WO2022205965A1 - 跨链访问控制方法和装置 - Google Patents

跨链访问控制方法和装置 Download PDF

Info

Publication number
WO2022205965A1
WO2022205965A1 PCT/CN2021/133116 CN2021133116W WO2022205965A1 WO 2022205965 A1 WO2022205965 A1 WO 2022205965A1 CN 2021133116 W CN2021133116 W CN 2021133116W WO 2022205965 A1 WO2022205965 A1 WO 2022205965A1
Authority
WO
WIPO (PCT)
Prior art keywords
resource
blockchain
access
identifier
transaction
Prior art date
Application number
PCT/CN2021/133116
Other languages
English (en)
French (fr)
Inventor
邱鸿霖
Original Assignee
蚂蚁区块链科技(上海)有限公司
支付宝(杭州)信息技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 蚂蚁区块链科技(上海)有限公司, 支付宝(杭州)信息技术有限公司 filed Critical 蚂蚁区块链科技(上海)有限公司
Publication of WO2022205965A1 publication Critical patent/WO2022205965A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/21—Design, administration or maintenance of databases
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/27—Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures

Definitions

  • the embodiments of this specification relate to the field of blockchain technology, and more particularly, to a cross-chain access control method and apparatus.
  • Blockchain technology also known as distributed ledger technology, is a decentralized distributed database technology characterized by decentralization, openness, transparency, immutability, and trustworthiness. Each data of the blockchain will be broadcast to the blockchain nodes of the entire network, and each full node has a full amount of consistent data.
  • many different types of chains have emerged, which are applied in the fields of finance, health care, supply chain, asset management and traceability.
  • most on-chain applications encrypted currencies or smart contracts
  • How to make different types of chains cooperate to realize the circulation of data has become the direction of exploration.
  • the cross-chain message to be sent to the second blockchain is written into the receipt of the first blockchain in the first blockchain, and the off-chain relay device from the first blockchain
  • the blockchain gets the receipt, provides the receipt to the second blockchain.
  • the receipt includes a data read request to the second blockchain or a call request to the smart contract.
  • one aspect of this specification provides a cross-chain access control method, the method is executed by a node device of a blockchain, a cross-chain contract is deployed in the blockchain, and the account status of the cross-chain contract is including an access control table corresponding to the blockchain, and the method includes: acquiring a first transaction and its digital signature, the first transaction calling the cross-chain contract, and providing a write to the cross-chain contract request, where the write request includes the identifier of the resource in the first blockchain and the authorization information of the resource; execute the first transaction to perform the following operations: Obtain the identifier for the resource based on the identifier of the resource Verifying the public key of the digital signature; using the public key to verify the digital signature; in the case of passing the verification, writing authorization information for the resource in the access control table.
  • acquiring the public key for verifying the digital signature based on the identifier of the resource includes determining the owner of the resource based on the identifier of the resource, and acquiring the public key of the owner.
  • the identifier of the resource is the account address of the smart contract
  • determining the owner of the resource based on the identifier of the resource includes reading the account status of the smart contract from the account state of the smart contract. The owner's account address.
  • the identifier of the resource includes an identifier of the second transaction, wherein determining the owner of the resource based on the identifier of the resource includes reading from the first blockchain based on the identifier of the second transaction Get the account address that sent the second transaction.
  • the identifier of the resource includes an identifier of the first block
  • acquiring the public key for verifying the digital signature based on the identifier of the resource includes acquiring, based on the identifier of the first block, the The public key of the owner of the first blockchain preset in the cross-chain contract.
  • the write request includes an identifier of an authorized account of the resource, and the authorized account is authorized to write the authorization information of the resource in the access control table, wherein in the Writing the authorization information for the resource in the access control table includes writing the identifier of the authorized account of the resource in the access control table.
  • acquiring the public key for verifying the digital signature based on the identifier of the resource includes reading the identifier of the authorized account of the resource in the access control table, and based on the authorized account to obtain the public key of the authorized account.
  • Another aspect of this specification provides a cross-chain access control method, the method is executed by a node device of a first blockchain, where a cross-chain contract is deployed in the first blockchain, and the account status of the cross-chain contract is includes an access control table corresponding to the blockchain, and the access control table includes authorization information of resources in the first blockchain, and the method includes: acquiring a third transaction, the third transaction Invoke the cross-chain contract, and provide an access request to the cross-chain contract, where the access request is used to request access to resources in the first blockchain; execute the third transaction to perform the following operations: based on The access control table determines whether the access request is authorized; in the case of determining that the access request is authorized, the access to the resource is performed.
  • the access request includes an identifier of the second blockchain that sent the access request, wherein determining whether the access request is authorized based on the access control table includes: based on the access control table The table determines whether the resource is a resource authorized to the second blockchain.
  • the access request further includes the requested access mode to the resource, wherein determining whether the access request is authorized based on the access control table includes: determining the access request based on the access control table. Whether the requested access mode to the resource is an authorized access mode.
  • the access request is a request for invoking a first contract in the first blockchain, wherein accessing the resource includes invoking the access request as an incoming parameter the first contract.
  • the access request is a read request for second data in the first blockchain, wherein accessing the resource includes reading from the first blockchain
  • the method further includes, after executing and completing the third transaction, storing the second data in the first blockchain.
  • a cross-chain access control device the device is deployed on a node device of a blockchain, where a cross-chain contract is deployed in the blockchain, and the account status of the cross-chain contract includes and The access control table corresponding to the blockchain, the device includes: an acquisition unit configured to acquire a first transaction and its digital signature, the first transaction invokes the cross-chain contract, and provides the cross-chain contract with A write request, where the write request includes an identifier of the resource in the first blockchain and authorization information of the resource; an execution unit, configured to execute the first transaction, the execution unit includes the following Subunit: an acquisition subunit, configured to acquire a public key for verifying the digital signature based on the identifier of the resource; a verification subunit, configured to use the public key to verify the digital signature; write The subunit is configured to, in the case of passing the verification, write authorization information for the resource in the access control table.
  • the obtaining subunit is further configured to determine the owner of the resource based on the identifier of the resource, and obtain the public key of the owner.
  • the identifier of the resource is the account address of the smart contract
  • the obtaining subunit is further configured to read the account address of the owner of the smart contract from the account state of the smart contract.
  • the identifier of the resource includes an identifier of the second transaction, wherein the obtaining subunit is further configured to read and send the second transaction from the first blockchain based on the identifier of the second transaction.
  • the account address of the transaction is not limited to the identifier of the second transaction.
  • the identifier of the resource includes the identifier of the first block, wherein the obtaining subunit is further configured to, based on the identifier of the first block, obtain the preset value in the cross-chain contract The public key of the owner of the first blockchain.
  • the write request includes an identifier of an authorized account of the resource, and the authorized account is authorized to write the authorization information of the resource in the access control table, wherein the The writing subunit is further configured to write the identifier of the authorized account of the resource in the access control table.
  • the obtaining subunit is further configured to read the identifier of the authorized account of the resource in the access control table, and obtain the public information of the authorized account based on the identifier of the authorized account. key.
  • a cross-chain access control device the device is deployed on a node device of a first blockchain, where a cross-chain contract is deployed in the first blockchain, and the account status of the cross-chain contract is includes an access control table corresponding to the blockchain, the access control table includes authorization information of the resources in the first blockchain, and the device includes: an obtaining unit configured to obtain a third transaction , the third transaction invokes the cross-chain contract, and provides an access request to the cross-chain contract, where the access request is used to request access to resources in the first blockchain; the execution unit is configured to execute For the third transaction, the execution unit includes the following subunits: a determination subunit, configured to determine whether the access request is authorized based on the access control table; an access subunit, configured to determine whether the access request is authorized When authorized, access to the resource is performed.
  • the access request includes an identifier of the second blockchain that sent the access request, wherein the judging subunit is further configured to: based on the access control table, determine whether the resource is a A resource authorized to the second blockchain.
  • the access request further includes the requested access mode to the resource, wherein the judging subunit is further configured to: determine the requested access to the resource based on the access control table Whether the access method is an authorized access method.
  • the access request is a call request to the first contract in the first blockchain, wherein the access subunit is further configured to call the access request with the access request as an incoming parameter the first contract.
  • the access request is a read request for the second data in the first blockchain
  • the access subunit is further configured to read from the first blockchain
  • the apparatus further includes a storage unit configured to store the second data in the first blockchain after the third transaction is executed and completed.
  • Another aspect of the present specification provides a computer-readable storage medium on which a computer program is stored, when the computer program is executed in a computer, the computer is made to execute any one of the above methods.
  • Another aspect of the present specification provides a computing device, including a memory and a processor, where executable code is stored in the memory, and when the processor executes the executable code, any one of the foregoing methods is implemented.
  • the owner of the resource or an account authorized by the resource owner can set the access authority of the resource in the ACL table by calling the cross-chain contract in the blockchain , so as to ensure the data security of the blockchain.
  • the blockchain executes a cross-chain contract to verify the permission of the access request based on the ACL table, thereby ensuring data security.
  • FIG. 1 shows a schematic diagram of a cross-chain system according to an embodiment of the present specification
  • FIG. 2 shows a flowchart of a cross-chain access control method according to an embodiment of the present specification
  • FIG. 3 shows a flowchart of a cross-chain access control method according to an embodiment of the present specification
  • FIG. 4 shows a cross-chain access control method according to an embodiment of the present specification
  • FIG. 5 shows a cross-chain access control apparatus 500 according to an embodiment of the present specification
  • FIG. 6 shows a cross-chain access control apparatus 600 according to an embodiment of the present specification.
  • FIG. 1 shows a schematic diagram of a cross-chain system according to an embodiment of the present specification.
  • the cross-chain system includes a first blockchain 11 , a relay device 12 and a second blockchain 13 .
  • the first blockchain 11 is connected to the second blockchain 13 through the relay device 12 .
  • the embodiment of this specification is not limited to this, for example, the first blockchain 11 and the second blockchain
  • the blockchains 13 may be connected to each other through multiple relay devices, which are not limited here.
  • a cross-chain contract is deployed in the first blockchain 11 , the account state of the cross-chain contract includes an access control table (ACL table), and the ACL table includes authorization information of resources in the first blockchain 11 .
  • the cross-chain contract includes an ACL table writing function and a permission verification function.
  • the ACL table writing function includes an identity authentication sub-function and a resource authentication sub-function.
  • the user can send a transaction calling the ACL table write function (hereinafter referred to as the write function) in the cross-chain contract to the first blockchain 11 through his device, so as to write the authorization information of a specific resource in the ACL table.
  • the node in the first blockchain 11 executes the transaction, it first executes the ACL table write function, thereby determining the owner or the authorized person of the resource by executing the resource authentication sub-function, and then determining the write through the identity authentication sub-function Whether the sender of the request is the owner of the resource or the authorizer of the resource, so as to determine whether to write to the ACL table based on the write request.
  • An off-chain device (eg, relay device 12 ) of the first blockchain 11 may send an access request to resources in the first blockchain 11 by sending a transaction calling the cross-chain contract to the first blockchain 11 .
  • the node in the first blockchain 11 executes the transaction, it first executes the permission verification function to verify the access permission of the access request based on the above ACL table, and then access the resource after the verification is passed.
  • FIG. 2 shows a flowchart of a cross-chain access control method according to an embodiment of the present specification. The method is executed by, for example, any node device in the first blockchain 11, and the method includes the following steps:
  • Step S202 acquire transaction n and its digital signature.
  • the n is the transaction number
  • the transaction n calls the writing function in the cross-chain contract, and provides the writing function with the identifier of the resource in the first blockchain and the writing function of the resource.
  • Step S204 executing transaction n, wherein, executing transaction n includes performing the following steps: Step S2041, determining the owner of the resource; Step S2042, verifying whether the signature is the signature of the owner; Step S2043, in In the case of verifying that the digital signature is not the signature of the owner, verify whether the signature is the signature of the authorized account of the resource; step S2044, write the ACL table.
  • the owner of the resource in the first blockchain 11 sends the transaction n and the digital signature to the first blockchain 11 through his device, so that each node device in the first blockchain 11 executes Step S202, obtain the transaction n and its digital signature from the first blockchain 11.
  • the digital signature is the digital signature of the sender of the transaction n to the transaction n.
  • the write function is called in the transaction n with a write request as an incoming parameter, and the write request includes the identifier of the specific resource to be authorized in the first blockchain and the information about the resource. authorization information.
  • the resources may include, for example, block data, transaction data, smart contracts and the like in the first blockchain 11 .
  • the identification of the block includes, for example, the block header hash value or the block number, etc.; the identification of the transaction includes, for example, the identification and transaction number of the exchange in the block; the identification of the smart contract includes, for example, the account address of the smart contract, etc. .
  • the authorization information includes, for example, the domain name of the blockchain authorized to use the specific resource, the authorized usage mode of the specific resource, and the like.
  • the authorized use methods include calling methods, and for resources such as block data and transaction data, the authorized use methods include reading methods, and so on.
  • step S204 the node device in the first blockchain 11 executes step S204 to execute transaction n.
  • the node device In the process of executing transaction n, the node device first executes step S2041 to determine the owner of the resource to determine whether the sender of the transaction n is the owner of the specific resource, that is, to determine whether the sender is the owner of the specific resource. Has permission to write to the ACL table. Therefore, the node device determines the owner of the resource by executing the resource authentication sub-function in the write function, and obtains the owner's public key.
  • the specific resource is a smart contract (eg, contract 1) deployed in the first blockchain 11, and the account address of the owner of the contract 1 is recorded in the owner field in the account state of the contract 1. Therefore, the node device can read the owner field in the account status of the contract 1 by executing the resource authentication sub-function to obtain the owner's account address, and can obtain the owner's account by reading the account status of the owner's account.
  • the owner's public key is a smart contract (eg, contract 1) deployed in the first blockchain 11, and the account address of the owner of the contract 1 is recorded in the owner field in the account state of the contract 1. Therefore, the node device can read the owner field in the account status of the contract 1 by executing the resource authentication sub-function to obtain the owner's account address, and can obtain the owner's account by reading the account status of the owner's account.
  • the owner's public key is a smart contract (eg, contract 1) deployed in the first blockchain 11, and the account address of the owner of the contract 1 is recorded in the owner field in the account
  • the specific resource is the transaction data of the transaction m stored in the first blockchain 11 .
  • different blockchains may have different regulations on the owner of the transaction data.
  • the transaction data of the transaction includes the transaction sender's certificate data, And in this blockchain, the owner of the transaction data is specified as the transaction sender, and in another blockchain, the owner of the transaction can be specified as the owner of the blockchain in the blockchain.
  • the resource authentication sub-function can preset a corresponding program according to the regulations on the owner of the transaction data in the first blockchain 11 .
  • the first blockchain 11 specifies that the owner of the transaction data is the sender of the transaction, then when the resource authentication sub-function is executed, the transaction m is read from the first blockchain 11 according to a preset program , obtain the sending account of transaction m from the transaction data, and obtain the account public key of the sending account from the account status of the sending account. If it is specified in the first blockchain 11 that the owner of the transaction data is the owner of the first blockchain 11, when the resource authentication sub-function is executed, the first blockchain preset in the resource authentication sub-function is obtained The public key of the owner of 11.
  • the specific resource is block data in the first blockchain 11, and generally, the owner of the block data is the owner of the corresponding blockchain.
  • the resource authentication sub-function can acquire the public key of the owner of the preset first blockchain 11 similarly to the above.
  • the node device executes step S2042, and determines whether the digital signature is the signature of the owner of the specific resource by executing the identity authentication sub-function. Specifically, after obtaining the public key of the owner of the specific resource, the identity authentication sub-function uses the public key to decrypt the digital signature, calculates the hash value of transaction n, and compares the decrypted data with the hash value. is the same. If they are the same, it can be determined that the digital signature is the signature of the owner of the specific resource, so that the node device can perform step S2044, and write the ACL table by executing the write function. As shown in FIG.
  • the ACL table is stored in the account state of the cross-chain contract, and writing the ACL table changes the account state of the cross-chain contract. If different, the node device will not write to the ACL table based on the write request, thereby improving the data security of the first blockchain 11 by executing the cross-chain contract to control the writing to the ACL table.
  • Table 1 shows a schematic diagram of the ACL table.
  • the column “Resource” is used to record the identifier of the resource in the first blockchain 11, and the resource includes, for example, block data, transaction data, smart contracts, etc., "Blockchain identifier"
  • a column is used to record the identity of the blockchain that is authorized to use the corresponding resource.
  • the domain name of the blockchain is used as the identity of the blockchain, and the column “Access Mode” is used to record the authorized access to the corresponding resource.
  • the access method includes calling the contract and reading the data. Specifically, assuming that the domain name of the second blockchain 13 is domain name 2, it is recorded in Table 1 that the second blockchain 13 is authorized to call the contract 1 in the first blockchain 11 and the first Read permission for transaction m in block N in blockchain 11.
  • the access control list shown in Table 1 is only illustrative and not restrictive.
  • the block chain identifier column is not limited to recording the domain name of the block chain, but other block chain identifiers used to uniquely identify the block chain can be recorded.
  • the access control table is not limited to including those shown in Table 1. 3 columns, but only one or two of them can be recorded.
  • the ACL table can only include the "resource" column in table 1, which means that the call permission to contract 1 is authorized for all blockchains , read access to transaction m in block N and block M.
  • the transaction n requests to write an account identifier authorized to set access rights to a specific resource in the ACL table, where the account identifier is, for example, an account public key or an account address.
  • the node device after determining that the digital signature is the signature of the owner of the specific resource by executing the resource authentication sub-function and the identity authentication sub-function, the node device writes the account authorized to the specific resource in the ACL table logo.
  • Table 2 shows a schematic diagram of the ACL table in this embodiment.
  • the authorized account is used to record the account publicity of the account authorized to set the access authority of the resource in the ACL table.
  • key shown schematically as abc456 in Table 2. It can be understood that the column of authorized accounts in Table 2 is not limited to recording account public keys. In the case where the account is an account in the first blockchain 11, the account can also be recorded in the ACL table. address.
  • the node device may perform step S2043 by executing the identity authentication sub-function to determine whether the signature is the signature of an authorized account . Specifically, the node device reads the account public key of the authorized account of the specific resource from the ACL table by executing the ACL table write function, and uses the public key to verify the signature, thereby determining whether the signature is the signature of the authorized account . In the case where the account address of the authorized account is recorded in the ACL table, the node device can obtain the public key corresponding to the account from the first blockchain 11 based on the account address, and use the public key to verify the signature.
  • the node device determines that the signature is the signature of an authorized account by executing the identity authentication sub-function, for example, the transaction n includes the access permission information of contract 1, then the node device modifies the cross-chain contract by executing the write function. Account status, write the blockchain identifier and access method associated with the contract 1 account as shown in Table 1 in the ACL table in the account status. If it is determined by executing step S2043 that the signature is not the signature of the authorized account, the method execution flow ends, and the ACL table is not written.
  • Fig. 3 shows a flowchart of a cross-chain access control method according to an embodiment of the present specification.
  • the method is executed by, for example, a node device of the first blockchain 11.
  • the method includes the following steps S302-S304, wherein in step S304 Steps S3041 to S3045 are included.
  • the node device of the first blockchain 11 first executes step S302 to receive the transaction n and the digital signature from the sender device.
  • the write function is called with the write request as the incoming parameter, and the write request includes the identifier of the specific resource to be authorized in the first blockchain, the authorization information for the resource, and the signature indication information.
  • the signature indication information is used to indicate whether the signature of the transaction n is the signature of the resource owner or the signature of the authorized account of the resource.
  • the node device executes step S304, that is, executes transaction n.
  • step S3041 is first executed to read the signature indication information in transaction n.
  • step S3042 determines the owner of the resource, thereby obtaining the owner's public key , and step S3043, using the owner's public key to verify whether the signature is the owner's signature, to determine whether to execute step S3045, that is, to determine whether to write to the ACL table.
  • step S3044 similarly to the above, and verifies whether the signature is the authorized account based on the ACL table. to determine whether to write to the ACL table.
  • the first blockchain 11 After the ACL table is recorded in the account state of the cross-chain contract through the above method, when the first blockchain 11 receives the cross-chain access from the off-chain device, it can verify whether the cross-chain access has access based on the ACL table permission, so as to determine whether to process the cross-chain access based on the verification result.
  • the process of permission verification for cross-chain access will be described in detail below.
  • Fig. 4 shows a flowchart of a method for cross-chain access control according to an embodiment of the present specification.
  • the method is executed by a node device of the first blockchain.
  • the method includes: step S402, obtaining a transaction q, the transaction q Invoke the cross-chain contract, and provide an access request to the cross-chain contract, where the access request is used to request access to resources in the first blockchain 11; step S404, execute the transaction q to perform the following Operation: Step S4041, determine whether the access request is authorized based on the ACL table; Step S4042, perform access to the resource when it is determined that the access request is authorized.
  • step S402 the transaction q is acquired.
  • a node device of the second blockchain 13 can access resources in the first blockchain 11 through the relay device 12 .
  • the access is, for example, a call to a smart contract in the first blockchain 11 or a reading of block data or transaction data in the first blockchain 11 .
  • the node device of the second blockchain 13 can store data including the access request (eg transaction receipt) in the second blockchain 13 by executing the transaction, and the relay device 12 reads from the second blockchain 13 After the data is obtained, the transaction q can be sent to the first blockchain 11, wherein the permission verification function in the cross-chain contract is called with the access request as an incoming parameter in the transaction q.
  • the access request is, for example, data having a predetermined data structure.
  • the access request includes, for example, the account address of the contract 1, the parameters passed to the contract 1 and other information.
  • the access request may further include an access method to the contract 1, that is, a calling method.
  • the access request may further include at least one of the following: sending a blockchain identifier, receiving a blockchain identifier, receiving a contract (eg, contract 1) account, sending account, receiving account, and the like.
  • the access request includes, for example, the identifier of transaction m (ie, block N, transaction m).
  • the access request may further include an access mode to the data of the transaction m, that is, a read mode.
  • the access request may further include at least one of the following: sending blockchain identification, receiving blockchain identification, sending account, receiving account, and the like.
  • Step S404 executing the transaction q.
  • step S4041 is executed, and whether the access request is authorized is determined based on the access control table.
  • the access request is authorized by reading the ACL table in the account status of the cross-chain contract, and the ACL table is shown in Table 1 above, for example. Specifically, the identifier of the resource requested to be accessed in the access request is obtained, the authorization information of the resource is read in the ACL table, and based on the authorization information of the resource, it is determined whether the access request is authorized.
  • the access request is used to request to call the contract 1 in the first blockchain 11, which includes the identifier of the contract 1, the parameters of the contract 1, the identifier of the sending chain (the second blockchain 13) and the access method (call) .
  • Table 1 it can be determined that the contract 1 is authorized to the second blockchain 13 (ie, the domain name 2), and the authorized access mode is invocation, and accordingly, it can be determined that the access request is authorized.
  • the access request may include different contents.
  • the ACL table only includes a list of resources authorized for each blockchain. In this case, the access request may only include the identifier of the resource.
  • the access request is used to request to read the data of transaction m of block N in the first blockchain 11, including the resource identifier (ie block N, transaction m), the identifier of the sending chain (the second block chain 13) and access mode (read).
  • the resource identifier ie block N, transaction m
  • the identifier of the sending chain the second block chain 13
  • access mode read
  • step S4042 is executed, and in the case where it is determined that the access request is authorized, access to the resource is performed.
  • the contract 1 is executed with the access request or the parameters of the contract 1 included in the access request as the incoming parameters, thereby completing the The process of cross-chain access. If the access request is used to read transaction m in block N, execute the data read function called in the permission verification function to read the data of transaction m in block N, and store the read data in into the receipt for the transaction q.
  • the relay device 12 is, for example, limited to only be able to read specific data in the first blockchain 11 (such as receipts corresponding to the execution of cross-chain contracts, receipts with a specific subject (eg ACL-read), etc.), relaying
  • the device 12 is allowed by the node device to read the receipt of the transaction q, and after reading the receipt of the transaction q, returns the receipt to the node device of the second blockchain 13, thereby completing the cross-chain access process.
  • the node device of the first blockchain 11 will not process the access request and return access failure information.
  • FIG. 5 shows a cross-chain access control apparatus 500 according to an embodiment of the present specification.
  • the apparatus 500 is deployed on a node device of a blockchain, and a cross-chain contract is deployed in the blockchain.
  • the account status includes an access control table corresponding to the blockchain, and the device 500 includes: an obtaining unit 51 configured to obtain a first transaction and its digital signature, the first transaction calling the cross-chain contract, and provide a write request to the cross-chain contract, where the write request includes the identifier of the resource in the first blockchain and the authorization information of the resource;
  • the execution unit 52 is configured to execute the first
  • the execution unit 52 includes the following subunits: an acquisition subunit 521, configured to acquire a public key for verifying the digital signature based on the identifier of the resource; a verification subunit 522, configured to use the The public key verifies the digital signature;
  • the writing subunit 523 is configured to, in the case of passing the verification, write the authorization information for the resource in the access control table.
  • the obtaining subunit 521 is further configured to determine the owner of the resource based on the identifier of the resource, and obtain the public key of the owner.
  • the identifier of the resource is the account address of the smart contract
  • the obtaining subunit 521 is further configured to read the account address of the owner of the smart contract from the account status of the smart contract .
  • the identifier of the resource includes an identifier of the second transaction, wherein the obtaining subunit 521 is further configured to read and send the first blockchain based on the identifier of the second transaction. 2. The account address of the transaction.
  • the identifier of the resource includes the identifier of the first block, wherein the obtaining subunit 521 is further configured to, based on the identifier of the first block, obtain a preset in the cross-chain contract The public key of the owner of the first blockchain.
  • the write request includes an identifier of an authorized account of the resource, and the authorized account is authorized to write the authorization information of the resource in the access control table, wherein the The writing subunit 523 is further configured to write the identifier of the authorized account of the resource in the access control table.
  • the obtaining subunit 521 is further configured to read the identifier of the authorized account of the resource in the access control table, and obtain the identifier of the authorized account based on the identifier of the authorized account. public key.
  • FIG. 6 shows a cross-chain access control apparatus 600 according to an embodiment of the present specification.
  • the apparatus 600 is deployed on a node device of a first blockchain where a cross-chain contract is deployed.
  • the account state of the cross-chain contract includes an access control table corresponding to the blockchain, and the access control table includes authorization information of resources in the first blockchain.
  • the apparatus 600 includes: an obtaining unit 61 , configured to obtain a third transaction, the third transaction invokes the cross-chain contract, and provides an access request to the cross-chain contract, and the access request is used to request access to resources in the first blockchain
  • the execution unit 62 is configured to execute the third transaction, and the execution unit 62 includes the following subunits: a judgment subunit 621 configured to judge whether the access request is authorized based on the access control table; the access subunit 621
  • the unit 622 is configured to, in the case of determining that the access request is authorized, perform access to the resource.
  • the access request includes an identifier of the second blockchain that sent the access request, wherein the judging subunit is further configured to: based on the access control table, determine whether the resource is a A resource authorized to the second blockchain.
  • the access request further includes the requested access mode to the resource, wherein the judging subunit is further configured to: determine the requested access to the resource based on the access control table Whether the access method is an authorized access method.
  • the access request is a call request to the first contract in the first blockchain, wherein the access subunit is further configured to call the access request with the access request as an incoming parameter the first contract.
  • the access request is a read request for the second data in the first blockchain
  • the access subunit is further configured to read from the first blockchain
  • the apparatus further includes a storage unit configured to store the second data in the first blockchain after the third transaction is executed and completed.
  • Another aspect of the present specification provides a computer-readable storage medium on which a computer program is stored, when the computer program is executed in a computer, the computer is made to execute any one of the above methods.
  • Another aspect of the present specification provides a computing device, including a memory and a processor, where executable code is stored in the memory, and when the processor executes the executable code, any one of the foregoing methods is implemented.
  • the owner of the resource or an account authorized by the resource owner can set the access authority of the resource in the ACL table by calling the cross-chain contract in the blockchain , so as to ensure the data security of the blockchain.
  • the blockchain executes a cross-chain contract to verify the permission of the access request based on the ACL table, thereby ensuring data security.
  • the software module can be placed in random access memory (RAM), internal memory, read only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disks, removable disks, CD-ROMs, or technical fields in any other form of storage medium known in the art.
  • RAM random access memory
  • ROM read only memory
  • electrically programmable ROM electrically erasable programmable ROM
  • registers hard disks, removable disks, CD-ROMs, or technical fields in any other form of storage medium known in the art.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Databases & Information Systems (AREA)
  • Signal Processing (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Theoretical Computer Science (AREA)
  • Computing Systems (AREA)
  • Data Mining & Analysis (AREA)
  • Computer Hardware Design (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)

Abstract

本说明书实施例提供了一种跨链访问控制方法和装置，所述方法由区块链的节点设备执行，所述区块链中部署有跨链合约，所述跨链合约的账户状态中包括与所述区块链对应的访问控制表，所述方法包括：获取第一交易及其数字签名，所述第一交易调用所述跨链合约，并对所述跨链合约提供写入请求，所述写入请求中包括所述第一区块链中的资源的标识和所述资源的授权信息；执行所述第一交易，以进行以下操作：基于所述资源的标识获取用于验证所述数字签名的公钥；使用所述公钥对所述数字签名进行验证；在验证通过的情况中，在所述访问控制表中写入对所述资源的授权信息。

Description

跨链访问控制方法和装置 技术领域
本说明书实施例涉及区块链技术领域，更具体地，涉及一种跨链访问控制方法和装置。
背景技术
区块链技术也被称之为分布式账本技术，是一种去中心化的分布式数据库技术，其特点是去中心化、公开透明、不可篡改、可信任。区块链的每笔数据，都会广播到全网的区块链节点，每个全节点都有全量的、一致的数据。随着区块链技术的火热，出现了许多不同类型的链，应用在金融、健康医疗、供应链、资产管理和溯源等领域。然而大部分链上应用(加密货币或者智能合约)都无法跨越当前链的边界，不能与其他链协同合作实现数据的流通，从而限制了区块链的发挥空间。如何能让不同类型的链协同合作实现数据的流通成了探索的方向。
在现有的一种跨链技术中，在第一区块链中将待发送给第二区块链的跨链消息写入第一区块链的收据，链下的中继设备从第一区块链获取该收据，将该收据提供给第二区块链。该收据中包括对第二区块链的数据读取请求或者对智能合约的调用请求。在该情况中，为了保证区块链中的数据安全性，如何对第二区块链进行访问权限控制，是亟待解决的问题。
因此，需要一种更有效的跨链访问控制方案。
发明内容
本说明书实施例旨在提供一种更有效的跨链访问控制方案，以解决现有技术中的不足。
为实现上述目的，本说明书一个方面提供一种跨链访问控制方法，所述方法由区块链的节点设备执行，所述区块链中部署有跨链合约，所述跨链合约的账户状态中包括与所述区块链对应的访问控制表，所述方法包括：获取第一交易及其数字签名，所述第一交易调用所述跨链合约，并对所述跨链合约提供写入请求，所述写入请求中包括所述第一区块链中的资源的标识和所述资源的授权信息；执行所述第一交易，以进行以下操作： 基于所述资源的标识获取用于验证所述数字签名的公钥；使用所述公钥对所述数字签名进行验证；在验证通过的情况中，在所述访问控制表中写入对所述资源的授权信息。
在一种实施方式中，基于所述资源的标识获取用于验证所述数字签名的公钥包括，基于所述资源的标识确定所述资源的所有者，获取所述所有者的公钥。
在一种实施方式中，所述资源的标识为智能合约的账户地址，基于所述资源的标识确定所述资源的所有者包括，从所述智能合约的账户状态中读取所述智能合约的所有者的账户地址。
在一种实施方式中，所述资源的标识包括第二交易的标识，其中，基于所述资源的标识确定所述资源的所有者包括，基于第二交易的标识从第一区块链中读取发送所述第二交易的账户地址。
在一种实施方式中，所述资源的标识包括第一区块的标识，其中，基于所述资源的标识获取用于验证所述数字签名的公钥包括，基于第一区块的标识，获取在所述跨链合约中预设的第一区块链的所有者的公钥。
在一种实施方式中，所述写入请求中包括所述资源的被授权账户的标识，所述被授权账户被授权在所述访问控制表写入所述资源的授权信息，其中，在所述访问控制表中写入对所述资源的授权信息包括，在所述访问控制表中写入所述资源的被授权账户的标识。
在一种实施方式中，基于所述资源的标识获取用于验证所述数字签名的公钥包括，在所述访问控制表读取所述资源的被授权账户的标识，基于所述被授权账户的标识获取所述被授权账户的公钥。
本说明书另一方面提供一种跨链访问控制方法，所述方法由第一区块链的节点设备执行，所述第一区块链中部署有跨链合约，所述跨链合约的账户状态中包括与所述区块链对应的访问控制表，所述访问控制表中包括所述第一区块链中的资源的授权信息，所述方法包括：获取第三交易，所述第三交易调用所述跨链合约，并对所述跨链合约提供访问请求，所述访问请求用于请求访问所述第一区块链中的资源；执行所述第三交易，以进行以下操作：基于所述访问控制表判断所述访问请求是否被授权；在判断所述访问请求被授权的情况中，进行对所述资源的访问。
在一种实施方式中，所述访问请求中包括发送所述访问请求的第二区块链的标识，其中，基于所述访问控制表判断所述访问请求是否被授权包括：基于所述访问控制表判 断所述资源是否为被授权给所述第二区块链的资源。
在一种实施方式中，所述访问请求中还包括请求的对所述资源的访问方式，其中，基于所述访问控制表判断所述访问请求是否被授权包括：基于所述访问控制表判断所述请求的对所述资源的访问方式是否为被授权的访问方式。
在一种实施方式中，所述访问请求为对所述第一区块链中的第一合约的调用请求，其中，进行对所述资源的访问包括，以所述访问请求为传入参数调用所述第一合约。
在一种实施方式中，所述访问请求为对所述第一区块链中的第二数据的读取请求，其中，进行对所述资源的访问包括，从所述第一区块链读取所述第二数据，所述方法还包括，在执行完成所述第三交易之后，在所述第一区块链中存入所述第二数据。
本说明书另一方面提供一种跨链访问控制装置，所述装置部署于区块链的节点设备，所述区块链中部署有跨链合约，所述跨链合约的账户状态中包括与所述区块链对应的访问控制表，所述装置包括：获取单元，配置为，获取第一交易及其数字签名，所述第一交易调用所述跨链合约，并对所述跨链合约提供写入请求，所述写入请求中包括所述第一区块链中的资源的标识和所述资源的授权信息；执行单元，配置为，执行所述第一交易，所述执行单元包括以下子单元：获取子单元，配置为，基于所述资源的标识获取用于验证所述数字签名的公钥；验证子单元，配置为，使用所述公钥对所述数字签名进行验证；写入子单元，配置为，在验证通过的情况中，在所述访问控制表中写入对所述资源的授权信息。
在一种实施方式中，所述获取子单元还配置为，基于所述资源的标识确定所述资源的所有者，获取所述所有者的公钥。
在一种实施方式中，所述资源的标识为智能合约的账户地址，所述获取子单元还配置为，从所述智能合约的账户状态中读取所述智能合约的所有者的账户地址。
在一种实施方式中，所述资源的标识包括第二交易的标识，其中，所述获取子单元还配置为，基于第二交易的标识从第一区块链中读取发送所述第二交易的账户地址。
在一种实施方式中，所述资源的标识包括第一区块的标识，其中，所述获取子单元还配置为，基于第一区块的标识，获取在所述跨链合约中预设的第一区块链的所有者的公钥。
在一种实施方式中，所述写入请求中包括所述资源的被授权账户的标识，所述被授权账户被授权在所述访问控制表写入所述资源的授权信息，其中，所述写入子单元还配 置为，在所述访问控制表中写入所述资源的被授权账户的标识。
在一种实施方式中，所述获取子单元还配置为，在所述访问控制表读取所述资源的被授权账户的标识，基于所述被授权账户的标识获取所述被授权账户的公钥。
本说明书另一方面提供一种跨链访问控制装置，所述装置部署于第一区块链的节点设备，所述第一区块链中部署有跨链合约，所述跨链合约的账户状态中包括与所述区块链对应的访问控制表，所述访问控制表中包括所述第一区块链中的资源的授权信息，所述装置包括：获取单元，配置为，获取第三交易，所述第三交易调用所述跨链合约，并对所述跨链合约提供访问请求，所述访问请求用于请求访问所述第一区块链中的资源；执行单元，配置为，执行所述第三交易，所述执行单元包括以下子单元：判断子单元，配置为，基于所述访问控制表判断所述访问请求是否被授权；访问子单元，配置为，在判断所述访问请求被授权的情况中，进行对所述资源的访问。
在一种实施方式中，所述访问请求中包括发送所述访问请求的第二区块链的标识，其中，所述判断子单元还配置为：基于所述访问控制表判断所述资源是否为被授权给所述第二区块链的资源。
在一种实施方式中，所述访问请求中还包括请求的对所述资源的访问方式，其中，所述判断子单元还配置为：基于所述访问控制表判断所述请求的对所述资源的访问方式是否为被授权的访问方式。
在一种实施方式中，所述访问请求为对所述第一区块链中的第一合约的调用请求，其中，所述访问子单元还配置为，以所述访问请求为传入参数调用所述第一合约。
在一种实施方式中，所述访问请求为对所述第一区块链中的第二数据的读取请求，其中，所述访问子单元还配置为，从所述第一区块链读取所述第二数据，所述装置还包括，存储单元，配置为，在执行完成所述第三交易之后，在所述第一区块链中存入所述第二数据。
本说明书另一方面提供一种计算机可读存储介质，其上存储有计算机程序，当所述计算机程序在计算机中执行时，令计算机执行上述任一项方法。
本说明书另一方面提供一种计算设备，包括存储器和处理器，所述存储器中存储有可执行代码，所述处理器执行所述可执行代码时，实现上述任一项方法。
通过根据本说明书实施例的跨链访问控制方案，使得只有资源的所有者或者由资源所有者授权的账户才可以通过在区块链中调用跨链合约而在ACL表中设置该资源的访 问权限，从而保障区块链的数据安全性。区块链在接收到链下的访问请求时，通过执行跨链合约基于ACL表对该访问请求验证权限，从而保障数据安全性。
附图说明
通过结合附图描述本说明书实施例，可以使得本说明书实施例更加清楚：
图1示出根据本说明书实施例的跨链系统的示意图；
图2示出根据本说明书实施例的一种跨链访问控制方法流程图；
图3示出根据本说明书实施例的一种跨链访问控制方法流程图；
图4示出根据本说明书实施例的一种跨链访问控制方法；
图5示出根据本说明书实施例的一种跨链访问控制装置500；
图6示出根据本说明书实施例的一种跨链访问控制装置600。
具体实施方式
下面将结合附图描述本说明书实施例。
图1示出根据本说明书实施例的跨链系统的示意图。如图1所示，所述跨链系统包括第一区块链11、中继设备12和第二区块链13。其中，第一区块链11通过中继设备12与第二区块链13连接。可以理解，这里虽然示意示出了，第一区块链11与第二区块链13通过中继设备12相互连接，本说明书实施例不限于此，例如，第一区块链11与第二区块链13之间可通过多个中继设备相互连接，在此不作限定。第一区块链11中部署有跨链合约，所述跨链合约的账户状态中包括访问控制表(ACL表)，所述ACL表中包括第一区块链11中的资源的授权信息。所述跨链合约中包括ACL表写入函数和权限验证函数。其中，ACL表写入函数中包括身份认证子函数和资源认证子函数。
用户可通过其设备向第一区块链11发送调用跨链合约中ACL表写入函数(下文中简称为写入函数)的交易，以用于在ACL表中写入特定资源的授权信息。当第一区块链11中的节点执行该交易时，首先执行ACL表写入函数，从而通过执行资源认证子函数确定资源的拥有者或被授权者，然后通过身份认证子函数确定该写入请求的发送者是否为所述资源的拥有者或者所述资源的授权者，从而确定是否基于该写入请求对ACL表进行写入。
第一区块链11的链下设备(例如中继设备12)可以通过向第一区块链11发送调用跨链合约的交易，而发送对第一区块链11中的资源的访问请求。第一区块链11中的节点在执行该交易时，首先执行权限验证函数，以基于上述ACL表对该访问请求的访问权限进行验证，在验证通过之后，再进行对所述资源的访问。
可以理解，上述参考图1的描述只是示意性的，而不是用于限制本说明书实施例的范围。下面将具体描述上述访问权限控制方法。
图2示出根据本说明书实施例的一种跨链访问控制方法流程图，所述方法例如由第一区块链11中的任一节点设备执行，所述方法包括以下步骤：
步骤S202，获取交易n及其数字签名。其中，所述n为交易编号，所述交易n调用所述跨链合约中的写入函数，并对所述写入函数提供所述第一区块链中的资源的标识和对所述资源的授权信息；步骤S204，执行交易n，其中，执行交易n包括进行以下步骤：步骤S2041，确定资源的所有者；步骤S2042，验证所述签名是否为所述所有者的签名；步骤S2043，在验证所述数字签名不是所述所有者的签名的情况中，验证所述签名是否为所述资源的被授权账户的签名；步骤S2044，对ACL表进行写入。
下文将通过多种实施方式对图2所示方法进行描述。
在一种实施方式中，第一区块链11中的资源的所有者通过其设备向第一区块链11发送交易n及数字签名，从而，第一区块链11中的各个节点设备执行步骤S202，从第一区块链11中获取交易n及其数字签名。其中，所述数字签名为所述交易n的发送者对所述交易n的数字签名。如图1所示，所述交易n中以写入请求为传入参数调用写入函数，所述写入请求中包括第一区块链中的将要授权的特定资源的标识和对该资源的授权信息。所述资源例如可以包括第一区块链11中的区块数据、交易数据、智能合约等。其中，区块的标识例如包括区块头哈希值或者区块编号等；交易的标识例如包括交易所在区块的标识和交易编号等；所述智能合约的标识例如包括智能合约的账户地址等。所述授权信息例如包括被授权使用该特定资源的区块链的域名、被授权的对该特定资源的使用方式等内容。例如，对于智能合约资源，被授权的使用方式包括调用方式，对于区块数据、交易数据等资源，被授权的使用方式包括读取方式，等等。
之后，第一区块链11中的节点设备执行步骤S204，执行交易n。
所述节点设备在执行交易n的过程中，首先执行步骤S2041，确定资源的所有者(owner)，以确定该交易n的发送者是否为所述特定资源的所有者，即确定该发送者 是否有权限对ACL表进行写入。因此，所述节点设备通过执行所述写入函数中的资源认证子函数以确定资源的所有者，并获取该所有者的公钥。
例如，所述特定资源为第一区块链11中部署的智能合约(例如合约1)，所述合约1的账户状态中的所有者字段中记录了该合约1的所有者的账户地址。从而，节点设备通过执行所述资源认证子函数可读取所述合约1的账户状态中的所有者字段，获取所有者的账户地址，并可通过读取所有者的账户的账户状态，获取该所有者的公钥。
例如，所述特定资源为第一区块链11中存储的交易m的交易数据。对于区块链中的交易数据，不同的区块链中可能对交易数据的所有者有不同的规定，例如，在一种区块链中，交易的交易数据包括交易发送者的存证数据，并且在该区块链中规定交易数据的所有者为交易发送者，在另一种区块链中，区块链中可规定交易的所有者为区块链的所有者。所述资源认证子函数可根据第一区块链11中对交易数据所有者的规定预设相应的程序。例如，第一区块链11中规定交易数据的所有者为交易的发送者，则在执行所述资源认证子函数时，根据预设的程序，从第一区块链11中读取交易m的交易数据，从该交易数据中获取交易m的发送账户，并从该发送账户的账户状态中获取该发送账户的账户公钥。如果第一区块链11中规定交易数据的所有者为第一区块链11的所有者，则在执行资源认证子函数时，获取在该资源认证子函数中预设的第一区块链11的所有者的公钥。
例如，所述特定资源为第一区块链11中的区块数据，通常，区块数据的所有者即为相应区块链的所有者。从而，资源认证子函数可与上文类似地获取预设的第一区块链11的所有者的公钥。
然后，节点设备执行步骤S2042，通过执行身份认证子函数确定所述数字签名是否为所述特定资源的所有者的签名。具体是，身份认证子函数在获取特定资源的所有者的公钥之后，使用公钥对所述数字签名进行解密，并计算交易n的哈希值，比较解密获取的数据与所述哈希值是否相同。如果相同，则可确定所述数字签名是所述特定资源的所有者的签名，从而节点设备可执行步骤S2044，通过执行所述写入函数对所述ACL表进行写入。如图1所示，所述ACL表存储在所述跨链合约的账户状态中，对所述ACL表进行写入即对所述跨链合约的账户状态进行更改。如果不同，则节点设备将不会基于写入请求对ACL表进行写入，从而通过执行跨链合约控制对ACL表的写入提高了第一区块链11的数据安全性。表1示出所述ACL表的示意图。
表1
资源 区块链标识 访问方式
合约1账户 域名2、域名4 调用
区块N，交易m 域名2 读取
区块M 域名3 读取
如表1中所示，其中，“资源”一栏用于记录第一区块链11中的资源的标识，该资源例如包括区块数据、交易数据、智能合约等，“区块链标识”一栏用于记录被授权使用相应资源的区块链的标识，在表1中以区块链的域名作为区块链的标识，“访问方式”一栏用于记录相应资源的被授权的访问方式，该访问方式包括对合约的调用和对数据的读取等。具体是，假设第二区块链13的域名为域名2，则表1中记录了，对第二区块链13授权对第一区块链11中的合约1的调用权限、以及对第一区块链11中的区块N中的交易m的读取权限。
可以理解，表1所示的访问控制表仅仅是示意性的，而不是限制性的。例如，区块链标识一栏中不限于记录区块链的域名，而可以记录其它用于唯一标识区块链的区块链标识，另外，访问控制表中不限于包括表1中所示的3栏，而是可以仅记录其中的一栏或两栏，例如，ACL表中可以仅包括表1中的“资源”栏，这表示，对于所有的区块链都授权对合约1的调用权限、对区块N中交易m、和区块M的读取权限。
在一种实施方式中，所述交易n例如请求在ACL表中写入被授权对特定资源设置访问权限的账户标识，该账户标识例如为账户公钥或账户地址等。在该情况中，节点设备在通过执行资源认证子函数和身份认证子函数确定所述数字签名为所述特定资源的所有者的签名之后，在所述ACL表中写入对特定资源授权的账户标识。表2示出该实施方式中ACL表的示意图。
表2
资源 区块链标识 访问方式 被授权账户
合约1账户     abc456、cde352
区块N，交易m     Dec678、ebc426
在如表2所示的ACL表中，与表1不同的是，还包括被授权账户一栏，该被授权账户用于记录被授权在该ACL表中设置资源的访问权限的账户的账户公钥(表2中以 abc456等示意示出)。可以理解，在表2中的被授权账户一栏不限于记录账户公钥，在所述账户为所述第一区块链11中的账户的情况中，在所述ACL表中也可以记录账户地址。
在另一种实施方式中，节点设备在执行步骤S2042确定所述数字签名不是资源所有者的签名之后，可通过执行身份认证子函数而执行步骤S2043，确定所述签名是否为被授权账户的签名。具体是，节点设备通过执行ACL表写入函数从ACL表中读取特定资源的被授权账户的账户公钥，使用该公钥对签名进行验证，从而确定所述签名是否为被授权账户的签名。在ACL表中记录了被授权账户的账户地址的情况中，节点设备可基于该账户地址从第一区块链11中获取该账户对应的公钥，并使用公钥对签名进行验证。
如果节点设备通过执行身份认证子函数确定所述签名是被授权账户的签名，例如，所述交易n中包括合约1的访问权限信息，则所述节点设备通过执行写入函数修改跨链合约的账户状态，在账户状态中的ACL表中写入如表1所示的与合约1账户关联的区块链标识、访问方式等内容。如果通过执行步骤S2043确定所述签名不是被授权账户的签名，则结束方法执行流程，不对ACL表进行写入。
图3示出根据本说明书实施例的一种跨链访问控制方法流程图，所述方法例如由第一区块链11的节点设备执行，所述方法包括以下步骤S302-S304，其中步骤S304中包括步骤S3041～S3045。
在该实施例中，第一区块链11的节点设备首先执行步骤S302，从发送者设备接收交易n及数字签名。所述交易n中以写入请求为传入参数调用写入函数，所述写入请求中包括第一区块链中的将要授权的特定资源的标识、对该资源的授权信息和签名指示信息。所述签名指示信息用于指示所述交易n的签名是资源所有者的签名还是资源的被授权账户的签名。之后，节点设备执行步骤S304，即执行交易n。在执行交易n的过程中，首先执行步骤S3041，在交易n中读取签名指示信息。如果该签名指示信息指示所述签名为资源所有者的标识，即，交易n由所述资源的所有者发送，则节点设备执行步骤S3042，确定资源的所有者，从而获取该所有者的公钥，和步骤S3043，使用所有者的公钥验证所述签名是否为所述所有者的签名，以确定是否执行步骤S3045，即确定是否对ACL表进行写入。如果该签名指示信息指示所述签名为被授权账户的签名，即，交易n由被授权账户发送，则节点设备与上文类似地执行步骤S3044，基于ACL表验证所述签名是否为被授权账户的签名，从而确定是否对ACL表进行写入。
在通过上述方法在跨链合约的账户状态中记录了ACL表之后，第一区块链11在接 收到来自链下设备的跨链访问时，可基于该ACL表验证该跨链访问是否具有访问权限，从而基于验证结果确定是否处理该跨链访问。下文将详细描述该对跨链访问进行权限验证的过程。
图4示出根据本说明书实施例的一种跨链访问控制方法流程图，所述方法由第一区块链的节点设备执行，所述方法包括：步骤S402，获取交易q，所述交易q调用所述跨链合约，并对所述跨链合约提供访问请求，所述访问请求用于请求访问所述第一区块链11中的资源；步骤S404，执行所述交易q，以进行以下操作：步骤S4041，基于ACL表判断所述访问请求是否被授权；步骤S4042，在判断所述访问请求被授权的情况中，进行对所述资源的访问。
首先，在步骤S402，获取交易q。
例如，第二区块链13的节点设备可通过中继设备12进行对第一区块链11中的资源的访问。所述访问例如是对第一区块链11中的智能合约的调用或者对第一区块链11中的区块数据或交易数据的读取。第二区块链13的节点设备可通过执行交易而在第二区块链13中存入包括访问请求的数据(例如交易收据)，中继设备12在从第二区块链13中读取到该数据之后，可向第一区块链11发送交易q，其中，在交易q中以该访问请求为传入参数调用跨链合约中的权限验证函数。
所述访问请求例如为具有预定数据结构的数据。例如，所述访问请求用于调用第一区块链11中的合约1，则该访问请求中例如包括合约1的账户地址、将对合约1传入的参数等信息。在一种实施方式中，所述访问请求中还可以包括对合约1的访问方式，即调用方式。在一种实施方式中，所述访问请求中还可以包括以下至少一项：发送区块链标识、接收区块链标识、接收合约(例如合约1)账户、发送账户、接收账户等等。
例如，所述访问请求用于读取第一区块链11中的区块N中的交易m的数据，则该访问请求中例如包括交易m的标识(即区块N，交易m)。在一种实施方式中，所述访问请求中还可以包括对交易m的数据的访问方式，即读取方式。在一种实施方式中，所述访问请求中还可以包括以下至少一项：发送区块链标识、接收区块链标识、发送账户、接收账户等等。
步骤S404，执行所述交易q。
其中，在执行交易q的过程中，首先执行跨链合约中的权限验证函数，从而执行步骤S4041，基于访问控制表判断所述访问请求是否被授权。
在该步骤的执行过程中，通过读取跨链合约的账户状态中的ACL表判断所述访问请求是否被授权，所述ACL表例如如上文表1所示。具体是，获取所述访问请求中请求访问的资源的标识，在ACL表中读取该资源的授权信息，并基于该资源的授权信息，确定该访问请求是否被授权。
例如，该访问请求用于请求调用第一区块链11中的合约1，其中包括合约1的标识、合约1的参数、发送链的标识(第二区块链13)和访问方式(调用)。通过读取表1可确定合约1被授权给第二区块链13(即域名2)，并且授权的访问方式为调用，据此，可确定该访问请求被授权。可以理解，根据ACL表的具体形式的不同，所述访问请求可包括不同的内容。例如所述ACL表中仅包括对各个区块链都授权的资源列表，在该情况中，所述访问请求中可以仅包括资源的标识。
例如，该访问请求用于请求读取第一区块链11中的区块N的交易m的数据，其中包括资源标识(即区块N，交易m)、发送链的标识(第二区块链13)和访问方式(读取)。通过读取表1可确定区块N交易m被授权给第二区块链13，并且授权的访问方式为调用，据此，可确定该访问请求被授权。
之后，执行步骤S4042，在判断所述访问请求被授权的情况中，进行对所述资源的访问。
在确定所述访问请求被授权的情况中，如果该访问请求用于请求调用合约1，则以上述访问请求或者访问请求中包括的合约1的参数为传入参数执行所述合约1，从而完成跨链访问的过程。如果该访问请求用于读取区块N中的交易m，则执行权限验证函数中调用的数据读取函数，以读取区块N中的交易m的数据，并将该读取的数据存入到该交易q的收据中。中继设备12例如被限制为仅可以读取第一区块链11中的特定数据(如与执行跨链合约对应的收据、具有特定主题(例如ACL-read)的收据等等)，中继设备12被节点设备允许读取交易q的收据，并在读取交易q的收据之后，将该收据返回给第二区块链13的节点设备，从而完成该跨链访问过程。
在确定所述访问请求未被授权的情况中，第一区块链11的节点设备将不处理所述访问请求，并返回访问失败信息。
图5示出根据本说明书实施例的一种跨链访问控制装置500，所述装置500部署于区块链的节点设备，所述区块链中部署有跨链合约，所述跨链合约的账户状态中包括与所述区块链对应的访问控制表，所述装置500包括：获取单元51，配置为，获取第一交 易及其数字签名，所述第一交易调用所述跨链合约，并对所述跨链合约提供写入请求，所述写入请求中包括所述第一区块链中的资源的标识和所述资源的授权信息；执行单元52，配置为，执行所述第一交易，所述执行单元52包括以下子单元：获取子单元521，配置为，基于所述资源的标识获取用于验证所述数字签名的公钥；验证子单元522，配置为，使用所述公钥对所述数字签名进行验证；写入子单元523，配置为，在验证通过的情况中，在所述访问控制表中写入对所述资源的授权信息。
在一种实施方式中，所述获取子单元521还配置为，基于所述资源的标识确定所述资源的所有者，获取所述所有者的公钥。
在一种实施方式中，所述资源的标识为智能合约的账户地址，所述获取子单元521还配置为，从所述智能合约的账户状态中读取所述智能合约的所有者的账户地址。
在一种实施方式中，所述资源的标识包括第二交易的标识，其中，所述获取子单元521还配置为，基于第二交易的标识从第一区块链中读取发送所述第二交易的账户地址。
在一种实施方式中，所述资源的标识包括第一区块的标识，其中，所述获取子单元521还配置为，基于第一区块的标识，获取在所述跨链合约中预设的第一区块链的所有者的公钥。
在一种实施方式中，所述写入请求中包括所述资源的被授权账户的标识，所述被授权账户被授权在所述访问控制表写入所述资源的授权信息，其中，所述写入子单元523还配置为，在所述访问控制表中写入所述资源的被授权账户的标识。
在一种实施方式中，所述获取子单元521还配置为，在所述访问控制表读取所述资源的被授权账户的标识，基于所述被授权账户的标识获取所述被授权账户的公钥。
图6示出根据本说明书实施例的一种跨链访问控制装置600，所述装置600部署于第一区块链的节点设备，所述第一区块链中部署有跨链合约，所述跨链合约的账户状态中包括与所述区块链对应的访问控制表，所述访问控制表中包括所述第一区块链中的资源的授权信息，所述装置600包括：获取单元61，配置为，获取第三交易，所述第三交易调用所述跨链合约，并对所述跨链合约提供访问请求，所述访问请求用于请求访问所述第一区块链中的资源；执行单元62，配置为，执行所述第三交易，所述执行单元62包括以下子单元：判断子单元621，配置为，基于所述访问控制表判断所述访问请求是否被授权；访问子单元622，配置为，在判断所述访问请求被授权的情况中，进行对所述资源的访问。
在一种实施方式中，所述访问请求中包括发送所述访问请求的第二区块链的标识，其中，所述判断子单元还配置为：基于所述访问控制表判断所述资源是否为被授权给所述第二区块链的资源。
在一种实施方式中，所述访问请求中还包括请求的对所述资源的访问方式，其中，所述判断子单元还配置为：基于所述访问控制表判断所述请求的对所述资源的访问方式是否为被授权的访问方式。
在一种实施方式中，所述访问请求为对所述第一区块链中的第一合约的调用请求，其中，所述访问子单元还配置为，以所述访问请求为传入参数调用所述第一合约。
在一种实施方式中，所述访问请求为对所述第一区块链中的第二数据的读取请求，其中，所述访问子单元还配置为，从所述第一区块链读取所述第二数据，所述装置还包括，存储单元，配置为，在执行完成所述第三交易之后，在所述第一区块链中存入所述第二数据。
本说明书另一方面提供一种计算机可读存储介质，其上存储有计算机程序，当所述计算机程序在计算机中执行时，令计算机执行上述任一项方法。
本说明书另一方面提供一种计算设备，包括存储器和处理器，所述存储器中存储有可执行代码，所述处理器执行所述可执行代码时，实现上述任一项方法。
通过根据本说明书实施例的跨链访问控制方案，使得只有资源的所有者或者由资源所有者授权的账户才可以通过在区块链中调用跨链合约而在ACL表中设置该资源的访问权限，从而保障区块链的数据安全性。区块链在接收到链下的访问请求时，通过执行跨链合约基于ACL表对该访问请求验证权限，从而保障数据安全性。
需要理解，本文中的“第一”，“第二”等描述，仅仅为了描述的简单而对相似概念进行区分，并不具有其他限定作用。
本说明书中的各个实施例均采用递进的方式描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。尤其，对于系统实施例而言，由于其基本相似于方法实施例，所以描述的比较简单，相关之处参见方法实施例的部分说明即可。
上述对本说明书特定实施例进行了描述。其它实施例在所附权利要求书的范围内。在一些情况下，在权利要求书中记载的动作或步骤可以按照不同于实施例中的顺序来执行并且仍然可以实现期望的结果。另外，在附图中描绘的过程不一定要求示出的特定顺 序或者连续顺序才能实现期望的结果。在某些实施方式中，多任务处理和并行处理也是可以的或者可能是有利的。
本领域普通技术人员应该还可以进一步意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、计算机软件或者二者的结合来实现，为了清楚地说明硬件和软件的可互换性，在上述说明中已经按照功能一般性地描述了各示例的组成及步骤。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。本领域普通技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。其中，软件模块可以置于随机存储器(RAM)、内存、只读存储器(ROM)、电可编程ROM、电可擦除可编程ROM、寄存器、硬盘、可移动磁盘、CD-ROM、或技术领域内所公知的任意其它形式的存储介质中。
以上所述的具体实施方式，对本发明的目的、技术方案和有益效果进行了进一步详细说明，所应理解的是，以上所述仅为本发明的具体实施方式而已，并不用于限定本发明的保护范围，凡在本发明的精神和原则之内，所做的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。

Claims (26)

  1. 一种跨链访问控制方法，所述方法由区块链的节点设备执行，所述区块链中部署有跨链合约，所述跨链合约的账户状态中包括与所述区块链对应的访问控制表，所述方法包括：
    获取第一交易及其数字签名，所述第一交易调用所述跨链合约，并对所述跨链合约提供写入请求，所述写入请求中包括第一区块链中的资源的标识和所述资源的授权信息；
    执行所述第一交易，以进行以下操作：
    基于所述资源的标识获取用于验证所述数字签名的公钥；
    使用所述公钥对所述数字签名进行验证；
    在验证通过的情况中，在所述访问控制表中写入对所述资源的授权信息。
  2. 根据权利要求1所述的方法，其中，基于所述资源的标识获取用于验证所述数字签名的公钥包括，基于所述资源的标识确定所述资源的所有者，获取所述所有者的公钥。
  3. 根据权利要求2所述的方法，其中，所述资源的标识为智能合约的账户地址，基于所述资源的标识确定所述资源的所有者包括，从所述智能合约的账户状态中读取所述智能合约的所有者的账户地址。
  4. 根据权利要求2所述的方法，其中，所述资源的标识包括第二交易的标识，其中，基于所述资源的标识确定所述资源的所有者包括，基于第二交易的标识从第一区块链中读取发送所述第二交易的账户地址。
  5. 根据权利要求2所述的方法，其中，所述资源的标识包括第一区块的标识，其中，基于所述资源的标识获取用于验证所述数字签名的公钥包括，基于第一区块的标识，获取在所述跨链合约中预设的第一区块链的所有者的公钥。
  6. 根据权利要求1-5任一项所述的方法，所述写入请求中包括所述资源的被授权账户的标识，所述被授权账户被授权在所述访问控制表写入所述资源的授权信息，其中，在所述访问控制表中写入对所述资源的授权信息包括，在所述访问控制表中写入所述资源的被授权账户的标识。
  7. 根据权利要求1所述的方法，其中，基于所述资源的标识获取用于验证所述数字签名的公钥包括，在所述访问控制表读取所述资源的被授权账户的标识，基于所述被授权账户的标识获取所述被授权账户的公钥。
  8. 一种跨链访问控制方法，所述方法由第一区块链的节点设备执行，所述第一区块链中部署有跨链合约，所述跨链合约的账户状态中包括与所述区块链对应的访问控制表，所述访问控制表中包括所述第一区块链中的资源的授权信息，所述方法包括：
    获取第三交易，所述第三交易调用所述跨链合约，并对所述跨链合约提供访问请求，所述访问请求用于请求访问所述第一区块链中的资源；
    执行所述第三交易，以进行以下操作：
    基于所述访问控制表判断所述访问请求是否被授权；
    在判断所述访问请求被授权的情况中，进行对所述资源的访问。
  9. 根据权利要求8所述的方法，其中，所述访问请求中包括发送所述访问请求的第二区块链的标识，其中，基于所述访问控制表判断所述访问请求是否被授权包括：基于所述访问控制表判断所述资源是否为被授权给所述第二区块链的资源。
  10. 根据权利要求9所述的方法，其中，所述访问请求中还包括请求的对所述资源的访问方式，其中，基于所述访问控制表判断所述访问请求是否被授权包括：基于所述访问控制表判断所述请求的对所述资源的访问方式是否为被授权的访问方式。
  11. 根据权利要求8-10中任一项所述的方法，其中，所述访问请求为对所述第一区块链中的第一合约的调用请求，其中，进行对所述资源的访问包括，以所述访问请求为传入参数调用所述第一合约。
  12. 根据权利要求8-10中任一项所述的方法，其中，所述访问请求为对所述第一区块链中的第二数据的读取请求，其中，进行对所述资源的访问包括，从所述第一区块链读取所述第二数据，所述方法还包括，在执行完成所述第三交易之后，在所述第一区块链中存入所述第二数据。
  13. 一种跨链访问控制装置，所述装置部署于区块链的节点设备，所述区块链中部署有跨链合约，所述跨链合约的账户状态中包括与所述区块链对应的访问控制表，所述装置包括：
    获取单元，配置为，获取第一交易及其数字签名，所述第一交易调用所述跨链合约，并对所述跨链合约提供写入请求，所述写入请求中包括第一区块链中的资源的标识和所述资源的授权信息；
    执行单元，配置为，执行所述第一交易，所述执行单元包括以下子单元：
    获取子单元，配置为，基于所述资源的标识获取用于验证所述数字签名的公钥；
    验证子单元，配置为，使用所述公钥对所述数字签名进行验证；
    写入子单元，配置为，在验证通过的情况中，在所述访问控制表中写入对所述资源的授权信息。
  14. 根据权利要求13所述的装置，其中，所述获取子单元还配置为，基于所述资源的标识确定所述资源的所有者，获取所述所有者的公钥。
  15. 根据权利要求14所述的装置，其中，所述资源的标识为智能合约的账户地址，所述获取子单元还配置为，从所述智能合约的账户状态中读取所述智能合约的所有者的账户地址。
  16. 根据权利要求14所述的装置，其中，所述资源的标识包括第二交易的标识，其中，所述获取子单元还配置为，基于第二交易的标识从第一区块链中读取发送所述第二交易的账户地址。
  17. 根据权利要求14所述的装置，其中，所述资源的标识包括第一区块的标识，其中，所述获取子单元还配置为，基于第一区块的标识，获取在所述跨链合约中预设的第一区块链的所有者的公钥。
  18. 根据权利要求13-17任一项所述的装置，所述写入请求中包括所述资源的被授权账户的标识，所述被授权账户被授权在所述访问控制表写入所述资源的授权信息，其中，所述写入子单元还配置为，在所述访问控制表中写入所述资源的被授权账户的标识。
  19. 根据权利要求13所述的装置，其中，所述获取子单元还配置为，在所述访问控制表读取所述资源的被授权账户的标识，基于所述被授权账户的标识获取所述被授权账户的公钥。
  20. 一种跨链访问控制装置，所述装置部署于第一区块链的节点设备，所述第一区块链中部署有跨链合约，所述跨链合约的账户状态中包括与所述区块链对应的访问控制表，所述访问控制表中包括所述第一区块链中的资源的授权信息，所述装置包括：
    获取单元，配置为，获取第三交易，所述第三交易调用所述跨链合约，并对所述跨链合约提供访问请求，所述访问请求用于请求访问所述第一区块链中的资源；
    执行单元，配置为，执行所述第三交易，所述执行单元包括以下子单元：
    判断子单元，配置为，基于所述访问控制表判断所述访问请求是否被授权；
    访问子单元，配置为，在判断所述访问请求被授权的情况中，进行对所述资源的访问。
  21. 根据权利要求20所述的装置，其中，所述访问请求中包括发送所述访问请求的第二区块链的标识，其中，所述判断子单元还配置为：基于所述访问控制表判断所述资源是否为被授权给所述第二区块链的资源。
  22. 根据权利要求21所述的装置，其中，所述访问请求中还包括请求的对所述资源的访问方式，其中，所述判断子单元还配置为：基于所述访问控制表判断所述请求的对所述资源的访问方式是否为被授权的访问方式。
  23. 根据权利要求20-22中任一项所述的装置，其中，所述访问请求为对所述第一区 块链中的第一合约的调用请求，其中，所述访问子单元还配置为，以所述访问请求为传入参数调用所述第一合约。
  24. 根据权利要求20-22中任一项所述的装置，其中，所述访问请求为对所述第一区块链中的第二数据的读取请求，其中，所述访问子单元还配置为，从所述第一区块链读取所述第二数据，所述装置还包括，存储单元，配置为，在执行完成所述第三交易之后，在所述第一区块链中存入所述第二数据。
  25. 一种计算机可读存储介质，其上存储有计算机程序，当所述计算机程序在计算机中执行时，令计算机执行权利要求1-12中任一项的所述的方法。
  26. 一种计算设备，包括存储器和处理器，所述存储器中存储有可执行代码，所述处理器执行所述可执行代码时，实现权利要求1-12中任一项所述的方法。
PCT/CN2021/133116 2021-03-30 2021-11-25 跨链访问控制方法和装置 WO2022205965A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110340164.9A CN112769871B (zh) 2021-03-30 2021-03-30 跨链访问控制方法和装置
CN202110340164.9 2021-03-30

Publications (1)

Publication Number Publication Date
WO2022205965A1 true WO2022205965A1 (zh) 2022-10-06

Family

ID=75691129

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/133116 WO2022205965A1 (zh) 2021-03-30 2021-11-25 跨链访问控制方法和装置

Country Status (2)

Country Link
CN (2) CN114244629B (zh)
WO (1) WO2022205965A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210281424A1 (en) * 2018-07-17 2021-09-09 Verizon Patent And Licensing Inc. Validating and securing caller identification to prevent identity spoofing

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114244629B (zh) * 2021-03-30 2024-04-16 支付宝(杭州)信息技术有限公司 跨链访问控制方法和装置
CN115914244B (zh) * 2022-09-23 2024-05-17 四川启睿克科技有限公司 一种优化分布式账本互操作性的方法

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170149819A1 (en) * 2015-11-25 2017-05-25 International Business Machines Corporation Resisting replay attacks efficiently in a permissioned and privacy- preserving blockchain network
CN109714348A (zh) * 2018-12-29 2019-05-03 百度在线网络技术（北京）有限公司 基于区块链实现的权限处理方法、装置、设备和介质
CN112508560A (zh) * 2020-12-01 2021-03-16 浙商银行股份有限公司 区块链跨链身份认证和权限管控方法、装置及计算机设备
CN112738139A (zh) * 2021-03-30 2021-04-30 支付宝(杭州)信息技术有限公司 一种跨链访问控制方法和装置
CN112769871A (zh) * 2021-03-30 2021-05-07 支付宝(杭州)信息技术有限公司 跨链访问控制方法和装置
CN112800404A (zh) * 2021-03-30 2021-05-14 支付宝(杭州)信息技术有限公司 一种跨链访问控制方法和装置

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP6617594B2 (ja) * 2016-02-15 2019-12-11 富士通株式会社 パケット中継プログラムおよびパケット中継方法
US11019059B2 (en) * 2018-04-26 2021-05-25 Radware, Ltd Blockchain-based admission processes for protected entities
CN108632268B (zh) * 2018-04-28 2021-04-09 腾讯科技（深圳）有限公司 区块链访问的鉴权方法和装置、存储介质、电子装置
CN109905464B (zh) * 2019-01-29 2021-08-20 华东师范大学 一种基于区块链的分布式遥感数据共享系统
CN110049066B (zh) * 2019-05-23 2020-05-26 中国科学院软件研究所 一种基于数字签名和区块链的资源访问授权方法
CN110222518B (zh) * 2019-05-30 2021-09-17 北京工业大学 基于区块链的可信权能访问控制方法
CN111314363B (zh) * 2020-02-25 2022-08-30 深圳市亿道信息股份有限公司 一种基于区块链的企业移动设备管理方法及系统

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170149819A1 (en) * 2015-11-25 2017-05-25 International Business Machines Corporation Resisting replay attacks efficiently in a permissioned and privacy- preserving blockchain network
CN109714348A (zh) * 2018-12-29 2019-05-03 百度在线网络技术（北京）有限公司 基于区块链实现的权限处理方法、装置、设备和介质
CN112508560A (zh) * 2020-12-01 2021-03-16 浙商银行股份有限公司 区块链跨链身份认证和权限管控方法、装置及计算机设备
CN112738139A (zh) * 2021-03-30 2021-04-30 支付宝(杭州)信息技术有限公司 一种跨链访问控制方法和装置
CN112769871A (zh) * 2021-03-30 2021-05-07 支付宝(杭州)信息技术有限公司 跨链访问控制方法和装置
CN112800404A (zh) * 2021-03-30 2021-05-14 支付宝(杭州)信息技术有限公司 一种跨链访问控制方法和装置

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210281424A1 (en) * 2018-07-17 2021-09-09 Verizon Patent And Licensing Inc. Validating and securing caller identification to prevent identity spoofing
US11824994B2 (en) * 2018-07-17 2023-11-21 Verizon Patent And Licensing Inc. Validating and securing caller identification to prevent identity spoofing

Also Published As

Publication number Publication date
CN112769871A (zh) 2021-05-07
CN114244629B (zh) 2024-04-16
CN112769871B (zh) 2021-11-19
CN114244629A (zh) 2022-03-25

Similar Documents

Publication Publication Date Title
WO2022205965A1 (zh) 跨链访问控制方法和装置
CN111898153B (zh) 调用合约的方法及装置
US11252166B2 (en) Providing data authorization based on blockchain
JP7072587B2 (ja) ブロックチェーン・ネットワークにおける暗号座礁リソースを回避又は削減するシステム及び方法
CN110096857B (zh) 区块链系统的权限管理方法、装置、设备和介质
JP7019697B2 (ja) ブロックチェーン上の動的アクセス制御
WO2022205963A1 (zh) 一种跨链访问控制方法和装置
EP3905078A1 (en) Identity verification method and system therefor
CN110266659B (zh) 一种数据处理方法和设备
US9648008B2 (en) Terminal identification method, and method, system and apparatus of registering machine identification code
CN109446259B (zh) 数据处理方法及装置、处理机及存储介质
CN111723383A (zh) 数据存储、验证方法及装置
WO2022205966A1 (zh) 一种跨链访问控制方法和装置
CN110138767B (zh) 事务请求的处理方法、装置、设备和存储介质
WO2022206453A1 (zh) 提供跨链隐私数据的方法和装置
CN110032846B (zh) 身份数据的防误用方法及装置、电子设备
CN112328558B (zh) 基于区块链的医疗系统的访问日志存储方法及系统
WO2022206439A1 (zh) 提供跨链消息的方法和装置
CN111901321A (zh) 一种认证鉴权方法、装置、电子设备和可读存储介质
CN101324913B (zh) 计算机文件保护方法和装置
US20180315044A1 (en) Systems and methods for distributed data mapping
CN109063461B (zh) 一种第三方免密登录方法及系统
CN111797373B (zh) 身份信息认证的方法、系统、计算机设备和可读存储介质
CN114117507B (zh) 对象存储系统及其访问控制方法和设备、存储介质
CN111818094B (zh) 一种身份注册方法、装置及设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21934601

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21934601

Country of ref document: EP

Kind code of ref document: A1