WO2022205961A1 - 一种更新区块链域名配置的方法和装置 - Google Patents
一种更新区块链域名配置的方法和装置 Download PDFInfo
- Publication number
- WO2022205961A1 WO2022205961A1 PCT/CN2021/133073 CN2021133073W WO2022205961A1 WO 2022205961 A1 WO2022205961 A1 WO 2022205961A1 CN 2021133073 W CN2021133073 W CN 2021133073W WO 2022205961 A1 WO2022205961 A1 WO 2022205961A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- domain name
- blockchain
- version number
- configuration package
- certificate
- Prior art date
Links
- 238000000034 method Methods 0.000 title claims abstract description 55
- 238000012795 verification Methods 0.000 claims abstract description 84
- 238000004590 computer program Methods 0.000 claims description 12
- 230000027455 binding Effects 0.000 description 6
- 238000009739 binding Methods 0.000 description 6
- 238000010586 diagram Methods 0.000 description 2
- 230000006870 function Effects 0.000 description 2
- 230000008569 process Effects 0.000 description 2
- 230000009286 beneficial effect Effects 0.000 description 1
- 230000008859 change Effects 0.000 description 1
- 230000007812 deficiency Effects 0.000 description 1
- 238000013461 design Methods 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 239000004744 fabric Substances 0.000 description 1
- 230000036541 health Effects 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 230000003993 interaction Effects 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 238000012545 processing Methods 0.000 description 1
- 230000000750 progressive effect Effects 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L61/00—Network arrangements, protocols or services for addressing or naming
- H04L61/45—Network directories; Name-to-address mapping
- H04L61/4505—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols
- H04L61/4511—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols using domain name system [DNS]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L61/00—Network arrangements, protocols or services for addressing or naming
- H04L61/50—Address allocation
- H04L61/5076—Update or notification mechanisms, e.g. DynDNS
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/10—Protocols in which an application is distributed across nodes in the network
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
Definitions
- the embodiments of this specification relate to the field of blockchain technology, and more particularly, to a method and apparatus for updating the configuration of a blockchain domain name.
- Blockchain technology also known as published ledger technology, is a decentralized published database technology, which is characterized by decentralization, openness, transparency, immutability, and trustworthiness. Each data of the blockchain will be broadcast to the blockchain nodes of the entire network, and each full node has a full amount of consistent data.
- many different types of chains have emerged, which are applied in the fields of finance, health care, supply chain, asset management and traceability.
- most on-chain applications encrypted currencies or smart contracts
- How to make different types of chains cooperate to realize the circulation of value has become the direction of exploration.
- each blockchain instance is deployed in the cross-blockchain network.
- the current access method of each blockchain instance is accessed through technical components such as the client or SDK of the blockchain.
- different blockchains are distinguished by the domain name with strong readability, and the domain name is bound to the verification root of the blockchain, so that the verification root of the blockchain can be obtained through domain name resolution, and the verification root can be obtained through the verification root of the blockchain.
- Perform operations such as verification of blockchain data.
- Establishing a unified blockchain readable identity through domain names is an important basis for cross-chain interaction.
- the domain name owner may wish to change the binding relationship between the domain name and the blockchain, and there is no solution for efficiently changing the domain name configuration in the prior art.
- the embodiments of this specification aim to provide a more effective solution for updating the configuration of the blockchain domain name, so as to solve the deficiencies in the prior art.
- one aspect of this specification provides a method for updating the configuration of a blockchain domain name, the method is executed by a device of a domain name owner, and the domain name owner has a private key corresponding to a first domain name, and the first domain name owner has a private key corresponding to the first domain name.
- the configuration of the domain name is currently determined based on the first domain name configuration package, where the first domain name configuration package includes the first domain name, the verification root of the first blockchain, and the first version number, and the method includes: generating a second domain name configuration package , the second domain name configuration package includes the first domain name, the verification root of the second blockchain, and a second version number, where the second version number is a version number different from the first version number; use The private key digitally signs the second domain name configuration package; publishes the second domain name configuration package and its digital signature.
- the second domain name configuration package includes a domain name certificate and a digital signature of the domain name certificate by the domain name issuing platform, and the domain name certificate includes the first domain name and a domain name corresponding to the first domain name. 's public key.
- both the first version number and the second version number are integers greater than or equal to zero, wherein the second version number is greater than the first version number.
- the second blockchain is an Ethereum chain type blockchain
- the verification root of the second blockchain is the hash value of the genesis block of the second blockchain.
- Another aspect of this specification provides a method for updating the configuration of a blockchain domain name.
- the method is executed by a data receiver device.
- the data receiver device currently configures a first domain name based on a first domain name configuration package.
- the domain name configuration package includes the first domain name, the verification root of the first blockchain and the first version number
- the method includes: acquiring the current latest second domain name configuration package corresponding to the first domain name and its digital signature
- the second domain name configuration package includes the first domain name, the verification root of the second blockchain, and the second version number; obtain the public key corresponding to the first domain name; use the public key to pair the digital
- the signature is verified; in the case of passing the verification, determine whether the first version number is equal to the second version number; in the case that the first version number is not equal to the second version number, in the local update all configuration of the first domain name, so that the first domain name is associated with the verification root of the second blockchain.
- the second domain name configuration package includes a domain name certificate and a digital signature of the domain name certificate by the domain name issuing platform, and the domain name certificate includes the domain name issued by the domain name issuing platform and the domain name issued by the domain name issuing platform.
- Issuing the public key corresponding to the domain name wherein obtaining the public key corresponding to the first domain name includes determining whether the issued domain name in the domain name certificate is consistent with the first domain name;
- the public key of the domain name issuing platform verifies the digital signature of the domain name certificate; in the case of passing the verification of the digital signature of the domain name certificate, the public key corresponding to the first domain name is obtained from the domain name certificate. key.
- the method is performed by a multi-chain client in a data recipient device.
- the method is performed before validating first data from a blockchain with the first domain name.
- Another aspect of this specification provides a device for updating the configuration of a blockchain domain name
- the device is deployed in the device of a domain name owner, the domain name owner has a private key corresponding to a first domain name, and the configuration of the first domain name It is currently determined based on the first domain name configuration package, which includes the first domain name, the verification root of the first blockchain, and the first version number
- the device includes: a generating unit configured to generate a second A domain name configuration package, the second domain name configuration package includes the first domain name, the verification root of the second blockchain, and a second version number, where the second version number is a different version from the first version number
- the signing unit is configured to use the private key to digitally sign the second domain name configuration package; the publishing unit is configured to publish the second domain name configuration package and its digital signature.
- a domain name configuration package includes a first domain name, a verification root of the first blockchain and a first version number
- the apparatus includes: a first obtaining unit configured to obtain the current latest first domain name corresponding to the first domain name
- a second domain name configuration package and its digital signature, the second domain name configuration package includes the first domain name, the verification root of the second blockchain and the second version number
- the second obtaining unit is configured to obtain the a public key corresponding to the first domain name
- a verification unit configured to use the public key to verify the digital signature
- a determination unit configured to, in the case of passing the verification, determine whether the first version number is equal to the the second version number
- the updating unit is configured to, in the case that the first version number is not equal to the second version number, locally update the configuration of the first domain name, so that the first domain name and the
- the second domain name configuration package includes a domain name certificate and a digital signature of the domain name certificate by the domain name issuing platform, and the domain name certificate includes the domain name issued by the domain name issuing platform and the domain name issued by the domain name issuing platform.
- the second obtaining unit includes a determining subunit configured to determine whether the issued domain name in the domain name certificate is consistent with the first domain name; the verifying subunit is configured to: In the case of being consistent, use the pre-obtained public key of the domain name issuing platform to verify the digital signature of the domain name certificate; the acquiring subunit is configured to, in the case that the verification of the digital signature of the domain name certificate is passed, The public key corresponding to the first domain name is obtained from the domain name certificate.
- Another aspect of the present specification provides a computer-readable storage medium on which a computer program or instruction is stored, and when the computer program or instruction is executed in a computer, causes the computer to execute any one of the above methods.
- Another aspect of the present specification provides a computing device, including a memory and a processor, where a computer program or instruction is stored in the memory, and the processor implements any one of the above methods when executing the computer program or instruction.
- the domain name owner can replace the existing domain name configuration package by publishing a new domain name configuration package, and the data receiver can obtain the new domain name configuration package in time. Obtain a new blockchain verification root corresponding to the domain name, thus preventing security attacks.
- FIG. 1 shows a schematic diagram of a system for configuring a domain name according to an embodiment of the present specification
- FIG. 2 shows a flowchart of a method for updating a blockchain domain name configuration according to an embodiment of the present specification
- Fig. 3 schematically shows the domain name configuration package of version 0 of the domain name "chain1"
- Fig. 4 schematically shows the domain name configuration package of another version 0 of the domain name "chain1"
- FIG. 7 shows a flowchart of a method for updating the configuration of a blockchain domain name according to an embodiment of the present specification
- FIG. 9 shows an apparatus 900 for updating the configuration of a blockchain domain name according to an embodiment of the present specification.
- FIG. 1 shows a schematic diagram of a system for domain name configuration according to an embodiment of the present specification.
- the system includes a domain name issuing platform 11, and the domain name issuing platform 11 owns the domain name by issuing the domain name to a plurality of blockchain platforms.
- the blockchain platform 12 is included in the plurality of blockchain platforms. In order to own the blockchain domain name, the blockchain platform 12 needs to apply to the domain name issuing platform 11, for example, to apply for the domain name "chain1".
- the domain name issuing platform 11 After determining that the domain name "chain1" does not have the same name as the existing blockchain domain name, the domain name issuing platform 11 generates a private key and a public key corresponding to "chain1", and then generates a domain name certificate including the domain name "chain1" and the public key, And use the private key of the domain name issuing platform itself to generate the digital signature of the domain name certificate. Then, the domain name issuing platform 11 provides the private key, the domain name certificate and the domain name certificate signature of the domain name "chain1" to the blockchain platform 12, so that the blockchain platform 12 owns the domain name "chain1".
- the blockchain platform 12 develops a first blockchain (a first blockchain instance), which generates a domain name configuration package based on the domain name "chain1", the verification root of the first blockchain, the domain name certificate, and the signature of the domain name certificate , use the private key corresponding to the domain name to digitally sign the domain name configuration package, and publish the domain name configuration information of the domain name "chain1", where the domain name configuration information includes the domain name configuration package and its digital signature.
- the cross-chain network includes multiple relay devices (for example, the first relay device 13 in the figure) and multiple other blockchains (blockchain instances).
- the first relay device 13 or Other blockchain nodes may be provided with multi-chain clients.
- the domain name "chain1” can be configured in the multi-chain client to be associated with the verification root of the first blockchain, that is, the domain name "chain1" is bound to the first blockchain, thereby The data from the first blockchain whose domain name is chain1 can be verified using the verification root of the first blockchain.
- the domain name configuration package of the domain name is not limited to the configuration as described above.
- the cross-chain network is not limited to binding the domain name to the corresponding blockchain instance in the multi-chain client.
- the domain name can also be bound to the corresponding blockchain instance based on the domain name configuration package in the predetermined smart contract.
- Fig. 2 shows a flowchart of a method for updating the configuration of a blockchain domain name according to an embodiment of the present specification.
- the method is executed by a device of a domain name owner, and the domain name owner owns a private key corresponding to the first domain name.
- the configuration of the first domain name is currently determined based on the first domain name configuration package.
- the first domain name configuration package includes the first domain name, the verification root of the first blockchain, and the first version number.
- the method includes: Step S202, generating A second domain name configuration package, the second domain name configuration package includes the first domain name, the verification root of the second blockchain, and a second version number, where the second version number is different from the first version number Step S204, use the private key to digitally sign the second domain name configuration package; Step S206, publish the second domain name configuration package and its digital signature.
- the domain name owner in this method is, for example, the blockchain platform 12 , which obtains the domain name "chain1" and the private key corresponding to the domain name "chain1" through the issuance of the domain name issuing platform 11 .
- the domain name issuing platform 11 may only provide the domain name "chain1" and the private key k1 corresponding to the domain name "chain1" to the blockchain platform 12, and in addition, the domain name issuing platform 11 externally provides a pair of keys corresponding to a specific domain name. public key query service.
- the blockchain platform 12 after receiving the domain name "chain1" and the private key corresponding to the domain name "chain1", the blockchain platform 12 initially wishes to associate the domain name "chain1" with the first blockchain whose verification root is the verification root 1 Binding, so that the domain name configuration information of the initial version can be released to bind the domain name "chain1" to the first blockchain, and the domain name configuration information includes the domain name configuration package with version number 0 (that is, the first domain name configuration package), and the blockchain platform 12 uses the private key k1 to digitally sign the domain name configuration package.
- Figure 3 schematically shows the domain name configuration package of version 0 of the domain name "chain1".
- the domain name configuration package has a predetermined data structure, for example, it includes 3 fields arranged in sequence, wherein the first field represents the version number (ie "0"), the second field represents the domain name (ie "" chain1"), and the third field represents the verification root (ie, "verification root 1") of the corresponding blockchain (here, the first blockchain).
- the verification root 1 may be verification data or minimum verification data for verifying the data in the first blockchain.
- the verification root 1 can be the hash value of the genesis block of the first blockchain, if the first blockchain is a Hyperledger Fabric chain type area block chain, the verification root 1 may be the respective public keys of a predetermined number of endorsing nodes of the first block chain.
- the blockchain platform 12 makes the multi-chain client in the cross-chain network bind “chain1” to the first blockchain by publishing the domain name configuration package shown in FIG. 3 and the digital signature of the domain name number package through k1 .
- the domain name issuing platform 11 provides the private key corresponding to the domain name "chain1", the domain name certificate, and the digital signature of the domain name issuing platform 11 on the domain name certificate to the blockchain platform 12, thereby Based on these data, the blockchain platform 12 can configure the domain name configuration package of version 0 for binding the domain name "chain1" to the first blockchain.
- FIG. 4 schematically shows another version 0 domain name configuration package of the domain name "chain1".
- the domain name configuration package includes five fields, the first three fields are the same as the three fields shown in FIG. 3 , and the fourth field is the domain name certificate generated by the domain name issuing platform 11 .
- the certificate includes the domain name "chain1" and the public key kp1 corresponding to the domain name "chain1”, and the fifth field is the digital signature of the domain name certificate by the domain name issuing platform 11 using its private key k2.
- the blockchain platform 12 can update the configuration of the domain name "chain1" through the following steps.
- step S202 a second domain name configuration package is generated, and the second domain name configuration package includes the first domain name, the verification root of the second blockchain, and a second version number, and the second version number is the same as the The first version number is a different version number.
- FIG. 5 shows the domain name configuration package of version 1 corresponding to the domain name configuration package shown in FIG. 3 , that is, the second domain name configuration package.
- the version 1 domain name configuration package includes 3 fields, of which the first field represents the version number, where the version number has changed from the previous "0" to "1", The second field is the domain name "chain1", and the third field is the verification root of the second blockchain (ie "verification root 2").
- the version number of the new domain name configuration package is determined as version 1 relative to the domain name configuration package of version 0, which is used to indicate that the domain name configuration package of version 1 is an updated domain name configuration package.
- the new version number is not limited to be represented as "1", as long as it is different from the previous version number, for example, it can also be 2, 3 and so on.
- the version number of the subsequent domain name configuration package can be set to be larger than the previous version number, so as to avoid duplication with the previous version number.
- the domain name configuration package of version 1 by binding the domain name "chain1" to the verification root 2 of the second blockchain, it is used to bind the domain name "chain1" to the second blockchain.
- FIG. 6 shows a domain name configuration package showing version 1 corresponding to the domain name configuration package shown in FIG. 4 .
- the first three fields are the same as the three fields shown in Figure 5, and the fourth and fifth fields are the same as the fourth and fifth fields in Figure 4.
- step S204 use the private key to digitally sign the second domain name configuration package.
- the blockchain platform 12 After the blockchain platform 12 generates the second domain name configuration package, it can use its own private key k1 corresponding to the domain name "chain1" to digitally sign the second domain name configuration package to prove that the second domain name configuration package is The package is generated by the owner of the domain name "chain1" (ie the blockchain platform 12).
- step S206 the second domain name configuration package and its digital signature are published.
- the blockchain platform 12 may provide a predetermined query interface or publishing window to publish the second domain name configuration package and its digital signature.
- the blockchain platform 12 may set up a domain name configuration package publishing center through a third-party trusted platform, and the publishing center provides a query interface for querying the latest domain name configuration package released by the blockchain platform 12 .
- the method is executed by a data receiver device.
- the data receiver device currently configures the first domain name configuration package based on the first domain name configuration package.
- domain name the first domain name configuration package includes the first domain name, the verification root of the first blockchain and the first version number
- the method includes: step S702, obtaining the current latest first domain name corresponding to the first domain name Second domain name configuration package and its digital signature, the second domain name configuration package includes the first domain name, the verification root of the second blockchain and the second version number;
- Step S704 obtain the corresponding first domain name public key;
- Step S706, use the public key to verify the digital signature;
- Step S708 in the case of passing the verification, determine whether the first version number is equal to the second version number;
- Step S710 in the In the case where the first version number is not equal to the second version number, the configuration of the first domain name is updated locally, so that the first domain name is associated with the verification root of the second blockchain.
- the method is performed, for example, in a multi-chain client in the first relay device 13 .
- the method may be performed periodically in the multi-chain client in the first relay device 13 to periodically update the domain name configuration, or may verify the data after receiving the data from the blockchain with the domain name "chain1" Previously, this method was implemented to ensure that the data was validated with the correct authentication root, preventing security attacks. It can be understood that the method is not limited to be executed in the client, for example, the method can also be executed in the blockchain node by executing the preset algorithm in the smart contract.
- step S702 obtain the current latest second domain name configuration package and its digital signature corresponding to the first domain name, and the second domain name configuration package includes the verification of the first domain name and the second blockchain root and second version number.
- Step S704 obtaining the public key corresponding to the first domain name.
- the second domain name configuration package is the domain name configuration package shown in FIG. 5 .
- the multi-chain client can query the domain name issuing platform 11 with the domain name “chain1” "The corresponding public key kp1, or the multi-chain client has previously queried and saved the public key kp1 corresponding to the domain name "chain1" locally, so the multi-chain client can directly read the public key kp1 locally.
- the second domain name configuration package is the domain name configuration package shown in FIG. 6
- the multi-chain client reads the domain name in the second domain name configuration package Whether the domain name in the certificate is "chain1”, if the domain name in the domain name certificate is "chain1”, use the pre-acquired public key kp2 of the domain name issuing platform 11 to verify the digital signature of the domain name certificate.
- step S706 the digital signature is verified using the public key.
- the multi-chain client can verify the digital signature of the second domain name configuration package through the public key kp1. In the case of passing the verification, that is, it can be determined that the digital signature of the second domain name configuration package is determined by Generated by the blockchain platform 12, the second domain name configuration package is authentic and credible.
- step S708 if the verification is passed, it is determined whether the first version number is equal to the second version number.
- the multi-chain client first reads the version number field from the second domain name configuration package to determine whether the configuration of the domain name "chain1" in the client is performed based on the latest version. For example, if the multi-chain client records that the current configuration of the domain name "chain1" is based on the domain name configuration package of version 0, and the version number in the second domain name configuration package read is 1, the two versions can be determined. The numbers are different, that is, the configuration of the domain name "chain1" in the client is not the latest configuration.
- step S710 in the case that the first version number is not equal to the second version number, locally update the configuration of the first domain name, so that the first domain name and the second blockchain Verify that the root is associated.
- the multi-chain client can read the "authentication root 2" from the second domain name configuration package, and locally configure the domain name "chain1" to be associated with the "authentication root 2", that is, the domain name "chain1” is configured to bind to the second blockchain.
- the multi-chain client verifies the data from the blockchain with the domain name "chain1”, the data will be verified using the verification root 2 instead of the previous verification root 1.
- the latest domain name configuration package corresponding to the domain name "chain1" queried by the multi-chain client is the domain name configuration shown in Figure 3 or 4
- the local configuration of the domain name "chain1" by the multi-chain client is based on the latest domain name configuration package. Therefore, the configuration of the domain name "chain1" is safe and available, and the multi-chain client can continue to use the verification Root 1 verifies data from the blockchain with the domain name "chain1".
- FIG. 8 shows an apparatus 800 for updating the configuration of a blockchain domain name according to an embodiment of the present specification.
- the apparatus is deployed in the equipment of a domain name owner, and the domain name owner owns a private key corresponding to the first domain name.
- the configuration of the first domain name is currently determined based on the first domain name configuration package, where the first domain name configuration package includes the first domain name, the verification root of the first blockchain and the first version number, and the device includes: a generating unit 81, It is configured to generate a second domain name configuration package, where the second domain name configuration package includes the first domain name, the verification root of the second blockchain, and a second version number, and the second version number is the same as the first version number.
- a version number with different version numbers is configured to use the private key to digitally sign the second domain name configuration package;
- the publishing unit 83 is configured to publish the second domain name configuration package and its digital signature sign.
- FIG. 9 shows an apparatus 900 for updating the configuration of a blockchain domain name according to an embodiment of the present specification.
- the apparatus is deployed in a data receiver device, and the data receiver device currently configures the first domain name configuration package based on the first domain name configuration package.
- domain name, the first domain name configuration package includes the first domain name, the verification root of the first blockchain and the first version number
- the device includes: a first obtaining unit 91, configured to obtain and the first domain name The corresponding current latest second domain name configuration package and its digital signature, the second domain name configuration package includes the first domain name, the verification root of the second blockchain and the second version number;
- the second obtaining unit 92 is configured to obtain the public key corresponding to the first domain name;
- the verification unit 93 is configured to use the public key to verify the digital signature;
- the determination unit 94 is configured to, in the case of passing the verification, determine Whether the first version number is equal to the second version number;
- the updating unit 95 is configured to, in the case that the first version number is not
- the second domain name configuration package includes a domain name certificate and a digital signature of the domain name certificate by the domain name issuing platform, and the domain name certificate includes the domain name issued by the domain name issuing platform and the domain name issued by the domain name issuing platform.
- the second obtaining unit 92 includes a determining subunit 921, configured to determine whether the issued domain name in the domain name certificate is consistent with the first domain name; the verifying subunit 922, configured In order to verify the digital signature of the domain name certificate using the pre-obtained public key of the domain name issuing platform in the case of consistency; the obtaining subunit 923 is configured to, when the digital signature verification of the domain name certificate passes In the case of , the public key corresponding to the first domain name is obtained from the domain name certificate.
- Another aspect of the present specification provides a computer-readable storage medium on which a computer program or instruction is stored, and when the computer program or instruction is executed in a computer, causes the computer to execute any one of the above methods.
- the domain name owner can replace the existing domain name configuration package by publishing a new domain name configuration package, and the data receiver can obtain the new domain name configuration package in time. Obtain a new blockchain verification root corresponding to the domain name, thus preventing security attacks.
- the software module can be placed in random access memory (RAM), internal memory, read only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disks, removable disks, CD-ROMs, or technical fields in any other form of storage medium known in the art.
- RAM random access memory
- ROM read only memory
- electrically programmable ROM electrically erasable programmable ROM
- registers hard disks, removable disks, CD-ROMs, or technical fields in any other form of storage medium known in the art.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
- Storage Device Security (AREA)
Abstract
本说明书实施例提供了一种更新区块链域名配置的方法和装置，所述方法由域名拥有方设备执行，所述域名拥有方拥有与第一域名对应的私钥，所述第一域名的配置当前基于第一域名配置包确定，所述第一域名配置包中包括第一域名、第一区块链的验证根及第一版本号，所述方法包括：生成第二域名配置包，所述第二域名配置包中包括所述第一域名、第二区块链的验证根及第二版本号，所述第二版本号为与所述第一版本号不同的版本号；使用所述私钥对所述第二域名配置包进行数字签名；发布所述第二域名配置包及其数字签名。
Description
本说明书实施例涉及区块链技术领域，更具体地，涉及一种更新区块链域名配置的方法和装置。
区块链技术也被称之为发布式账本技术，是一种去中心化的发布式数据库技术，其特点是去中心化、公开透明、不可篡改、可信任。区块链的每笔数据，都会广播到全网的区块链节点，每个全节点都有全量的、一致的数据。随着区块链技术的火热，出现了许多不同类型的链，应用在金融、健康医疗、供应链、资产管理和溯源等领域。然而大部分链上应用(加密货币或者智能合约)都无法跨越当前链的边界，不能与其他链协同合作实现价值的流通，从而限制了区块链的发挥空间。如何能让不同类型的链协同合作实现价值的流通成了探索的方向。
目前，跨区块链网络中部署有基于不同区块链产品多个区块链实例，每个区块链实例目前的访问方式都通过区块链的客户端或SDK等技术组件访问，在这些客户端中，以可读性较强的域名区分不同的区块链，并将域名与区块链的验证根绑定，从而可通过域名解析获取区块链的验证根，并通过该验证根进行对区块链数据的验证等操作。通过域名建立统一的区块链可读标识，是跨链交互的重要基础。而在一些情况中，域名拥有方可能希望更改域名与区块链的绑定关系，而现有技术中尚未出现高效地更改域名配置的方案。
因此，需要一种更有效的更新区块链域名配置的方案。
发明内容
本说明书实施例旨在提供一种更有效的更新区块链域名配置的方案，以解决现有技术中的不足。
为实现上述目的，本说明书一个方面提供一种更新区块链域名配置的方法，所述方法由域名拥有方设备执行，所述域名拥有方拥有与第一域名对应的私钥，所述第一域名的配置当前基于第一域名配置包确定，所述第一域名配置包中包括第一域名、第一区块 链的验证根及第一版本号，所述方法包括：生成第二域名配置包，所述第二域名配置包中包括所述第一域名、第二区块链的验证根及第二版本号，所述第二版本号为与所述第一版本号不同的版本号；使用所述私钥对所述第二域名配置包进行数字签名；发布所述第二域名配置包及其数字签名。
在一种实施方式中，所述第二域名配置包中包括域名证书及域名发放平台对所述域名证书的数字签名，所述域名证书中包括所述第一域名和与所述第一域名对应的公钥。
在一种实施方式中，所述第一版本号和所述第二版本号都为大于等于零的整数，其中，所述第二版本号大于所述第一版本号。
在一种实施方式中，所述第二区块链为以太坊链类型区块链，所述第二区块链的验证根为所述第二区块链的创世块的哈希值。
本说明书另一方面提供一种更新区块链域名配置的方法，所述方法由数据接收方设备执行，所述数据接收方设备中当前基于第一域名配置包配置第一域名，所述第一域名配置包中包括第一域名、第一区块链的验证根及第一版本号，所述方法包括：获取与所述第一域名对应的当前最新的第二域名配置包及其数字签名，所述第二域名配置包中包括所述第一域名、第二区块链的验证根及第二版本号；获取与所述第一域名对应的公钥；使用所述公钥对所述数字签名进行验证；在验证通过的情况中，确定所述第一版本号是否等于所述第二版本号；在所述第一版本号不等于所述第二版本号的情况中，在本地更新所述第一域名的配置，以使得所述第一域名与所述第二区块链的验证根相关联。
在一种实施方式中，所述第二域名配置包中包括域名证书及域名发放平台对所述域名证书的数字签名，所述域名证书中包括由所述域名发放平台发放的域名和与所述发放域名对应的公钥，其中，获取与所述第一域名对应的公钥包括，确定所述域名证书中的发放域名与所述第一域名是否一致；在一致的情况中，使用预先获取的所述域名发放平台的公钥对所述域名证书的数字签名进行验证；在对所述域名证书的数字签名验证通过的情况中，从所述域名证书中获取与所述第一域名对应的公钥。
在一种实施方式中，所述方法由数据接收方设备中的多链客户端执行。
在一种实施方式中，所述方法在对第一数据进行验证之前执行，所述第一数据来自于具有所述第一域名的区块链。
本说明书另一方面提供一种更新区块链域名配置的装置，所述装置部署于域名拥有方设备中，所述域名拥有方拥有与第一域名对应的私钥，所述第一域名的配置当前基于 第一域名配置包确定，所述第一域名配置包中包括第一域名、第一区块链的验证根及第一版本号，所述装置包括：生成单元，配置为，生成第二域名配置包，所述第二域名配置包中包括所述第一域名、第二区块链的验证根及第二版本号，所述第二版本号为与所述第一版本号不同的版本号；签名单元，配置为，使用所述私钥对所述第二域名配置包进行数字签名；发布单元，配置为，发布所述第二域名配置包及其数字签名。
本说明书另一方面提供一种更新区块链域名配置的装置，所述装置部署于数据接收方设备中，所述数据接收方设备中当前基于第一域名配置包配置第一域名，所述第一域名配置包中包括第一域名、第一区块链的验证根及第一版本号，所述装置包括：第一获取单元，配置为，获取与所述第一域名对应的当前最新的第二域名配置包及其数字签名，所述第二域名配置包中包括所述第一域名、第二区块链的验证根及第二版本号；第二获取单元，配置为，获取与所述第一域名对应的公钥；验证单元，配置为，使用所述公钥对所述数字签名进行验证；确定单元，配置为，在验证通过的情况中，确定所述第一版本号是否等于所述第二版本号；更新单元，配置为，在所述第一版本号不等于所述第二版本号的情况中，在本地更新所述第一域名的配置，以使得所述第一域名与所述第二区块链的验证根相关联。
在一种实施方式中，所述第二域名配置包中包括域名证书及域名发放平台对所述域名证书的数字签名，所述域名证书中包括由所述域名发放平台发放的域名和与所述发放域名对应的公钥，其中，所述第二获取单元包括，确定子单元，配置为，确定所述域名证书中的发放域名与所述第一域名是否一致；验证子单元，配置为，在一致的情况中，使用预先获取的所述域名发放平台的公钥对所述域名证书的数字签名进行验证；获取子单元，配置为，在对所述域名证书的数字签名验证通过的情况中，从所述域名证书中获取与所述第一域名对应的公钥。
本说明书另一方面提供一种计算机可读存储介质，其上存储有计算机程序或指令，当所述计算机程序或指令在计算机中执行时，令计算机执行上述任一项方法。
本说明书另一方面提供一种计算设备，包括存储器和处理器，所述存储器中存储有计算机程序或指令，所述处理器在执行所述计算机程序或指令时，实现上述任一项方法。
通过根据本说明书实施例的更新区块链域名配置的方案，使得域名拥有方可通过发布新的域名配置包取代已有的域名配置包，数据接收方可通过及时获取新的域名配置包而及时获取域名对应的新的区块链验证根，从而可防止安全攻击。
通过结合附图描述本说明书实施例，可以使得本说明书实施例更加清楚：
图1示出根据本说明书实施例的用于进行域名配置的系统的示意图；
图2示出根据本说明书实施例的一种更新区块链域名配置的方法流程图；
图3示意示出域名“chain1”的0号版本的域名配置包；
图4示意示出域名“chain1”的另一0号版本的域名配置包；
图5示出与图3所示的域名配置包对应的1号版本的域名配置包；
图6示出示出与图4所示的域名配置包对应的1号版本的域名配置包；
图7示出根据本说明书实施例的一种更新区块链域名配置的方法流程图；
图8示出根据本说明书实施例的一种更新区块链域名配置的装置800；
图9示出根据本说明书实施例的一种更新区块链域名配置的装置900。
下面将结合附图描述本说明书实施例。
图1示出根据本说明书实施例的用于进行域名配置的系统的示意图。如图1中所示，该系统中包括域名发放平台11，域名发放平台11通过向多个区块链平台发放域名而使其拥有域名。所述多个区块链平台中包括区块链平台12。区块链平台12为了拥有区块链域名，需要向域名发放平台11进行申请，例如申请域名“chain1”。域名发放平台11在确定该域名“chain1”不与已有区块链域名重名之后，生成与“chain1”对应的私钥和公钥，然后生成包括域名“chain1”和公钥的域名证书，并使用自身(即域名发放平台)的私钥生成域名证书的数字签名。然后，域名发放平台11将域名“chain1”的私钥、域名证书和域名证书签名提供给区块链平台12，从而区块链平台12拥有了域名“chain1”。
区块链平台12例如开发有第一区块链(第一区块链实例)，其基于域名“chain1”、第一区块链的验证根、域名证书、及域名证书的签名生成域名配置包，使用与域名对应的私钥对该域名配置包进行数字签名，并发布域名“chain1”的域名配置信息，该域名配置信息包括域名配置包及其数字签名。如图1中所示，跨链网络中包括多个中继设备(例如图中的第一中继设备13)和多个其它区块链(区块链实例)，第一中继设备13或者 其它区块链节点中可能设置有多链客户端，第一中继设备13或其它区块链的节点在获取到由区块链平台发布的“chain1”域名配置包和数字签名之后，在对域名配置包进行验证之后，可在多链客户端中将域名“chain1”配置为与第一区块链的验证根相关联，即，将域名“chain1”与第一区块链绑定，从而可使用第一区块链的验证根来验证来自于域名为chain1的第一区块链的数据。
在一些情况中，例如第一区块链受到黑客的攻击，区块链平台12可能希望将其拥有的域名“chain1”与新的区块链实例(例如第二区块链)绑定，在该情况中，区块链平台可发布更新的域名配置包及其数字签名，从而使得跨链网络中的多链客户端可更新对域名“chain1”的配置，从而将域名“chain1”更新为第二区块链绑定。
可以理解，上述参考图1的描述仅仅是示例性的，而不是限制性的。例如，域名的域名配置包不限于如上文所述配置，另外，在跨链网络中不限于在多链客户端中将域名与相应的区块链实例进行绑定，在区块链节点中，也可以在预定智能合约中基于域名配置包将域名与相应的区块链实例进行绑定。
下面将详细描述上述域名配置方法。
图2示出根据本说明书实施例的一种更新区块链域名配置的方法流程图，所述方法由域名拥有方设备执行，所述域名拥有方拥有与第一域名对应的私钥，所述第一域名的配置当前基于第一域名配置包确定，所述第一域名配置包中包括第一域名、第一区块链的验证根及第一版本号，所述方法包括：步骤S202,生成第二域名配置包，所述第二域名配置包中包括所述第一域名、第二区块链的验证根及第二版本号，所述第二版本号为与所述第一版本号不同的版本号；步骤S204,使用所述私钥对所述第二域名配置包进行数字签名；步骤S206,发布所述第二域名配置包及其数字签名。
如上文所述，该方法中的域名拥有方例如为区块链平台12，其通过域名发放平台11的发放而获取了域名“chain1”和与域名“chain1”对应的私钥。
在一种实施方式中，域名发放平台11可仅将域名“chain1”和与域名“chain1”对应的私钥k1提供给区块链平台12，另外，域名发放平台11对外提供对与特定域名对应的公钥的查询服务。在该情况中，区块链平台12在接收到域名“chain1”和与域名“chain1”对应的私钥之后，在初始希望将域名“chain1”与验证根为验证根1的第一区块链绑定，从而可通过发布初始版本的域名配置信息，以用于将域名“chain1”与第一区块链绑定，该域名配置信息中包括版本号为0的域名配置包(即第一域名配置包)、及区块链平台12 使用私钥k1对该域名配置包的数字签名。图3示意示出域名“chain1”的0号版本的域名配置包。如图3所示，该域名配置包具有预定数据结构，例如，其中包括3个顺序排列的字段，其中第1个字段表示版本号(即“0”)，第二个字段表示域名(即“chain1”)，第三个字段表示对应区块链(这里为第一区块链)的验证根(即“验证根1”)。这里，验证根1可以为用于对第一区块链中的数据进行验证的验证数据或者最小验证数据。例如，如果第一区块链为以太坊链类型的区块链，则验证根1可以为第一区块链的创世块的哈希值，如果第一区块链为Hyperledger Fabric链类型区块链，则验证根1可以为第一区块链的预定数目的背书节点各自的公钥。
区块链平台12通过发布图3所示的域名配置包及通过k1对该域名数目包的数字签名，从而使得跨链网络中的多链客户端将“chain1”与第一区块链绑定。
在一种实施方式中，如前文所述，域名发放平台11将与域名“chain1”对应的私钥、域名证书、以及域名发放平台11对域名证书的数字签名提供给区块链平台12，从而区块链平台12可基于这些数据配置0号版本的域名配置包，以用于将域名“chain1”与第一区块链绑定。图4示意示出域名“chain1”的另一0号版本的域名配置包。如图4所示，在该域名配置包中包括5个字段，其中前3个字段与图3所示的三个字段相同，第4个字段为由域名发放平台11生成的域名证书，该域名证书中包括域名“chain1”和与域名“chain1”对应的公钥kp1，第5个字段为由域名发放平台11使用其私钥k2对域名证书的数字签名。
当区块链平台12希望将域名“chain1”与验证根为“验证根2”的第二区块链绑定时，区块链平台12可通过以下步骤来更新域名“chain1”的配置。
在步骤S202,生成第二域名配置包，所述第二域名配置包中包括所述第一域名、第二区块链的验证根及第二版本号，所述第二版本号为与所述第一版本号不同的版本号。
图5示出与图3所示的域名配置包对应的1号版本的域名配置包，也即第二域名配置包。如图5所示，与图3对应地，该1号版本域名配置包中包括3个字段，其中第1个字段表示版本号，这里版本号已从之前的“0”变为“1”，第2个字段为域名“chain1”，第3个字段为第二区块链的验证根(即“验证根2”)。通过相对于0号版本的域名配置包将新的域名配置包的版本号确定为1号版本，用于指示，该1号版本的域名配置包为更新的域名配置包。可以理解，这里，不限于将新的版本号表示为“1”，只要其与之前的版本号不相同即可，例如，也可以为2、3等等。在后续再次更新域名配置时，可将后续的域名配置包的版本号设定为大于前一次的版本号，从而避免与过去的版本号重复。 在该1号版本的域名配置包中，通过将域名“chain1”与第二区块链的验证根2绑定，从而用于将域名“chain1”与第二区块链绑定。
图6示出示出与图4所示的域名配置包对应的1号版本的域名配置包。在该1号版本的域名配置包中，前3个字段与图5中所示的3个字段相同，第4、第5个字段与图4中的第4、第5个字段相同，为由域名发放平台11提供的域名证书和通过k2生成的域名证书的数字签名。
在步骤S204，使用所述私钥对所述第二域名配置包进行数字签名。
区块链平台12在生成第二域名配置包之后，可使用其拥有的与域名“chain1”对应的私钥k1对该第二域名配置包进行数字签名，以用于证明，该第二域名配置包是由域名“chain1”的拥有者(即区块链平台12)生成。
在步骤S206,发布所述第二域名配置包及其数字签名。
区块链平台12可提供预定查询接口或发布窗口，以发布所述第二域名配置包及其数字签名。或者区块链平台12可通过第三方可信平台设置域名配置包发布中心，该发布中心提供查询接口，以用于查询区块链平台12发布的最新域名配置包。
图7示出根据本说明书实施例的一种更新区块链域名配置的方法流程图，所述方法由数据接收方设备执行，所述数据接收方设备中当前基于第一域名配置包配置第一域名，所述第一域名配置包中包括第一域名、第一区块链的验证根及第一版本号，所述方法包括：步骤S702，获取与所述第一域名对应的当前最新的第二域名配置包及其数字签名，所述第二域名配置包中包括所述第一域名、第二区块链的验证根及第二版本号；步骤S704，获取与所述第一域名对应的公钥；步骤S706，使用所述公钥对所述数字签名进行验证；步骤S708，在验证通过的情况中，确定所述第一版本号是否等于所述第二版本号；步骤S710，在所述第一版本号不等于所述第二版本号的情况中，在本地更新所述第一域名的配置，以使得所述第一域名与所述第二区块链的验证根相关联。
参考图1，该方法例如在第一中继设备13中的多链客户端中执行。第一中继设备13中可在多链客户端中定期执行该方法，以定期对域名配置进行更新，或者可以在接收到来自域名为“chain1”的区块链的数据之后，在验证该数据之前，执行该方法，以确保通过正确的验证根对该数据进行验证，从而防止安全攻击。可以理解，该方法不限于在客户端中执行，例如，该方法也可以在区块链节点中通过执行智能合约中的预设算法而执行。
首先，在步骤S702，获取与所述第一域名对应的当前最新的第二域名配置包及其数字签名，所述第二域名配置包中包括所述第一域名、第二区块链的验证根及第二版本号。
假设当前区块链平台12已经发布了如图5或图6所示的1号版本的第二域名配置包及其数字签名，从而，第一中继设备13中的多链客户端可通过预定查询接口获取该第二域名配置包及其数字签名。
步骤S704，获取与所述第一域名对应的公钥。
在一种实施方式中，所述第二域名配置包为如图5所示的域名配置包，在获取该第二域名配置包之后，多链客户端可从域名发放平台11查询与域名“chain1”对应的公钥kp1，或者多链客户端在之前已经查询过并在本地保存了与域名“chain1”对应的公钥kp1，从而，该多链客户端可从本地直接读取公钥kp1。
在一种实施方式中，所述第二域名配置包为如图6所示的域名配置包，在获取该第二域名配置包之后，该多链客户端读取第二域名配置包中的域名证书中的域名是否为“chain1”，在域名证书中的域名为“chain1”的情况中，使用预先获取的域名发放平台11的公钥kp2对所述域名证书的数字签名进行验证。该验证过程具体是，计算域名证书的哈希值，使用公钥kp2对数字签名进行解密，确定域名证书的哈希值与所述解密获取的数据是否相同，如果相同，则证明该数字签名确实是通过域名发放平台11的私钥k2生成的，从而可验证该数字签名是由域名发放平台11生成。在对所述域名证书的数字签名验证通过的情况中，说明该域名证书确实为由域名发放平台11生成的“chain1”的域名证书，即，该域名证书中的公钥kp1确实为与域名“chain1”对应的公钥，从而，可从该域名证书中获取与域名“chain1”对应的公钥kp1。
在步骤S706，使用所述公钥对所述数字签名进行验证。
所述多链客户端在获取公钥kp1之后，可通过公钥kp1验证第二域名配置包的数字签名，在验证通过的情况中，即，可确定，该第二域名配置包的数字签名由区块链平台12生成，该第二域名配置包是真实可信的。
在步骤S708，在验证通过的情况中，确定所述第一版本号是否等于所述第二版本号。
从而，在验证通过之后，可读取该第二域名配置包中的数据，并且这些数据都是真实可信的。多链客户端首先从第二域名配置包中读取版本号字段，以确定客户端中的对域名“chain1”的配置是否基于最新版本进行。例如，多链客户端中记录了当前对域名“chain1”的配置基于0号版本的域名配置包进行，而读取的第二域名配置包中的版本号 为1，则可确定这两个版本号是不相同的，也就是说，客户端中的对域名“chain1”的配置不是最新配置。
在步骤S710，在所述第一版本号不等于所述第二版本号的情况中，在本地更新所述第一域名的配置，以使得所述第一域名与所述第二区块链的验证根相关联。
如上文所述，在确定所述第一版本号不等于所述第二版本号的情况中，也就是需要更新本地的对域名“chain1”的配置。如图5或6所示，多链客户端可从第二域名配置包中读取“验证根2”，并在本地将域名“chain1”配置为与“验证根2”相关联，也即将域名“chain1”配置为与第二区块链相绑定。从而，在多链客户端对来自域名为“chain1”的区块链的数据进行验证时，将使用验证根2对该数据进行验证，而不再使用之前的验证根1。
在所述第一版本号等于所述第二版本号的情况中，也就是说，多链客户端查询的与域名“chain1”对应的最新域名配置包为如图3或4所示的域名配置包，多链客户端本地对域名“chain1”的配置是基于当前最新的域名配置包进行配置的，因此，该对域名“chain1”的配置是安全可用的，该多链客户端可继续使用验证根1对来自域名为“chain1”的区块链的数据进行验证。
图8示出根据本说明书实施例的一种更新区块链域名配置的装置800，所述装置部署于域名拥有方设备中，所述域名拥有方拥有与第一域名对应的私钥，所述第一域名的配置当前基于第一域名配置包确定，所述第一域名配置包中包括第一域名、第一区块链的验证根及第一版本号，所述装置包括：生成单元81，配置为，生成第二域名配置包，所述第二域名配置包中包括所述第一域名、第二区块链的验证根及第二版本号，所述第二版本号为与所述第一版本号不同的版本号；签名单元82，配置为，使用所述私钥对所述第二域名配置包进行数字签名；发布单元83，配置为，发布所述第二域名配置包及其数字签名。
图9示出根据本说明书实施例的一种更新区块链域名配置的装置900，所述装置部署于数据接收方设备中，所述数据接收方设备中当前基于第一域名配置包配置第一域名，所述第一域名配置包中包括第一域名、第一区块链的验证根及第一版本号，所述装置包括：第一获取单元91，配置为，获取与所述第一域名对应的当前最新的第二域名配置包及其数字签名，所述第二域名配置包中包括所述第一域名、第二区块链的验证根及第二版本号；第二获取单元92，配置为，获取与所述第一域名对应的公钥；验证单元93，配置为，使用所述公钥对所述数字签名进行验证；确定单元94，配置为，在验证通过的情况中，确定所述第一版本号是否等于所述第二版本号；更新单元95，配置为，在所述 第一版本号不等于所述第二版本号的情况中，在本地更新所述第一域名的配置，以使得所述第一域名与所述第二区块链的验证根相关联。
在一种实施方式中，所述第二域名配置包中包括域名证书及域名发放平台对所述域名证书的数字签名，所述域名证书中包括由所述域名发放平台发放的域名和与所述发放域名对应的公钥，其中，所述第二获取单元92包括，确定子单元921，配置为，确定所述域名证书中的发放域名与所述第一域名是否一致；验证子单元922，配置为，在一致的情况中，使用预先获取的所述域名发放平台的公钥对所述域名证书的数字签名进行验证；获取子单元923，配置为，在对所述域名证书的数字签名验证通过的情况中，从所述域名证书中获取与所述第一域名对应的公钥。
本说明书另一方面提供一种计算机可读存储介质，其上存储有计算机程序或指令，当所述计算机程序或指令在计算机中执行时，令计算机执行上述任一项方法。
本说明书另一方面提供一种计算设备，包括存储器和处理器，所述存储器中存储有计算机程序或指令，所述处理器在执行所述计算机程序或指令时，实现上述任一项方法。
通过根据本说明书实施例的更新区块链域名配置的方案，使得域名拥有方可通过发布新的域名配置包取代已有的域名配置包，数据接收方可通过及时获取新的域名配置包而及时获取域名对应的新的区块链验证根，从而可防止安全攻击。
本说明书中的各个实施例均采用递进的方式描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。尤其，对于系统实施例而言，由于其基本相似于方法实施例，所以描述的比较简单，相关之处参见方法实施例的部分说明即可。
上述对本说明书特定实施例进行了描述。其它实施例在所附权利要求书的范围内。在一些情况下，在权利要求书中记载的动作或步骤可以按照不同于实施例中的顺序来执行并且仍然可以实现期望的结果。另外，在附图中描绘的过程不一定要求示出的特定顺序或者连续顺序才能实现期望的结果。在某些实施方式中，多任务处理和并行处理也是可以的或者可能是有利的。
本领域普通技术人员应该还可以进一步意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、计算机软件或者二者的结合来实现，为了清楚地说明硬件和软件的可互换性，在上述说明中已经按照功能一般性地描述了各示例的组成及步骤。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用 和设计约束条件。本领域普通技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。其中，软件模块可以置于随机存储器(RAM)、内存、只读存储器(ROM)、电可编程ROM、电可擦除可编程ROM、寄存器、硬盘、可移动磁盘、CD-ROM、或技术领域内所公知的任意其它形式的存储介质中。
以上所述的具体实施方式，对本发明的目的、技术方案和有益效果进行了进一步详细说明，所应理解的是，以上所述仅为本发明的具体实施方式而已，并不用于限定本发明的保护范围，凡在本发明的精神和原则之内，所做的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。
Claims (18)
- 一种更新区块链域名配置的方法，所述方法由域名拥有方设备执行，所述域名拥有方拥有与第一域名对应的私钥，所述第一域名的配置当前基于第一域名配置包确定，所述第一域名配置包中包括第一域名、第一区块链的验证根及第一版本号，所述方法包括：生成第二域名配置包，所述第二域名配置包中包括所述第一域名、第二区块链的验证根及第二版本号，所述第二版本号为与所述第一版本号不同的版本号；使用所述私钥对所述第二域名配置包进行数字签名；发布所述第二域名配置包及其数字签名。
- 根据权利要求1所述的方法，其中，所述第二域名配置包中包括域名证书及域名发放平台对所述域名证书的数字签名，所述域名证书中包括所述第一域名和与所述第一域名对应的公钥。
- 根据权利要求1所述的方法，其中，所述第一版本号和所述第二版本号都为大于等于零的整数，其中，所述第二版本号大于所述第一版本号。
- 根据权利要求1所述的方法，其中，所述第二区块链为以太坊链类型区块链，所述第二区块链的验证根为所述第二区块链的创世块的哈希值。
- 一种更新区块链域名配置的方法，所述方法由数据接收方设备执行，所述数据接收方设备中当前基于第一域名配置包配置第一域名，所述第一域名配置包中包括第一域名、第一区块链的验证根及第一版本号，所述方法包括：获取与所述第一域名对应的当前最新的第二域名配置包及其数字签名，所述第二域名配置包中包括所述第一域名、第二区块链的验证根及第二版本号；获取与所述第一域名对应的公钥；使用所述公钥对所述数字签名进行验证；在验证通过的情况中，确定所述第一版本号是否等于所述第二版本号；在所述第一版本号不等于所述第二版本号的情况中，在本地更新所述第一域名的配置，以使得所述第一域名与所述第二区块链的验证根相关联。
- 根据权利要求5所述的方法，其中，所述第二域名配置包中包括域名证书及域名发放平台对所述域名证书的数字签名，所述域名证书中包括由所述域名发放平台发放的域名和与所述发放域名对应的公钥，其中，获取与所述第一域名对应的公钥包括，确定所述域名证书中的发放域名与所述第一域名是否一致；在一致的情况中，使用预先获取的所述域名发放平台的公钥对所 述域名证书的数字签名进行验证；在对所述域名证书的数字签名验证通过的情况中，从所述域名证书中获取与所述第一域名对应的公钥。
- 根据权利要求5所述的方法，其中，所述方法由数据接收方设备中的多链客户端执行。
- 根据权利要求5所述的方法，其中，所述方法在对第一数据进行验证之前执行，所述第一数据来自于具有所述第一域名的区块链。
- 一种更新区块链域名配置的装置，所述装置部署于域名拥有方设备中，所述域名拥有方拥有与第一域名对应的私钥，所述第一域名的配置当前基于第一域名配置包确定，所述第一域名配置包中包括第一域名、第一区块链的验证根及第一版本号，所述装置包括：生成单元，配置为，生成第二域名配置包，所述第二域名配置包中包括所述第一域名、第二区块链的验证根及第二版本号，所述第二版本号为与所述第一版本号不同的版本号；签名单元，配置为，使用所述私钥对所述第二域名配置包进行数字签名；发布单元，配置为，发布所述第二域名配置包及其数字签名。
- 根据权利要求9所述的装置，其中，所述第二域名配置包中包括域名证书及域名发放平台对所述域名证书的数字签名，所述域名证书中包括所述第一域名和与所述第一域名对应的公钥。
- 根据权利要求9所述的装置，其中，所述第一版本号和所述第二版本号都为大于等于零的整数，其中，所述第二版本号大于所述第一版本号。
- 根据权利要求9所述的装置，其中，所述第二区块链为以太坊链类型区块链，所述第二区块链的验证根为所述第二区块链的创世块的哈希值。
- 一种更新区块链域名配置的装置，所述装置部署于数据接收方设备中，所述数据接收方设备中当前基于第一域名配置包配置第一域名，所述第一域名配置包中包括第一域名、第一区块链的验证根及第一版本号，所述装置包括：第一获取单元，配置为，获取与所述第一域名对应的当前最新的第二域名配置包及其数字签名，所述第二域名配置包中包括所述第一域名、第二区块链的验证根及第二版本号；第二获取单元，配置为，获取与所述第一域名对应的公钥；验证单元，配置为，使用所述公钥对所述数字签名进行验证；确定单元，配置为，在验证通过的情况中，确定所述第一版本号是否等于所述第二 版本号；更新单元，配置为，在所述第一版本号不等于所述第二版本号的情况中，在本地更新所述第一域名的配置，以使得所述第一域名与所述第二区块链的验证根相关联。
- 根据权利要求13所述的装置，其中，所述第二域名配置包中包括域名证书及域名发放平台对所述域名证书的数字签名，所述域名证书中包括由所述域名发放平台发放的域名和与所述发放域名对应的公钥，其中，所述第二获取单元包括，确定子单元，配置为，确定所述域名证书中的发放域名与所述第一域名是否一致；验证子单元，配置为，在一致的情况中，使用预先获取的所述域名发放平台的公钥对所述域名证书的数字签名进行验证；获取子单元，配置为，在对所述域名证书的数字签名验证通过的情况中，从所述域名证书中获取与所述第一域名对应的公钥。
- 根据权利要求13所述的装置，其中，所述装置部署于数据接收方设备中的多链客户端中。
- 根据权利要求13所述的装置，其中，所述装置在对第一数据进行验证之前部署，所述第一数据来自于具有所述第一域名的区块链。
- 一种计算机可读存储介质，其上存储有计算机程序或指令，当所述计算机程序或指令在计算机中执行时，令计算机执行权利要求1-8中任一项的所述的方法。
- 一种计算设备，包括存储器和处理器，所述存储器中存储有计算机程序或指令，所述处理器在执行所述计算机程序或指令时，实现权利要求1-8中任一项所述的方法。
Applications Claiming Priority (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110339677.8 | 2021-03-30 | ||
| CN202110339677.8A CN112737793B (zh) | 2021-03-30 | 2021-03-30 | 一种更新区块链域名配置的方法和装置 |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| WO2022205961A1 true WO2022205961A1 (zh) | 2022-10-06 |
Family
ID=75596074
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| PCT/CN2021/133073 WO2022205961A1 (zh) | 2021-03-30 | 2021-11-25 | 一种更新区块链域名配置的方法和装置 |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN112737793B (zh) |
| WO (1) | WO2022205961A1 (zh) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112737793B (zh) * | 2021-03-30 | 2021-09-28 | 支付宝(杭州)信息技术有限公司 | 一种更新区块链域名配置的方法和装置 |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20160342408A1 (en) * | 2015-05-20 | 2016-11-24 | International Business Machines Corporation | Rolling upgrade of a distributed application |
| CN109218082A (zh) * | 2018-08-24 | 2019-01-15 | 维沃移动通信有限公司 | 一种网络配置参数处理方法、装置及设备 |
| CN109672755A (zh) * | 2019-01-24 | 2019-04-23 | 中国互联网络信息中心 | 一种基于区块链的域名记录更新方法及系统 |
| CN111434085A (zh) * | 2018-11-16 | 2020-07-17 | 阿里巴巴集团控股有限公司 | 用于在区块链系统中进行跨链交互的域名管理方案 |
| CN112737793A (zh) * | 2021-03-30 | 2021-04-30 | 支付宝(杭州)信息技术有限公司 | 一种更新区块链域名配置的方法和装置 |
-
2021
- 2021-03-30 CN CN202110339677.8A patent/CN112737793B/zh active Active
- 2021-11-25 WO PCT/CN2021/133073 patent/WO2022205961A1/zh active Application Filing
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20160342408A1 (en) * | 2015-05-20 | 2016-11-24 | International Business Machines Corporation | Rolling upgrade of a distributed application |
| CN109218082A (zh) * | 2018-08-24 | 2019-01-15 | 维沃移动通信有限公司 | 一种网络配置参数处理方法、装置及设备 |
| CN111434085A (zh) * | 2018-11-16 | 2020-07-17 | 阿里巴巴集团控股有限公司 | 用于在区块链系统中进行跨链交互的域名管理方案 |
| CN109672755A (zh) * | 2019-01-24 | 2019-04-23 | 中国互联网络信息中心 | 一种基于区块链的域名记录更新方法及系统 |
| CN112737793A (zh) * | 2021-03-30 | 2021-04-30 | 支付宝(杭州)信息技术有限公司 | 一种更新区块链域名配置的方法和装置 |
Also Published As
| Publication number | Publication date |
|---|---|
| CN112737793A (zh) | 2021-04-30 |
| CN112737793B (zh) | 2021-09-28 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Nikitin et al. | {CHAINIAC}: Proactive {Software-Update} transparency via collectively signed skipchains and verified builds | |
| US10826888B2 (en) | Method for providing certificate service based on smart contract and server using the same | |
| Bozic et al. | A tutorial on blockchain and applications to secure network control-planes | |
| CN108111314B (zh) | 数字证书的生成和校验方法及设备 | |
| Reyzin et al. | Efficient asynchronous accumulators for distributed PKI | |
| CN108881252B (zh) | 身份认证数据处理方法、装置、计算机设备和存储介质 | |
| CN109104396B (zh) | 一种基于代理签名的区块链代理授权方法、介质 | |
| CN110569674A (zh) | 基于区块链网络的认证方法及装置 | |
| CN114008971A (zh) | 将分散标识符绑定到已验证声明 | |
| CN111092737A (zh) | 数字证书管理方法、装置及区块链节点 | |
| CN111311258B (zh) | 基于区块链的可信交易方法、装置、系统、设备及介质 | |
| CN110942302A (zh) | 一种区块链凭证撤销、验证方法、签发节点、验证节点 | |
| JP2023524715A (ja) | ネットワーク間の識別情報プロビジョニング | |
| US11757659B2 (en) | Post-quantum certificate binding | |
| US20210306135A1 (en) | Electronic device within blockchain based pki domain, electronic device within certification authority based pki domain, and cryptographic communication system including these electronic devices | |
| CN111340483A (zh) | 一种基于区块链的数据管理方法及相关设备 | |
| CN111835526A (zh) | 一种生成匿名凭证的方法及系统 | |
| CN105187218A (zh) | 一种多核心基础设施的数字化记录签名、验证方法 | |
| WO2022205961A1 (zh) | 一种更新区块链域名配置的方法和装置 | |
| Saleem et al. | ProofChain: An X. 509-compatible blockchain-based PKI framework with decentralized trust | |
| JP2022552420A (ja) | 証明書認証用の分散台帳に基づく方法およびシステム | |
| US20240126886A1 (en) | Trusted Computing for Digital Devices | |
| CN114189341A (zh) | 基于区块链标识的数字证书分级处理方法及装置 | |
| CN113159774A (zh) | 一种区块链中可监管零知识证明验证方法及系统 | |
| CN112653767B (zh) | 数字身份管理方法、装置、电子设备和可读存储介质 |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| 121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 21934597 Country of ref document: EP Kind code of ref document: A1 |
|
| NENP | Non-entry into the national phase |
Ref country code: DE |
|
| 122 | Ep: pct application non-entry in european phase |
Ref document number: 21934597 Country of ref document: EP Kind code of ref document: A1 |