WO2020244236A1 - 一种块链式账本的授时认证方法、装置及设备 - Google Patents

一种块链式账本的授时认证方法、装置及设备 Download PDF

Info

Publication number
WO2020244236A1
WO2020244236A1 PCT/CN2020/071295 CN2020071295W WO2020244236A1 WO 2020244236 A1 WO2020244236 A1 WO 2020244236A1 CN 2020071295 W CN2020071295 W CN 2020071295W WO 2020244236 A1 WO2020244236 A1 WO 2020244236A1
Authority
WO
WIPO (PCT)
Prior art keywords
block
time
data
data block
trusted
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2020/071295
Other languages
English (en)
French (fr)
Inventor
杨新颖
张渊
俞本权
李亿泽
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Advanced New Technologies Co Ltd
Original Assignee
Advanced New Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Advanced New Technologies Co Ltd filed Critical Advanced New Technologies Co Ltd
Priority to US16/803,237 priority Critical patent/US10778452B2/en
Priority to US16/945,707 priority patent/US10911251B2/en
Publication of WO2020244236A1 publication Critical patent/WO2020244236A1/zh
Priority to US17/164,748 priority patent/US11108573B2/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/27—Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/22—Indexing; Data structures therefor; Storage structures
    • G06F16/2228—Indexing structures
    • G06F16/2255—Hash tables
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures

Definitions

  • the embodiments of this specification relate to the field of information technology, and in particular to a method, device, and equipment for time service authentication of a block chain ledger.
  • the purpose of the embodiments of the present application is to provide a method for ensuring the authenticity of the book in the block chain ledger.
  • a time service authentication method for block chain ledgers, applied to a centralized database server that stores data through block chain ledgers includes:
  • the target ledger According to the order of the block heights of the data blocks in the target ledger, generate a Merkel tree corresponding to the target ledger, and determine the root hash of the Merkel tree based on the block hash of each data block;
  • Execute the pre-set time capture code in the trusted execution environment obtain the trusted time, and generate a digital signature of the trusted time and the root hash of the trusted execution environment, wherein the time capture code Used to obtain trusted time from the interface provided by a trusted timing agency;
  • Timing certificate including the trusted time, root hash and digital signature.
  • the embodiment of this specification also provides a timing authentication device for a block chain ledger, which is applied to a centralized database server that stores data through a block chain ledger, including:
  • the root hash generation module generates a Merkel tree corresponding to the target ledger in the order of the block heights of the data blocks in the target ledger, and determines the root of the Merkel tree based on the block hash of each data block Hash
  • the trusted execution module executes the pre-set time capture code in the trusted execution environment, obtains the trusted time, and generates a digital signature of the trusted execution environment on the trusted time and the root hash, where all The time capture code is used to obtain the trusted time from the interface provided by the trusted timing agency;
  • the generating module generates a timing certificate including the trusted time, root hash and digital signature.
  • the embodiments of the application execute the code that captures the trusted time in a Trusted Execution Environment (TEE) to obtain the trusted time, thereby achieving the root of the target ledger.
  • TEE Trusted Execution Environment
  • the hash and trusted time are digitally signed to ensure the credibility of the timestamp in the ledger, and users can verify based on the root hash of the data block at any time.
  • FIG. 1 is a schematic diagram of a block header provided by an embodiment of this specification
  • FIG. 2 is a schematic diagram of a pseudo chain provided by an embodiment of this specification
  • Fig. 3 is a time service authentication method for a block chain ledger provided by an embodiment of this specification
  • Figure 4 is a schematic diagram of the time in the webpage provided by Greenwich;
  • FIG. 5 is a schematic structural diagram of a time service authentication device for a block chain ledger provided by an embodiment of this specification
  • Fig. 6 is a schematic structural diagram of a device for configuring the method of the embodiment of this specification.
  • data blocks can be generated in advance in the following ways:
  • the data records to be stored can be various consumption records of individual users of the client, or can be business results, intermediate states, and operation records generated when the application server executes business logic based on user instructions.
  • Specific business scenarios can include consumption records, audit logs, supply chains, government supervision records, medical records, and so on.
  • each data record to be written in the data block is determined, and the Nth data block including the hash value of the data block and the data record is generated.
  • the preset block conditions include: the number of data records to be stored reaches the number threshold, for example, every time one thousand data records are received, a new data block is generated and one thousand data records are written into the block; or , The time interval from the last block formation time reaches the time threshold, for example, every 5 minutes, a new data block is generated, and the data records received within these 5 minutes are written into the block.
  • the N here refers to the serial number of the data block.
  • the data block is in the form of a block chain, which is arranged sequentially based on the order of the block time, and has a strong timing characteristic.
  • the block height of the data block increases monotonically based on the sequence of the block time.
  • the block height can be a sequence number, at this time the block height of the Nth data block is N; the block height can also be generated in other ways.
  • the data block at this time is the initial data block.
  • the current data block (the first data block) can be generated based on the hash value of the previous data block (that is, the N-1th data block). For example, a feasible way is to determine the hash value of each data record to be written in the Nth block, and generate a Merck according to the sequence in the block.
  • Merkel tree splicing the root hash value of the Merkel tree and the hash value of the previous data block together, again using the hash algorithm to generate the hash value of the current block, and can also be based on the root of the Merkel tree
  • the hash value and some other metadata (such as the version number, the generation timestamp of the data block, etc.) generate the current fast hash value.
  • the string is hashed to generate the hash value of the data block.
  • each data block is determined by a hash value
  • the hash value of the data block is determined by the content and sequence of the data records in the data block and the hash value of the previous data block.
  • the user can initiate verification based on the hash value of the data block or the hash value of the data record at any time. Any modification of the data block (including the modification of the data record content or sequence in the data block) will result in the calculation during verification.
  • the hash value of the data block is inconsistent with the hash value when the data block is generated, resulting in verification failure, thus realizing non-tampering under centralization.
  • the format of the data block can be customized.
  • the format of the data block may be similar to the block format in the blockchain.
  • each data block it contains a block header for storing metadata, and a block body for storing data records.
  • the block header in the data block can be used to store things such as the parent hash, its own block hash value, version number, root hash of the data record, timestamp, and so on.
  • Figure 1 is a schematic diagram of a block header provided by an embodiment of this specification.
  • the format of the block header can be customized based on business needs, and it can also contain some other information, for example, It is used to describe the state array of the data record state, and can also be stored in the trusted time provided by the embodiment of this specification, the root hash of the target ledger, etc.
  • the block is used to store the plain text of the data record or the hash value of the data record.
  • FIG. 2 is a schematic diagram of a pseudo chain provided by an embodiment of this specification.
  • the blocking method of the data block is the same as the aforementioned blocking method.
  • the embodiment of this specification provides a scheme for performing time service authentication on a blockchain ledger based on a Trusted Execution Environment (TEE), as shown in FIG. 3, which is a solution provided by the embodiment of this specification
  • TEE Trusted Execution Environment
  • the timing authentication method of the block chain ledger is applied to a centralized database server that stores data through the block chain ledger.
  • the process specifically includes the following steps:
  • each data block contains at least one data record, and each data block contains the hash value of the previous data block and its own
  • the data record determines the hash value of its own data block, and the block height of the data block increases monotonically based on the sequence of the block time.
  • the server first determines from the data blocks that have been generated and stored, a section of the ledger that needs time service authentication, which should contain at least one data block, or multiple blocks of highly continuous data.
  • the method of determination can be specified based on user operations. For example, the user initiates a timing instruction, which contains the starting block height and the number of blocks that need to be authenticated; it can also be specified by the user, and the server automatically performs it based on the preset business logic .
  • each data block can be applied for timing.
  • the root hash of the Merkel tree is the block hash value of the data block, which can protect the authenticity of the ledger (that is, each data block) to the greatest extent. Due to the high frequency of data block generation, this method has higher hardware requirements for the server.
  • An optional method is to set a certain preset time service condition, and initiate a time service request when the certain preset time service condition is met.
  • the preset time-serving condition may be: the number of data blocks to be time-served and authenticated reaches the threshold, or the time interval since the last time-service authentication has reached the time Threshold.
  • S303 Generate a Merkel tree corresponding to the target ledger according to the order of the block height of the data blocks in the target ledger, and determine the root hash of the Merkel tree based on the block hash of each data block;
  • the specific calculation method of the root hash is the conventional calculation method, which will not be repeated here.
  • the hash value of the data block is the root hash of the Merkel tree in the target ledger.
  • S305 Execute the pre-set time grab code in the trusted execution environment, obtain the trusted time, and generate a digital signature of the trusted execution environment on the trusted time and the root hash.
  • the time capture code is a piece of code that can be seen publicly, so that both the public and users can understand the purpose of the code, thereby ensuring the fairness of the credible time obtained in the embodiments of this specification.
  • the time capture code is used to obtain credible time from a credible timing agency, and the credible time refers to the time provided by an authoritative timing agency. For example, get Greenwich Mean Time from the webpage https://greenwichmeantime.com. As shown in Figure 4, Figure 4 is a schematic diagram of the time in the webpage provided by Greenwich. It should be noted that what is captured is a time value, not a screenshot. In addition, reliable time can also be obtained from other relevant institutions, for example, from the time service interface provided by the National Time Service Center.
  • TEE Trusted Execution Environment
  • Global Platform to solve the security isolation of resources on mobile devices, and parallel to the operating system to provide a trusted and secure execution environment for applications.
  • ARM's Trust Zone technology is the first to realize the real commercial TEE technology.
  • TEE has also been rapidly developed and expanded.
  • server chip manufacturers Intel, AMD, etc. have successively introduced hardware-assisted TEE and enriched the concept and characteristics of TEE, which has been widely recognized in the industry.
  • the TEE mentioned now usually refers to this kind of hardware-assisted TEE technology.
  • cloud access requires remote access, and the end user is invisible to the hardware platform. Therefore, the first step in using TEE is to confirm the authenticity of TEE.
  • the current TEE technology has introduced a remote certification mechanism, which is endorsed by hardware vendors (mainly CPU vendors) and digital signature technology ensures that users can verify the state of the TEE. In other words, the result of execution in TEE can be digitally signed by the hardware manufacturer.
  • TEEs including Intel SGX and AMD SEV, also provide memory encryption technology to limit trusted hardware to the inside of the CPU.
  • the data on the bus and memory are ciphertext to prevent malicious users from snooping.
  • Intel Software Protection Extensions (SGX) and other TEE technologies isolate code execution, remote attestation, secure configuration, secure storage of data, and trusted paths for code execution.
  • the applications running in the TEE are protected by security and are almost impossible to be accessed by third parties.
  • SGX provides an enclave (also called an enclave), which is an encrypted trusted execution area in the memory, and the CPU protects data from being stolen.
  • enclave also called an enclave
  • the CPU protects data from being stolen.
  • a part of the area EPC Enclave Page Cache, enclave page cache or enclave page cache
  • the encryption engine MEE in the CPU encrypts the data in it.
  • the encrypted content in EPC will be decrypted into plaintext only after entering the CPU. Therefore, in SGX, users can distrust the operating system, VMM (Virtual Machine Monitor), and even BIOS (Basic Input Output System). They only need to trust the CPU to ensure code execution.
  • the trusted time can be obtained by executing the public code in the trusted execution environment, so as to ensure the authenticity of the time obtained, and the trusted execution environment can check the trusted time and the aforementioned roots. Hope to sign digitally.
  • S307 Generate a time service certificate including the trusted time, root hash and digital signature.
  • the database server can generate a series of time service certificates containing trusted time.
  • the trusted time in each time service certificate is guaranteed by the trusted execution environment signature, and the root hash contained in the time service certificate It is possible to clarify the part of the account book corresponding to the time service certificate.
  • the database can perform corresponding management and verification based on the trusted time.
  • the database server can provide the corresponding trusted timestamp and signed timing certificate contained in the ledger, and perform the Merkel tree root based on the relevant information contained in the timing certificate.
  • Greek recalculation if the calculated root hash of the Merkel tree is consistent with the authorization certificate, it can be verified that the certificate is correct.
  • it can be confirmed from the trusted timestamp that the data block corresponding to the certificate cannot be forged in the future, which can effectively prevent the server and the served party from jointly manufacturing a ledger containing false timestamps to avoid corresponding audits.
  • the embodiments of the application execute the code that captures the credible time in a Trusted Execution Environment (TEE) to obtain the credible time, thereby realizing the root of the target ledger.
  • TEE Trusted Execution Environment
  • Xihe Trust Time performs digital signatures to ensure the credibility of the timestamp in the ledger, and users can verify based on the root hash of the data block at any time.
  • the obtained trusted time and digital signature may also be written into a certain data block in the target ledger, for example, written into the block header of the last data block in the target ledger.
  • each data block can store the trusted time corresponding to the data block containing the TEE signature, and the root hash at this time It is the block hash of the data block itself (it can be directly obtained based on its own data record and the block hash of the previous data block). In this way, it is realized that each data block in the ledger is time-served and authenticated, and the authenticity of each data block in the ledger is guaranteed.
  • the embodiment of the present specification also provides a time service authentication device for a block chain ledger, which is applied to a centralized database server that stores data through a block chain ledger, as shown in Figure 5, which is an implementation of this specification.
  • the example provides a schematic structural diagram of a block-chained ledger timing authentication device, including:
  • the determining module 501 determines the target account book that needs to be timed
  • the root hash generating module 503 generates a Merkel tree corresponding to the target ledger in the order of the block heights of the data blocks in the target ledger, and determines the Merkel tree based on the block hash of each data block Root hash
  • the trusted execution module 505 executes the pre-set time capture code in the trusted execution environment, obtains the trusted time, and generates a digital signature of the trusted execution environment on the trusted time and the root hash, where:
  • the time capture code is used to obtain trusted time from an interface provided by a trusted timing agency;
  • the generating module 507 generates a timing certificate including the trusted time, root hash and digital signature.
  • the device further includes a data block generation module 509, which is used to receive the data records to be stored and determine the hash value of each data record; when the preset blocking condition is reached, determine the data block to be written For each data record, generate the Nth data block containing the hash value of the data block and the data record, which specifically includes:
  • the hash value and block height of the initial data block are given based on a preset method
  • N>1 determine the hash value of the Nth data block according to the data records in the data block to be written and the hash value of the N-1th data block, and generate a hash containing the Nth data block The Nth data block of the value, each data record and the block time of the data block, where the block height of the data block increases monotonically based on the sequence of the block time.
  • the preset blocking condition includes: the number of data records to be stored reaches the number threshold; or, the time interval from the last blocking time reaches the time threshold.
  • the determining module 501 determines each newly generated data block as the target ledger; or, based on the starting block height and the number of blocks contained in the user's instruction, determines the target ledger that needs time service authentication.
  • the determining module 501 takes a newly generated ledger that meets the preset conditions of time service as the target ledger, and the preset conditions of time service include: when the newly generated data block reaches the threshold value; or, the time since the last time service authentication The time interval has reached the time threshold.
  • the trusted execution environment includes Intel SGX or AMD SEV or ARM Trustzone.
  • the device further includes a writing module 511, which writes the root hash, trusted time, and digital signature into a designated data block in the target ledger.
  • the embodiments of this specification also provide a computer device, which at least includes a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the processor implements the blocks shown in FIG. 3 when the program is executed.
  • Time service authentication method for chain ledger is a computer device that at least includes a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the processor implements the blocks shown in FIG. 3 when the program is executed.
  • the device may include a processor 1010, a memory 1020, an input/output interface 1030, a communication interface 1040, and a bus 1050.
  • the processor 1010, the memory 1020, the input/output interface 1030, and the communication interface 1040 realize the communication connection between each other in the device through the bus 1050.
  • the processor 1010 may be implemented in a general-purpose CPU (Central Processing Unit, central processing unit), microprocessor, application specific integrated circuit (Application Specific Integrated Circuit, ASIC), or one or more integrated circuits for execution related Program to implement the technical solutions provided in the embodiments of this specification.
  • a general-purpose CPU Central Processing Unit, central processing unit
  • microprocessor microprocessor
  • application specific integrated circuit Application Specific Integrated Circuit, ASIC
  • ASIC Application Specific Integrated Circuit
  • the memory 1020 may be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory, random access memory), static storage device, dynamic storage device, etc.
  • the memory 1020 may store an operating system and other application programs. When the technical solutions provided in the embodiments of the present specification are implemented through software or firmware, related program codes are stored in the memory 1020 and called and executed by the processor 1010.
  • the input/output interface 1030 is used to connect an input/output module to realize information input and output.
  • the input/output/module can be configured in the device as a component (not shown in the figure), or can be connected to the device to provide corresponding functions.
  • the input device may include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and an output device may include a display, a speaker, a vibrator, an indicator light, and the like.
  • the communication interface 1040 is used to connect a communication module (not shown in the figure) to realize the communication interaction between the device and other devices.
  • the communication module can realize communication through wired means (such as USB, network cable, etc.), or through wireless means (such as mobile network, WIFI, Bluetooth, etc.).
  • the bus 1050 includes a path to transmit information between various components of the device (for example, the processor 1010, the memory 1020, the input/output interface 1030, and the communication interface 1040).
  • the device may also include the necessary equipment for normal operation.
  • the above-mentioned device may also include only the components necessary to implement the solutions of the embodiments of the present specification, rather than all the components shown in the figures.
  • the embodiment of this specification also provides a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, the time service authentication method of the block chain ledger shown in FIG. 3 is realized.
  • Computer-readable media include permanent and non-permanent, removable and non-removable media, and information storage can be realized by any method or technology.
  • the information can be computer-readable instructions, data structures, program modules, or other data.
  • Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, CD-ROM, digital versatile disc (DVD) or other optical storage, Magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media can be used to store information that can be accessed by computing devices. According to the definition in this article, computer-readable media does not include transitory media, such as modulated data signals and carrier waves.
  • a typical implementation device is a computer.
  • the specific form of the computer can be a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email receiving and sending device, and a game control A console, a tablet computer, a wearable device, or a combination of any of these devices.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Databases & Information Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Data Mining & Analysis (AREA)
  • Computer Security & Cryptography (AREA)
  • Bioethics (AREA)
  • Computer Hardware Design (AREA)
  • General Health & Medical Sciences (AREA)
  • Health & Medical Sciences (AREA)
  • Computing Systems (AREA)
  • Storage Device Security (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

一种块链式账本的授时认证方法、装置及设备。该方法通过在可信执行环境(Trusted Execution Environment, TEE)执行抓取可信时间的代码，获取可信时间，从而实现对目标账本的根哈希和可信时间进行数字签名，保障了账本中时间戳的可信度，并且用户可以随时基于数据块的根哈希对验证。

Description

一种块链式账本的授时认证方法、装置及设备 技术领域
本说明书实施例涉及信息技术领域，尤其涉及一种块链式账本的授时认证方法、装置及设备。
背景技术
在以链式账本的方式对数据记录进行中心化的存储时，虽然服务方本身已经难以对数据进行直接修改，但此时，仍然存在用户或者企业与服务方联合作假的可能性。例如，为逃避审计，用户和服务方联合起来对于部分数据块进行了伪造，形成了一条难以验证的伪链。
基于此，需要一种可以保证账本真实性的授时认证方案。
发明内容
本申请实施例的目的是提供一种块链式账本中保障账本真实性的方法。
为解决上述技术问题，本申请实施例是这样实现的：
一种块链式账本的授时认证方法，应用于通过块链式账本存储数据的中心化的数据库服务端中，包括：
确定需要进行授时的目标账本；
按照所述目标账本中数据块的块高的顺序，生成对应于所述目标账本的默克尔树，基于各数据块的块哈希确定所述默克尔树的根哈希；
在可信执行环境中执行预先设定的时间抓取代码，获取可信时间，生成可信执行环境对所述可信时间和所述根哈希的数字签名，其中，所述时间抓取代码用于从可信授时机构所提供的界面中获取可信时间；
生成包含所述可信时间、根哈希和数字签名的授时证书。
对应的，本说明书实施例还提供一种块链式账本的授时认证装置，应用于通过块链式账本存储数据的中心化的数据库服务端中，包括：
确定模块，确定需要进行授时的目标账本；
根哈希生成模块，按照所述目标账本中数据块的块高的顺序，生成对应于所述目标账本的默克尔树，基于各数据块的块哈希确定所述默克尔树的根哈希；
可信执行模块，在可信执行环境中执行预先设定的时间抓取代码，获取可信时间，生成可信执行环境对所述可信时间和所述根哈希的数字签名，其中，所述时间抓取代码用于从可信授时机构所提供的界面中获取可信时间；
生成模块，生成包含所述可信时间、根哈希和数字签名的授时证书。
由以上本申请实施例提供的技术方案可见，本申请实施例通过在可信执行环境(Trusted Execution Environment,TEE)执行抓取可信时间的代码，获取可信时间，从而实现对目标账本的根哈希和可信时间进行数字签名，保障了账本中时间戳的可信度，并且用户可以随时基于数据块的根哈希对验证。
应当理解的是，以上的一般描述和后文的细节描述仅是示例性和解释性的，并不能限制本说明书实施例。
此外，本说明书实施例中的任一实施例并不需要达到上述的全部效果。
附图说明
为了更清楚地说明本说明书实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本说明书实施例中记载的一些实施例，对于本领域普通技术人员来讲，还可以根据这些附图获得其他的附图。
图1为本说明书实施例所提供的一种关于块头的示意图；
图2为本说明书实施例所提供的一种伪链的示意图；
图3是本说明书实施例提供的一种块链式账本的授时认证方法；
图4为格林威治所提供的网页中时间的一个示意图；
图5是本说明书实施例提供的一种块链式账本的授时认证装置的结构示意图；
图6是用于配置本说明书实施例方法的一种设备的结构示意图。
具体实施方式
为了使本领域技术人员更好地理解本说明书实施例中的技术方案，下面将结合本说 明书实施例中的附图，对本说明书实施例中的技术方案进行详细地描述，显然，所描述的实施例仅仅是本说明书的一部分实施例，而不是全部的实施例。基于本说明书中的实施例，本领域普通技术人员所获得的所有其他实施例，都应当属于保护的范围。
首先对本说明书实施例所提供的块链式账本进行说明，在本说明书实施例所涉及中心化的数据库系统中，数据块可以通过如下方式预先生成：
接收待存储的数据记录，确定各数据记录的哈希值。此处的待存储的数据记录，可以是客户端个人用户的各种消费记录，也可以是应用服务器基于用户的指令，在执行业务逻辑时产生的业务结果、中间状态以及操作记录等等。具体的业务场景可以包括消费记录、审计日志、供应链条、政府监管记录、医疗记录等等。
当达到预设的成块条件时，确定待写入数据块中的各数据记录，生成包含数据块的哈希值和数据记录的第N个数据块。
所述预设的成块条件包括：待存储的数据记录数量达到数量阈值，例如，每接收到一千条数据记录时，生成一个新数据块，将一千条数据记录写入块中；或者，距离上一次成块时刻的时间间隔达到时间阈值，例如，每隔5分钟，生成一个新数据块，将在这5分钟内接收到的数据记录写入块中。
此处的N指的是数据块的序号，换言之，在本说明书实施例中，数据块是以块链的形式，基于成块时间的顺序先后排列，具有很强的时序特征。其中，数据块的块高基于成块时间的先后顺序单调递增。块高可以是序号，此时第N个数据块的块高即为N；块高也可以其它方式生成。
当N＝1时，即此时的数据块为为初始数据块。初始数据块的哈希值和块高基于预设方式给定。例如，初始数据块中不包含数据记录，哈希值则为任一给定的哈希值，块高blknum＝0；又例如，初始数据块的生成触发条件与其它数据块的触发条件一致，但是初始数据块的哈希值由对初始数据块中的所有内容取哈希确定。
当N>1时，由于前一数据块的内容和哈希值已经确定，则此时，可以基于前一数据块(即第N－1个数据块)的哈希值生成当前数据块(第N个数据块)的哈希值，例如，一种可行的方式为，确定每一条将要写入第N个块中的数据记录的哈希值，按照在块中的排列顺序，生成一个默克尔树，将默克尔树的根哈希值和前一数据块的哈希值拼接在一起，再次采用哈希算法，生成当前块的哈希值，以及还可以根据默克尔树的根哈希值和其它一些元数据(例如版本号、数据块的生成时间戳等等)生成当前快的哈希值。又 例如，还可以按照块中数据记录的顺序进行拼接并取哈希得到整体数据记录的哈希值，拼接前一数据块的哈希值和整体数据记录的哈希值，并对拼接得到的字串进行哈希运算，生成数据块的哈希值。
通过前述的数据块的生成方式，每一个数据块通过哈希值确定，数据块的哈希值由数据块中的数据记录的内容、顺序以及前一数据块的哈希值决定。用户可以随时基于数据块的哈希值或者数据记录的哈希值发起验证，对于数据块中任何内容(包括对于数据块中数据记录内容或者顺序的修改)的修改都会造成在验证时计算得到的数据块的哈希值和数据块生成时的哈希值不一致，而导致验证失败，从而实现了中心化下的不可篡改。
在本说明书实施例中，数据块的格式是可以自定义的。在一种实施例中，数据块的格式可以是类似于区块链中的区块格式。在每一个数据块中，其包含用于存储元数据的块头，和，用于存储数据记录的块体。数据块中的块头可以用于存储诸如父哈希、自身的块哈希值、版本号、数据记录的根哈希、时间戳等等。如图1所示，图1为本说明书实施例所提供的一种关于块头的示意图，当然，块头的格式是可以基于业务需要进行自定义的，其还可以包含一些其它的信息，例如，用于描述数据记录状态的状态数组，以及，还可以存储在本说明书书实施例所提供的可信时间、目标账本的根哈希等等。而块体中则用于存储数据记录的明文或者数据记录的哈希值。
在上述方式中，仍然有可能用户和服务方联合起来对于部分数据块进行了伪造，重新生成一条相关的伪链，从而形成一个与原账本部分相同的新的账本，以躲避相关的审计和验证。如图2所示，图2为本说明书实施例所提供的一种伪链的示意图。在生成伪链的过程中，数据块的成块方式和前述的成块方式相同。
在该示意图中，在账本已经记录了很多数据块之后，业务方认为第1000个数据块中的数据记录有问题，因此，为了不暴露该问题，其和数据库服务方联合起来，从第1000个数据块开始对数据块进行了替换，重新生成一个新的第1000个数据块，接在第999个数据块之后，形成一条与原账本部分相同的伪链，以躲避验证和审计，而在外部第三方而言并不能识别出伪链和真链。
基于此，本说明书实施例提供一种基于可信执行环境(Trusted Execution Environment,TEE)对块链式账本进行授时认证的方案，如图3所示，图3是本说明书实施例提供的一种块链式账本的授时认证方法，应用于通过块链式账本存储数据的中心化的数据库服务端中，该流程具体包括如下步骤：
S301，确定需要进行授时的目标账本。
如前所述，在所述链式账本中，除初始数据块以外，每一数据块中包含至少一条数据记录，每一数据块中包含由前一数据块的哈希值和自身所包含的数据记录确定的自身数据块的哈希值，数据块的块高基于成块时间的先后顺序单调递增。
具体而言，服务方首先从已经生成并存储的数据块中确定出需要进行授时认证的一段账本，其中至少应该包含一个数据块，或者多个块高连续的数据块。确定的方式可以基于用户操作进行指定，例如，用户发起授时指令，指令中包含需要进行授时认证的起始块高和块数量；也可以是无需用户指定，服务方基于预设的业务逻辑自动进行。
例如，从最细粒度上，可以每一个数据块都去申请授时。在这种方式下，默克尔树的根哈希即为该数据块的块哈希值，该方式可以最大程度的对账本(即各数据块)进行真实性的保护。由于数据块的出块频率较高，这种方式对于服务端的硬件要求会比较高。
一种可选的方式为，设置一定的授时预设条件，当满足一定的授时预设条件时，发起授时请求。在新生成的数据块都认为是待授时认证的数据块时，所述的授时预设条件可以是：待授时认证的数据块达到数量阈值，或者，距离上一次授时认证的时间间隔已经到达时间阈值。
S303，按照所述目标账本中数据块的块高的顺序，生成对应于所述目标账本的默克尔树，基于各数据块的块哈希确定所述默克尔树的根哈希；
具体的根哈希的计算方式即为常规的计算方式，此处不再赘述。在目标账本中只有一个数据块时，数据块的哈希值即为目标账本中的默克尔树的根哈希。
S305，在可信执行环境中执行预先设定的时间抓取代码，获取可信时间，生成可信执行环境对所述可信时间和所述根哈希的数字签名。
时间抓取代码是一段可以公开所见的代码，从而公众以及用户均可以了解该代码的用途，进而保证在本说明书实施例中所得到的可信时间的公正性。
时间抓取代码用于从可信授时机构获取可信时间，所述可信时间指的是权威授时机构所提供的时间。例如，从网页https://greenwichmeantime.com中获取格林威治标准时间。如图4所示，图4为格林威治所提供的网页中时间的一个示意图。需要说明的是，抓取得到的是一个时间值，而不是一个截图。此外，还可以从其它相关机构获取可信时间，例如，国家授时中心所提供的授时界面中获取。
可信执行环境(Trusted Execution Environment,TEE)是基于CPU硬件的安全扩展，且与外部完全隔离的可信执行环境。TEE最早是由Global Platform提出的概念，用于解决移动设备上资源的安全隔离，平行于操作系统为应用程序提供可信安全的执行环境。ARM的Trust Zone技术最早实现了真正商用的TEE技术。
伴随着互联网的高速发展，安全的需求越来越高，不仅限于移动设备，云端设备，数据中心都对TEE提出了更多的需求。TEE的概念也得到了高速的发展和扩充。现在所说的TEE相比与最初提出的概念已经是更加广义的TEE。例如，服务器芯片厂商Intel，AMD等都先后推出了硬件辅助的TEE并丰富了TEE的概念和特性，在工业界得到了广泛的认可。现在提起的TEE通常更多指这类硬件辅助的TEE技术。不同于移动端，云端访问需要远程访问，终端用户对硬件平台不可见，因此使用TEE的第一步就是要确认TEE的真实可信。因此现在的TEE技术都引入了远程证明机制，由硬件厂商(主要是CPU厂商)背书并通过数字签名技术确保用户对TEE状态可验证。换言之，在TEE中执行的结果可以得到硬件厂商的数字签名。
同时仅仅是安全的资源隔离也无法满足的安全需求，进一步的数据隐私保护也被提出。包括Intel SGX，AMD SEV在内的商用TEE也都提供了内存加密技术，将可信硬件限定在CPU内部，总线和内存的数据均是密文防止恶意用户进行窥探。例如，英特尔的软件保护扩展(SGX)等TEE技术隔离了代码执行、远程证明、安全配置、数据的安全存储以及用于执行代码的可信路径。在TEE中运行的应用程序受到安全保护，几乎不可能被第三方访问。
以Intel SGX技术为例，SGX提供了围圈(enclave，也称为飞地)，即内存中一个加密的可信执行区域，由CPU保护数据不被窃取。以服务端采用支持SGX的CPU为例，利用新增的处理器指令，在内存中可以分配一部分区域EPC(Enclave Page Cache，围圈页面缓存或飞地页面缓存)，通过CPU内的加密引擎MEE(Memory Encryption Engine)对其中的数据进行加密。EPC中加密的内容只有进入CPU后才会被解密成明文。因此，在SGX中，用户可以不信任操作系统、VMM(Virtual Machine Monitor，虚拟机监控器)、甚至BIOS(Basic Input Output System，基本输入输出系统)，只需要信任CPU便能确保代码的执行。
实际应用中，通过在可信执行环境中执行公开的代码以获取可信时间，从而可以保证获取得到的时间的真实性，并且，可信执行环境可以对所述可信时间以及前述的根哈希进行数字签名。
S307，生成包含所述可信时间、根哈希和数字签名的授时证书。
通过前述方式，数据库服务端可以生成一系列的包含可信时间的授时证书，每一个授时证书中的可信时间是由可信执行环境签名所保障，而通过授时证书中所包含的根哈希可以明确该授时证书所对应的部分账本。数据库则可以基于该可信时间进行相应的管理以及验证。
例如，在需要对某账本进行审计时，数据库服务端可以给出账本中相应的包含的可信时间戳和签名的授时证书，并且根据授时证书中所包含的相关信息进行默克尔树根哈希的重新计算，如果计算得到的默克尔树根哈希与授权证书中的一致，则可以验证该段证书是正确无误的。并且，从可信时间戳上还可以确认该证书所对应的数据块是不可能被日后伪造的，可以有效防止服务方和被服务方联合制造包含虚假时间戳的账本，以躲避相应的审计。
以上本申请实施例提供的技术方案可见，本申请实施例通过在可信执行环境(Trusted Execution Environment,TEE)执行抓取可信时间的代码，获取可信时间，从而实现对目标账本的根哈希和可信时间进行数字签名，保障了账本中时间戳的可信度，并且用户可以随时基于数据块的根哈希对验证。
在一种实施例中，还可以将获取得到的可信时间和数字签名写入目标账本中的某个数据块中，例如，写入目标账本中最后一个数据块的块头中。
在这种方式下，如果每一个数据块都被视为目标账本时，则每一个数据块都中都可以保存有该数据块所对应的包含TEE签名的可信时间，此时的根哈希即为该数据块自身的块哈希(可以基于自身的数据记录和前一数据块的块哈希直接得到)。在这种方式下，实现了对账本中的每一个数据块均进行了授时认证，保障了账本中每一个数据块的真实性。
对应的，本说明书实施例还提供一种块链式账本的授时认证装置，应用于通过块链式账本存储数据的中心化的数据库服务端中，如图5所示，图5是本说明书实施例提供的一种块链式账本的授时认证装置的结构示意图，包括：
确定模块501，确定需要进行授时的目标账本；
根哈希生成模块503，按照所述目标账本中数据块的块高的顺序，生成对应于所述目标账本的默克尔树，基于各数据块的块哈希确定所述默克尔树的根哈希；
可信执行模块505，在可信执行环境中执行预先设定的时间抓取代码，获取可信时 间，生成可信执行环境对所述可信时间和所述根哈希的数字签名，其中，所述时间抓取代码用于从可信授时机构所提供的界面中获取可信时间；
生成模块507，生成包含所述可信时间、根哈希和数字签名的授时证书。
进一步地，所述装置还包括数据块生成模块509，用于接收待存储的数据记录，确定各数据记录的哈希值；当达到预设的成块条件时，确定待写入数据块中的各数据记录，生成包含数据块的哈希值和数据记录的第N个数据块，具体包括：
当N＝1时，初始数据块的哈希值和块高基于预设方式给定；
当N>1时，根据待写入数据块中的各数据记录和第N－1个数据块的哈希值确定第N个数据块的哈希值，生成包含第N个数据块的哈希值、各数据记录和数据块的成块时间的第N个数据块，其中，数据块的块高基于成块时间的先后顺序单调递增。
进一步地，在所述装置中，所述预设的成块条件包括：待存储的数据记录数量达到数量阈值；或者，距离上一次成块时刻的时间间隔达到时间阈值。
进一步地，所述确定模块501，将每一个新出的数据块确定为目标账本；或者，基于用户的指令所包含的起始块高和块数量，确定需要进行授时认证的目标账本。
进一步地，所述确定模块501，将符合授时预设条件内的新生成的账本作为目标账本，所述授时预设条件包括：新生成的数据块达到数量阈值时；或者，距离上一次授时认证的时间间隔已经到达时间阈值。
进一步地，在所述装置中，所述可信执行环境包括Intel SGX或AMD SEV或ARM Trustzone。
进一步地，所述装置还包括写入模块511，将所述根哈西、可信时间和数字签名写入所述目标账本中指定数据块中。
本说明书实施例还提供一种计算机设备，其至少包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，其中，处理器执行所述程序时实现图3所示的块链式账本的授时认证方法。
图6示出了本说明书实施例所提供的一种更为具体的计算设备硬件结构示意图，该设备可以包括：处理器1010、存储器1020、输入/输出接口1030、通信接口1040和总线1050。其中处理器1010、存储器1020、输入/输出接口1030和通信接口1040通过总线1050实现彼此之间在设备内部的通信连接。
处理器1010可以采用通用的CPU(Central Processing Unit，中央处理器)、微处理器、应用专用集成电路(Application Specific Integrated Circuit，ASIC)、或者一个或多个集成电路等方式实现，用于执行相关程序，以实现本说明书实施例所提供的技术方案。
存储器1020可以采用ROM(Read Only Memory，只读存储器)、RAM(Random Access Memory，随机存取存储器)、静态存储设备，动态存储设备等形式实现。存储器1020可以存储操作系统和其他应用程序，在通过软件或者固件来实现本说明书实施例所提供的技术方案时，相关的程序代码保存在存储器1020中，并由处理器1010来调用执行。
输入/输出接口1030用于连接输入/输出模块，以实现信息输入及输出。输入输出/模块可以作为组件配置在设备中(图中未示出)，也可以外接于设备以提供相应功能。其中输入设备可以包括键盘、鼠标、触摸屏、麦克风、各类传感器等，输出设备可以包括显示器、扬声器、振动器、指示灯等。
通信接口1040用于连接通信模块(图中未示出)，以实现本设备与其他设备的通信交互。其中通信模块可以通过有线方式(例如USB、网线等)实现通信，也可以通过无线方式(例如移动网络、WIFI、蓝牙等)实现通信。
总线1050包括一通路，在设备的各个组件(例如处理器1010、存储器1020、输入/输出接口1030和通信接口1040)之间传输信息。
需要说明的是，尽管上述设备仅示出了处理器1010、存储器1020、输入/输出接口1030、通信接口1040以及总线1050，但是在具体实施过程中，该设备还可以包括实现正常运行所必需的其他组件。此外，本领域的技术人员可以理解的是，上述设备中也可以仅包含实现本说明书实施例方案所必需的组件，而不必包含图中所示的全部组件。
本说明书实施例还提供一种计算机可读存储介质，其上存储有计算机程序，该程序被处理器执行时实现图3所示的块链式账本的授时认证方法。
计算机可读介质包括永久性和非永久性、可移动和非可移动媒体可以由任何方法或技术来实现信息存储。信息可以是计算机可读指令、数据结构、程序的模块或其他数据。计算机的存储介质的例子包括，但不限于相变内存(PRAM)、静态随机存取存储器(SRAM)、动态随机存取存储器(DRAM)、其他类型的随机存取存储器(RAM)、只读存储器(ROM)、电可擦除可编程只读存储器(EEPROM)、快闪记忆体或其他内存技术、只读光盘只读存储器(CD-ROM)、数字多功能光盘(DVD)或其他光学存储、磁盒式磁带，磁带磁磁盘存储或其他磁性存储设备或任何其他非传输介质，可用于 存储可以被计算设备访问的信息。按照本文中的界定，计算机可读介质不包括暂存电脑可读媒体(transitory media)，如调制的数据信号和载波。
通过以上的实施方式的描述可知，本领域的技术人员可以清楚地了解到本说明书实施例可借助软件加必需的通用硬件平台的方式来实现。基于这样的理解，本说明书实施例的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品可以存储在存储介质中，如ROM/RAM、磁碟、光盘等，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本说明书实施例各个实施例或者实施例的某些部分所述的方法。
上述实施例阐明的系统、方法、模块或单元，具体可以由计算机芯片或实体实现，或者由具有某种功能的产品来实现。一种典型的实现设备为计算机，计算机的具体形式可以是个人计算机、膝上型计算机、蜂窝电话、相机电话、智能电话、个人数字助理、媒体播放器、导航设备、电子邮件收发设备、游戏控制台、平板计算机、可穿戴设备或者这些设备中的任意几种设备的组合。
本说明书中的各个实施例均采用递进的方式描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。尤其，对于方法实施例而言，由于其基本相似于方法实施例，所以描述得比较简单，相关之处参见方法实施例的部分说明即可。以上所描述的方法实施例仅仅是示意性的，其中所述作为分离部件说明的模块可以是或者也可以不是物理上分开的，在实施本说明书实施例方案时可以把各模块的功能在同一个或多个软件和/或硬件中实现。也可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。本领域普通技术人员在不付出创造性劳动的情况下，即可以理解并实施。
以上所述仅是本说明书实施例的具体实施方式，应当指出，对于本技术领域的普通技术人员来说，在不脱离本说明书实施例原理的前提下，还可以做出若干改进和润饰，这些改进和润饰也应视为本说明书实施例的保护范围。

Claims (15)

  1. 一种块链式账本的授时认证方法，应用于通过块链式账本存储数据的中心化的数据库服务端中，包括：
    确定需要进行授时的目标账本；
    按照所述目标账本中数据块的块高的顺序，生成对应于所述目标账本的默克尔树，基于各数据块的块哈希确定所述默克尔树的根哈希；
    在可信执行环境中执行预先设定的时间抓取代码，获取可信时间，生成可信执行环境对所述可信时间和所述根哈希的数字签名，其中，所述时间抓取代码用于从可信授时机构所提供的界面中获取可信时间；
    生成包含所述可信时间、根哈希和数字签名的授时证书。
  2. 如权利要求1所述的方法，在中心化的数据库服务端，块链式账本中的数据块通过如下方式预先生成：
    接收待存储的数据记录，确定各数据记录的哈希值；
    当达到预设的成块条件时，确定待写入数据块中的各数据记录，生成包含数据块的哈希值和数据记录的第N个数据块，具体包括：
    当N＝1时，初始数据块的哈希值和块高基于预设方式给定；
    当N>1时，根据待写入数据块中的各数据记录和第N－1个数据块的哈希值确定第N个数据块的哈希值，生成包含第N个数据块的哈希值、各数据记录和数据块的成块时间的第N个数据块，其中，数据块的块高基于成块时间的先后顺序单调递增。
  3. 如权利要求2所述的方法，所述预设的成块条件包括：
    待存储的数据记录数量达到数量阈值；或者，
    距离上一次成块时刻的时间间隔达到时间阈值。
  4. 如权利要求1所述的方法，确定需要进行授时认证的目标账本，包括：
    将每一个新出的数据块确定为目标账本；或者，
    基于用户的指令所包含的起始块高和块数量，确定需要进行授时认证的目标账本。
  5. 如权利要求1所述的方法，确定需要进行授时认证的目标账本，包括：
    将符合授时预设条件内的新生成的账本作为目标账本，所述授时预设条件包括：新生成的数据块达到数量阈值时；或者，距离上一次授时认证的时间间隔已经到达时间阈值。
  6. 如权利要求1所述的方法，所述可信执行环境包括Intel SGX或AMD SEV或ARM Trustzone。
  7. 如权利要求1所述的方法，在生成包含所述可信时间、根哈希和数字签名的授时证书之前，所述方法还包括：
    将所述根哈希、可信时间和数字签名写入所述目标账本中指定数据块中。
  8. 一种块链式账本的授时认证装置，应用于通过块链式账本存储数据的中心化的数据库服务端中，包括：
    确定模块，确定需要进行授时的目标账本；
    根哈希生成模块，按照所述目标账本中数据块的块高的顺序，生成对应于所述目标账本的默克尔树，基于各数据块的块哈希确定所述默克尔树的根哈希；
    可信执行模块，在可信执行环境中执行预先设定的时间抓取代码，获取可信时间，生成可信执行环境对所述可信时间和所述根哈希的数字签名，其中，所述时间抓取代码用于从可信授时机构所提供的界面中获取可信时间；
    生成模块，生成包含所述可信时间、根哈希和数字签名的授时证书。
  9. 如权利要求8所述的装置，还包括数据块生成模块，用于
    接收待存储的数据记录，确定各数据记录的哈希值；当达到预设的成块条件时，确定待写入数据块中的各数据记录，生成包含数据块的哈希值和数据记录的第N个数据块，具体包括：
    当N＝1时，初始数据块的哈希值和块高基于预设方式给定；
    当N>1时，根据待写入数据块中的各数据记录和第N－1个数据块的哈希值确定第N个数据块的哈希值，生成包含第N个数据块的哈希值、各数据记录和数据块的成块时间的第N个数据块，其中，数据块的块高基于成块时间的先后顺序单调递增。
  10. 如权利要求9所述的装置，所述预设的成块条件包括：
    待存储的数据记录数量达到数量阈值；或者，
    距离上一次成块时刻的时间间隔达到时间阈值。
  11. 如权利要求8所述的装置，所述确定模块，将每一个新出的数据块确定为目标账本；或者，基于用户的指令所包含的起始块高和块数量，确定需要进行授时认证的目标账本。
  12. 如权利要求8所述的装置，所述确定模块，将符合授时预设条件内的新生成的账本作为目标账本，所述授时预设条件包括：新生成的数据块达到数量阈值时；或者，距离上一次授时认证的时间间隔已经到达时间阈值。
  13. 如权利要求8所述的装置，所述可信执行环境包括Intel SGX或AMD SEV或ARM Trustzone。
  14. 如权利要求8所述的装置，还包括写入模块，将所述根哈西、可信时间和数字签名写入所述目标账本中指定数据块中。
  15. 一种计算机设备，包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，其中，所述处理器执行所述程序时实现如权利要求1至7任一项所述的方法。
PCT/CN2020/071295 2019-06-03 2020-01-10 一种块链式账本的授时认证方法、装置及设备 Ceased WO2020244236A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
US16/803,237 US10778452B2 (en) 2019-06-03 2020-02-27 Blockchain ledger authentication
US16/945,707 US10911251B2 (en) 2019-06-03 2020-07-31 Blockchain ledger authentication
US17/164,748 US11108573B2 (en) 2019-06-03 2021-02-01 Blockchain ledger authentication

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910476244.X 2019-06-03
CN201910476244.XA CN110347745B (zh) 2019-06-03 2019-06-03 一种块链式账本的授时认证方法、装置及设备

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/803,237 Continuation US10778452B2 (en) 2019-06-03 2020-02-27 Blockchain ledger authentication

Publications (1)

Publication Number Publication Date
WO2020244236A1 true WO2020244236A1 (zh) 2020-12-10

Family

ID=68181442

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/071295 Ceased WO2020244236A1 (zh) 2019-06-03 2020-01-10 一种块链式账本的授时认证方法、装置及设备

Country Status (2)

Country Link
CN (2) CN112487084B (zh)
WO (1) WO2020244236A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114329622A (zh) * 2021-12-20 2022-04-12 北京信安世纪科技股份有限公司 一种文件保护方法、验证方法、装置、设备和介质
CN120408568A (zh) * 2025-04-30 2025-08-01 湖北云雷信息技术有限公司 一种基于区块链的数字版权存证方法、电子设备以及可读存储介质

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112487084B (zh) * 2019-06-03 2024-08-09 创新先进技术有限公司 一种块链式账本的授时认证方法、装置及设备
US10778452B2 (en) 2019-06-03 2020-09-15 Alibaba Group Holding Limited Blockchain ledger authentication
CN112364389B (zh) * 2021-01-12 2021-04-06 支付宝(杭州)信息技术有限公司 一种基于可信账本数据库的业务记录授时方法
CN117914868B (zh) * 2022-10-11 2026-01-13 抖音视界有限公司 一种数据处理方法、装置、设备及存储介质
CN115935386B (zh) 2022-12-05 2026-01-09 北京火山引擎科技有限公司 数据处理方法、装置和计算机可读存储介质
CN119989425B (zh) * 2025-04-15 2025-07-29 法正智能科技有限公司 一种基于区块链的招投标数据安全处理方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150363594A1 (en) * 2014-06-12 2015-12-17 Nagravision Sa System and method for secure loading data in a cache memory
CN105790954A (zh) * 2016-03-02 2016-07-20 布比（北京）网络技术有限公司 一种构建电子证据的方法和系统
CN109492431A (zh) * 2018-10-31 2019-03-19 国网河南省电力公司信息通信公司 财务数据的存储方法及其系统和电子设备
CN109741039A (zh) * 2019-01-07 2019-05-10 深圳市红砖坊技术有限公司 记账方法、矿池服务器、终端设备、挖矿节点及矿池
CN110347745A (zh) * 2019-06-03 2019-10-18 阿里巴巴集团控股有限公司 一种块链式账本的授时认证方法、装置及设备

Family Cites Families (18)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5422953A (en) * 1993-05-05 1995-06-06 Fischer; Addison M. Personal date/time notary device
US20030163692A1 (en) * 2002-01-31 2003-08-28 Brocade Communications Systems, Inc. Network security and applications to the fabric
JP2005094146A (ja) * 2003-09-12 2005-04-07 Nippon Telegr & Teleph Corp <Ntt> バルク型時刻認証要求用プログラム、及びバルク型時刻認証要求用記録媒体、並びに、検証装置、検証方法、検証用プログラム、及び検証用記録媒体
US9292712B2 (en) * 2012-09-28 2016-03-22 St-Ericsson Sa Method and apparatus for maintaining secure time
US9530010B2 (en) * 2013-11-07 2016-12-27 Fujitsu Limited Energy usage data management
US9705892B2 (en) * 2014-06-27 2017-07-11 Intel Corporation Trusted time service for offline mode
US10204341B2 (en) * 2016-05-24 2019-02-12 Mastercard International Incorporated Method and system for an efficient consensus mechanism for permissioned blockchains using bloom filters and audit guarantees
KR101841566B1 (ko) * 2016-10-11 2018-05-04 주식회사 코인플러그 블록체인 내의 블록별로 발란스 데이터베이스를 관리하여 전자 바우처를 발행, 사용, 환불, 정산 및 파기하는 방법과 이를 이용한 서버
CN106850200B (zh) * 2017-01-25 2019-10-22 中钞信用卡产业发展有限公司杭州区块链技术研究院 一种使用基于区块链的数字货币的安全方法、系统及终端
CN107274159B (zh) * 2017-06-09 2024-07-12 北京泛融科技有限公司 一种基于区块并发执行算法的记账系统及方法
CN107819777B (zh) * 2017-11-17 2020-07-24 利姆斯(北京)区块链技术有限公司 一种基于区块链技术的数据存证方法及系统
CN108009445B (zh) * 2017-11-30 2021-05-11 成都蓝海贝信息技术有限公司 一种半中心化的可信数据管理系统
CN108280328A (zh) * 2018-01-31 2018-07-13 北京安妮全版权科技发展有限公司 基于数字签名和授时的版权确权方法及装置
CN108809467A (zh) * 2018-05-22 2018-11-13 深圳华博高科光电技术有限公司 监控图片认证的方法、装置及计算机可读存储介质
CN109034805B (zh) * 2018-08-09 2022-09-02 江苏先安科技有限公司 一种适用于区块链和嵌入式领域的时间戳签名验证方法
CN109508984B (zh) * 2018-11-26 2021-09-07 中国科学院软件研究所 一种基于确定性共识与可信时间戳的区块链电子存证方法
CN109785130B (zh) * 2018-12-17 2021-05-28 金蝶软件（中国）有限公司 区块链随机共识方法、装置、计算机设备和存储介质
CN109447807A (zh) * 2019-01-25 2019-03-08 杨城 数字银行的总分双链的弱中心化可信数据管理系统及方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150363594A1 (en) * 2014-06-12 2015-12-17 Nagravision Sa System and method for secure loading data in a cache memory
CN105790954A (zh) * 2016-03-02 2016-07-20 布比（北京）网络技术有限公司 一种构建电子证据的方法和系统
CN109492431A (zh) * 2018-10-31 2019-03-19 国网河南省电力公司信息通信公司 财务数据的存储方法及其系统和电子设备
CN109741039A (zh) * 2019-01-07 2019-05-10 深圳市红砖坊技术有限公司 记账方法、矿池服务器、终端设备、挖矿节点及矿池
CN110347745A (zh) * 2019-06-03 2019-10-18 阿里巴巴集团控股有限公司 一种块链式账本的授时认证方法、装置及设备

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114329622A (zh) * 2021-12-20 2022-04-12 北京信安世纪科技股份有限公司 一种文件保护方法、验证方法、装置、设备和介质
CN120408568A (zh) * 2025-04-30 2025-08-01 湖北云雷信息技术有限公司 一种基于区块链的数字版权存证方法、电子设备以及可读存储介质

Also Published As

Publication number Publication date
CN110347745A (zh) 2019-10-18
CN112487084A (zh) 2021-03-12
CN110347745B (zh) 2020-10-02
CN112487084B (zh) 2024-08-09

Similar Documents

Publication Publication Date Title
US11108573B2 (en) Blockchain ledger authentication
CN110347745B (zh) 一种块链式账本的授时认证方法、装置及设备
TWI740388B (zh) 基於可信執行環境的操作記錄儲存方法、裝置及設備
TWI727594B (zh) 塊鏈式帳本中的簽名驗證方法、系統、裝置及設備
US11283622B2 (en) Signature verification for a blockchain ledger
TWI725709B (zh) 資料儲存方法、裝置及設備
US10783277B2 (en) Blockchain-type data storage
WO2020199708A1 (zh) 一种针对授时证书生成请求的监控方法、装置及设备
US20200210314A1 (en) Method, apparatus, and device for storing operation record based on trusted execution environment
WO2020233149A1 (zh) 一种块链式账本中的授时认证方法、装置及设备
CN110851851B (zh) 一种块链式账本中的权限管理方法、装置及设备
CN111292082B (zh) 一种块链式账本中的公钥管理方法、装置及设备
HK40046899A (zh) 一种块链式账本的授时认证方法、装置及设备
HK40015734B (zh) 一种块链式账本的授时认证方法、装置及设备
HK40015734A (zh) 一种块链式账本的授时认证方法、装置及设备
HK40046899B (zh) 一种块链式账本的授时认证方法、装置及设备
CN112380573B (zh) 一种块链式账本中的数字签名方法、装置及设备
HK40029449B (zh) 一种块链式账本中的公钥管理方法、装置及设备
HK40029449A (zh) 一种块链式账本中的公钥管理方法、装置及设备
HK40017473B (zh) 基於可信执行环境的操作记录存储方法、装置及设备
HK40017473A (zh) 基於可信执行环境的操作记录存储方法、装置及设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20819486

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20819486

Country of ref document: EP

Kind code of ref document: A1