WO2021169655A1 - 超级账本的授权访问方法、装置及存储介质 - Google Patents

超级账本的授权访问方法、装置及存储介质 Download PDF

Info

Publication number
WO2021169655A1
WO2021169655A1 PCT/CN2021/071985 CN2021071985W WO2021169655A1 WO 2021169655 A1 WO2021169655 A1 WO 2021169655A1 CN 2021071985 W CN2021071985 W CN 2021071985W WO 2021169655 A1 WO2021169655 A1 WO 2021169655A1
Authority
WO
WIPO (PCT)
Prior art keywords
authorization
authorization code
authorizer
request information
content
Prior art date
Application number
PCT/CN2021/071985
Other languages
English (en)
French (fr)
Inventor
薄辰龙
Original Assignee
深圳壹账通智能科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳壹账通智能科技有限公司 filed Critical 深圳壹账通智能科技有限公司
Publication of WO2021169655A1 publication Critical patent/WO2021169655A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/604—Tools and structures for managing or administering access control systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/108—Network architectures or network communication protocols for network security for controlling access to devices or network resources when the policy decisions are valid for a limited amount of time
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H04L67/1095—Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/088—Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2141—Access rights, e.g. capability lists, access control lists, access tables, access matrices

Definitions

  • This application belongs to the technical field of blockchain access, and in particular relates to an authorized access method, device, and computer-readable storage medium for Hyperledger.
  • Hyperledger is an open source project that promotes the cross-industry application of blockchain. Its members include finance, banking, Internet of Things, supply chain, manufacturing, and technology industries. At present, in the Hyperledger resources, you must be a member of the alliance to access it, that is, the member is certified by the alliance organization. Normally, this member has a certificate issued by the organization. When the transaction instruction of this member is processed by the blockchain node, it is necessary to retrieve whether the sender exists and whether the transaction signature is correct. Only when the verification is passed can the processing continue. This method cannot support authorized access to resources of non-members of the alliance, such as authorized one-time access, authorized access for a period of time, and so on.
  • this application provides an authorized access method, device, and computer-readable storage medium for Hyperledger. Its main purpose is to bring more value to the enterprise and to the authorized organization or user. In terms of security.
  • this application provides a method for authorizing access to Hyperledger, which includes:
  • an authorization code with the signature of the authorizer is generated according to preset authorization transaction rules, wherein the authorization request information includes the node information to be authorized and the content to be authorized, and the signature of the authorizer is included.
  • the authorization code includes the authorizer’s identity information, authorizer’s signature, random value and authorization expression;
  • Each node is preset with a built-in contract, and an alliance contract is stored in the built-in contract;
  • the identity verification of the authorization code in the access request information is performed together, wherein the access request information includes the node to be accessed, The content to be accessed and the authorization code with the signature of the authorizer;
  • the present application also provides an electronic device, which includes a memory and a processor.
  • the memory stores an authorized access program for the Hyperledger.
  • the processor executes, the following steps are implemented:
  • an authorization code with the signature of the authorizer is generated according to preset authorization transaction rules, wherein the authorization request information includes the node information to be authorized and the content to be authorized, and the signature of the authorizer is included.
  • the authorization code includes the authorizer’s identity information, authorizer’s signature, random value and authorization expression;
  • Each node is preset with a built-in contract, and an alliance contract is stored in the built-in contract;
  • the identity verification of the authorization code in the access request information is performed together, wherein the access request information includes the node to be accessed, The content to be accessed and the authorization code with the signature of the authorizer;
  • this application also provides a computer-readable storage medium in which an authorized access program for Hyperledger is stored, and when the authorized access program for Hyperledger is executed by a processor, To achieve the following steps:
  • an authorization code with the signature of the authorizer is generated according to preset authorization transaction rules, wherein the authorization request information includes the node information to be authorized and the content to be authorized, and the signature of the authorizer is included.
  • the authorization code includes the authorizer’s identity information, authorizer’s signature, random value and authorization expression;
  • Each node is preset with a built-in contract, and an alliance contract is stored in the built-in contract;
  • the identity verification of the authorization code in the access request information is performed together, wherein the access request information includes the node to be accessed, The content to be accessed and the authorization code with the signature of the authorizer;
  • an authorized access system for Hyperledger includes:
  • the authorization code generation module is used to generate an authorization code with the signature of the authorizer according to preset authorization transaction rules according to the obtained authorization request information of the requesting party, where the authorization request information includes the node information to be authorized and the content to be authorized, with
  • the authorization code signed by the authorizer includes the authorizer's identity information, the authorizer's signature, a random value, and an authorization expression;
  • the authorization code processing module is used to return the authorization code with the authorizer's signature to the requesting party, and synchronize the authorization code with the authorizer's signature to the built-in contract preset by each node of the Hyperledger.
  • the Hyperledger Each node of, has a built-in contract by default, and the alliance contract is stored in the built-in contract;
  • the authorization code identity verification module is used to verify the identity of the authorization code in the access request information according to the obtained access request information of the requesting party and the built-in contract preset by all nodes of the Hyperledger, where the access request information includes the waiting The access node, the content to be accessed, and the authorization code with the signature of the authorizer;
  • the authorized content verification module is used to verify the authorized content of the authorization code in the access request information if the authorizer's identity verification is passed;
  • the information reply module is used to reply to the requesting party's access request information according to the result of the authorization content verification.
  • the authorized access method, device and computer-readable storage medium of the Hyperledger proposed in this application synchronize the authorization code with the authorizer’s signature generated in accordance with the preset authorization transaction rules to the built-in contracts preset by all nodes of the Hyperledger
  • the built-in contracts preset by all nodes of the Hyperledger will jointly verify the identity of the authorization code and the node to be accessed will verify the authorization content of the authorization code, so that the requesting party
  • the nodes on the Hyperledger can be directly accessed through the authorization of the alliance members.
  • the design is flexible, convenient, safe and controllable. At the same time, it improves more business possibilities and brings more value to the enterprise. Compared with the existing technology, it is The authorized organization or user has security guarantees.
  • FIG. 1 is a schematic diagram of an application environment of a preferred embodiment of a method for authorizing access to a hyperledger according to this application;
  • Fig. 2 is a schematic diagram of modules of a preferred embodiment of the authorized access program of Hyperledger in Fig. 1;
  • Fig. 3 is a flowchart of a preferred embodiment of the authorized access method for Hyperledger of the present application.
  • This application provides a method for authorizing access to a Hyperledger, which is applied to an electronic device 1.
  • FIG. 1 it is a schematic diagram of the application environment of the preferred embodiment of the method for authorizing access to the Hyperledger of this application.
  • the electronic device 1 may be a terminal device with a computing function such as a server, a smart phone, a tablet computer, a portable computer, a desktop computer, and the like.
  • the electronic device 1 includes a processor 12, a memory 11, a network interface 13, and a communication bus 14.
  • the memory 11 includes at least one type of readable storage medium.
  • the at least one type of readable storage medium may be a non-volatile storage medium such as flash memory, hard disk, multimedia card, card-type memory 11, and the like.
  • the readable storage medium may be an internal storage unit of the electronic device 1, for example, the hard disk of the electronic device 1.
  • the readable storage medium may also be the external memory 11 of the electronic device 1, such as a plug-in hard disk or a smart memory card (Smart Memory Card) equipped on the electronic device 1.
  • the readable storage medium of the memory 11 is generally used to store the authorized access program 10 of the hyperledger installed in the electronic device 1, preset authorized transaction rules, and the like.
  • the memory 11 can also be used to temporarily store data that has been output or will be output.
  • the processor 12 may be a central processing unit (Central Processing Unit) in some embodiments.
  • Central Processing Unit CPU
  • microprocessor or other data processing chip, used to run the program code or processing data stored in the memory 11, for example, execute the authorized access program 10 of the Hyperledger.
  • the network interface 13 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface), and is usually used to establish a communication connection between the electronic device 1 and other electronic devices.
  • a standard wired interface and a wireless interface such as a WI-FI interface
  • the communication bus 14 is used to realize the connection and communication between the above-mentioned components.
  • FIG. 1 only shows the electronic device 1 with the components 11-14, but it should be understood that it is not required to implement all the illustrated components, and more or fewer components may be implemented instead.
  • the electronic device 1 may further include a camera device, and the camera device may be a part of the electronic device 1 or may be independent of the electronic device 1.
  • the electronic device 1 is a terminal device with a camera such as a smart phone, a tablet computer, or a portable computer, and the camera device is the camera of the electronic device 1.
  • the electronic device 1 may be a server, and the camera device is independent of the electronic device 1 and is connected to the electronic device 1 through a wired or wireless network.
  • the camera device is installed in a specific place, such as an office place or a surveillance area, and a real-time image is obtained by real-time shooting of a target entering the specific place, and the real-time image obtained by the shooting is transmitted to the processor 12 through the network.
  • a specific place such as an office place or a surveillance area
  • the electronic device 1 may also include a user interface.
  • the user interface may include an input unit such as a keyboard (Keyboard), a voice input device such as a microphone (microphone) and other devices with a voice recognition function, and a voice output device such as audio, earphones, etc.
  • the user interface may also include a standard wired interface and a wireless interface.
  • the electronic device 1 may also include a display, and the display may also be referred to as a display screen or a display unit.
  • the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, an organic light-emitting diode (Organic Light-Emitting Diode, OLED) touch device, etc.
  • the display is used for displaying information processed in the electronic device 1 and for displaying a visualized user interface.
  • the electronic device 1 further includes a touch sensor.
  • the area provided by the touch sensor for the user to perform a touch operation is called a touch area.
  • the touch sensor here may be a resistive touch sensor, a capacitive touch sensor, or the like.
  • the touch sensor includes not only a contact type touch sensor, but also a proximity type touch sensor and the like.
  • the touch sensor may be a single sensor, or may be, for example, a plurality of sensors arranged in an array.
  • the area of the display of the electronic device 1 may be the same as or different from the area of the touch sensor.
  • the display and the touch sensor are stacked to form a touch display screen. The device detects the touch operation triggered by the user based on the touch screen.
  • the electronic device 1 may also include a radio frequency (RF) circuit, a sensor, an audio circuit, etc., which will not be repeated here.
  • RF radio frequency
  • the memory 11 as a computer storage medium may include an operating system and an authorized access program 10 for Hyperledger; the processor 12 executes the authorized access program 10 for Hyperledger stored in the memory 11.
  • the processor 12 executes the authorized access program 10 for Hyperledger stored in the memory 11.
  • an authorization code with the authorizer’s signature is generated according to preset authorization transaction rules, where the authorization request information includes the node information to be authorized and the content to be authorized, and the authorization code with the authorizer’s signature includes Authorizer identity information, authorizer’s signature, random value and authorization expression;
  • the authorization code signed by the authorizer is returned to the requesting party, and the authorization code signed by the authorizer is synchronized to the built-in contract preset by each node of the Hyperledger.
  • Each node of the Hyperledger is preset with Built-in contract, the alliance contract is stored in the built-in contract;
  • the access request information includes the node to be accessed, the content to be accessed, and the Authorization code signed by the authorizer;
  • the authorization content verification is performed on the authorization code in the access request information
  • the step of generating the authorization code with the authorizer's signature according to the preset authorization transaction rule according to the obtained authorization request information of the requesting party includes:
  • the authorization code with the signature of the authorizer is obtained.
  • the preset authorization transaction rule includes the structure of the generated authorization code and the authorization transaction content.
  • the authorization expression includes: authorization content, performance measures, authorization code usage times, authorization code validity period, and authorization code access frequency.
  • the steps of performing identity verification on the authorization code in the access request information according to the obtained access request information of the requesting party and the built-in contract preset by all nodes of the Hyperledger include:
  • the obtained access request information compare the information of the node to be visited with the alliance contract stored in the built-in contract, where the alliance contract records the information of each alliance member and all the node information of the Hyperledger;
  • the signature of the authorizer of the authorization code in the access request information is verified according to the built-in contract preset by all nodes of the Hyperledger, and the authorizer identity verification result is obtained.
  • the step of verifying the authorization content of the authorization code in the access request information includes:
  • the authorization code is parsed to obtain the authorization code analysis content, where the authorization code analysis content includes the authorizer's identity information, the authorizer's signature, the random value, and the authorization expression;
  • the content to be accessed in the access request information is compared with the content to be analyzed by the authorization code, and the content to be accessed is selected from the content to be accessed that meets the content of the authorized code to be analyzed;
  • the performance measures for allowing access to the content, the number of times of authorization code access, the access time period, and the access frequency are verified, and the authorization content verification result is obtained.
  • the processor 12 further implements the following steps when executing the hyperledger authorized access program 10 stored in the memory 11:
  • the access status is synchronized to the preset built-in contracts of all nodes in the Hyperledger.
  • the access status includes the access content, the time of use of the authorization code, and the number of times the authorization code is used.
  • the authorized access program 10 of Hyperledger may also be divided into one or more modules, and the one or more modules are stored in the memory 11 and executed by the processor 12 to complete the application.
  • the module referred to in this application refers to a series of computer program instruction segments that can complete specific functions.
  • FIG. 2 it is a program module diagram of a preferred embodiment of the authorized access program 10 of Hyperledger in FIG. 1.
  • the authorized access program 10 of the Hyperledger can be divided into: an authorization code generation module 110, an authorization code processing module 120, an authorization code identity verification module 130, an authorized content verification module 140, an information reply module 150, the module 110
  • the functions or operation steps implemented by -150 are similar to the above, and will not be described in detail here. Illustratively, for example:
  • Authorization code generation module 110 used to generate an authorization code with an authorizer’s signature according to preset authorization transaction rules according to the obtained authorization request information of the requesting party, where the authorization request information includes the node information to be authorized and the content to be authorized, with The authorization code signed by the authorizer includes the authorizer's identity information, the authorizer's signature, a random value, and an authorization expression.
  • Authorization code processing module 120 used to return the authorization code signed by the authorizer to the requesting party, and synchronize the authorization code signed by the authorizer to the built-in contract preset by each node of the Hyperledger for storage. Among them, the super Each node of the ledger is preset with a built-in contract, and the built-in contract stores an alliance contract.
  • Authorization code identity verification module 130 used to verify the identity of the authorization code in the access request information according to the obtained access request information of the requesting party and the built-in contract preset by all nodes of the Hyperledger, where the access request information includes The node to be accessed, the content to be accessed, and the authorization code with the signature of the authorized person.
  • Authorized content verification module 140 if the authorizer's identity is verified, it will verify the authorized content of the authorization code in the access request information.
  • Information reply module 150 used to reply to the requesting party’s access request information according to the result of the authorization content verification.
  • this application also provides an authorized access method for Hyperledger.
  • FIG. 3 it is a flowchart of a preferred embodiment of a method for authorizing access to a hyperledger of this application. The method can be executed by a device, and the device can be implemented by software and/or hardware.
  • the method for authorizing access to Hyperledger includes: step S10 to step S50.
  • Step S10 According to the obtained authorization request information of the requesting party, an authorization code with the signature of the authorizer is generated according to the preset authorization transaction rule.
  • the authorization request information includes the node information to be authorized and the content to be authorized
  • the authorization code with the authorizer's signature includes the authorizer's identity information, the authorizer's signature, the random value, and the authorization expression.
  • the requesting party may be a member of an alliance that does not form the Hyperledger, that is, an outsider of the alliance.
  • the person outside the alliance may use the user terminal to For example, a web browser, e-mail client or some instant messaging client software sends information requesting authorization to the Hyperledger, where the node information to be authorized is the node information that the outsiders of the alliance want to access, including the node name, and the node Authorize to external personnel; the content to be authorized refers to the content that the visitor wants to access the node; the authorizer's identity information refers to the information of the alliance member signed by the authorization code generated by the node to be authorized, including the name, code, and alliance of the member Membership certificate, etc.; the random value is a string of randomly generated numbers, which is unique.
  • the step of generating an authorization code with the authorizer's signature according to the preset authorization transaction rule according to the obtained authorization request information of the requesting party includes:
  • the authorization code with the signature of the authorizer is obtained.
  • the preset authorized transaction rules include the structure of the generated authorization code and the authorized transaction content.
  • the authorization expression includes: authorization content, performance measures, authorization code usage times, authorization code validity period, and authorization code access frequency.
  • the authorization request information includes the node to be authorized and the content to be authorized, the IP address of the node to be authorized is obtained according to the node to be authorized in the authorization request information, and the IP address of the node to be authorized is obtained according to the IP address of the node to be authorized.
  • Alliance members In the Hyperledger, each node of the Hyperledger has an alliance member responsible for the node.
  • the information of the alliance member includes: the member's name, code, and alliance member certificate, etc., and each node has a preset built-in contract
  • the alliance contract is stored in both; the node to be authorized generates the authorization code according to the preset authorization transaction rules, and the alliance member responsible for the node to be authorized uses the private key to sign the authorization code to obtain the authorization code with the authorizer’s signature .
  • the structure of the generated authorization code included in the preset authorization transaction rule is the content of each part of the generated authorization code, the arrangement of each part of the content, etc., such as authorizer identity information, authorizer signature, random value, and authorization expression The arrangement method and so on.
  • the authorized transaction content is the transaction content that needs to be completed between the requesting party and the node to be authorized. For example, the requesting party obtains information from the node to be authorized in the Hyperledger through payment or other methods.
  • the expression needs to specify the Hyperledger channel, authorized content, fulfillment measures, authorization code usage times, authorization code validity period, and authorization code access frequency.
  • Example 1 Inquire about the performance contract, you can inquire once a day from June to August for an unlimited number of times:
  • Example 2 Enterprise information, 12 times specify that it can be queried once a month in 2019:
  • the generated authorization code and authorization information are all stored in the built-in contract.
  • Each node of the Hyperledger has a built-in contract, and the information of the visited node is synchronized to all built-in contracts.
  • step S20 the authorization code with the authorizer's signature is returned to the requesting party, and the authorization code with the authorizer's signature is synchronized to the built-in contract preset by each node of the hyperledger for storage.
  • each node of the Hyperledger has a built-in contract by default, and the alliance contract is stored in the built-in contract.
  • the authorization code with the authorizer’s signature is returned to the requester.
  • the return method can be either online or offline. For example, if the requester sends the authorization request information through the user side, then it can be generated The authorization code is directly returned to the requesting party’s client, or the phone number can be reserved by the requesting party in the authorization request information. When the authorization code with the authorizer’s signature is generated, the authorization code will be returned to the client in the form of information On the requester’s phone.
  • the specific information of each Hyperledger member and all the node information of the Hyperledger are stored in the alliance contract, which is convenient for subsequent identity verification of the authorization code obtained from the access request information.
  • Step S30 Perform identity verification on the authorization code in the access request information according to the obtained access request information of the requesting party and the built-in contract preset by all nodes of the hyperledger.
  • the access request information includes the node to be accessed, the content to be accessed, and the authorization code with the signature of the authorized person.
  • the requesting party After the requesting party receives the authorization code signed by the authorizer, it sends the access request information to the Hyperledger through the client.
  • the access request information includes at least the node to be accessed, the content to be accessed, and the authorization signed by the authorizer
  • the built-in contract preset by all nodes of the Hyperledger will jointly verify the identity of the authorization code in the access request information, strictly control and check, prevent errors, and ensure safety higher.
  • the built-in contracts preset by all nodes of the Hyperledger jointly perform identity verification on the authorization code in the access request information.
  • the steps include:
  • the node to be visited is compared with the alliance contract stored in the built-in contract, where the alliance contract records the information of each alliance member and all the node information of the Hyperledger;
  • the built-in contract preset by all nodes of the Hyperledger verifies the authorizer's signature of the authorization code in the access request information to obtain the authorizer identity verification result.
  • the information of each alliance member and the information of all nodes in the Hyperledger are recorded in the alliance contract, and the node to be visited is compared with the information of all nodes in the Hyperledger. If the node to be visited is recorded in the alliance contract, then the node to be visited is recorded in the alliance contract.
  • the access node belongs to the hyperledger, and the authorizer signature in the authorization code is compared with the authorizer signature of the authorization code generated by the node to be accessed recorded in each preset built-in contract, and the result of the comparison is obtained as a comparison Authorizer identity verification result.
  • step S40 if the authorizer's identity verification is passed, the authorization content verification is performed on the authorization code in the access request information.
  • the steps of verifying the authorization content of the authorization code in the access request information include:
  • the authorization code is parsed to obtain the authorization code analysis content, where the authorization code analysis content includes the authorizer's identity information, the authorizer's signature, the random value, and the authorization expression;
  • the content to be accessed in the access request information is compared with the content to be analyzed by the authorization code, and the content to be accessed is selected from the content to be accessed that meets the content of the authorized code to be analyzed;
  • the performance measures for allowing access to the content, the number of times of authorization code access, the access time period, and the access frequency are verified, and the authorization content verification result is obtained.
  • the authorization code is generated according to preset authorization transaction rules
  • the content of the authorization code needs to be parsed according to the preset authorization code parsing rules, and the authorization code obtained after the analysis is analyzed.
  • the content is compared with the content to be accessed in the access request information, and the content to be accessed is screened out from the content to be accessed that meets the authorization code analysis content, and then based on the authorization expression in the authorization code to perform measures and authorization for the content to be accessed
  • the code access times, access time period, and access frequency are verified, and the authorized content verification result is obtained.
  • step S50 a reply is made to the requesting party's access request information according to the result of the authorization content verification.
  • the identity verification of the authorization code fails, the subsequent content verification is directly stopped, and an identity verification failure message is generated and returned to the requesting party.
  • identity verification of the authorization code passes, but the content of the authorization code
  • the authorization code content inspection failure information is generated, which can let the requesting visitor understand the reason of the access failure and facilitate the solution; when the authorization code identity and content are all verified successfully, a reply message of successful verification is generated and returned to Requester.
  • the authorization access method of Hyperledger also includes:
  • the access status is synchronized to the preset built-in contracts of all nodes in the Hyperledger.
  • the access status includes the access content, the time of use of the authorization code, and the number of times the authorization code is used. It is convenient to control and manage the use of authorization codes.
  • an embodiment of the present application also proposes a computer-readable storage medium that stores an authorized access program for Hyperledger, and when the authorized access program for Hyperledger is executed by a processor, the following operations are implemented:
  • an authorization code with the authorizer’s signature is generated according to preset authorization transaction rules, where the authorization request information includes the node information to be authorized and the content to be authorized, and the authorization code with the authorizer’s signature includes Authorizer identity information, authorizer’s signature, random value and authorization expression;
  • the authorization code signed by the authorizer is returned to the requesting party, and the authorization code signed by the authorizer is synchronized to the built-in contract preset by each node of the Hyperledger.
  • Each node of the Hyperledger is preset with Built-in contract, the alliance contract is stored in the built-in contract;
  • the access request information includes the node to be accessed, the content to be accessed, and the Authorization code signed by the authorizer;
  • the authorization content verification is performed on the authorization code in the access request information
  • the step of generating the authorization code with the authorizer's signature according to the preset authorization transaction rule according to the obtained authorization request information of the requesting party includes:
  • the authorization code with the signature of the authorizer is obtained.
  • the preset authorization transaction rule includes the structure of the generated authorization code and the authorization transaction content.
  • the authorization expression includes: authorization content, performance measures, authorization code usage times, authorization code validity period, and authorization code access frequency.
  • the step of performing identity verification on the authorization code in the access request information according to the obtained access request information of the requesting party and the built-in contract preset by all nodes of the Hyperledger includes:
  • the obtained access request information compare the information of the node to be visited with the alliance contract stored in the built-in contract, where the alliance contract records the information of each alliance member and all the node information of the Hyperledger;
  • the authorizer signature of the authorization code in the access request information is verified according to the built-in contract preset by all nodes of the hyperledger, and the authorizer identity verification result is obtained.
  • the step of verifying the authorization content of the authorization code in the access request information includes:
  • the authorization code is parsed to obtain the authorization code analysis content, where the authorization code analysis content includes the authorizer's identity information, the authorizer's signature, the random value, and the authorization expression;
  • the content to be accessed in the access request information is compared with the content to be analyzed by the authorization code, and the content to be accessed is selected from the content to be accessed that meets the content of the authorized code to be analyzed;
  • the performance measures for allowing access to the content, the number of times of authorization code access, the access time period, and the access frequency are verified, and the authorization content verification result is obtained.
  • the following operations are implemented when the authorized access program of the Hyperledger is executed by the processor:
  • the access status is synchronized to the preset built-in contracts of all nodes in the Hyperledger.
  • the access status includes the access content, the time of use of the authorization code, and the number of times the authorization code is used.
  • the specific implementation of the computer-readable storage medium of the present application is substantially the same as the specific implementations of the above-mentioned hyperledger authorization access method and electronic device, and will not be repeated here.
  • the computer-readable storage medium may be non-volatile or Can be volatile.

Abstract

本申请属于区块链访问技术领域，本申请提供一种超级账本的授权访问方法、装置及计算机可读存储介质，其中的方法包括：根据获取的请求方的授权请求信息，生成带有授权者签名的授权码；将带有授权者签名的授权码返回给请求方，将带有授权者签名的授权码同步至超级账本每个节点预设的内置合约中储存；根据请求方的访问请求信息、及根据超级账本所有节点预设的内置合约共同对访问请求信息中的授权码进行身份校验；若授权者身份校验通过，则对授权码进行授权内容校验；根据授权内容校验的结果，对请求方的访问请求信息作出回复。本申请能够使联盟外部的请求方通过联盟成员的授权直接对超级账本上的节点进行访问，灵活方便，安全可控。

Description

超级账本的授权访问方法、装置及存储介质
本申请要求于2020年02月27日提交中国专利局、申请号为202010122964.9，发明名称为“超级账本的授权访问方法、装置及存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请属于区块链访问技术领域，尤其涉及一种超级账本的授权访问方法、装置及计算机可读存储介质。
 背景技术
超级账本是推动区块链跨行业应用的开源项目，成员包括金融、银行、物联网、供应链、制造和科技行业等。目前在超级账本资源中，必须是联盟成员才能访问，即成员是被联盟组织认证的。通常情况，这个成员具有组织签发的证书，这个成员的交易指令，在区块链节点处理时，要检索发送者是否是存在以及交易的签名是否正确，只有校验通过才能继续处理。这种方式不能支持对非联盟成员资源的授权访问，比如授权一次访问，授权一段时间访问等。
目前的联盟链中的授权访问普遍的做法，都是联盟成员通过自家系统来对链进行访问，再把数据授权给其它组织或者用户，发明人意识到这种方式本质上就不可信，跟中心化没有区别，对被授权的组织或者用户而言缺少安全保障。
 技术问题
基于上述现有技术中存在的问题，本申请提供一种超级账本的授权访问方法、装置及计算机可读存储介质，其主要目的在于，给企业带来更多价值，对被授权的组织或者用户而言具有安全保障。
为实现上述目的，本申请提供一种超级账本的授权访问方法，该方法包括：
根据获取的请求方的授权请求信息，按照预设授权交易规则生成带有授权者签名的授权码，其中，所述授权请求信息包括待授权节点信息和待授权内容，所述带有授权者签名的授权码包括授权者身份信息、授权者签名、随机值和授权表达式；
将所述带有授权者签名的授权码返回给请求方，并将所述带有授权者签名的授权码同步至超级账本每个节点预设的内置合约中储存，其中，所述超级账本的每个节点预设有内置合约，所述内置合约中储存有联盟合约；
根据获取的请求方的访问请求信息、及所述超级账本所有节点预设的内置合约共同对所述访问请求信息中的授权码进行身份校验，其中，所述访问请求信息包括待访问节点、待访问内容以及所述带有授权者签名的授权码；
若所述授权者身份校验通过，则对所述访问请求信息中的授权码进行授权内容校验；
根据授权内容校验的结果，对所述请求方的访问请求信息作出回复。
此外，为实现上述目的，本申请还提供一种电子装置，该电子装置包括：存储器、处理器，所述存储器中存储有超级账本的授权访问程序，所述超级账本的授权访问程序被所述处理器执行时实现如下步骤：
根据获取的请求方的授权请求信息，按照预设授权交易规则生成带有授权者签名的授权码，其中，所述授权请求信息包括待授权节点信息和待授权内容，所述带有授权者签名的授权码包括授权者身份信息、授权者签名、随机值和授权表达式；
将所述带有授权者签名的授权码返回给请求方，并将所述带有授权者签名的授权码同步至超级账本每个节点预设的内置合约中储存，其中，所述超级账本的每个节点预设有内置合约，所述内置合约中储存有联盟合约；
根据获取的请求方的访问请求信息、及所述超级账本所有节点预设的内置合约共同对所述访问请求信息中的授权码进行身份校验，其中，所述访问请求信息包括待访问节点、待访问内容以及所述带有授权者签名的授权码；
若所述授权者身份校验通过，则对所述访问请求信息中的授权码进行授权内容校验；
根据授权内容校验的结果，对所述请求方的访问请求信息作出回复。
此外，为实现上述目的，本申请还提供一种计算机可读存储介质，所述计算机可读存储介质中存储有超级账本的授权访问程序，所述超级账本的授权访问程序被处理器执行时，实现如下步骤：
根据获取的请求方的授权请求信息，按照预设授权交易规则生成带有授权者签名的授权码，其中，所述授权请求信息包括待授权节点信息和待授权内容，所述带有授权者签名的授权码包括授权者身份信息、授权者签名、随机值和授权表达式；
将所述带有授权者签名的授权码返回给请求方，并将所述带有授权者签名的授权码同步至超级账本每个节点预设的内置合约中储存，其中，所述超级账本的每个节点预设有内置合约，所述内置合约中储存有联盟合约；
根据获取的请求方的访问请求信息、及所述超级账本所有节点预设的内置合约共同对所述访问请求信息中的授权码进行身份校验，其中，所述访问请求信息包括待访问节点、待访问内容以及所述带有授权者签名的授权码；
若所述授权者身份校验通过，则对所述访问请求信息中的授权码进行授权内容校验；
根据授权内容校验的结果，对所述请求方的访问请求信息作出回复。
此外，为实现上述目的，一种超级账本的授权访问系统，其中，包括：
授权码生成模块，用于根据获取的请求方的授权请求信息，按照预设授权交易规则生成带有授权者签名的授权码，其中，授权请求信息包括待授权节点信息和待授权内容，带有授权者签名的授权码包括授权者身份信息、授权者签名、随机值和授权表达式；
授权码处理模块，用于将带有授权者签名的授权码返回给请求方，并将带有授权者签名的授权码同步至超级账本每个节点预设的内置合约中储存，其中，超级账本的每个节点预设有内置合约，内置合约中储存有联盟合约；
授权码身份校验模块，用于根据获取的请求方的访问请求信息、及超级账本所有节点预设的内置合约共同对访问请求信息中的授权码进行身份校验，其中，访问请求信息包括待访问节点、待访问内容以及带有授权者签名的授权码；
授权内容校验模块，用于若授权者身份校验通过，则对访问请求信息中的授权码进行授权内容校验；
信息回复模块，用于根据授权内容校验的结果，对请求方的访问请求信息作出回复。
本申请提出的超级账本的授权访问方法、装置及计算机可读存储介质，通过将按照预设授权交易规则生成的带有授权者签名的授权码同步至超级账本的所有节点预设的内置合约中，当获取到请求方的授权请求信息时，分别由超级账本的所有节点预设的内置合约共同对该授权码的身份进行检验和由待访问节点对授权码的授权内容进行检验，使请求方可通过联盟成员的授权直接对超级账本上的节点进行访问，设计灵活方便、安全可控，同时提高了业务的更多可能性，给企业带来更多价值，与现有技术相比较，对被授权的组织或者用户而言具有安全保障。
 技术解决方案
在此处键入技术解决方案描述段落。
 有益效果
在此处键入有益效果描述段落。
 附图说明
图1为本申请超级账本的授权访问方法较佳实施例的应用环境示意图；
图2为图1中超级账本的授权访问程序较佳实施例的模块示意图；图3为本申请超级账本的授权访问方法较佳实施例的流程图。
本申请目的的实现、功能特点及优点将结合实施例，参照附图做进一步说明。
 本发明的最佳实施方式
在此处键入本发明的最佳实施方式描述段落。
 本发明的实施方式
应当理解，此处所描述的具体实施例仅仅用以解释本申请，并不用于限定本申请。
本申请提供一种超级账本的授权访问方法，应用于一种电子装置1。参照图1所示，为本申请超级账本的授权访问方法较佳实施例的应用环境示意图。
在本实施例中，电子装置1可以是服务器、智能手机、平板电脑、便携计算机、桌上型计算机等具有运算功能的终端设备。
该电子装置1包括：处理器12、存储器11、网络接口13及通信总线14。
存储器11包括至少一种类型的可读存储介质。该至少一种类型的可读存储介质可为如闪存、硬盘、多媒体卡、卡型存储器11等的非易失性存储介质。在一些实施例中，可读存储介质可以是电子装置1的内部存储单元，例如该电子装置1的硬盘。在另一些实施例中，可读存储介质也可以是电子装置1的外部存储器11，例如电子装置1上配备的插接式硬盘、智能存储卡（Smart Media Card, SMC）、安全数字（Secure Digital, SD）卡、闪存卡（Flash Card）等。
在本实施例中，存储器11的可读存储介质通常用于存储安装于电子装置1的超级账本的授权访问程序10、预设授权交易规则等。存储器11还可以用于暂时地存储已经输出或者将要输出的数据。
处理器12在一些实施例中可以是一中央处理器（Central Processing Unit, CPU）、微处理器或其他数据处理芯片，用于运行存储器11中存储的程序代码或处理数据，例如执行超级账本的授权访问程序10等。
网络接口13可选地可以包括标准的有线接口、无线接口（如WI-FI接口），通常用于在该电子装置1与其他电子设备之间建立通信连接。
通信总线14用于实现上述这些组件之间的连接通信。
图1仅示出了具有组件11-14的电子装置1，但是应理解的是，并不要求实施所有示出的组件，可以替代的实施更多或者更少的组件。
可选地，该电子装置1还可以包括摄像装置，摄像装置既可以是电子装置1的一部分，也可以独立于电子装置1。在一些实施例中，电子装置1为智能手机、平板电脑、便携计算机等具有摄像头的终端设备，则摄像装置即为电子装置1的摄像头。在其他实施例中，电子装置1可以为服务器，摄像装置独立于该电子装置1、与该电子装置1通过有线或者无线网络连接。例如，该摄像装置安装于特定场所，如办公场所、监控区域，对进入该特定场所的目标进行实时拍摄得到实时图像，通过网络将拍摄得到的实时图像传输至处理器12。
可选地，该电子装置1还可以包括用户接口，用户接口可以包括输入单元比如键盘（Keyboard）、语音输入装置比如麦克风（microphone）等具有语音识别功能的设备、语音输出装置比如音响、耳机等，可选地用户接口还可以包括标准的有线接口、无线接口。
可选地，该电子装置1还可以包括显示器，显示器也可以称为显示屏或显示单元。在一些实施例中可以是LED显示器、液晶显示器、触控式液晶显示器以及有机发光二极管（Organic Light-Emitting Diode，OLED）触摸器等。显示器用于显示在电子装置1中处理的信息以及用于显示可视化的用户界面。
可选地，该电子装置1还包括触摸传感器。该触摸传感器所提供的供用户进行触摸操作的区域称为触控区域。此外，这里的触摸传感器可以为电阻式触摸传感器、电容式触摸传感器等。而且，触摸传感器不仅包括接触式的触摸传感器，也可包括接近式的触摸传感器等。此外，触摸传感器可以为单个传感器，也可以为例如阵列布置的多个传感器。 
此外，该电子装置1的显示器的面积可以与所述触摸传感器的面积相同，也可以不同。可选地，将显示器与所述触摸传感器层叠设置，以形成触摸显示屏。该装置基于触摸显示屏侦测用户触发的触控操作。
可选地，该电子装置1还可以包括射频（Radio Frequency，RF）电路，传感器、音频电路等等，在此不再赘述。
在图1所示的装置实施例中，作为一种计算机存储介质的存储器11中可以包括操作系统以及超级账本的授权访问程序10；处理器12执行存储器11中存储的超级账本的授权访问程序10时实现如下步骤：
根据获取的请求方的授权请求信息，按照预设授权交易规则生成带有授权者签名的授权码，其中，授权请求信息包括待授权节点信息和待授权内容，带有授权者签名的授权码包括授权者身份信息、授权者签名、随机值和授权表达式；
将带有授权者签名的授权码返回给请求方，并将带有授权者签名的授权码同步至超级账本每个节点预设的内置合约中储存，其中，超级账本的每个节点预设有内置合约，内置合约中储存有联盟合约；
根据获取的请求方的访问请求信息、及超级账本所有节点预设的内置合约共同对访问请求信息中的授权码进行身份校验，其中，访问请求信息包括待访问节点、待访问内容以及带有授权者签名的授权码；
若授权者身份校验通过，则对访问请求信息中的授权码进行授权内容校验；
根据授权内容校验的结果，对请求方的访问请求信息作出回复。
在一个实施例中，根据获取的请求方的授权请求信息，按照预设授权交易规则生成带有授权者签名的授权码的步骤包括：
根据授权请求信息，获取待授权节点的IP地址；
根据待授权节点的IP地址获取负责待授权节点的联盟成员；
通过待授权节点并按照预设授权交易规则生成授权码；
通过负责待授权节点的联盟成员，并采用私钥对授权码进行授权者签名，得到带有授权者签名的授权码。
在一个实施例中，预设授权交易规则包括生成授权码的结构和授权交易内容。
在一个实施例中，授权表达式包括：授权内容、履行措施、授权码使用次数、授权码有效时间段及授权码访问频次。
在一个实施例中，根据获取的请求方的访问请求信息、及超级账本所有节点预设的内置合约共同对访问请求信息中的授权码进行身份校验的步骤包括：
根据获取的访问请求信息，将待访问节点信息与储存在内置合约中的联盟合约进行比对，其中，联盟合约内记录各联盟成员信息及超级账本所有节点信息；
若待访问节点信息记录在联盟合约中，则根据超级账本所有节点预设的内置合约对访问请求信息中授权码的授权者签名进行校验，得到授权者身份校验结果。
在一个实施例中，若授权者身份校验通过，则对访问请求信息中的授权码进行授权内容校验的步骤包括：
根据预设授权码解析规则，对授权码进行解析，得到授权码解析内容，其中，授权码解析内容包括授权者身份信息、授权者签名、随机值和授权表达式；
将访问请求信息中的待访问内容与授权码解析内容进行比对，从待访问内容中筛选出符合授权码解析内容的允许访问内容；
根据授权表达式，对允许访问内容的履行措施、授权码访问次数、访问时间段及访问频次进行校验，得到授权内容校验结果。
在一个实施例中，若对请求方的访问请求信息作出回复为通过访问请求，则处理器12执行存储器11中存储的超级账本的授权访问程序10时还实现如下步骤：
将访问情况同步至超级账本所有节点的预设内置合约中，访问情况包括访问内容、授权码的使用时间以及授权码使用次数。
在其他实施例中，超级账本的授权访问程序10还可以被分割为一个或者多个模块，一个或者多个模块被存储于存储器11中，并由处理器12执行，以完成本申请。
本申请所称的模块是指能够完成特定功能的一系列计算机程序指令段。参照图2所示，为图1中超级账本的授权访问程序10较佳实施例的程序模块图。所述超级账本的授权访问程序10可以被分割为：授权码生成模块110、授权码处理模块120、授权码身份校验模块130、授权内容校验模块140、信息回复模块150，所述模块110-150所实现的功能或操作步骤均与上文类似，此处不再详述，示例性地，例如其中：
授权码生成模块110：用于根据获取的请求方的授权请求信息，按照预设授权交易规则生成带有授权者签名的授权码，其中，授权请求信息包括待授权节点信息和待授权内容，带有授权者签名的授权码包括授权者身份信息、授权者签名、随机值和授权表达式。
授权码处理模块120：用于将带有授权者签名的授权码返回给请求方，并将带有授权者签名的授权码同步至超级账本每个节点预设的内置合约中储存，其中，超级账本的每个节点预设有内置合约，内置合约中储存有联盟合约。
授权码身份校验模块130：用于根据获取的请求方的访问请求信息、及超级账本所有节点预设的内置合约共同对访问请求信息中的授权码进行身份校验，其中，访问请求信息包括待访问节点、待访问内容以及带有授权者签名的授权码。
授权内容校验模块140：用于若授权者身份校验通过，则对访问请求信息中的授权码进行授权内容校验。
信息回复模块150：用于根据授权内容校验的结果，对请求方的访问请求信息作出回复。
此外，本申请还提供一种超级账本的授权访问方法。参照图3所示，为本申请超级账本的授权访问方法较佳实施例的流程图。该方法可以由一个装置执行，该装置可以由软件和/或硬件实现。
在本实施例中，超级账本的授权访问方法包括：步骤S10-步骤S50。
步骤S10，根据获取的请求方的授权请求信息，按照预设授权交易规则生成带有授权者签名的授权码。
其中，授权请求信息包括待授权节点信息和待授权内容，带有授权者签名的授权码包括授权者身份信息、授权者签名、随机值和授权表达式。
具体地，在本申请的实施例中，请求方可以是非组成超级账本的联盟成员，即联盟外部人员，当联盟外部的人员想要访问超级账本内部的资料时，联盟外部的人员通过用户端，例如网页浏览器、电子邮件客户端或者一些即时通讯的客户端软件向超级账本发送请求授权的信息，其中，待授权节点信息为联盟外部人员想要访问的节点信息，包括节点名称，由该节点向外部人员进行授权；待授权内容即访问方想要对该节点进行的访问内容；授权者身份信息即对待授权节点生成的授权码签名的联盟成员的信息，具体包括成员的名称、代码以及联盟成员证书等；随机值为一串随机生成的数字，该数字具有唯一性。
其中，根据获取的请求方的授权请求信息，按照预设授权交易规则生成带有授权者签名的授权码的步骤包括：
根据授权请求信息，获取待授权节点的IP地址；
根据待授权节点的IP地址获取负责待授权节点的联盟成员；
通过待授权节点并按照预设授权交易规则生成授权码；
通过负责待授权节点的联盟成员，并采用私钥对授权码进行授权者签名，得到带有授权者签名的授权码。
其中，预设授权交易规则包括生成授权码的结构和授权交易内容。
其中，授权表达式包括：授权内容、履行措施、授权码使用次数、授权码有效时间段及授权码访问频次。
具体地，在授权请求信息中包括待授权节点和待授权内容，根据授权请求信息中的待授权节点，获取该待授权节点的IP地址，根据待授权节点的IP地址获取到负责待授权节点的联盟成员，在超级账本中，超级账本的每个节点均有负责该节点的联盟成员，其中，联盟成员的信息包括：成员的名称、代码以及联盟成员证书等，每个节点预设的内置合约中均储存有联盟合约；待授权节点按照预设授权交易规则生成授权码，并由负责待授权节点的联盟成员通过私钥对授权码进行授权者签名，从而得到带有授权者签名的授权码。其中，预设授权交易规则包括的生成授权码的结构即生成的授权码包括的各部分内容，各部分内容的排列方式等，如，授权者身份信息、授权者签名、随机值和授权表达式的排列方式等。授权交易内容为请求方与待授权节点之间需要完成的交易内容，例如，请求方通过付费或其它方式从超级账本的待授权节点处获取信息。表达式中需要指定超级账本通道、授权内容、履行措施、授权码使用次数、授权码有效时间段及授权码访问频次。
为了便于理解，举例如下：
举例1、成绩合约的查询，不限次数指定6月-8月每天一次可以查询：
examination/scores/query/(*)(201906010000000,201909010000000)(1d)。
举例2、企业信息，12次指定2019年每月一次可以查询：
banks/finance/select/(12)(201901010000000,202001010000000)(1mth)。
生成的授权码以及授权信息全部储存至内置合约中，超级账本的各个节点处均设置有内置合约，被访问的节点信息同步至所有内置合约。
步骤S20，将带有授权者签名的授权码返回给请求方，并将带有授权者签名的授权码同步至超级账本每个节点预设的内置合约中储存。
其中，超级账本的每个节点预设有内置合约，内置合约中储存有联盟合约。
具体地，带有授权者签名的授权码返回给请求方，返回的方式可以为在线返回，也可以为离线返回，例如，如果请求方是通过用户端发送的授权请求信息，那么，可将生成的授权码直接返回到请求方的用户端上，也可以通过由请求方在授权请求信息中预留电话号码，当生成带有授权者签名的授权码后，将授权码以信息的形式返回到请求方的手机上。在联盟合约中储存有各个超级账本成员的具体信息和超级账本的所有节点信息，便于之后对从访问请求信息中获取的授权码进行身份校验。
步骤S30，根据获取的请求方的访问请求信息、及超级账本所有节点预设的内置合约共同对访问请求信息中的授权码进行身份校验。
其中，访问请求信息包括待访问节点、待访问内容以及带有授权者签名的授权码。
具体地，当请求方收到授权者签名的授权码后，通过客户端向超级账本发送访问请求信息，在访问请求信息中，至少包括待访问节点、待访问内容以及带有授权者签名的授权码，根据访问信息中的待访问节点和授权者签名的授权码由超级账本所有节点预设的内置合约共同对访问请求信息中的授权码进行身份校验，严控把关，防止出错，安全性更高。
其中，根据获取的请求方的访问请求信息，超级账本所有节点预设的内置合约共同对访问请求信息中的授权码进行身份校验的步骤包括：
根据获取的访问请求信息，将待访问节点与储存在内置合约中的联盟合约进行比对，其中，联盟合约内记录各联盟成员信息及超级账本所有节点信息；
若待访问节点记录在联盟合约中，则由超级账本所有节点预设的内置合约对访问请求信息中授权码的授权者签名进行校验，得到授权者身份校验结果。
具体地，在联盟合约中记载有各个联盟成员的信息及超级账本所有节点信息，将待访问节点与超级账本所有节点信息进行比对，若在联盟合约中记载有该待访问节点，则该待访问节点属于该超级账本，再将授权码中的授权者签名与各个预设的内置合约中记载的该待访问节点生成的授权码的授权者签名进行比对，得到比对的结果，作为对授权者身份校验结果。
步骤S40，若授权者身份校验通过，则对访问请求信息中的授权码进行授权内容校验。
其中，若授权者身份校验通过，则对访问请求信息中的授权码进行授权内容校验的步骤包括：
根据预设授权码解析规则，对授权码进行解析，得到授权码解析内容，其中，授权码解析内容包括授权者身份信息、授权者签名、随机值和授权表达式；
将访问请求信息中的待访问内容与授权码解析内容进行比对，从待访问内容中筛选出符合授权码解析内容的允许访问内容；
根据授权表达式，对允许访问内容的履行措施、授权码访问次数、访问时间段及访问频次进行校验，得到授权内容校验结果。
具体地，由于授权码是按照预设授权交易规则生成的，所以当对授权码的内容进行校验时，需要按照预设授权码解析规则将授权码的内容解析，将解析后得到的授权码内容与访问请求信息中的待访问内容进行比对，从待访问内容中筛选出符合授权码解析内容的允许访问内容，再根据授权码中的授权表达式对对允许访问内容的履行措施、授权码访问次数、访问时间段及访问频次进行校验，得到授权内容校验结果。
步骤S50，根据授权内容校验的结果，对请求方的访问请求信息作出回复。
具体地，当对授权码的身份检验不合格时，直接停止其后的内容校验，并生成身份校验失败信息，返回给请求方，当授权码的身份校验通过，但授权码的内容检验不合格时，生成授权码内容检验失败信息，能够让请求访问者了解访问失败的原因，便于解决；当授权码的身份及内容全部校验成功后，生成校验成功的回复信息，返回给请求方。
若对请求方的访问请求信息作出回复为通过访问请求，则超级账本的授权访问方法还包括：
将访问情况同步至超级账本所有节点的预设内置合约中，访问情况包括访问内容、授权码的使用时间以及授权码使用次数。便于对授权码使用的控制和管理。
此外，本申请实施例还提出一种计算机可读存储介质，所述计算机可读存储介质中存储有超级账本的授权访问程序，所述超级账本的授权访问程序被处理器执行时实现如下操作：
根据获取的请求方的授权请求信息，按照预设授权交易规则生成带有授权者签名的授权码，其中，授权请求信息包括待授权节点信息和待授权内容，带有授权者签名的授权码包括授权者身份信息、授权者签名、随机值和授权表达式；
将带有授权者签名的授权码返回给请求方，并将带有授权者签名的授权码同步至超级账本每个节点预设的内置合约中储存，其中，超级账本的每个节点预设有内置合约，内置合约中储存有联盟合约；
根据获取的请求方的访问请求信息、及超级账本所有节点预设的内置合约共同对访问请求信息中的授权码进行身份校验，其中，访问请求信息包括待访问节点、待访问内容以及带有授权者签名的授权码；
若授权者身份校验通过，则对访问请求信息中的授权码进行授权内容校验；
根据授权内容校验的结果，对请求方的访问请求信息作出回复。
在一个实施例中，根据获取的请求方的授权请求信息，按照预设授权交易规则生成带有授权者签名的授权码的步骤包括：
根据授权请求信息，获取待授权节点的IP地址；
根据待授权节点的IP地址获取负责待授权节点的联盟成员；
通过待授权节点并按照预设授权交易规则生成授权码；
通过负责待授权节点的联盟成员，并采用私钥对授权码进行授权者签名，得到带有授权者签名的授权码。
在一个实施例中，预设授权交易规则包括生成授权码的结构和授权交易内容。
在一个实施例中，授权表达式包括：授权内容、履行措施、授权码使用次数、授权码有效时间段及授权码访问频次。
在一个实施例中，根据获取的请求方的访问请求信息及超级账本所有节点预设的内置合约共同对访问请求信息中的授权码进行身份校验的步骤包括：
根据获取的访问请求信息，将待访问节点信息与储存在内置合约中的联盟合约进行比对，其中，联盟合约内记录各联盟成员信息及超级账本所有节点信息；
若待访问节点记录在联盟合约中，则根据超级账本所有节点预设的内置合约对访问请求信息中授权码的授权者签名进行校验，得到授权者身份校验结果。
在一个实施例中，若授权者身份校验通过，则对访问请求信息中的授权码进行授权内容校验的步骤包括：
根据预设授权码解析规则，对授权码进行解析，得到授权码解析内容，其中，授权码解析内容包括授权者身份信息、授权者签名、随机值和授权表达式；
将访问请求信息中的待访问内容与授权码解析内容进行比对，从待访问内容中筛选出符合授权码解析内容的允许访问内容；
根据授权表达式，对允许访问内容的履行措施、授权码访问次数、访问时间段及访问频次进行校验，得到授权内容校验结果。
在一个实施例中，若对请求方的访问请求信息作出回复为通过访问请求，则超级账本的授权访问程序被处理器执行时实现如下操作：
将访问情况同步至超级账本所有节点的预设内置合约中，访问情况包括访问内容、授权码的使用时间以及授权码使用次数。
本申请之计算机可读存储介质的具体实施方式与上述超级账本的授权访问方法、电子装置的具体实施方式大致相同，在此不再赘述，其中，计算机可读存储介质可以是非易失性，也可以是易失性。
需要说明的是，在本文中，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、装置、物品或者方法不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、装置、物品或者方法所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括该要素的过程、装置、物品或者方法中还存在另外的相同要素。
上述本申请实施例序号仅仅为了描述，不代表实施例的优劣。通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到上述实施例方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在如上所述的一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端设备(可以是手机，计算机，服务器，或者网络设备等)执行本申请各个实施例所述的方法。
以上仅为本申请的优选实施例，并非因此限制本申请的专利范围，凡是利用本申请说明书及附图内容所作的等效结构或等效流程变换，或直接或间接运用在其他相关的技术领域，均同理包括在本申请的专利保护范围内。
 工业实用性
在此处键入工业实用性描述段落。
 序列表自由内容
在此处键入序列表自由内容描述段落。

Claims (20)

  1. 一种超级账本的授权访问方法，应用于电子装置，其中，所述方法包括：
    根据获取的请求方的授权请求信息，按照预设授权交易规则生成带有授权者签名的授权码，其中，所述授权请求信息包括待授权节点信息和待授权内容，所述带有授权者签名的授权码包括授权者身份信息、授权者签名、随机值和授权表达式；
    将所述带有授权者签名的授权码返回给请求方，并将所述带有授权者签名的授权码同步至超级账本每个节点预设的内置合约中储存，其中，所述超级账本的每个节点预设有内置合约，所述内置合约中储存有联盟合约；
    根据获取的请求方的访问请求信息、及所述超级账本所有节点预设的内置合约共同对所述访问请求信息中的授权码进行身份校验，其中，所述访问请求信息包括待访问节点、待访问内容以及所述带有授权者签名的授权码；
    若所述授权者身份校验通过，则对所述访问请求信息中的授权码进行授权内容校验；
    根据授权内容校验的结果，对所述请求方的访问请求信息作出回复。
  2. 根据权利要求1所述的超级账本的授权访问方法，其中，所述根据获取的请求方的授权请求信息，按照预设授权交易规则生成带有授权者签名的授权码的步骤包括：
    根据所述授权请求信息，获取所述待授权节点的IP地址；
    根据所述待授权节点的IP地址获取负责所述待授权节点的联盟成员；
    通过所述待授权节点并按照预设授权交易规则生成授权码；
    通过负责所述待授权节点的联盟成员，并采用私钥对所述授权码进行授权者签名，得到带有授权者签名的授权码。
  3. 根据权利要求1所述的超级账本的授权访问方法，其中，所述预设授权交易规则包括生成授权码的结构和授权交易内容。
  4. 根据权利要求1所述的超级账本的授权访问方法，其中，所述授权表达式包括：授权内容、履行措施、授权码使用次数、授权码有效时间段及授权码访问频次。
  5. 根据权利要求1所述的超级账本的授权访问方法，其中，所述根据获取的请求方的访问请求信息、及所述超级账本所有节点预设的内置合约共同对所述访问请求信息中的授权码进行身份校验的步骤包括：
    根据获取的所述访问请求信息，将所述待访问节点信息与储存在所述内置合约中的联盟合约进行比对，其中，所述联盟合约内记录各联盟成员信息及超级账本所有节点信息；
    若所述待访问节点信息记录在所述联盟合约中，则根据超级账本所有节点预设的内置合约对所述访问请求信息中授权码的授权者签名进行校验，得到授权者身份校验结果。
  6. 根据权利要求4所述的超级账本的授权访问方法，其中，所述若所述授权者身份校验通过，则对所述访问请求信息中的授权码进行授权内容校验的步骤包括：
    根据预设授权码解析规则，对授权码进行解析，得到授权码解析内容，其中，所述授权码解析内容包括授权者身份信息、授权者签名、随机值和授权表达式；
    将访问请求信息中的待访问内容与所述授权码解析内容进行比对，从所述待访问内容中筛选出符合所述授权码解析内容的允许访问内容；
    根据所述授权表达式，对所述允许访问内容的履行措施、授权码访问次数、访问时间段及访问频次进行校验，得到授权内容校验结果。
  7. 根据权利要求1所述的超级账本的授权访问方法，其中，若对所述请求方的访问请求信息作出回复为通过访问请求，则所述超级账本的授权访问方法还包括：
    将访问情况同步至所述超级账本所有节点的预设内置合约中，所述访问情况包括访问内容、授权码的使用时间以及授权码使用次数。
  8. 一种电子装置，其中，该电子装置包括：存储器、处理器，所述存储器中存储有超级账本的授权访问程序，所述超级账本的授权访问程序被所述处理器执行时实现如下步骤：
    根据获取的请求方的授权请求信息，按照预设授权交易规则生成带有授权者签名的授权码，其中，所述授权请求信息包括待授权节点信息和待授权内容，所述带有授权者签名的授权码包括授权者身份信息、授权者签名、随机值和授权表达式；
    将所述带有授权者签名的授权码返回给请求方，并将所述带有授权者签名的授权码同步至超级账本每个节点预设的内置合约中储存，其中，所述超级账本的每个节点预设有内置合约，所述内置合约中储存有联盟合约；
    根据获取的请求方的访问请求信息、及所述超级账本所有节点预设的内置合约共同对所述访问请求信息中的授权码进行身份校验，其中，所述访问请求信息包括待访问节点、待访问内容以及所述带有授权者签名的授权码；
    若所述授权者身份校验通过，则对所述访问请求信息中的授权码进行授权内容校验；
    根据授权内容校验的结果，对所述请求方的访问请求信息作出回复。
  9. 根据权利要求8所述的电子装置，其中，所述根据获取的请求方的授权请求信息，按照预设授权交易规则生成带有授权者签名的授权码的步骤包括：
    根据所述授权请求信息，获取所述待授权节点的IP地址；
    根据所述待授权节点的IP地址获取负责所述待授权节点的联盟成员；
    通过所述待授权节点并按照预设授权交易规则生成授权码；
    通过负责所述待授权节点的联盟成员，并采用私钥对所述授权码进行授权者签名，得到带有授权者签名的授权码。
  10. 根据权利要求8所述的电子装置，其中，所述预设授权交易规则包括生成授权码的结构和授权交易内容。
  11. 根据权利要求8所述的电子装置，其中，所述授权表达式包括：授权内容、履行措施、授权码使用次数、授权码有效时间段及授权码访问频次。
  12. 根据权利要求8所述的电子装置，其中，所述根据获取的请求方的访问请求信息、及所述超级账本所有节点预设的内置合约共同对所述访问请求信息中的授权码进行身份校验的步骤包括：
    根据获取的所述访问请求信息，将所述待访问节点信息与储存在所述内置合约中的联盟合约进行比对，其中，所述联盟合约内记录各联盟成员信息及超级账本所有节点信息；
    若所述待访问节点信息记录在所述联盟合约中，则根据超级账本所有节点预设的内置合约对所述访问请求信息中授权码的授权者签名进行校验，得到授权者身份校验结果。
  13. 根据权利要求11所述的电子装置，其中，所述若所述授权者身份校验通过，则对所述访问请求信息中的授权码进行授权内容校验的步骤包括：
    根据预设授权码解析规则，对授权码进行解析，得到授权码解析内容，其中，所述授权码解析内容包括授权者身份信息、授权者签名、随机值和授权表达式；
    将访问请求信息中的待访问内容与所述授权码解析内容进行比对，从所述待访问内容中筛选出符合所述授权码解析内容的允许访问内容；
    根据所述授权表达式，对所述允许访问内容的履行措施、授权码访问次数、访问时间段及访问频次进行校验，得到授权内容校验结果。
  14. 根据权利要求8所述的电子装置，其中，若对所述请求方的访问请求信息作出回复为通过访问请求，则所述超级账本的授权访问方法还包括：
    将访问情况同步至所述超级账本所有节点的预设内置合约中，所述访问情况包括访问内容、授权码的使用时间以及授权码使用次数。
  15. 一种计算机可读存储介质，其中，所述计算机可读存储介质中存储有超级账本的授权访问程序，所述超级账本的授权访问程序被处理器执行时，实现如下步骤：
    根据获取的请求方的授权请求信息，按照预设授权交易规则生成带有授权者签名的授权码，其中，所述授权请求信息包括待授权节点信息和待授权内容，所述带有授权者签名的授权码包括授权者身份信息、授权者签名、随机值和授权表达式；
    将所述带有授权者签名的授权码返回给请求方，并将所述带有授权者签名的授权码同步至超级账本每个节点预设的内置合约中储存，其中，所述超级账本的每个节点预设有内置合约，所述内置合约中储存有联盟合约；
    根据获取的请求方的访问请求信息、及所述超级账本所有节点预设的内置合约共同对所述访问请求信息中的授权码进行身份校验，其中，所述访问请求信息包括待访问节点、待访问内容以及所述带有授权者签名的授权码；
    若所述授权者身份校验通过，则对所述访问请求信息中的授权码进行授权内容校验；
    根据授权内容校验的结果，对所述请求方的访问请求信息作出回复。
  16. 根据权利要求15所述的计算机可读存储介质，其中，所述根据获取的请求方的授权请求信息，按照预设授权交易规则生成带有授权者签名的授权码的步骤包括：
    根据所述授权请求信息，获取所述待授权节点的IP地址；
    根据所述待授权节点的IP地址获取负责所述待授权节点的联盟成员；
    通过所述待授权节点并按照预设授权交易规则生成授权码；
    通过负责所述待授权节点的联盟成员，并采用私钥对所述授权码进行授权者签名，得到带有授权者签名的授权码。
  17. 根据权利要求15所述的计算机可读存储介质，其中，所述预设授权交易规则包括生成授权码的结构和授权交易内容。
  18. 根据权利要求15所述的计算机可读存储介质，其中，所述授权表达式包括：授权内容、履行措施、授权码使用次数、授权码有效时间段及授权码访问频次。
  19. 根据权利要求15所述的计算机可读存储介质，其中，所述根据获取的请求方的访问请求信息、及所述超级账本所有节点预设的内置合约共同对所述访问请求信息中的授权码进行身份校验的步骤包括：
    根据获取的所述访问请求信息，将所述待访问节点信息与储存在所述内置合约中的联盟合约进行比对，其中，所述联盟合约内记录各联盟成员信息及超级账本所有节点信息；
    若所述待访问节点信息记录在所述联盟合约中，则根据超级账本所有节点预设的内置合约对所述访问请求信息中授权码的授权者签名进行校验，得到授权者身份校验结果。
  20. 一种超级账本的授权访问系统，其中，包括：
    授权码生成模块，用于根据获取的请求方的授权请求信息，按照预设授权交易规则生成带有授权者签名的授权码，其中，授权请求信息包括待授权节点信息和待授权内容，带有授权者签名的授权码包括授权者身份信息、授权者签名、随机值和授权表达式；
    授权码处理模块，用于将带有授权者签名的授权码返回给请求方，并将带有授权者签名的授权码同步至超级账本每个节点预设的内置合约中储存，其中，超级账本的每个节点预设有内置合约，内置合约中储存有联盟合约；
    授权码身份校验模块，用于根据获取的请求方的访问请求信息、及超级账本所有节点预设的内置合约共同对访问请求信息中的授权码进行身份校验，其中，访问请求信息包括待访问节点、待访问内容以及带有授权者签名的授权码；
    授权内容校验模块，用于若授权者身份校验通过，则对访问请求信息中的授权码进行授权内容校验；
    信息回复模块，用于根据授权内容校验的结果，对请求方的访问请求信息作出回复。
PCT/CN2021/071985 2020-02-27 2021-01-15 超级账本的授权访问方法、装置及存储介质 WO2021169655A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010122964.9A CN111431857B (zh) 2020-02-27 2020-02-27 超级账本的授权访问方法、装置及存储介质
CN202010122964.9 2020-02-27

Publications (1)

Publication Number Publication Date
WO2021169655A1 true WO2021169655A1 (zh) 2021-09-02

Family

ID=71547783

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/071985 WO2021169655A1 (zh) 2020-02-27 2021-01-15 超级账本的授权访问方法、装置及存储介质

Country Status (2)

Country Link
CN (1) CN111431857B (zh)
WO (1) WO2021169655A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111431857B (zh) * 2020-02-27 2022-09-27 深圳壹账通智能科技有限公司 超级账本的授权访问方法、装置及存储介质
CN112118107B (zh) * 2020-08-12 2021-08-27 北京大学 一种实现数据可信的自适应执行方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107135209A (zh) * 2017-04-21 2017-09-05 天津理工大学 一种基于区块链的数据共享方法
CN107426157A (zh) * 2017-04-21 2017-12-01 杭州趣链科技有限公司 一种基于数字证书以及ca认证体系的联盟链权限控制方法
US20190102755A1 (en) * 2017-09-29 2019-04-04 PokitDok, Inc. Blockchain system and method with secure cryptoassets
CN110447022A (zh) * 2017-03-19 2019-11-12 国际商业机器公司 区块链数据的自动生成分析
CN111431857A (zh) * 2020-02-27 2020-07-17 深圳壹账通智能科技有限公司 超级账本的授权访问方法、装置及存储介质

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109361663B (zh) * 2018-10-10 2021-05-28 中航信托股份有限公司 一种访问加密数据的相关方法、系统和相关装置
CN109587132B (zh) * 2018-11-29 2021-03-26 南京苏宁软件技术有限公司 一种基于联盟链的数据传递方法及装置
CN109600366A (zh) * 2018-12-06 2019-04-09 中链科技有限公司 基于区块链的保护用户数据隐私的方法及装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110447022A (zh) * 2017-03-19 2019-11-12 国际商业机器公司 区块链数据的自动生成分析
CN107135209A (zh) * 2017-04-21 2017-09-05 天津理工大学 一种基于区块链的数据共享方法
CN107426157A (zh) * 2017-04-21 2017-12-01 杭州趣链科技有限公司 一种基于数字证书以及ca认证体系的联盟链权限控制方法
US20190102755A1 (en) * 2017-09-29 2019-04-04 PokitDok, Inc. Blockchain system and method with secure cryptoassets
CN111431857A (zh) * 2020-02-27 2020-07-17 深圳壹账通智能科技有限公司 超级账本的授权访问方法、装置及存储介质

Also Published As

Publication number Publication date
CN111431857B (zh) 2022-09-27
CN111431857A (zh) 2020-07-17

Similar Documents

Publication Publication Date Title
US11539685B2 (en) Federated identity management with decentralized computing platforms
US10771459B2 (en) Terminal apparatus, server apparatus, blockchain and method for FIDO universal authentication using the same
US10735182B2 (en) Apparatus, system, and methods for a blockchain identity translator
US9967261B2 (en) Method and system for secure authentication
US9398009B2 (en) Device driven user authentication
JP6046765B2 (ja) 秘密情報にアクセスするための、多重パーティ及び多重レベルの承認を可能にするシステム及び方法
WO2017167093A1 (zh) 基于生物特征的身份注册、认证的方法和装置
US7571473B1 (en) Identity management system and method
US20190050551A1 (en) Systems and methods for authenticating users
TWI728261B (zh) 判定認證能力之查詢系統、方法及非暫態機器可讀媒體
US8141134B2 (en) Authentication engine for enrollment into a computer environment
CN106575281B (zh) 用于实施托管的验证服务的系统和方法
US11824850B2 (en) Systems and methods for securing login access
WO2021169655A1 (zh) 超级账本的授权访问方法、装置及存储介质
US20190320039A1 (en) Systems and methods for use in providing digital identities
CA3178249A1 (en) Systems and methods for conducting remote attestation
US10230564B1 (en) Automatic account management and device registration
CN113343216B (zh) 一种发行者的管理方法、装置、存储介质及服务器
KR20180034199A (ko) 싱글 사인 온 서비스 기반의 상호 인증 방법 및 시스템
JP2015203974A (ja) 認証システム
US20240163279A1 (en) Systems and methods for securing login access
US20230064932A1 (en) Systems and methods for use in establishing reusable data files associated with users
CN117411725B (zh) 门户应用认证方法、装置、及计算机设备
US20240129311A1 (en) Digital identity step-up
CN117436888A (zh) 支付服务处理方法、装置、计算机设备和存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21761360

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 11/01/2023)

122 Ep: pct application non-entry in european phase

Ref document number: 21761360

Country of ref document: EP

Kind code of ref document: A1