WO2021129004A1 - 一种基于智能合约的区块链数据访问控制方法及装置 - Google Patents

一种基于智能合约的区块链数据访问控制方法及装置 Download PDF

Info

Publication number
WO2021129004A1
WO2021129004A1 PCT/CN2020/117172 CN2020117172W WO2021129004A1 WO 2021129004 A1 WO2021129004 A1 WO 2021129004A1 CN 2020117172 W CN2020117172 W CN 2020117172W WO 2021129004 A1 WO2021129004 A1 WO 2021129004A1
Authority
WO
WIPO (PCT)
Prior art keywords
transaction
blockchain
institution
state
hash value
Prior art date
Application number
PCT/CN2020/117172
Other languages
English (en)
French (fr)
Inventor
王贺贺
许玉壮
朱涛
周钰
Original Assignee
中国银联股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中国银联股份有限公司 filed Critical 中国银联股份有限公司
Priority to EP20904718.2A priority Critical patent/EP3968199B1/en
Priority to US17/595,767 priority patent/US11687921B2/en
Publication of WO2021129004A1 publication Critical patent/WO2021129004A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3827—Use of message hashing
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
    • G06Q40/04—Trading; Exchange, e.g. stocks, commodities, derivatives or currency exchange
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/27—Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
    • G06F21/645—Protecting data integrity, e.g. using checksums, certificates or signatures using a third party
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3821—Electronic credentials
    • G06Q20/38215—Use of certificates or encrypted proofs of transaction rights
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/401—Transaction verification
    • G06Q20/4014—Identity check for transactions
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/407—Cancellation of a transaction
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/108—Network architectures or network communication protocols for network security for controlling access to devices or network resources when the policy decisions are valid for a limited amount of time
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3239—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3297—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving time stamps, e.g. generation of time stamps
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/50—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using hash chains, e.g. blockchains or hash trees
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2137—Time limited access, e.g. to a computer or data
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
    • G06Q40/08—Insurance

Definitions

  • the embodiments of the present invention relate to the technical field of data processing, and in particular to a method and device for controlling access to blockchain data based on smart contracts.
  • the embodiment of the present invention provides a block chain data access control method and device based on smart contracts, which are used to improve the control effect of adding nodes after control to access the data before adding.
  • an embodiment of the present invention provides a blockchain data access control method based on smart contracts, including:
  • the blockchain node obtains an institution access operation request, the access operation request includes the transaction identifier of the accessed transaction;
  • the blockchain node determines the blockchain state corresponding to the transaction identifier according to the transaction identifier; the blockchain state includes the hash of the transaction corresponding to the last change in the blockchain state. )value;
  • the blockchain node performs data access control on the institution according to the hash value of the transaction corresponding to the last change in the blockchain state and the identity of the institution to obtain the control result;
  • the blockchain node sends the control result to the institution.
  • the blockchain node can obtain the time stamp of the corresponding transaction data and the joining time of the institution through the identity of the institution and the hash value of the transaction when the state occurred last time, so as to compare the time stamp and the joining time of the institution based on the time stamp and the joining time of the institution.
  • the organization's data access control can improve the control effect of the later joining nodes to access the data before joining, and improve the control efficiency.
  • the blockchain node performs data access control on the institution based on the hash value of the transaction corresponding to the last change in the blockchain state and the identity of the institution to obtain the control result, including:
  • the blockchain node determines the timestamp of the block corresponding to the hash value according to the hash value of the transaction corresponding to the last time the blockchain state changes;
  • the blockchain node determines the timestamp of the configuration block of the organization according to the identifier of the organization
  • the blockchain node determines whether the timestamp of the configuration block of the institution is later than the timestamp of the block corresponding to the hash value
  • the blockchain node executes the access operation of the institution and determines the result of the access operation as the control result; otherwise, it is determined that the institution does not have the right to access the transaction, and the access denied information is determined as the Control the results.
  • the method further includes:
  • the blockchain node obtains the transaction identifier of the transaction to be executed
  • the blockchain node executes the transaction to be executed, and writes transaction data into the block
  • the blockchain node When the blockchain node confirms that the transaction data has changed, it updates the blockchain state, and stores the hash value of the block in the blockchain state.
  • the blockchain state is the state at the time of the latest transaction execution corresponding to the transaction identifier.
  • the identity of the institution is obtained through a deployed smart contract.
  • an embodiment of the present invention provides a block chain data access control device based on a smart contract, including:
  • the obtaining unit is configured to obtain an institution's access operation request, where the access operation request includes the transaction identifier of the accessed transaction;
  • the processing unit is configured to determine, according to the transaction identifier, the state of the blockchain corresponding to the transaction identifier; the state of the blockchain includes the hash value of the transaction corresponding to the last change in the state of the blockchain; The hash value of the transaction corresponding to the last change in the state of the blockchain and the identity of the institution, and data access control on the institution to obtain the control result;
  • the sending unit is used to send the control result to the institution.
  • processing unit is specifically configured to:
  • processing unit is further configured to:
  • the state of the block chain is updated, and the hash value of the block is stored in the state of the block chain.
  • the state of the blockchain is the state of the latest transaction execution corresponding to the transaction identifier.
  • the identity of the institution is obtained through a deployed smart contract.
  • an embodiment of the present invention also provides a computing device, including:
  • Memory used to store program instructions
  • the processor is configured to call the program instructions stored in the memory, and execute the above-mentioned smart contract-based blockchain data access control method according to the obtained program.
  • an embodiment of the present invention also provides a computer-readable non-volatile storage medium, including computer-readable instructions.
  • the computer reads and executes the computer-readable instructions, the computer is caused to execute the above-mentioned smart contract-based Block chain data access control method.
  • FIG. 1 is a schematic diagram of a system architecture provided by an embodiment of the present invention
  • FIG. 2 is a schematic flowchart of a method for controlling access to blockchain data based on smart contracts according to an embodiment of the present invention
  • FIG. 3 is a schematic diagram of a block provided by an embodiment of the present invention.
  • FIG. 4 is a schematic structural diagram of a block chain data access control device based on smart contracts provided by an embodiment of the present invention
  • FIG. 5 is a schematic structural diagram of a block chain data access control device based on a smart contract provided by an embodiment of the present invention.
  • FIG. 1 exemplarily shows a system architecture to which an embodiment of the present invention is applicable.
  • the system architecture may include multiple institutional clients 100 and a blockchain system 200.
  • the institutional client 100 is used to communicate with the blockchain system 200, and send transaction data to the blockchain system 200 for processing and uploading to the chain.
  • the blockchain system 200 consists of multiple blockchain nodes 210 communicating with the institutional client 100 for processing and storing transaction data sent by the institutional client 100.
  • the multiple blockchain nodes 210 can be connected to each other for communication.
  • Each blockchain node 210 includes multiple blocks, and the blocks are used to store transaction data sent by the institutional client 100.
  • FIG. 1 is only an example, which is not limited in the embodiment of the present invention.
  • FIG. 2 shows in detail the flow of a smart contract-based blockchain data access control method provided by an embodiment of the present invention.
  • the flow can be executed by a smart contract-based blockchain data access control device.
  • the device may be located in the above-mentioned blockchain node 210, or it may be the blockchain node 210.
  • the process specifically includes:
  • Step 201 The blockchain node obtains an organization access operation request.
  • the access operation request may include the transaction identification of the accessed transaction.
  • the corresponding blockchain state can be found through the transaction identifier.
  • the transaction ID can be a transaction ID.
  • the institutional client can establish a calling relationship with the blockchain system through the SDK (Software Development Kit), and then the institutional client initiates the transaction process through the SDK.
  • SDK Software Development Kit
  • the key value passed in By operating the key value passed in, the latest hash value stored in the block chain state of the exchange that changes the state of the block chain in the block is obtained.
  • the state of the blockchain is the state of the latest transaction execution corresponding to the transaction identifier.
  • the blockchain node obtains the transaction identifier of the transaction to be executed, then executes the transaction to be executed, and writes the transaction data into the block. Finally, when it is confirmed that the transaction data has changed, the blockchain state is updated, and the hash value of the block is stored in the blockchain state.
  • Step 202 The blockchain node determines the state of the blockchain corresponding to the transaction identifier according to the transaction identifier.
  • the block chain state includes the hash value of the transaction corresponding to the last time the block chain state changes, and the block chain state is the state when the latest transaction corresponding to the transaction identifier is executed.
  • the blockchain state can be It is implemented using a key value database such as LevelDb or couchDb. Therefore, when performing data operations, the hash field of the block is first obtained through the key value (transaction identifier).
  • Step 203 The blockchain node performs data access control on the institution according to the hash value of the transaction corresponding to the last change in the blockchain state and the identity of the institution, and obtains the control result.
  • the blockchain node determines the timestamp of the block corresponding to the hash value according to the hash value of the transaction corresponding to the last time the blockchain state changes; then the blockchain node determines the timestamp of the block corresponding to the hash value according to the
  • the identification of the institution determines the time stamp of the configuration block of the institution; finally determines whether the time stamp of the configuration block of the institution is later than the time stamp of the block corresponding to the hash value; if so, then the area
  • the block chain node executes the access operation of the institution and determines the result of the access operation as the control result; otherwise, it is determined that the institution is not authorized to access the transaction, and the access denied information is determined as the control result.
  • the certificate and organization ID of the calling organization can be read through the deployed smart contract, and the time when the organization joins the alliance can be obtained through the organization ID.
  • Step 204 The blockchain node sends the control result to the institution.
  • control result When the control result is obtained, it can be sent to the organization to effectively control the organization's data access.
  • This embodiment uses a payment voucher blockchain platform with Fabric as the bottom layer of the blockchain.
  • the platform is assumed to be established by the tax bureau and medical insurance department first, and then the social insurance department will join in later.
  • the tax bureau and the medical insurance department due to the previous online operation, have already generated data and shared this part of the data for use.
  • the subsequent social insurance department joins the tax bureau and the medical insurance department because the data before the social insurance joins the tax bureau and the medical insurance
  • the business processes of the two parties are generated, so it is not desired and unnecessary to share this part of the data with the social security department. Therefore, the contract for data access control according to the time of institution’s joining is deployed on the consortium chain constructed by the tax bureau-social security-medical insurance.
  • Go language is used to obtain the time when the social security institution joins the alliance and obtain the status of the exchange that ultimately changes its status.
  • the hash value of the block, and the timestamp of the exchange in the block is read based on the hash value, and the two times are compared to determine whether the institution has the authority to read the credential data.
  • Institutional client is a business system developed by each institution according to their own needs.
  • the SDK is a package that is packaged on the basis of the SDK officially provided by Fabric, which is more convenient to use than the original SDK.
  • the social security agency client establishes a connection with the Fabric platform through the SDK, and uploads the social security agency's certificate and social security agency ID.
  • the social security agency client initiates the process of operating data through the SDK
  • a hospital medical record sharing platform with Ethereum as the bottom layer is adopted, and the platform is assumed to be jointly built by Hospital A and Hospital B. Due to the initial online operation, the two hospitals A and B have been implemented over time. During this time, the patients' medical records have been shared. This part of the data is jointly generated and used by both parties A and B.
  • hospital C joins in the two hospitals A and B don't want to add hospital C to the previous data. As soon as C joins the alliance, they will have access to all data. This is also unfair to hospitals A and B. Therefore, the contract for data access control according to the time of the institution’s joining is deployed on the alliance chain constructed by the hospital A-B-C.
  • the Solidity language is used to obtain the time when the hospital C joins the alliance, and the exchange that finally changes the patient’s medical record status in the acquisition state is The hash value of the block, and the timestamp of the exchange in the block is read using the hash value, and the two times are compared to determine whether the institution has the authority to read the patient's medical record data.
  • Institutional client is a business system developed by each institution according to their own needs.
  • the SDK is a package based on the SDK officially provided by Ethereum, which is more convenient to use than the original SDK.
  • the client of Hospital C establishes a connection with the Ethereum platform through the SDK, and uploads the certificate of Hospital C and the ID of Hospital C.
  • the hospital C client initiates the process of operating data through the SDK
  • the above embodiment shows that the blockchain node obtains the institutional access operation request.
  • the access operation request includes the transaction identifier of the accessed transaction.
  • the corresponding blockchain state of the transaction identifier is determined, and the blockchain state includes the blockchain state.
  • the hash value of the transaction corresponding to a change according to the hash value of the transaction corresponding to the last change in the blockchain state and the identity of the institution, data access control to the institution, the control result is obtained, and the control result is sent to the mechanism.
  • the blockchain node can obtain the time stamp of the corresponding transaction data and the joining time of the institution through the identity of the institution and the hash value of the transaction when the state occurred last time, so as to access the data of the institution according to the time stamp and the joining time of the institution. Control can improve the control effect of the data before the joining node is accessed, and the control efficiency can be improved.
  • FIG. 4 exemplarily shows the structure of a smart contract-based blockchain data access control device provided by an embodiment of the present invention, which can perform smart contract-based blockchain data access control Process.
  • the device specifically includes:
  • the obtaining unit 401 is configured to obtain an institution's access operation request, where the access operation request includes the transaction identifier of the accessed transaction;
  • the processing unit 402 is configured to determine, according to the transaction identifier, the state of the blockchain corresponding to the transaction identifier; the state of the blockchain includes the hash value of the transaction corresponding to the last time the state of the blockchain changes; according to The hash value of the transaction corresponding to the last change in the state of the blockchain and the identity of the institution, and data access control on the institution to obtain the control result;
  • the sending unit 403 is configured to send the control result to the organization.
  • processing unit 402 is specifically configured to:
  • processing unit 402 is further configured to:
  • the state of the block chain is updated, and the hash value of the block is stored in the state of the block chain.
  • the blockchain state is the state at the time of the latest transaction execution corresponding to the transaction identifier.
  • the identity of the institution is obtained through a deployed smart contract.
  • embodiments of the present invention provide a block chain data access control device based on smart contracts.
  • At least one processor and, a memory communicatively connected with the at least one processor; the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable
  • the at least one processor can execute the smart contract-based blockchain data access control method in the foregoing embodiment.
  • FIG. 5 shows the structure of a smart contract-based blockchain data access control device provided by an embodiment of the present invention.
  • the smart contract-based blockchain data access control device 500 includes: a transceiver 501, a processor 502, memory 503 and bus system 504;
  • the memory 503 is used to store programs.
  • the program may include program code, and the program code includes computer operation instructions.
  • the memory 503 may be a random access memory (random access memory, RAM for short), or a non-volatile memory (non-volatile memory), such as at least one disk memory. Only one memory is shown in the figure. Of course, the memory can also be set to multiple as required.
  • the memory 503 may also be a memory in the processor 502.
  • the memory 503 stores the following elements, executable modules or data structures, or their subsets, or their extended sets:
  • Operating instructions including various operating instructions, used to implement various operations.
  • Operating system Including various system programs, used to implement various basic services and process hardware-based tasks.
  • the above-mentioned blockchain data access control method based on smart contracts in the embodiment of the present invention may be applied to the processor 502, or implemented by the processor 502.
  • the processor 502 may be an integrated circuit chip with signal processing capability.
  • the steps of the above-mentioned block chain data access control method based on smart contracts can be completed by hardware integrated logic circuits in the processor 502 or instructions in the form of software.
  • the above-mentioned processor 502 may be a general-purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware Components.
  • DSP digital signal processor
  • ASIC application specific integrated circuit
  • FPGA field programmable gate array
  • the methods, steps, and logical block diagrams disclosed in the embodiments of the present application can be implemented or executed.
  • the general-purpose processor may be a microprocessor or the processor may also be any conventional processor or the like.
  • the steps of the method disclosed in combination with the embodiments of the present invention may be directly embodied as being executed and completed by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor.
  • the software module can be located in a mature storage medium in the field, such as random access memory, flash memory, read-only memory, programmable read-only memory, or electrically erasable programmable memory, registers.
  • the storage medium is located in the memory 503, and the processor 502 reads the information in the memory 503, and performs the following steps in combination with its hardware:
  • the transceiver 501 is configured to obtain an institution access operation request, where the access operation request includes the transaction identifier of the accessed transaction;
  • the processor 502 is configured to determine, according to the transaction identifier, the state of the blockchain corresponding to the transaction identifier; the state of the blockchain includes the hash value of the transaction corresponding to the last time the state of the blockchain changes; according to The hash value of the transaction corresponding to the last change in the state of the blockchain and the identity of the institution, and data access control on the institution to obtain the control result;
  • the transceiver 501 is used to send the control result to the organization.
  • the processor 502 is configured to determine the timestamp of the block corresponding to the hash value according to the hash value of the transaction corresponding to the last time the blockchain state changes; according to the identity of the institution , Determine the time stamp of the configuration block of the institution; determine whether the time stamp of the configuration block of the institution is later than the time stamp of the block corresponding to the hash value; if so, execute the access operation of the institution , And determine the result of the access operation as the control result; otherwise, it is determined that the institution is not authorized to access the transaction, and the access denied information is determined as the control result.
  • the processor 502 is further configured to obtain the transaction identifier of the transaction to be executed before obtaining the institution's access operation request; execute the transaction to be executed, and write the transaction data into the block; after confirming that the transaction data has occurred When it changes, the state of the block chain is updated, and the hash value of the block is stored in the state of the block chain.
  • the blockchain state is the state at the time of the latest transaction execution corresponding to the transaction identifier.
  • the identity of the institution is obtained through a deployed smart contract.
  • an embodiment of the present invention also provides a computing device, including:
  • Memory used to store program instructions
  • the processor is used to call the program instructions stored in the memory, and execute the smart contract-based blockchain data access control method according to the obtained program.
  • embodiments of the present invention also provide a computer-readable non-volatile storage medium, including computer-readable instructions.
  • the computer reads and executes the computer-readable instructions, the computer executes the above-mentioned smart contract-based Blockchain data access control method.
  • These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing equipment to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction device.
  • the device implements the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.
  • These computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operation steps are executed on the computer or other programmable equipment to produce computer-implemented processing, so as to execute on the computer or other programmable equipment.
  • the instructions provide steps for implementing the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.

Abstract

一种基于智能合约的区块链数据访问控制方法及装置，该方法包括区块链节点获取机构访问操作请求，访问操作请求包括访问的交易的交易标识，根据交易标识，确定出交易标识对应区块链状态，区块链状态包括区块链状态最后一次发生变化时对应的交易的hash值，根据区块链状态最后一次发生变化时对应的交易的hash值和机构的标识，对机构进行数据访问控制，得到控制结果，将控制结果发送给所述机构。区块链节点通过机构的标识以及状态最后一次发生时的交易的hash值得到交易数据的时间戳和机构的加入时间，依据该时间戳和机构的加入时间对机构的数据访问进行控制，可以提高后加入节点访问加入前的数据的控制效果，提高控制效率。

Description

一种基于智能合约的区块链数据访问控制方法及装置
相关申请的交叉引用
本申请要求在2019年12月25日提交中国专利局、申请号为201911355239.X、申请名称为“一种基于智能合约的区块链数据访问控制方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明实施例涉及数据处理技术领域，尤其涉及一种基于智能合约的区块链数据访问控制方法及装置。
背景技术
基于区块链系统中，由于各机构参与方并非在同一时间加入联盟，有些机构可能是联盟链运行一段时间之后才加入，先加入联盟的机构由于已经贡献或者产生了数据，对这部分先产生的数据先加入联盟的机构拥有优先权利，存在不想让后续新加入机构访问的需求。由于区块链系统在运行的过程中各个参与节点都会同步所有区块数据，各节点的状态需要一致，现有的技术方案采用权限管理，或者区块压缩的方式来控制后加入节点的访问，但是都不能有效的控制后加入节点访问加入前的数据。
发明内容
本发明实施例提供一种基于智能合约的区块链数据访问控制方法及装置，用以提高控制后加入节点访问加入前的数据的控制效果。
第一方面，本发明实施例提供一种基于智能合约的区块链数据访问控制方法，包括：
区块链节点获取机构访问操作请求，所述访问操作请求包括访问的交易的交易标识；
所述区块链节点根据所述交易标识，确定出所述交易标识对应区块链状态；所述区块链状态包括所述区块链状态最后一次发生变化时对应的交易的hash(哈希)值；
所述区块链节点根据所述区块链状态最后一次发生变化时对应的交易的hash值和所述机构的标识，对所述机构进行数据访问控制，得到控制结果；
所述区块链节点将所述控制结果发送给所述机构。
上述技术方案中，区块链节点通过机构的标识以及状态最后一次发生时的交易的hash值可以得到相应的交易数据的时间戳和机构的加入时间，从而依据该时间戳和机构的加入时间对机构的数据访问进行控制，可以提高后加入节点访问加入前的数据的控制效果，提高控制效率。
可选的，所述区块链节点根据所述区块链状态最后一次发生变化时对应的交易的hash值和所述机构的标识，对所述机构进行数据访问控制，得到控制结果，包括：
所述区块链节点根据所述区块链状态最后一次发生变化时对应的交易的hash值，确定出所述hash值对应的区块的时间戳；
所述区块链节点根据所述机构的标识，确定出所述机构的配置区块的时间戳；
所述区块链节点确定所述机构的配置区块的时间戳是否晚于所述hash值对应的区块的时间戳；
若是，则所述区块链节点执行所述机构的访问操作，并将访问操作的结果确定为所述控制结果；否则确定所述机构无权访问所述交易，将拒绝访问信息确定为所述控制结果。
可选的，在所述区块链节点获取机构访问操作请求之前，还包括：
所述区块链节点获取待执行交易的交易标识；
所述区块链节点执行所述待执行交易，将交易数据写入区块；
所述区块链节点在确认所述交易数据发生变化时，更新所述区块链状态，将所述区块的hash值存储在所述区块链状态中。
可选的，所述区块链状态为所述交易标识对应的最新一次交易执行时的状态。
可选的，所述机构的标识是通过部署的智能合约获取的。
第二方面，本发明实施例提供一种基于智能合约的区块链数据访问控制装置，包括：
获取单元，用于获取机构访问操作请求，所述访问操作请求包括访问的交易的交易标识；
处理单元，用于根据所述交易标识，确定出所述交易标识对应区块链状态；所述区块链状态包括所述区块链状态最后一次发生变化时对应的交易的hash值；根据所述区块链状态最后一次发生变化时对应的交易的hash值和所述机构的标识，对所述机构进行数据访问控制，得到控制结果；
发送单元，用于将所述控制结果发送给所述机构。
可选的，所述处理单元具体用于：
根据所述区块链状态最后一次发生变化时对应的交易的hash值，确定出所述hash值对应的区块的时间戳；
根据所述机构的标识，确定出所述机构的配置区块的时间戳；
确定所述机构的配置区块的时间戳是否晚于所述hash值对应的区块的时间戳；
若是，则执行所述机构的访问操作，并将访问操作的结果确定为所述控制结果；否则确定所述机构无权访问所述交易，将拒绝访问信息确定为所述控制结果。
可选的，所述处理单元还用于：
在获取机构访问操作请求之前，获取待执行交易的交易标识；
执行所述待执行交易，将交易数据写入区块；
在确认所述交易数据发生变化时，更新所述区块链状态，将所述区块的hash值存储在所述区块链状态中。
可选的，所述区块链状态为所述交易标识对应的最新一次交易执行时的 状态。
可选的，所述机构的标识是通过部署的智能合约获取的。
第三方面，本发明实施例还提供一种计算设备，包括：
存储器，用于存储程序指令；
处理器，用于调用所述存储器中存储的程序指令，按照获得的程序执行上述基于智能合约的区块链数据访问控制方法。
第四方面，本发明实施例还提供一种计算机可读非易失性存储介质，包括计算机可读指令，当计算机读取并执行所述计算机可读指令时，使得计算机执行上述基于智能合约的区块链数据访问控制方法。
附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简要介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域的普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为本发明实施例提供的一种系统架构的示意图；
图2为本发明实施例提供的一种基于智能合约的区块链数据访问控制方法的流程示意图；
图3为本发明实施例提供的一种区块的示意图；
图4为本发明实施例提供的一种基于智能合约的区块链数据访问控制装置的结构示意图；
图5为本发明实施例提供的一种基于智能合约的区块链数据访问控制设备的结构示意图。
具体实施方式
为了使本发明的目的、技术方案和优点更加清楚，下面将结合附图对本发明作进一步地详细描述，显然，所描述的实施例仅仅是本发明一部分实施 例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其它实施例，都属于本发明保护的范围。
图1示例性的示出了本发明实施例所适用的一种系统架构，该系统架构可以包括多个机构客户端100和区块链系统200。
其中，机构客户端100用于与区块链系统200进行通信，将交易数据发送给区块链系统200进行处理并上链。
区块链系统200由多个区块链节点210，与机构客户端100进行通信，用于处理和存储机构客户端100发送的交易数据。该多个区块链节点210可以相互连接通信，每个区块链节点210中包括多个区块，区块用于存储机构客户端100发送的交易数据。
需要说明的是，上述图1所示的结构仅是一种示例，本发明实施例对此不做限定。
基于上述描述，图2详细的示出了本发明实施例提供的一种基于智能合约的区块链数据访问控制方法的流程，该流程可以由基于智能合约的区块链数据访问控制装置执行，该装置可以位于上述区块链节点210中，也可以是该区块链节点210。
如图2所示，该流程具体包括：
步骤201，区块链节点获取机构访问操作请求。
该访问操作请求可以包括访问的交易的交易标识。通过该交易标识可以找到对应的区块链状态。该交易标识可以为交易ID。
在具体实现时，机构客户端可以通过SDK(Software Development Kit，软件开发工具包)与区块链系统建立调用关系，然后机构客户端通过SDK发起交易流程。通过操作传入的key值，获取到区块链状态中存储的最新的改变该区块链状态的交易所在区块的hash值。
在获取机构访问操作请求之前，需要先在执行每次交易时，将hash值写入到区块链状态中。区块链状态为交易标识对应的最新一次交易执行时的状 态。
具体的，区块链节点获取待执行交易的交易标识，然后执行该待执行交易，将交易数据写入区块。最后在确认交易数据发生变化时，更新区块链状态，将区块的hash值存储在区块链状态中。
步骤202，所述区块链节点根据所述交易标识，确定出所述交易标识对应区块链状态。
该区块链状态包括区块链状态最后一次发生变化时对应的交易的hash值，区块链状态为交易标识对应的最新一次交易执行时的状态。
对于上链的数据，在其区块链状态中添加最新的交易所在区块hash字段，该字段值只保留最新的使状态发生改变的交易所在区块的hash值，区块链状态可以采用的是LevelDb或couchDb等key value型数据库来实现，因此在进行数据操作的时候，通过key值(交易标识)首先来获取区块的hash字段。
其中，单个区块上的数据结构可以如图3所示。
步骤203，所述区块链节点根据所述区块链状态最后一次发生变化时对应的交易的hash值和所述机构的标识，对所述机构进行数据访问控制，得到控制结果。
具体的，区块链节点根据所述区块链状态最后一次发生变化时对应的交易的hash值，确定出所述hash值对应的区块的时间戳；然后所述区块链节点根据所述机构的标识，确定出所述机构的配置区块的时间戳；最后确定所述机构的配置区块的时间戳是否晚于所述hash值对应的区块的时间戳；若是，则所述区块链节点执行所述机构的访问操作，并将访问操作的结果确定为所述控制结果；否则确定所述机构无权访问所述交易，将拒绝访问信息确定为所述控制结果。
也就是说，通过区块的hash值，查询该区块，获取区块的时间戳，该时间戳即为交易数据的上链时间。机构加入联盟，会有相应的配置区块生成，获取配置区块的时间戳，即为区块加入时间，因此将机构的ID，时间，以及机构加入联盟操作的交易hash上传到区块链上进行保存，且设定该方法只可 在机构加入时执行一次，一旦机构加入完成，后续将无权限进行操作。以此来保证机构加入时间的唯一性。
可以通过部署的智能合约读取调用机构的证书及机构ID，通过机构ID获取到机构加入联盟的时间。
对比机构加入联盟的时间和数据上链的时间，若机构加入联盟的时间晚于数据上链的时间，则该机构无权操作该数据，若早于，则返回操作的结果。
步骤204，所述区块链节点将所述控制结果发送给所述机构。
当得到控制结果后，可以发送给机构，从而实现对机构的数据访问进行有效控制。
为了更好的解释本发明实施例，下面将在具体场景下来描述上述区块链数据访问控制的流程。
实施例一：
本实施例采用以Fabric为区块链底层的缴费凭证区块链平台，平台假设为税局和医保部门首先搭建，后续社保部门加入进来。税局及医保部门，由于前期的上线运行，双方已经产生了数据，并就这部分数据进行共享使用，后续社保部门的加入，税局及医保部门由于在社保加入之前的数据为税局同医保两方的业务流程产生，因此不希望也无必要将这部分数据同社保部门共享。因此在税局—社保—医保三方构建的联盟链上部署的按机构加入时间进行数据访问控制的合约，采用Go语言实现获取社保机构加入联盟时间，获取状态中最终改变其状态的交易所在区块的hash值，并以此hash值读取交易所在区块的时间戳，对两时间进行比对，判断机构是否有权限读取凭证数据。
状态中的字段除了原始单据之外，还需要存储最新改变状态的交易所在区块的hash值。机构客户端，为各机构根据各自需求开发的业务系统。SDK为在Fabric官方提供的SDK基础上进行封装以后的套件，相比于原始SDK使用起来更加方便。
基于上述架构，缴费凭证区块链平台进行机构数据访问控制的步骤如下：
1、社保机构客户端通过SDK同Fabric平台建立连接，上传社保机构的 证书以及社保机构ID。
2、社保机构客户端通过SDK发起操作数据的流程；
3、通过操作传入的key值，获取到对应状态中的存储的最新的改变该状态的交易所在区块的hash值。
4、通过区块的hash值，查询该区块，获取区块的时间戳，该时间戳即为数据的上链时间。
5、社保机构加入联盟的操作会有相应的配置区块生成，获取配置区块的时间戳，即为社保机构加入联盟的时间，将机构ID，时间以及机构加入联盟的操作的交易ID上传到区块链上进行保存。
6、通过调用智能合约读取调用机构的证书及机构ID。通过机构ID获取到机构加入联盟的时间。
7、对比社保机构加入联盟的时间，和数据上链的时间，若机构加入联盟的时间晚于数据上链的时间，则该机构无权对该数据进行相应操作，若早于，则社保机构拥有对该笔数据的操作权限。可进行后续的操作。
实施例二：
本实施例采用以太坊为底层的医院病历共享平台，平台假设为医院A和医院B共同搭建。由于前期的上线运行，A、B两医院随着时间的推行，在这段时间的病人，就诊病历已经共享了出来，这部分的数据是A、B两方所共同产生和使用的。后续医院C加入进来的时候，A、B两医院不希望将医院C加入进来之前的数据，在C一开始加入进联盟就获得全部数据的访问权限。这对于A、B两医院也是不公平的。因此在医院A—B—C三方构建的联盟链上部署的按机构加入时间进行数据访问控制的合约，采用Solidity语言实现获取医院C加入联盟时间，获取状态中最终改变病人病历状态的交易所在区块的hash值，并以此hash值读取交易所在区块的时间戳，对两时间进行比对，判断机构是否有权限读取病人病历数据。
状态中的字段除了原始病人病历之外，还需要存储最新改变状态的交易所在区块的hash值。机构客户端，为各机构根据各自需求开发的业务系统。 SDK为在以太坊官方提供的SDK基础上进行封装以后的套件，相比于原始SDK使用起来更加方便。
基于上述架构，医院病历共享平台进行机构数据访问控制的步骤如下：
1、医院C客户端通过SDK同以太坊平台建立连接，上传医院C的证书以及医院C的ID。
2、医院C客户端通过SDK发起操作数据的流程；
3、通过操作传入的key值，获取到对应病人病历状态中的存储的最新的改变该病人病历的交易所在区块的hash值。
4、通过区块的hash值，查询该区块，获取区块的时间戳，该时间戳即为该病人病历数据的上链时间。
5、医院C加入联盟的操作会有相应的配置区块生成，获取配置区块的时间戳，即为医院C加入联盟的时间，将医院C的ID，加入联盟的时间以及医院C加入联盟的操作的交易ID上传到区块链上进行保存。
6、通过调用智能合约读取调用机构的证书及机构ID。通过机构ID获取到机构加入联盟的时间。
7、对比医院C加入联盟的时间，和数据上链的时间，若医院C加入联盟的时间晚于病人病历上链的时间，则医院C无权对该数据进行相应操作，若早于，则医院C拥有对该笔数据的操作权限。可进行后续的操作。
上述实施例表明，区块链节点获取机构访问操作请求，访问操作请求包括访问的交易的交易标识，根据交易标识，确定出交易标识对应区块链状态，区块链状态包括区块链状态最后一次发生变化时对应的交易的hash值，根据区块链状态最后一次发生变化时对应的交易的hash值和机构的标识，对机构进行数据访问控制，得到控制结果，将控制结果发送给所述机构。区块链节点通过机构的标识以及状态最后一次发生时的交易的hash值可以得到相应的交易数据的时间戳和机构的加入时间，从而依据该时间戳和机构的加入时间对机构的数据访问进行控制，可以提高后加入节点访问加入前的数据的控制效果，提高控制效率。
基于相同的技术构思，图4示例性的示出了本发明实施例提供的一种基于智能合约的区块链数据访问控制装置的结构，该装置可以执行基于智能合约的区块链数据访问控制流程。
如图4所示，该装置具体包括：
获取单元401，用于获取机构访问操作请求，所述访问操作请求包括访问的交易的交易标识；
处理单元402，用于根据所述交易标识，确定出所述交易标识对应区块链状态；所述区块链状态包括所述区块链状态最后一次发生变化时对应的交易的hash值；根据所述区块链状态最后一次发生变化时对应的交易的hash值和所述机构的标识，对所述机构进行数据访问控制，得到控制结果；
发送单元403，用于将所述控制结果发送给所述机构。
可选的，所述处理单元402具体用于：
根据所述区块链状态最后一次发生变化时对应的交易的hash值，确定出所述hash值对应的区块的时间戳；
根据所述机构的标识，确定出所述机构的配置区块的时间戳；
确定所述机构的配置区块的时间戳是否晚于所述hash值对应的区块的时间戳；
若是，则执行所述机构的访问操作，并将访问操作的结果确定为所述控制结果；否则确定所述机构无权访问所述交易，将拒绝访问信息确定为所述控制结果。
可选的，所述处理单元402还用于：
在获取机构访问操作请求之前，获取待执行交易的交易标识；
执行所述待执行交易，将交易数据写入区块；
在确认所述交易数据发生变化时，更新所述区块链状态，将所述区块的hash值存储在所述区块链状态中。
可选的，所述区块链状态为所述交易标识对应的最新一次交易执行时的状态。
可选的，所述机构的标识是通过部署的智能合约获取的。
基于相同的技术构思，本发明实施例提供一种基于智能合约的区块链数据访问控制设备。至少一个处理器；以及，与所述至少一个处理器通信连接的存储器；所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器能够执行上述实施例中的基于智能合约的区块链数据访问控制方法。
以一个处理器为例，图5为本发明实施例提供的基于智能合约的区块链数据访问控制设备的结构，该基于智能合约的区块链数据访问控制设备500包括：收发器501、处理器502、存储器503和总线系统504；
其中，存储器503，用于存放程序。具体地，程序可以包括程序代码，程序代码包括计算机操作指令。存储器503可能为随机存取存储器(random access memory，简称RAM)，也可能为非易失性存储器(non-volatile memory)，例如至少一个磁盘存储器。图中仅示出了一个存储器，当然，存储器也可以根据需要，设置为多个。存储器503也可以是处理器502中的存储器。
存储器503存储了如下的元素，可执行模块或者数据结构，或者它们的子集，或者它们的扩展集：
操作指令：包括各种操作指令，用于实现各种操作。
操作系统：包括各种系统程序，用于实现各种基础业务以及处理基于硬件的任务。
上述本发明实施例基于智能合约的区块链数据访问控制方法可以应用于处理器502中，或者说由处理器502实现。处理器502可能是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述基于智能合约的区块链数据访问控制方法的各步骤可以通过处理器502中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器502可以是通用处理器、数字信号处理器(DSP)、专用集成电路(ASIC)、现场可编程门阵列(FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是 微处理器或者该处理器也可以是任何常规的处理器等。结合本发明实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器503，处理器502读取存储器503中的信息，结合其硬件执行以下步骤：
收发器501，用于获取机构访问操作请求，所述访问操作请求包括访问的交易的交易标识；
处理器502，用于根据所述交易标识，确定出所述交易标识对应区块链状态；所述区块链状态包括所述区块链状态最后一次发生变化时对应的交易的hash值；根据所述区块链状态最后一次发生变化时对应的交易的hash值和所述机构的标识，对所述机构进行数据访问控制，得到控制结果；
收发器501，用于将所述控制结果发送给所述机构。
可选的，所述处理器502用于根据所述区块链状态最后一次发生变化时对应的交易的hash值，确定出所述hash值对应的区块的时间戳；根据所述机构的标识，确定出所述机构的配置区块的时间戳；确定所述机构的配置区块的时间戳是否晚于所述hash值对应的区块的时间戳；若是，则执行所述机构的访问操作，并将访问操作的结果确定为所述控制结果；否则确定所述机构无权访问所述交易，将拒绝访问信息确定为所述控制结果。
可选的，所述处理器502还用于在获取机构访问操作请求之前，获取待执行交易的交易标识；执行所述待执行交易，将交易数据写入区块；在确认所述交易数据发生变化时，更新所述区块链状态，将所述区块的hash值存储在所述区块链状态中。
可选的，所述区块链状态为所述交易标识对应的最新一次交易执行时的状态。
可选的，所述机构的标识是通过部署的智能合约获取的。
基于相同的技术构思，本发明实施例还提供了一种计算设备，包括：
存储器，用于存储程序指令；
处理器，用于调用存储器中存储的程序指令，按照获得的程序执行上述基于智能合约的区块链数据访问控制方法。
基于相同的技术构思，本发明实施例还提供了一种计算机可读非易失性存储介质，包括计算机可读指令，当计算机读取并执行计算机可读指令时，使得计算机执行上述基于智能合约的区块链数据访问控制方法。
本发明是参照根据本发明实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
尽管已描述了本发明的优选实施例，但本领域内的技术人员一旦得知了基本创造性概念，则可对这些实施例作出另外的变更和修改。所以，所附权利要求意欲解释为包括优选实施例以及落入本发明范围的所有变更和修改。
显然，本领域的技术人员可以对本发明进行各种改动和变型而不脱离本发明的精神和范围。这样，倘若本发明的这些修改和变型属于本发明权利要 求及其等同技术的范围之内，则本发明也意图包含这些改动和变型在内。

Claims (12)

  1. 一种基于智能合约的区块链数据访问控制方法，其特征在于，包括：
    区块链节点获取机构访问操作请求，所述访问操作请求包括访问的交易的交易标识；
    所述区块链节点根据所述交易标识，确定出所述交易标识对应区块链状态；所述区块链状态包括所述区块链状态最后一次发生变化时对应的交易的hash值；
    所述区块链节点根据所述区块链状态最后一次发生变化时对应的交易的hash值和所述机构的标识，对所述机构进行数据访问控制，得到控制结果；
    所述区块链节点将所述控制结果发送给所述机构。
  2. 如权利要求1所述的方法，其特征在于，所述区块链节点根据所述区块链状态最后一次发生变化时对应的交易的hash值和所述机构的标识，对所述机构进行数据访问控制，得到控制结果，包括：
    所述区块链节点根据所述区块链状态最后一次发生变化时对应的交易的hash值，确定出所述hash值对应的区块的时间戳；
    所述区块链节点根据所述机构的标识，确定出所述机构的配置区块的时间戳；
    所述区块链节点确定所述机构的配置区块的时间戳是否晚于所述hash值对应的区块的时间戳；
    若是，则所述区块链节点执行所述机构的访问操作，并将访问操作的结果确定为所述控制结果；否则确定所述机构无权访问所述交易，将拒绝访问信息确定为所述控制结果。
  3. 如权利要求1所述的方法，其特征在于，在所述区块链节点获取机构访问操作请求之前，还包括：
    所述区块链节点获取待执行交易的交易标识；
    所述区块链节点执行所述待执行交易，将交易数据写入区块；
    所述区块链节点在确认所述交易数据发生变化时，更新所述区块链状态，将所述区块的hash值存储在所述区块链状态中。
  4. 如权利要求1所述的方法，其特征在于，所述区块链状态为所述交易标识对应的最新一次交易执行时的状态。
  5. 如权利要求1至4任一项所述的方法，其特征在于，所述机构的标识是通过部署的智能合约获取的。
  6. 一种基于智能合约的区块链数据访问控制装置，其特征在于，包括：
    获取单元，用于获取机构访问操作请求，所述访问操作请求包括访问的交易的交易标识；
    处理单元，用于根据所述交易标识，确定出所述交易标识对应区块链状态；所述区块链状态包括所述区块链状态最后一次发生变化时对应的交易的hash值；根据所述区块链状态最后一次发生变化时对应的交易的hash值和所述机构的标识，对所述机构进行数据访问控制，得到控制结果；
    发送单元，用于将所述控制结果发送给所述机构。
  7. 如权利要求6所述的装置，其特征在于，所述处理单元具体用于：
    根据所述区块链状态最后一次发生变化时对应的交易的hash值，确定出所述hash值对应的区块的时间戳；
    根据所述机构的标识，确定出所述机构的配置区块的时间戳；
    确定所述机构的配置区块的时间戳是否晚于所述hash值对应的区块的时间戳；
    若是，则执行所述机构的访问操作，并将访问操作的结果确定为所述控制结果；否则确定所述机构无权访问所述交易，将拒绝访问信息确定为所述控制结果。
  8. 如权利要求6所述的装置，其特征在于，所述处理单元还用于：
    在获取机构访问操作请求之前，获取待执行交易的交易标识；
    执行所述待执行交易，将交易数据写入区块；
    在确认所述交易数据发生变化时，更新所述区块链状态，将所述区块的 hash值存储在所述区块链状态中。
  9. 如权利要求6所述的装置，其特征在于，所述区块链状态为所述交易标识对应的最新一次交易执行时的状态。
  10. 如权利要求6至9任一项所述的装置，其特征在于，所述机构的标识是通过部署的智能合约获取的。
  11. 一种计算设备，其特征在于，包括：
    存储器，用于存储程序指令；
    处理器，用于调用所述存储器中存储的程序指令，按照获得的程序执行权利要求1至5任一项所述的方法。
  12. 一种计算机可读非易失性存储介质，其特征在于，包括计算机可读指令，当计算机读取并执行所述计算机可读指令时，使得计算机执行如权利要求1至5任一项所述的方法。
PCT/CN2020/117172 2019-12-25 2020-09-23 一种基于智能合约的区块链数据访问控制方法及装置 WO2021129004A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP20904718.2A EP3968199B1 (en) 2019-12-25 2020-09-23 Blockchain data access control method and apparatus based on intelligent contract
US17/595,767 US11687921B2 (en) 2019-12-25 2020-09-23 Method and device for control of blockchain data access based on smart contract

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201911355239.X 2019-12-25
CN201911355239.XA CN111127206B (zh) 2019-12-25 2019-12-25 一种基于智能合约的区块链数据访问控制方法及装置

Publications (1)

Publication Number Publication Date
WO2021129004A1 true WO2021129004A1 (zh) 2021-07-01

Family

ID=70503534

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/117172 WO2021129004A1 (zh) 2019-12-25 2020-09-23 一种基于智能合约的区块链数据访问控制方法及装置

Country Status (4)

Country Link
US (1) US11687921B2 (zh)
EP (1) EP3968199B1 (zh)
CN (1) CN111127206B (zh)
WO (1) WO2021129004A1 (zh)

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111127206B (zh) 2019-12-25 2021-04-16 中国银联股份有限公司 一种基于智能合约的区块链数据访问控制方法及装置
CN112738172B (zh) * 2020-12-23 2022-03-08 平安科技（深圳）有限公司 区块链节点的管理方法、装置、计算机设备和存储介质
CN113742384A (zh) * 2021-09-09 2021-12-03 海南安迈云网络技术有限公司 一种基于区块链的数据读取方法
CN114401090A (zh) * 2021-12-08 2022-04-26 杭州趣链科技有限公司 静态页面访问方法、系统、装置、设备及存储介质

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20160283920A1 (en) * 2015-03-28 2016-09-29 Justin Fisher Authentication and verification of digital data utilizing blockchain technology
CN106991334A (zh) * 2016-11-24 2017-07-28 阿里巴巴集团控股有限公司 一种数据存取的方法、系统及装置
CN108932297A (zh) * 2018-06-01 2018-12-04 阿里巴巴集团控股有限公司 一种数据查询、数据共享的方法、装置及设备
US20190228086A1 (en) * 2018-01-25 2019-07-25 Merck Sharp & Dohme Corp. Verification of Data Provenance for Existing Computer Systems
CN110263579A (zh) * 2018-11-16 2019-09-20 腾讯科技（深圳）有限公司 一种数据处理方法、系统及相关设备
CN111127206A (zh) * 2019-12-25 2020-05-08 中国银联股份有限公司 一种基于智能合约的区块链数据访问控制方法及装置

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111027971B (zh) 2018-12-07 2023-08-22 深圳市智税链科技有限公司 在区块链网络中确定记账节点的方法、代理节点和介质
CN109829824B (zh) * 2019-03-05 2020-10-27 河钢国际科技(北京)有限公司 一种基于区块链技术的商品交易信息共享方法
CN110138733B (zh) * 2019-04-03 2021-09-21 华南理工大学 基于区块链的对象存储系统可信存证与访问权限控制方法

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20160283920A1 (en) * 2015-03-28 2016-09-29 Justin Fisher Authentication and verification of digital data utilizing blockchain technology
CN106991334A (zh) * 2016-11-24 2017-07-28 阿里巴巴集团控股有限公司 一种数据存取的方法、系统及装置
US20190228086A1 (en) * 2018-01-25 2019-07-25 Merck Sharp & Dohme Corp. Verification of Data Provenance for Existing Computer Systems
CN108932297A (zh) * 2018-06-01 2018-12-04 阿里巴巴集团控股有限公司 一种数据查询、数据共享的方法、装置及设备
CN110263579A (zh) * 2018-11-16 2019-09-20 腾讯科技（深圳）有限公司 一种数据处理方法、系统及相关设备
CN111127206A (zh) * 2019-12-25 2020-05-08 中国银联股份有限公司 一种基于智能合约的区块链数据访问控制方法及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3968199A4 *

Also Published As

Publication number Publication date
EP3968199B1 (en) 2023-07-19
CN111127206B (zh) 2021-04-16
EP3968199A1 (en) 2022-03-16
US11687921B2 (en) 2023-06-27
EP3968199A4 (en) 2022-07-27
CN111127206A (zh) 2020-05-08
US20220327531A1 (en) 2022-10-13

Similar Documents

Publication Publication Date Title
WO2021129004A1 (zh) 一种基于智能合约的区块链数据访问控制方法及装置
US11558177B2 (en) Block chain permission control method, device, and node apparatus
EP3518170B1 (en) Blockchain interoperability
US11483338B2 (en) Secure blockchain-based consensus
US20220084643A1 (en) Blockchain-based mechanisms for secure health information resource exchange
EP3610436B1 (en) Rapid distributed consensus on blockchain
CN111177797B (zh) 基于区块链的数据处理方法及装置、电子设备
CN114710329B (zh) 用于管理对区块链系统中的账户的访问的方法和设备
CN111033489B (zh) 用于数据遍历的方法和设备
Koscina et al. Enabling trust in healthcare data exchange with a federated blockchain-based architecture
US20190109889A1 (en) Method and system for controlling data transmission
WO2020182233A2 (en) Methods and devices for executing cross-chain anonymous multi-swap contracts
CN111201751B (zh) 用于仲裁区块链中数据真实性的方法和系统
CN110662210A (zh) 基于区块链的二次或多次手机号的识别方法、系统及设备
WO2019214071A1 (zh) 区块链上用户通信方法、装置、终端设备及存储介质
CN111339208B (zh) 调用智能合约的方法及装置
WO2021023094A1 (en) Methods and devices for executing n-time hashed time lock contracts
KR102549812B1 (ko) 스마트 계약을 이용한 표준진료지침 생성 방법
CN117151712B (zh) 区块链交易处理方法、装置、计算机设备和存储介质
CN113468586A (zh) 权限管理方法及装置
CN116975153A (zh) 数据管理方法、装置及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20904718

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2020904718

Country of ref document: EP

Effective date: 20211208

NENP Non-entry into the national phase

Ref country code: DE