines that the access request meets the first access condition for accessing the resource, it also determines that the access request does not meet the second access condition for accessing the resource; the second The access condition is that the account of the resource requester is an account with access authority to the first resource recorded in the account information.

In the foregoing implementation manner, by pre-verifying the authority of the account corresponding to the resource requester, the comprehensiveness of the verification can be ensured and the effectiveness of the verification can be improved.

In a possible implementation manner, the authorized content includes authorized attributes; determining that the authorized content in the authorization token includes the first resource is determined according to the following manner: according to the authorized attributes, in the attributes In the corresponding relationship with the resource authority, it is searched whether the resource corresponding to the authorized attribute includes the first resource; if it is determined that the first resource is included, it is determined that the authorized content in the authorization token includes the first resource .

In the above implementation, by setting authorized attributes, the authorization and verification of authorized tokens are made more flexible, and by compressing the fields of authorized tokens, the transmission time of verification can also be shortened. By verifying the authorized attributes or the resources corresponding to the authorized attributes To verify the authorization Token, more optional verification methods are provided and the verification efficiency is higher.

In a possible implementation manner, the authorized content includes authorized resources; determining that the authorized content in the authorization token includes the first resource is determined according to the following manner: if the authorized resources in the authorized content are determined If the first resource is included, it is determined that the authorized content in the authorization Token includes the first resource.

In the foregoing implementation manner, by setting authorized resources in the authorized content, it is possible to directly determine whether the first resource exists by searching for the authorized resources in the authorized content, which shortens the verification time and improves the verification efficiency.

In a third aspect, an embodiment of the present invention provides a permission control device for a blockchain, including:

The transceiver unit is configured to receive a verification request sent by the resource party, where the verification request includes an authorization token;

The processing unit is configured to search for an authorization summary matching the authorization Token through the blockchain; the blockchain stores the authorization summary of the authorization Token generated by each authorized party;

The transceiver unit is configured to send a verification pass message to the resource party after finding the authorization digest matching the authorization Token.

In a possible implementation manner, the transceiver unit is further configured to: receive an upload request sent by an authorized party, the upload request includes an authorization token; the processing unit is also used to verify that the authorized party in the authorized token is legal And the authorization content in the authorization token includes authorized resources, and the authorization summary of the authorization token is uploaded to the blockchain.

In a possible implementation manner, account information is also stored in the blockchain, and the account information includes the correspondence between accounts and attributes, and the correspondence between attributes and resource permissions; the processing unit is specifically configured to The corresponding relationship between the account and the attribute determines the attribute of the authorizing party; according to the corresponding relationship between the attribute and the resource authority, it is determined whether the attribute of the authorizing party has the access authority to the authorized content in the authorization token; if so , It is determined that the authorized party of the authorized Token is legal.

In a fourth aspect, an embodiment of the present invention provides a permission control device for a blockchain, including:

The transceiver unit is configured to obtain an access request for the first resource sent by the resource requester; the access request includes an authorization voucher Token; the authorization Token includes an authorized party and authorized content;

The processing unit is configured to send the first resource to the resource requester when it is determined that the access request satisfies the first access condition for accessing the first resource; the first access condition is to find through the blockchain The authorization summary matching the authorization Token, the authorization party in the authorization Token is legal, and the authorization content in the authorization Token includes the first resource; the blockchain stores the authorization Token generated by each authorization party Of authorization summary.

In a possible implementation manner, the access request further includes an authorized party signature, the authorized party signature is obtained by the authorized party signing the generated authorization token; the processing unit determines that the access request satisfies the access to the Before the access condition of the first resource, it is also determined by the authorizing party's signature that the authorization Token is issued by the authorizing party.

In a possible implementation manner, before the processing unit determines that the access request meets the first access condition for accessing the resource, it also determines that the access request does not meet the second access condition for accessing the resource; the second The access condition is that the account of the resource requester is an account with access authority to the first resource recorded in the account information.

In a possible implementation manner, the authorized content includes authorized attributes; the processing unit is specifically configured to find the authorized attributes corresponding to the authorized attributes in the corresponding relationship between the attributes and the resource permissions according to the authorized attributes Whether the resource of includes the first resource; if it is determined that the first resource is included, it is determined that the authorized content in the authorization Token includes the first resource.

In a possible implementation manner, the authorized content includes authorized resources; the processing unit is specifically configured to determine that the authorized resource in the authorized content includes the first resource. The authorized content includes the first resource.

In a fifth aspect, an embodiment of the present invention provides a computer device, including at least one processing unit and at least one storage unit, wherein the storage unit stores a computer program, and when the program is executed by the processing unit, The processing unit is made to execute the steps of the permission control method of the blockchain.

In a sixth aspect, an embodiment of the present invention provides a computer-readable medium that stores a computer program executable by a terminal device, and when the program runs on the terminal device, the terminal device has the authority to execute the blockchain Control method steps.

Description of the drawings

In order to more clearly describe the technical solutions in the embodiments of the present invention, the following will briefly introduce the drawings needed in the description of the embodiments. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings may be obtained from these drawings without creative labor.

FIG. 1 is a schematic diagram of a system architecture of a blockchain network provided by an embodiment of the present invention;

FIG. 2 is a schematic flowchart of a method for controlling permissions on a blockchain according to an embodiment of the present invention;

FIG. 3 is a schematic flowchart of a method for controlling permissions on a blockchain according to an embodiment of the present invention;

FIG. 4 is a schematic flowchart of a method for controlling permissions on a blockchain according to an embodiment of the present invention;

5 is a schematic structural diagram of a permission control device for a blockchain provided by an embodiment of the present invention;

FIG. 6 is a schematic structural diagram of another block chain permission control device provided by an embodiment of the present invention;

FIG. 7 is a schematic structural diagram of a computing device provided by an embodiment of the present invention.

detailed description

In order to make the objectives, technical solutions and beneficial effects of the present invention clearer, the following further describes the present invention in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the present invention, but not to limit the present invention.

To facilitate understanding, the terms involved in the embodiments of the present invention are explained below.

Blockchain: Blockchain uses block-chain data structure to verify and store data, uses distributed node consensus algorithm to generate and update data, uses cryptography to ensure the security of data transmission and access, and is composed of automated script codes A new distributed infrastructure and calculation method that uses one or more of the smart contracts to program and manipulate data.

The embodiment of the present invention provides a method for controlling permissions on a blockchain, which can be applied in a blockchain network scenario to improve the security of single sign-on and avoid the possibility of an authorized party from doing evil.

Exemplarily, FIG. 1 is a schematic diagram of the system architecture of a blockchain network provided by an embodiment of the present invention. As shown in FIG. 1, the blockchain network includes multiple network nodes, such as network node 101, network node 102, and The network node 103, any network node includes a block chain authority control device. Among them, each network node can be a server or a server cluster composed of several servers, and each network node is connected through a wireless network.

In the organization that maintains the blockchain, each organization can correspond to one or more network nodes, and the tables in each network node in the blockchain are synchronized in real time. For each network node, the institution initiates a transaction request through a transaction account in other network nodes. After receiving the transaction request, the network node determines the content to be operated based on the transaction information. Among them, the transaction request can be an access request for accessing resources, or a verification request. Correspondingly, the content to be operated can be access to resources, or verification rights. Further, the network node determines the transaction account corresponding to the content to be operated from the preset permission table, and when it is determined that the transaction account matches the permission account corresponding to the content to be operated, returns the resource that the user needs to access. After that, the network node generates an operation record of the content to be operated, and sends the operation record to other network nodes in the blockchain network. The operation record includes the identifier of the content to be operated, the authority content of the content to be operated, and the transaction. Account.

Wherein, the resource mentioned in the present invention may be a resource URI. For example, the data webpage Uniform Resource Location (URL), executable state transfer application program interface (Resource Representational State Transfer Application Programming Interface, RESTful API), such as GET/POST/DELETE, etc., are not limited.

Users on the blockchain have different roles and different access rights to different resources. Users have requirements for authorization. There is an existing authority management method in the traditional security field. In this method, authorization is generally expressed by SSO Token, but the problem of rule storms will occur when SSO Token is directly transplanted to the blockchain system. For example, if each permission is on the chain without distinction, it will cause the problem of a single authorization type, and a large number of permission rules need to be set, and each permission needs to be checked on the chain when it is used. In this way, in the case of rapid growth in the number of users and business volume (that is, the business volume is large), too many rules will make it difficult for traditional databases to accept, and the problem of rule storms will arise.

Based on the foregoing problems, the embodiments of the present invention provide a flow of a blockchain permission control method to solve the technical problem of rule storms that occur in the prior art when the number of users and business volume increase rapidly.

Fig. 2 is a schematic flowchart of a method for controlling permission of a blockchain according to an embodiment of the present invention. The method can be executed by a permission control device of a blockchain. As shown in Fig. 2, the method includes the following steps:

Step 201: The verification agency receives a verification request sent by the resource party, where the verification request includes an authorization token.

Among them, the resource party specifically refers to the holder of the resource. Authorization Token is a unit used to describe authorization information, which can be expressed as a json string. The field of the authorization token can include: the universally unique identifier (UUID) of the authorized token, UUID is used to represent the unique identifier of the authorized token; the original authorized user's blockchain address; the authorized user's blockchain address (can pass through Authorized content; authorized time; authorization termination time; authorized user digital signature, etc.

Step 202: The verification agency searches for an authorization digest matching the authorization Token through the blockchain; the blockchain stores the authorization digest of the authorization Token generated by each authorized party.

Step 203: After finding the authorization digest matching the authorization Token, the verification agency sends a verification pass message to the resource party.

In the embodiment of the present invention, the authorization Token is generated by the authorizer, so that the authorized content of the authorization Token does not need to be completely stored in the authorization table. Therefore, when the resource requester’s account initiates an access request, the authorizer and the authorization Token can be directly verified to Flexible control of access to resources. Moreover, since the authorizer does not need to write the authorization table when generating the authorization token, the authorizer can freely set the specific account permissions according to its own permissions, and add or delete the authorized content of the authorized token based on actual needs to achieve authorization. The free addition and deletion of the permissions of, avoid the problem of rule storm caused by all the rules on the chain, and improve the privacy protection of authorized tokens.

In step 201, the authorizer can create a corresponding authorization Token for the resource requester. Among them, the resource requester can be any user in the single sign-on system, or any account registered on the blockchain.

Among them, the specific generation process can include:

The authorizer generates an authorization token in a specified format according to the authorization target account (combined with the above scenarios, it can be the resource requester), the authorizer account, the authorization content, and the authorization start and end time. The authorizing party can create a corresponding authorization token for the resource requester outside the chain. For example, the authorizing party is an authorized institution, and the authorized institution can be a device outside the chain. After the authorized institution is verified, the authorized Token can be sent to the resource requester.

Illustratively, the management node can be selected from the blockchain network, and then the account corresponding to the management node can be set as the administrator account. Only the administrator account can become the authorized party, and the non-administrator account cannot become the authorized party, that is, non-administrative The account has no authorization function.

In the embodiment of the present invention, the authorized content of the authorization token may include two types of authorized content of attributes and resources. Among them, attribute authorization means that the authorizing party can authorize one of its own attributes to the resource party. It should be noted that the attribute can be any feature of the account, such as the role of the account, the geographic location of the account, the access time and other features, which are not limited here. Resource authorization means that the authorizing party can authorize its own access rights to a resource to the resource requesting party.

Specifically, the permission information may be stored in the permission table, and used to determine the permission control usage rule. When setting an account's authority to a certain table, add the authority record corresponding to the account in the authority table. Exemplarily, the permission table is located in a block of the blockchain. When the permission table is updated, the updated permission table takes effect in the next block of the current block. For example, when a new permission record A is added to the permission table, a new block is generated after the current block, and the new permission record A is stored in the block body of the new block. Or, when the permission record B is modified in the permission table, a new block is generated after the current block, and the modified permission record B is stored in the block body of the new block.

In specific implementation, a preset permission contract interface can be used to operate the permission table. The rights contract interface can include a write interface, a remove interface, a query interface, and so on. The write interface sets the permission record through the table name and account address, and returns the set number of records. The set record will be saved in the permission table. If the permission record is an existing permission record, it will refuse to set the same permission record repeatedly, that is Return 0 directly. The removal interface removes the set permission records through the table name and account address, and returns the number of removed records. The query interface queries the set permission record through the table name, and returns the permission record obtained by the query. The record can be returned in the form of a json string.

In a possible implementation manner, the permission table may include an attribute account table and an attribute permission table. Among them, the attribute account table is used to store attributes in the registered account and the account corresponding to each attribute. The records in the attribute account table can be written by the registered party or by the authorized party. Correspondingly, the attribute authority table is used to store the access authority of the resource corresponding to each attribute in the registered account.

In a possible implementation manner, the authorized content includes authorized attributes; the authorizing party determines the authorized content of the authorized token according to the authorized resources required by the authorized target account and the attributes of the authorized target account. The attributes of the authorized target account may be set by the authorized party for the authorized target account, or may be set by the registered party for the authorized target account when the authorized target account is registered, which is not limited here.

In the above implementation, by setting the corresponding relationship between the account and the attribute, and the corresponding relationship between the attribute and the resource authority, the access authority of the authorized party can be directly verified according to the attribute of the authorized party, thereby reducing the complexity of the verification process; and, by reducing the need The permission rules corresponding to the stored accounts can further avoid the problem of rule storms.

In the embodiment of the present invention, if the attributes of the authorized target account are set by the registrant for the authorized target account when the authorized target account is registered, the registrant may also write the attributes of the authorized target account into the block when the authorized target account is registered chain. For example, the attributes of the authorized target account and the account of the authorized target account are written into the account attribute table. In this way, the authorized party can directly determine the attribute corresponding to the account of the authorized target account by querying the account attribute table.

Exemplarily, because the account attribute table on the blockchain is public, in order to improve the security of authorized tokens, reduce the setting of rules, and avoid rule storms, when the authorizing party sets the authorized token for the authorized target account, The attributes of the authorized target account can be reset, that is, the authorized attributes in the authorization token are not written into the account of the authorized target account.

Exemplarily, the authorized content in the authorization token includes the first resource, and the way to determine whether the first resource is included may be: the verification agency finds the corresponding attribute of the authorized attribute in the corresponding relationship between the attribute and the resource authority according to the authorized attribute Whether the resource includes the first resource; if it is determined that the first resource is included, it is determined that the authorized content in the authorization Token includes the first resource. By setting the attributes of the authorization, the authorization and verification of the authorization Token is made more flexible, and the fields of the authorization Token are compressed, and the transmission time of the verification is shortened. In this way, the verification agency can verify the authorization Token by verifying the authorized attributes, or pass the verification. The resources corresponding to the authorized attributes are used to verify the authorization Token, thereby providing more optional verification methods and improving the verification efficiency.

In a possible implementation method, in order to improve the security of the authorization token, reduce the setting of rules, and avoid rule storms, when the authorizing party sets the authorization token for the authorization target account, it can also reset the resource permissions of the authorization target account. Method, that is, the authorized resources in the authorization token are not written into the authorization table.

Specifically, the authorized content may include authorized resources; the authorizing party determines the authorized content of the authorized token according to the authorized resources required by the authorized target account. Thus, the authorized content in the authorized token is the authorized resource.

Exemplarily, the authorized content in the authorization token includes the first resource, and the way to determine whether the first resource is included may be: if it is determined that the authorized resource in the authorized content includes the first resource, then it is determined that the authorized content in the authorization token includes the first resource. One resource. By setting authorized resources in the authorized content, the verification time can be shortened and the verification efficiency can be improved.

Exemplarily, in order to improve the security of the authorized token, the private key of the authorized party can also be used to sign the authorized token. Among them, the private key of the authorizing party is the public key data of each account generated and stored when the authorizing party registers on the blockchain. Specifically, when creating an account for a user, the public and private key pair of the account is generated first, and then the public key is stored in the public key data contract; of course, the public key that meets the algorithm format requirements can also be uploaded for the user, and then verified and stored.

In a possible implementation manner, the authorization token is generated by an authorized institution. In this way, the authorization Token is generated by the authorization agency, which can prevent the authorized party from generating the authorization Token privately, thereby improving the security of the authorization Token.

In the embodiment of the present invention, the authorized institution may be an institution outside the blockchain or an institution on the blockchain; the verification institution may be an institution on the blockchain or an institution outside the blockchain, without limitation .

In one possible implementation, all authorized tokens are on the chain. At this time, the logic on the chain has changed from a specific user to a smart contract, so that the rules and execution are visible to the entire network without additional moral hazard. Second, authorization records can be reduced by one field to reduce storage costs and future indexing time costs.

In one possible implementation, all authorized tokens are not chained. At this time, the security of the authorized Token can be guaranteed by the digital signature of the authorized user. In this way, the out-of-chain execution can greatly reduce the time overhead of the verification algorithm.

In a possible implementation manner, the authorization Token can be uploaded by an off-chain organization, and the off-chain organization can be at least one determined authoritative maintainer, which is used to maintain the authorized data record table. In this way, when each authorized party needs to authorize the Token to be chained, it can send an upload request to at least one authoritative maintainer.

Among them, the off-chain tools on the chain by the authoritative maintainer can be implemented according to the process of the solution in the embodiment of the present invention, and accept audit supervision. The off-chain tool can be SDK/RESTful Client.

Exemplarily, the authorization record in the authorization data record table also adds a field signed by the chain owner, and the chain owner's signature can be generated based on the private key of the authority maintainer.

In a possible implementation, in order to reduce the storage content of the blockchain and improve the security of the authorization token, the authorizing party can also upload the authorization token created by itself. In specific implementation, the verification agency can receive the upload request sent by the authorized party, and the upload request includes the authorization Token; further, if the verification agency verifies that the authorized party in the authorized Token is legal and the authorized content in the authorized Token includes authorized resources, it will The authorization summary of the authorization token is uploaded to the blockchain.

Among them, the upload request can be processed by the nodes on the chain. Specifically:

Step 1: The verification agency checks whether the authorized Token content is legal.

In specific implementation, the verification agency can check the digital signature of the authorized token to determine whether the public key value of the authorized party can be correctly solved. If yes, go to step 2; otherwise, go to step 4.

Step 2: The verification agency calls the attribute management module to check whether the authorization is valid.

Here, the authorization verification logic can be off-chain or on-chain. However, any request that includes the authorization token received by the verification agency needs to verify the validity and signature of the authorization token.

Specifically, the verification agency can detect whether the authorized party has the access right to the corresponding authorized resource. If not, go to step 4; otherwise, go to step 3;

Step 3: The verification agency generates the hash value (ie, the Hash value) of the authorized Token and stores it on the chain.

Here, it can be stored in the authorization data table on the blockchain, and the index of the table entry on the chain of the authorized party is returned.

In a possible implementation, the authorization digest of the authorization token may be the hash value of the authorization token. Among them, the authorization record stored in the authorization data record table on the chain may include the following fields: UUID; Hash value. The hash value of the authorization token may be a digest value generated based on a digest generation algorithm, such as sha3 (authorization token).

In the above implementation, because the authorization digest corresponding to the authorized Token is stored through the blockchain, the legitimacy of the authorized Token is verified on the chain, so that the security of the authorized Token can be guaranteed, and the existence of the authorization party to manage user permissions is avoided The possibility of evil by authorized parties.

Exemplarily, in order to improve the security of the verification Token, the authorization data record table only allows one-way access by the verification agency. In other words, once a record is added, the record cannot be modified subsequently.

Figure 3 is a schematic flow chart of a method for controlling permissions on a blockchain provided by an embodiment of the present invention. As shown in Figure 3, the verification logic of the verification agency is separated from the data in the authorization data table, and the corresponding verification contract is only used for verification. The agency verifies the authorization Token, and the verification agency supports upgrade and data migration. In the authorization data table, each record has a validity period, and authorization records mainly include the following two types:

i. Attribute authorization record: The data of each attribute authorization record represents the summary of the authorization token of the attribute type, that is, an account with the same attribute can authorize others to reuse the same attribute.

ii. Resource authorization records: The data of each resource authorization record indicates a summary of the authorization token of the resource type, that is, an account with the same operation authority can authorize others to access a certain resource.

The contents of the above two tables can be publicly queried by all nodes on the blockchain, and the authorized party of each authorization record can modify the authorization record.

Step 4. The verification agency returns a message that the upload request failed to the authorized party.

In order to better explain the embodiments of the present invention, the following describes the permission control method of the blockchain provided by the embodiments of the present invention in combination with specific implementation scenarios. This method can be executed by a network node on the chain or off-chain. This method It includes the following steps:

Step 1. The authorization sends an authorization token generation request to the authorization institution.

Wherein, the authorization token generation request includes authorization token parameters, that is, authorization target account (combined with the above scenario, it can be the resource requester), authorizer account, authorized content, authorization start and end time, digital signature, etc.

Step 2: The authorized institution checks the legality of the authorized Token parameters. If the check passes, then step 3 is executed; otherwise, step 5 is executed.

Step 3: The authorized institution generates the authorized token, and signs the authorized token with the private key passed in by the authorized party.

Step 4. The authorized institution sends the generated authorization token to the authorized party.

Step 5. The authorized institution returns a message that the generation failed to the authorized party.

Step 1: The authorization sends the signed authorization Token to the verification agency.

Step 2: The verification agency checks the validity of the authorized Token's parameters. The parameters include the validity period and signature of the authorized Token. If the check passes, go to step 3; otherwise, go to step 5.

Step 3: Verify the access authority table of the agency and check whether the authorized content of the authorized token is true and effective. For example, check whether there are declared resource permissions in the authorized party that can be used for authorization. If the check passes, go to step 4; otherwise, go to step 5.

Step 4. The verification agency generates the Hash value of the authorized Token, stores it in the authorization data table on the chain, and returns the successful upload information and/or the record of the authorization data table to the authorized party.

In order to better explain the embodiments of the present invention, the following describes a block chain permission control method provided by the embodiments of the present invention in combination with specific implementation scenarios. The method can be executed by network nodes on the chain or off-chain. The method includes the following steps:

Step 1. The resource party uploads the authorization token that needs to be verified.

In a possible implementation manner, the resource party can also selectively upload the on-chain record information corresponding to the authorized token on the resource requester chain, such as the index of the authorization digest of the authorized token, so that the verification agency can quickly verify the authorized token.

Step 2: The verification agency checks the legality of the parameters of the authorized Token; if it is legal, perform step three; otherwise, perform step five.

Specifically, the verification agency can access the attribute management module to check whether the authorized content of the authorized Token is true and valid, that is, whether the authorized Token authorized party has declared resources that can be used for authorization.

Step 3. If the record information on the incoming chain is not empty, the verification agency accesses the authorization record table on the chain, determines the hash value of the authorization token that needs to be verified, and compares the hash value with the hash value in the authorization record table Is it consistent? If yes, go to step 4; otherwise, go to step 5.

Step 4. Confirm that the authorization token uploaded by the resource party needs to be verified successfully.

Step 5. It is determined that the authentication of the authorization token that needs to be verified uploaded by the resource party fails.

It should be noted that step 3 and step 4 can exchange the verification sequence, which is not limited here.

Fig. 4 is an embodiment of the present invention providing a method for controlling permissions on a blockchain. As shown in Fig. 4, the method includes:

Step 401: The resource party obtains an access request for the first resource sent by the resource requester.

Among them, the access request includes the authorization certificate Token, and the authorization Token includes the authorized party and authorized content.

Step 402: When the resource party determines that the access request meets the first access condition for accessing the first resource, the resource party sends the first resource to the resource requester.

Here, the authorization summary of the authorization token generated by each authorization party is stored in the blockchain.

Correspondingly, the first access condition is: the authorization digest matching the authorization token is found in the blockchain, and the authorized party in the authorization token is legal, and the authorization content in the authorization token includes all The first resource.

In the embodiment of the present invention, the resource requester carries the authorization Token, and performs multi-party verification of the authorization Token, such as verifying the legitimacy of the authorized Token, verifying the authorized content of the authorized Token, and verifying the authority of the authorized party, etc., to ensure the validity of the verification result Sex. Moreover, when the authorizer generates the authorization token, there is no need to write the authorization token into the authorization table. In this way, the authorizer can freely set the specific permissions of the account according to its own permissions, and can add or delete the authorized content of the authorized token based on actual needs. In order to realize the free addition and deletion of authorized permissions, compared with the method of verifying permission rules in the prior art, it can avoid the problem of rule storm caused by chaining all rules and improve the privacy protection of authorized tokens. In addition, the authorization token can also store the corresponding authorization summary through the blockchain. In this way, by verifying the legitimacy of the authorization token on the chain, the security of the authorization token can be guaranteed, avoiding the existence of the authorized party managing user permissions The possibility of the authorized party doing evil.

In a possible implementation manner, the access request further includes a signature of the authorized party; before the resource party determines that the access request meets the access conditions for accessing the first resource, the authorized party also determines the authorization through the signature of the authorized party. The Token is issued by the authorized party; the authorized party signature is obtained by the authorized party signing the generated authorized Token. In this way, by verifying the authorized token based on the digital signature, the security of the authorized token can be further improved.

In a possible implementation manner, before the resource party determines that the access request meets the first access condition for accessing the resource, it also determines that the access request does not meet the second access condition for accessing the resource; The second access condition is that the account of the resource requester is an account recorded in the account information that has access authority to the first resource. In this way, by pre-verifying the authority of the account corresponding to the resource requester, the comprehensiveness of the verification can be ensured, and the effectiveness of the verification can be improved.

The solution proposed by the present invention aims to achieve a balance between flexibility and scalability, and to ensure the multi-dimensional, multi-granularity of authorized content, and the tamper-proof modification of authorized Token. Moreover, the authorizer can divide the authorization types, and can also authorize its own capabilities to the authorized target account in terms of attributes and resources, and at the same time allow the authorization to be revoked. In addition, the authorization summary of the authorization token can be stored on the blockchain. Since only the authorization summary of the authorization token is stored, the minimum disclosure and non-tampering can be guaranteed. Based on this, the present invention can greatly reduce the impact of regular storms and has good scalability.

In order to better explain the embodiments of the present invention, the following describes the permission control method of the blockchain provided by the embodiments of the present invention in combination with specific implementation scenarios. The method is executed by a network node, and the method includes the following steps:

Step 1: The resource requester sends a resource request to the resource party. The resource request includes an authorization token and an authorization record address on the chain.

Step 2: The resource party checks whether the resource requester can directly meet the second resource access condition for accessing the resource without using the authorization token; if so, perform step five, otherwise, perform step three.

Step 3: The resource party verifies the authorized token through the verification agency. If the verification is successful, go to step 5; otherwise, go to step 6.

For the specific process, refer to the method of verifying the authorization token in the above embodiment, which will not be repeated here.

Step 4: The resource party checks whether the authorized Token meets the first resource access condition based on the authorized content in the authorized Token; if so, execute step 5.

Step 5. The resource returns the content of the requested resource to the resource requester.

Step 6. The resource returns a request failure message to the resource requester.

Illustratively, in the embodiment of the present invention, the authorized institution is an institution outside the blockchain, and the verification institution is an institution on the blockchain; or, both the authorized institution and the verification institution are institutions outside the blockchain.

Based on the same technical concept, the embodiment of the present invention provides a block chain permission setting device.

Fig. 5 is a schematic structural diagram of a block chain permission setting device provided by an embodiment of the present invention, as shown in Fig. 5, including:

The transceiver unit 501 is configured to receive a verification request sent by a resource party, where the verification request includes an authorization token;

The processing unit 502 is configured to search for an authorization digest matching the authorization token through the blockchain; the blockchain stores the authorization digest of the authorization token generated by each authorized party;

The transceiver unit 501 is further configured to send a verification pass message to the resource party after finding an authorization digest matching the authorization Token.

In a possible implementation manner, the transceiver unit 501 is further configured to receive an upload request sent by an authorizing party, and the upload request includes an authorization token;

The processing unit 502 is further configured to upload the authorization digest of the authorization token to the blockchain after verifying that the authorized party in the authorization token is legal and the authorized content in the authorization token includes authorized resources. .

In a possible implementation manner, account information is also stored in the blockchain, and the account information includes the corresponding relationship between the account and the attribute, and the corresponding relationship between the attribute and the resource authority;

The processing unit 502 is specifically configured to determine the attribute of the authorizing party according to the corresponding relationship between the account and the attribute; according to the corresponding relationship between the attribute and the resource authority, determine whether the attribute of the authorizing party has the Authorize the access rights of the authorized content in the authorized token; if there is, determine that the authorized party of the authorized token is legal.

Fig. 6 is a schematic structural diagram of yet another block chain permission setting device provided by an embodiment of the present invention, as shown in Fig. 6, including:

The transceiver unit 601 is configured to obtain an access request for the first resource sent by the resource requester; the access request includes an authorization credential Token; the authorization Token includes an authorized party and authorized content;

The processing unit 602 is configured to send the first resource to the resource requester when it is determined that the access request satisfies the first access condition for accessing the first resource; the first access condition is searching through the blockchain To the authorization digest matching the authorization token, the authorized party in the authorization token is legal, and the authorized content in the authorization token includes the first resource; the blockchain stores the authorization generated by each authorized party Token authorization summary.

In a possible implementation manner, the access request further includes an authorized party signature, and the authorized party signature is obtained by the authorized party signing the generated authorization Token;

Before the processing unit 602 determines that the access request meets the access condition for accessing the first resource, it is further configured to:

It is determined by the authorizing party's signature that the authorization Token is issued by the authorizing party.

In a possible implementation manner, before the processing unit 602 determines that the access request meets the first access condition for accessing the resource, it is further configured to:

It is determined that the access request does not satisfy the second access condition for accessing the resource; the second access condition is that the account of the resource requester is the account that has access rights to the first resource recorded in the account information .

In a possible implementation manner, the authorized content includes authorized attributes;

The processing unit 602 is specifically configured to find whether the resource corresponding to the authorized attribute includes the first resource in the corresponding relationship between the attribute and the resource authority according to the authorized attribute; The first resource, it is determined that the authorization content in the authorization Token includes the first resource.

In a possible implementation manner, the authorized content includes authorized resources;

The processing unit 602 is specifically configured to determine that the authorized content in the authorization Token includes the first resource if it is determined that the authorized resource in the authorized content includes the first resource.

Based on the same technical concept, an embodiment of the present invention provides a computing device. As shown in FIG. 7, it includes at least one processor 701 and a memory 702 connected to the at least one processor. The embodiment of the present invention does not limit the processor. The specific connection medium between the 701 and the memory 702 is, for example, the connection between the processor 701 and the memory 702 through a bus in FIG. 7. The bus can be divided into address bus, data bus, control bus, etc.

In the embodiment of the present invention, the memory 702 stores instructions that can be executed by at least one processor 701. By executing the instructions stored in the memory 702, the at least one processor 701 can execute the aforementioned blockchain permission control method. step.

Among them, the processor 701 is the control center of the computing device, which can use various interfaces and lines to connect to various parts of the computing device, and control the authority by running or executing instructions stored in the memory 702 and calling data stored in the memory 702 . Optionally, the processor 701 may include one or more processing units, and the processor 701 may integrate an application processor and a modem processor. The application processor mainly processes the operating system, user interface, and application programs. The adjustment processor mainly deals with wireless communication. It can be understood that the foregoing modem processor may not be integrated into the processor 701. In some embodiments, the processor 701 and the memory 702 may be implemented on the same chip, and in some embodiments, they may also be implemented on separate chips.

The processor 701 may be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application specific integrated circuit (ASIC), a field programmable gate array or other programmable logic devices, discrete gates or transistors Logic devices and discrete hardware components can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present invention. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the embodiments of the present invention may be directly embodied as being executed and completed by a hardware processor, or executed and completed by a combination of hardware and software modules in the processor.

The memory 702, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. The memory 702 may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (Random Access Memory, RAM), static random access memory (Static Random Access Memory, SRAM), Programmable Read Only Memory (PROM), Read Only Memory (ROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), magnetic memory, disk , CD, etc. The memory 702 is any other medium that can be used to carry or store desired program codes in the form of instructions or data structures and that can be accessed by a computer, but is not limited thereto. The memory 702 in the embodiment of the present invention may also be a circuit or any other device capable of realizing a storage function for storing program instructions and/or data.

Based on the same inventive concept, the embodiments of the present invention provide a computer-readable medium that stores a computer program executable by a terminal device. When the program runs on the terminal device, the terminal device executes blockchain Steps of the permission control method.

Those skilled in the art should understand that the embodiments of the present invention may be provided as methods or computer program products. Therefore, the present invention may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

The present invention is described with reference to flowcharts and/or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and/or block in the flowchart and/or block diagram, and the combination of processes and/or blocks in the flowchart and/or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing equipment to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing equipment are generated It is a device that realizes the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.

These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing equipment to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction device. The device implements the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.

These computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operation steps are executed on the computer or other programmable equipment to produce computer-implemented processing, so as to execute on the computer or other programmable equipment. The instructions provide steps for implementing functions specified in a flow or multiple flows in the flowchart and/or a block or multiple blocks in the block diagram.

Although the preferred embodiments of the present invention have been described, those skilled in the art can make additional changes and modifications to these embodiments once they learn the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present invention.

Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. In this way, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalent technologies, the present invention is also intended to include these modifications and variations.

Claims

A permission control method for blockchain, characterized in that the method comprises:

The verification agency receives the verification request sent by the resource party, where the verification request includes the authorization token Token;

The verification agency searches for the authorization digest matching the authorization Token through the blockchain; the blockchain stores the authorization digest of the authorization Token generated by each authorized party;

After finding the authorization digest that matches the authorization token, the verification agency sends a verification pass message to the resource party.
The method of claim 1, wherein the method further comprises:

The verification agency receives an upload request sent by an authorized party, and the upload request includes an authorization Token;

The verification agency verifies that the authorized party in the authorized token is legal and the authorized content in the authorized token includes authorized resources, and then uploads the authorization digest of the authorized token to the blockchain.
The method according to claim 2, wherein account information is also stored in the blockchain, and the account information includes the corresponding relationship between the account and the attribute, and the corresponding relationship between the attribute and the resource authority;

The verification by the verification agency that the authorized party in the authorization Token is legal includes:

Determine the attribute of the authorizing party according to the correspondence between the account and the attribute;

According to the corresponding relationship between the attribute and the resource authority, determine whether the attribute of the authorizer has the access authority of the authorized content in the authorization token;

If yes, it is determined that the authorized party of the authorized Token is legal.
The method of claim 1, wherein the authorization Token is generated by an authorized institution.
A permission control method for blockchain, characterized in that the method comprises:

The resource party obtains an access request for the first resource sent by the resource requester; the access request includes an authorization voucher Token; the authorization Token includes an authorized party and authorized content;

When the resource party determines that the access request satisfies the first access condition for accessing the first resource, it sends the first resource to the resource requester; the first access condition is to find and The authorization summary matched by the authorization Token, the authorization party in the authorization Token is legal, and the authorization content in the authorization Token includes the first resource; the blockchain stores the authorization Token generated by each authorization party Authorization summary.
The method according to claim 5, wherein the access request further includes a signature of the authorized party;

Before the resource party determines that the access request meets the access condition for accessing the first resource, the method further includes:

The resource party determines that the authorized Token is issued by the authorized party through the authorized party's signature; the authorized party signature is obtained by the authorized party signing the generated authorized Token.
The method according to claim 6, wherein before the resource party determines that the access request satisfies the first access condition for accessing the resource, the method further comprises:

The resource party determines that the access request does not meet the second access condition for accessing the resource; the second access condition is that the account of the resource requester is recorded in the account information for the first resource Account with access rights.
The method according to claim 5, wherein the authorized content includes authorized attributes; the authorized content in the authorization token including the first resource is determined according to the following method:

According to the authorized attribute, in the corresponding relationship between the attribute and the resource authority, searching whether the resource corresponding to the authorized attribute includes the first resource;

If it is determined that the first resource is included, it is determined that the authorized content in the authorization Token includes the first resource.
The method of claim 5, wherein the authorized content includes authorized resources; the authorized content in the authorization Token includes the first resource, which is determined according to the following method:

If it is determined that the authorized resource in the authorized content includes the first resource, it is determined that the authorized content in the authorization Token includes the first resource.
A permission control device for blockchain, characterized in that the device includes:

The transceiver unit is configured to receive a verification request sent by the resource party, where the verification request includes an authorization token;

The processing unit is configured to search for an authorization summary matching the authorization Token through the blockchain; the blockchain stores the authorization summary of the authorization Token generated by each authorized party;

The transceiver unit is further configured to send a verification pass message to the resource party after finding the authorization digest matching the authorization Token.
A permission control device for blockchain, characterized in that the device includes:

The transceiver unit is configured to obtain an access request for the first resource sent by the resource requester; the access request includes an authorization voucher Token; the authorization Token includes an authorized party and authorized content;

The processing unit is configured to send the first resource to the resource requester when it is determined that the access request satisfies the first access condition for accessing the first resource; the first access condition is to find through the blockchain The authorization summary matching the authorization Token, the authorization party in the authorization Token is legal, and the authorization content in the authorization Token includes the first resource; the blockchain stores the authorization Token generated by each authorization party Of authorization summary.
A computer device, which is characterized by comprising at least one processing unit and at least one storage unit, wherein the storage unit stores a computer program, and when the program is executed by the processing unit, the processing unit executes The steps of the method according to any one of claims 1 to 4 or claims 5 to 9.
A computer-readable medium, characterized in that it stores a computer program executable by a terminal device, and when the program runs on the terminal device, the terminal device executes claims 1 to 4 or claims 5 to 9 Any of the steps of the method.