WO2022205966A1 - 一种跨链访问控制方法和装置 - Google Patents

一种跨链访问控制方法和装置 Download PDF

Info

Publication number
WO2022205966A1
WO2022205966A1 PCT/CN2021/133127 CN2021133127W WO2022205966A1 WO 2022205966 A1 WO2022205966 A1 WO 2022205966A1 CN 2021133127 W CN2021133127 W CN 2021133127W WO 2022205966 A1 WO2022205966 A1 WO 2022205966A1
Authority
WO
WIPO (PCT)
Prior art keywords
blockchain
access
relay device
request
data
Prior art date
Application number
PCT/CN2021/133127
Other languages
English (en)
French (fr)
Inventor
邱鸿霖
Original Assignee
蚂蚁区块链科技(上海)有限公司
支付宝(杭州)信息技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 蚂蚁区块链科技(上海)有限公司, 支付宝(杭州)信息技术有限公司 filed Critical 蚂蚁区块链科技(上海)有限公司
Publication of WO2022205966A1 publication Critical patent/WO2022205966A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/21—Design, administration or maintenance of databases
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/27—Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/60—Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/50—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using hash chains, e.g. blockchains or hash trees

Definitions

  • the embodiments of this specification relate to the field of blockchain technology, and more particularly, to a cross-chain access control method and apparatus.
  • Blockchain technology also known as distributed ledger technology, is a decentralized distributed database technology characterized by decentralization, openness, transparency, immutability, and trustworthiness. Each data of the blockchain will be broadcast to the blockchain nodes of the entire network, and each full node has a full amount of consistent data.
  • many different types of chains have emerged, which are applied in the fields of finance, health care, supply chain, asset management and traceability.
  • most on-chain applications encrypted currencies or smart contracts
  • How to make different types of chains cooperate to realize the circulation of data has become the direction of exploration.
  • the cross-chain message to be sent to the second blockchain is written into the receipt of the first blockchain in the first blockchain, and the off-chain relay device from the first blockchain
  • the blockchain gets the receipt, provides the receipt to the second blockchain.
  • the receipt includes a data read request to the second blockchain or a call request to the smart contract.
  • one aspect of this specification provides a cross-chain access control method, the method is executed by a first relay device, the first relay device is connected to the first blockchain, and the first relay device is connected to the first blockchain.
  • An access control table corresponding to the first blockchain is preset in the device, and the access control table includes authorization information of resources in the first blockchain, and the method includes: block chain access request, the access request is used to request access to the resources in the first block chain; based on the access control table to determine whether the access request is authorized; when judging that the access request is authorized In this case, access to the resource is made.
  • the access request includes an identifier of the second blockchain that sent the access request, wherein determining whether the access request is authorized based on the access control table includes: based on the access control table The table determines whether the resource is a resource authorized to the second blockchain.
  • the access request further includes the requested access mode to the resource, wherein determining whether the access request is authorized based on the access control table includes: determining the access request based on the access control table. whether the requested access mode to the resource is the access mode authorized to the second blockchain.
  • the access request is an invocation request to a smart contract in the first blockchain, wherein accessing the resource includes sending a transaction to the first blockchain to Invoke the smart contract.
  • the access request is a read request for data in the first blockchain, wherein accessing the resource includes reading all data from the first blockchain stated data.
  • reading the data from the first blockchain includes reading the data and its attestation data from the first blockchain.
  • the first relay device is connected to a relay device network, and a look-up table is stored in the first relay device, and the look-up table records predetermined schedules in the relay network.
  • a blockchain to which each of a number of relay devices is connected, and the method further includes sending the data to at least one of the predetermined number of relay devices based on the look-up table.
  • Another aspect of this specification provides a cross-chain access control device, the device is deployed on a first relay device, the first relay device is connected to the first blockchain, and the first relay device is preset There is an access control table corresponding to the first block chain, and the access control table includes authorization information of resources in the first block chain, and the device includes: a receiving unit configured to receive the first block chain.
  • An access request of a blockchain the access request is used to request access to the resources in the first blockchain; the judging unit is configured to determine whether the access request is authorized based on the access control table; access The unit is configured to, in the case of judging that the access request is authorized, perform access to the resource.
  • the access request includes an identifier of the second blockchain that sent the access request, wherein the judging unit is further configured to: based on the access control table, determine whether the resource is a A resource authorized to the second blockchain.
  • the access request further includes a requested access mode to the resource
  • the judging unit is further configured to: judge the requested access to the resource based on the access control table Whether the access method is the access method authorized to the second blockchain.
  • the access request is a request for invoking a smart contract in the first blockchain, wherein the accessing unit is further configured to send a transaction to the first blockchain to invoke the smart contract.
  • the access request is a read request for data in the first blockchain, wherein the access unit is further configured to read the data from the first blockchain data.
  • the access unit is further configured to read the data and its certification data from the first blockchain.
  • the first relay device is connected to a relay device network, and a look-up table is stored in the first relay device, and the look-up table records predetermined schedules in the relay network.
  • a blockchain to which a number of relay devices are respectively connected, and the apparatus further includes a sending unit configured to send the data to at least one relay device in the predetermined number of relay devices based on the look-up table .
  • Another aspect of the present specification provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed in a computer, causes the computer to execute any one of the above methods.
  • Another aspect of the present specification provides a computing device, including a memory and a processor, where a computer program is stored in the memory, and the processor implements any one of the above methods when executing the computer program.
  • the cross-chain resource access rights can be set according to actual needs, This ensures the security and controllability of resources in the blockchain.
  • FIG. 1 shows a schematic diagram of a cross-chain system according to an embodiment of the present specification
  • FIG. 2 shows a flowchart of a method for invoking a contract across chains according to an embodiment of the present specification
  • FIG. 3 shows a schematic diagram of reading data across chains according to an embodiment of the present specification
  • FIG. 4 shows a flowchart of a method for reading data across chains according to an embodiment of the present specification
  • FIG. 5 shows a cross-chain access control apparatus 500 according to an embodiment of the present specification.
  • FIG. 1 shows a schematic diagram of a cross-chain system according to an embodiment of the present specification.
  • the cross-chain system includes a first blockchain 11 , a relay device network 12 and a second blockchain 13 .
  • the relay device network 12 includes a plurality of relay devices with a predetermined connection relationship, and FIG. 1 only schematically shows the first relay device 121 and the second relay device 122 , wherein the clouds shown in dotted lines represent , the first relay device 121 and the second relay device 122 may be directly connected, or may be connected through other relay devices.
  • Each relay device in the relay device network 12 is connected to at least one blockchain, and each relay device stores a look-up table that records the correspondence of a predetermined number of relay devices to the blockchain to which it is connected. Therefore, through the plurality of relay devices in the relay device network 12, the relay device network can be connected with more blockchains.
  • 1 schematically shows that the first blockchain 11 is connected to the first relay device 121 , and the second blockchain 13 is connected to the second relay device 122
  • the first contract and the message sending contract are deployed in the second blockchain 13
  • the message receiving contract and the fourth contract are deployed in the second blockchain 13
  • the first contract and the fourth contract are, for example, contracts for performing cross-chain transfers.
  • account A in the second blockchain 13 wishes to transfer money to account B in the first blockchain 11, and account A initiates the transfer by sending a transaction that invokes the first contract.
  • the first contract is executed, thereby subtracting the number of transfers from the balance of account A, and the message sending contract called in the first contract is executed, so that in the second block
  • the chain 13 stores, for example, a receipt m, where m is a receipt number, and the receipt m includes a message to be sent to the fourth contract in the first blockchain 11 .
  • the message includes, for example, the identifier of the sending chain (the second blockchain 13 ), the identifier of the receiving chain (the first blockchain 11 ), the account of the receiving contract (the fourth contract), the sending account (account A), and the receiving account of the message. (Account B), and the amount added to the balance of Account B, etc.
  • the second relay device 122 can obtain the receipt m and the corresponding simple data from the second blockchain 13 Payment Verification (Spv) proof data. Based on the content of the message in the receipt m, the second relay device 122 can determine that the receiving chain of the message is the first blockchain 11, and the second relay device 122 determines whether it is connected to the first blockchain 11, and if it is connected to the first blockchain 11 When the blockchain 11 is connected, the second relay device 122 can determine whether the second blockchain 13 is authorized to call the fourth contract based on the access control table therein, and if it is determined that the second blockchain 13 is authorized to call the fourth contract the authority of the contract, the receipt m and its Spv proof data are provided to the first blockchain 11 (this situation is not shown in FIG.
  • the second relay device 122 determines that it is not connected to the first blockchain 11, it can determine the routing path to the first blockchain 11 by reading the lookup table as shown in FIG. 1, so that the second intermediate The relay device 122 can send the receipt m and its Spv certification data to the relay device network 12 and finally to the first relay device 121 .
  • the first relay device 121 can determine whether the second blockchain 13 is authorized to call the fourth contract based on the access control table therein, and if it is determined that the second blockchain 13 When authorized to call the fourth contract, the transaction n is sent to the first blockchain 11, where n is the transaction number. In the transaction n, the receipt m and its Spv proof number are used as the incoming parameters to call the message receiving contract.
  • the node in the first blockchain 11 executes the transaction n, that is, when the message receiving contract is executed, the receipt m is verified using the Spv proof data to verify whether the receipt m is indeed the receipt in the second blockchain 13 . After the verification is passed, the message is parsed from the data of the message.
  • the fourth contract is called with the message as an incoming parameter, thereby passing the message to the fourth contract.
  • the fourth contract increases the balance of the account B in the first blockchain 11 by the amount corresponding to the predetermined amount according to the content of the message, thereby completing the transfer process.
  • the relay device is not limited to the form shown in FIG. 1
  • the first contract and the fourth contract are not limited to contracts for transfer, and so on.
  • FIG. 2 shows a flow chart of a method for invoking a contract across chains according to an embodiment of the present specification.
  • the method can be executed by any relay device in the relay device network 12 in FIG. 1 .
  • the first relay device is used 121 is taken as an example for description, the method includes: step S202, receiving a call request for a contract in the first blockchain 11; step S204, judging whether the call request is authorized based on the access control table; step S206, based on The result of the judgment determines whether to provide the call request to the first blockchain 11 .
  • step S202 a call request for a contract in the first blockchain 11 is received.
  • the first relay device 121 receives the receipt m and its Spv proof from other relay devices in the relay device network, the receipt m includes a message, and the message includes, for example, a transmission chain of the message in a predetermined data structure (Second block chain 13) identification, receiving chain (first block chain 11) identification, receiving contract (fourth contract) account, sending account, receiving account (account B), and the number of additions to the balance of account B and so on. Therefore, the above data structure can indicate by default that the access method to the fourth contract is the calling method. Therefore, according to the receiving contract account (that is, the account of the fourth contract) included in the message, it can be determined that the receipt m is for the first blockchain.
  • the call request of the fourth contract in 11. It can be understood that a field for indicating an access mode may be additionally included in the access request, so as to indicate that the access request is a call request.
  • the call request is not limited to the above-mentioned form.
  • the call request may not include the sending chain identifier. If the first relay device 121 is only connected to the first blockchain 11 and the second blockchain 13, Then, the call request may not include the receiving chain identifier.
  • the invocation request may only include the identifier (eg, account address) of the smart contract that is requested to be invoked, or the invocation request may include the identifier of the smart contract that is requested to be invoked and the parameters passed into the smart contract.
  • step S204 it is determined whether the invocation request is authorized based on the access control table.
  • Table 1 schematically shows the access control table corresponding to the first blockchain 11 according to the embodiment of the present specification:
  • Blockchain ID resource interview method Domain 2 Fourth contract account transfer block p, transaction q read Domain 3 block p read
  • the column “Blockchain ID” is used to record the ID of the authorized blockchain.
  • the domain name of the blockchain is used as the ID of the blockchain.
  • the column is used to record the resources in the first blockchain 11 that the authorized blockchain is specifically authorized to access.
  • the resources include, for example, block data, transaction data, contracts, etc.
  • the “Access Mode” column is used to record the authorized access.
  • the specific authorized access method of the blockchain includes calling the contract and reading the data.
  • the domain name of the second blockchain 13 is the domain name 2
  • the read authority of the transaction q in the block p in the first block chain 11 and Table 1 also records that the block chain with the domain name of the domain name 3 has the read authority to the block p in the first block chain 11 .
  • the access control list shown in Table 1 is only illustrative and not restrictive.
  • the column of the blockchain identifier is not limited to recording the domain name of the blockchain, but other blockchain identifiers for uniquely identifying the blockchain can be recorded.
  • the access control table is not limited to include the 3 columns shown in Table 1, but only one or two of the columns can be recorded.
  • the access control table only includes the "resource" column in All blockchains grant access to the fourth contract, transaction q in block p, and read access to block p.
  • Table 2 shows a schematic diagram of another access control table corresponding to the first blockchain 11 according to an embodiment of the present specification.
  • the authorization information of the resource is recorded with respect to each resource.
  • the access control table according to the embodiment of the present specification is not limited to that shown in Table 2.
  • Other columns may also be included in the access control list to authorize other items.
  • the access control table may include a sending contract account column to authorize the account of the contract sending the resource invocation request.
  • the authorized sending contract account of the fourth contract account can also be defined as the account of the first contract in FIG. During authorization, it can be determined whether the contract that sends the call request is the first contract.
  • the first relay device 121 may determine whether the invocation request is authorized based on any of the above access control tables. Specifically, for example, for the access control table shown in Table 1, obtain the sending chain identifier (that is, the domain name 2 of the second blockchain 13) in the message, and determine whether the domain name is recorded in the above access control table, if recorded Now, it can be determined that the second blockchain 13 is an authorized blockchain, and if it is not recorded, it can be determined that the second blockchain 13 is not authorized to access the first blockchain 11 . It can be determined from Table 1 that the second blockchain 13 is the blockchain authorized to access the first blockchain 11 . Then, obtain the fourth contract account in the message, and determine whether the contract account is authorized to the second blockchain 13 based on the access control table.
  • the sending chain identifier that is, the domain name 2 of the second blockchain 13
  • the smart contract requested to be called in the call request such as the fourth contract account
  • the smart contract requested to be called in the call request can be found in Table 2, and then it is judged whether the blockchain identifier corresponding to the fourth contract includes the second area
  • the identifier of the blockchain 13 ie, the domain name 2
  • the access control list may have various other forms.
  • the access control table does not include a column of access mode. In this case, it is only necessary to determine whether the blockchain identifier corresponding to the fourth contract includes the identifier of the second blockchain 13 (ie, the domain name 2).
  • step S206 it is determined whether to provide the calling request to the first blockchain 11 based on the result of the judgment.
  • the first relay device 121 sends a transaction n to the first blockchain 11 in which the invocation message takes the receipt m and the Spv proof as parameters Receive the contract, so that in the process of executing the message receiving contract, the fourth contract is invoked with the message in the receipt m as the incoming parameter, so as to realize the invocation of the fourth contract.
  • the first relay device 121 is not limited to providing a call request to the first blockchain 11 in this way.
  • the first relay device 121 can directly call the fourth contract with the receipt m and the Spv proof as parameters, thereby realizing A call to the fourth contract.
  • the first relay device 121 In the case of determining that the invocation request is not authorized, the first relay device 121 will not provide the invocation request to the first blockchain 11, and return the invocation failure information to the second blockchain 13 through the relay device network 12 .
  • FIG. 3 shows a schematic diagram of reading data across chains according to an embodiment of the present specification.
  • the system for implementing the process shown in FIG. 3 is the same as the system shown in FIG. 1 , wherein a fifth contract is also deployed in the second blockchain 13 .
  • the fifth contract is, for example, used to calculate the account balance of account B in the first blockchain 11.
  • the transfer transaction is recorded in the first blockchain 11, for example, by means of receipt b (where b is a receipt number).
  • the message sending contract is called in the fifth contract to issue a request to read the receipt b in the first blockchain 11 .
  • a receipt a is stored in the second blockchain 13, and the read request is included in the receipt a.
  • the second relay device 122 After depositing the receipt a in the second blockchain 13, the second relay device 122 can obtain the receipt a from the second blockchain 13, thereby obtaining the read request. Based on the content in the read request, the second relay device 122 can determine that the read request is for requesting to read the receipt b in the first blockchain 11, and the second relay device 122 determines whether it is related to the first block chain 11 or not. The blockchain 11 is connected, and if connected to the first blockchain 11, the second relay device 122 can directly read the receipt b from the first blockchain 11 (this situation is not shown in FIG. 3). If the second relay device 122 determines that it is not connected to the first blockchain 11, as shown in FIG. 3, by reading the lookup table, the routing path to the first blockchain 11 can be determined, so that the second intermediate The relay device 122 can send the read request to the relay device network 12 to finally send it to the first relay device 121 .
  • the first relay device 121 After the first relay device 121 receives the read request, it can determine whether the second blockchain 13 is authorized to read receipt b based on the access control table therein, and if it is determined that the second blockchain 13 is authorized to do so. , the receipt b and its Simple Payment Verification (Spv) proof data are read from the first blockchain 11 , and the receipt b and its Spv proof data are sent back to the second relay device 122 . Afterwards, the second relay device 122 can transmit the receipt b and its Spv proof data back to the message sending contract by sending a transaction (not shown) to the second blockchain 13, wherein the receipt b and the Spv proof data are sent back to the message sending contract. Its Spv proof data calls the message sending contract for the incoming parameters.
  • Spv Simple Payment Verification
  • the message sending contract After receiving the receipt b and its Spv proof data, the message sending contract verifies the receipt b through the Spv proof data. After the verification is passed, it calls the fifth contract with the receipt b as the incoming parameter, thereby providing the receipt b to the fifth contract. contract.
  • FIG. 4 shows a flow chart of a method for reading data across chains according to an embodiment of the present specification.
  • the method can be executed by any relay device in the relay device network 12 in FIG. 1 .
  • the first relay is used.
  • the device 121 is used as an example for description, and the method includes: step S402, receiving a read request for data in the first blockchain 11; step S404, judging whether the read request is authorized based on the access control table; step S406, based on the result of the judgment, determine whether to read data from the first blockchain 11.
  • step S402 a read request for data in the first blockchain 11 is received.
  • the first relay device 121 receives a read request for the receipt b in the first blockchain 11 from other relay devices in the relay device network.
  • the read request includes, for example, the identification of the request sending chain (the second blockchain 13 ), the identification of the receiving chain (the first blockchain 11 ), the identification of the receipt b, and the like, wherein the identification of the receipt b includes, for example, the block number (eg block p), receipt number (eg receipt b).
  • the read request is not limited to requesting the receipt in the first blockchain 11, but can read any data recorded in the first blockchain 11, such as transaction data, contract data, account status data, area data Block header data, etc., are not limited here.
  • the read request is not limited to the above-mentioned form, for example, the read request may only include an identifier of the data requested to be read.
  • step S404 it is determined whether the read request is authorized based on the access control table.
  • the access control table in the first relay device 121 is shown in Table 1 above.
  • the first relay device 121 may determine whether the read request is authorized based on the access control table. Specifically, the identifier of the sending chain being read (that is, the domain name 2 of the second blockchain 13) is obtained, and it is determined whether the domain name is recorded in the access control table. If it is recorded, it can be determined that the second blockchain 13 is Authorized blockchain, if not recorded, it can be determined that the second blockchain 13 is not authorized to access the first blockchain 11 . It can be determined from Table 1 that the second blockchain 13 is the blockchain authorized to access the first blockchain 11 .
  • the identification of the data to be read in the read request (that is, the receipt b) is obtained, and based on the access control table, it is determined whether the data is authorized to the second blockchain 13 .
  • receipt b is the transaction receipt of transaction q
  • step S406 it is determined whether to read data from the first blockchain 11 based on the result of the judgment.
  • the first relay device 121 In the case where it is determined that the read request is authorized based on the above judgment result, the first relay device 121 reads the receipt m in the first blockchain 11 . In the case where it is determined that the read request is not authorized based on the above judgment result, the first relay device 121 determines not to perform the read from the first blockchain 11, and sends the request to the second blockchain through the relay device network 12. The block chain 13 returns a read failure message.
  • the first relay device 121 is connected to any node in the first blockchain 11, and reads the receipt b from the node.
  • the client of the first blockchain 11 is installed in the first relay device 121, and the interface in the client directly displays the node options of the connectable blockchain, and the options include the first The identifier of the node in the blockchain 11, so that the business person corresponding to the first relay device 121 directly clicks on the identifier of the node in the first blockchain 11 to connect to the first blockchain 11 through the client .
  • a button or input box for reading data will be displayed on the interface of the client, and the business personnel can read the first blockchain by clicking or inputting in the client 11 for the corresponding data.
  • receipt b can be read
  • the Spv proof data button corresponding to receipt b in the client can be read data.
  • the Spv proof data is the data used for Spv verification of the data.
  • the Spv proof data of receipt b includes: the block header hash value of block p, the receipt tree root hash value included in block p Hash value, hash value of each other node in the tree path from receipt b to the root node in the receipt tree.
  • the first relay device 121 reads the receipt b and its certification data is only an example description of the embodiment of the present specification, and is not used to limit the scope of the embodiment of the present specification.
  • the first relay device 121 may only read the receipt b for transmission back to the second blockchain 13 .
  • the first relay device 121 may only read the data requested to be read without reading its certification data.
  • the first relay device 121 After reading the data b and its Spv proof data from the first blockchain 11 , the first relay device 121 directly or indirectly sends the receipt b and its Spv proof data to the second relay device 122 .
  • the second relay device 122 thus provides the receipt b and its Spv proof data to the first blockchain 11 .
  • the second relay device 122 is directly connected to the first relay device 121, so that the first relay device 121 can directly send the receipt b and its Spv proof data to the second relay device 121.
  • Relay device 122 is directly connected to the first relay device 121, so that the first relay device 121 can directly send the receipt b and its Spv proof data to the second relay device 121.
  • the second relay device 122 determines a transmission path based on a look-up table therein when the read request is previously sent, so as to send the read request to the first relay through the relay of other relay devices device 121.
  • the look-up table is, for example, a distributed hash table (DHT table), and the second relay device 122 can calculate a routing path based on the look-up table, so that the read request is sent to the first relay device 121 with a minimum number of relays .
  • the read request may be attached with its sending path from the second relay device 122 to the first relay device 121 , for example, the sending path is the second relay device 122 ⁇ Third relay device (not shown in FIG. 3 ) ⁇ First relay device 121 . Therefore, when the first relay device 121 sends back the read data corresponding to the read request, it can send the read data back to the second relay device 122 based on the transmission path.
  • the first relay device 121 may determine a routing path for providing receipt b and its Spv proof data to the second blockchain 13 based on its local lookup table, so that the receipt b and the Its Spv certification data is sent back to the second relay device 122 .
  • FIG. 5 shows a cross-chain access control apparatus 500 according to an embodiment of the present specification.
  • the apparatus 500 is deployed on a first relay device, the first relay device is connected to a first blockchain, and the first relay device is connected to the first blockchain.
  • An access control table corresponding to the first blockchain is preset in the relay device, and the access control table includes authorization information of resources in the first blockchain, and the apparatus 500 includes: a receiving unit 51, configured to receive an access request to the first blockchain, where the access request is used to request access to resources in the first blockchain; judging unit 52, configured to determine based on the access control table Whether the access request is authorized; the access unit 53 is configured to access the resource when it is determined that the access request is authorized.
  • the access request includes an identifier of the second blockchain that sent the access request, wherein the determining unit 52 is further configured to: determine whether the resource is a resource based on the access control table A resource authorized to the second blockchain.
  • the access request further includes the requested access mode to the resource
  • the judging unit 52 is further configured to: determine the requested access to the resource based on the access control table Whether the access method is the access method authorized to the second blockchain.
  • the access request is a request for calling a smart contract in the first blockchain, wherein the accessing unit 53 is further configured to send a transaction to the first blockchain to Invoke the smart contract.
  • the access request is a read request for data in the first blockchain, wherein the access unit 53 is further configured to read all data from the first blockchain stated data.
  • the access unit 53 is further configured to read the data and its certification data from the first blockchain.
  • the first relay device is connected to a relay device network, and a look-up table is stored in the first relay device, and the look-up table records predetermined schedules in the relay network.
  • the apparatus 500 further includes a sending unit 54, configured to send the data to at least one of the predetermined number of relay devices based on the look-up table follow the device.
  • Another aspect of the present specification provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed in a computer, causes the computer to execute any one of the above methods.
  • Another aspect of the present specification provides a computing device, including a memory and a processor, where a computer program is stored in the memory, and the processor implements any one of the above methods when executing the computer program.
  • the cross-chain resource access rights can be set according to actual needs, This ensures the security and controllability of resources in the blockchain.
  • the software module can be placed in random access memory (RAM), internal memory, read only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disks, removable disks, CD-ROMs, or technical fields in any other form of storage medium known in the art.
  • RAM random access memory
  • ROM read only memory
  • electrically programmable ROM electrically erasable programmable ROM
  • registers hard disks, removable disks, CD-ROMs, or technical fields in any other form of storage medium known in the art.

Landscapes

  • Engineering & Computer Science (AREA)
  • Databases & Information Systems (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Data Mining & Analysis (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computing Systems (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本说明书实施例提供了一种跨链访问控制方法和装置，所述方法由第一中继设备执行，所述第一中继设备与第一区块链连接，所述第一中继设备中预设有与所述第一区块链对应的访问控制表，所述访问控制表中包括所述第一区块链中的资源的授权信息，所述方法包括：接收对第一区块链的访问请求，所述访问请求用于请求访问的所述第一区块链中的资源；基于所述访问控制表判断所述访问请求是否被授权；在判断所述访问请求被授权的情况中，进行对所述资源的访问。

Description

一种跨链访问控制方法和装置 技术领域
本说明书实施例涉及区块链技术领域，更具体地，涉及一种跨链访问控制方法和装置。
背景技术
区块链技术也被称之为分布式账本技术，是一种去中心化的分布式数据库技术，其特点是去中心化、公开透明、不可篡改、可信任。区块链的每笔数据，都会广播到全网的区块链节点，每个全节点都有全量的、一致的数据。随着区块链技术的火热，出现了许多不同类型的链，应用在金融、健康医疗、供应链、资产管理和溯源等领域。然而大部分链上应用(加密货币或者智能合约)都无法跨越当前链的边界，不能与其他链协同合作实现数据的流通，从而限制了区块链的发挥空间。如何能让不同类型的链协同合作实现数据的流通成了探索的方向。
在现有的一种跨链技术中，在第一区块链中将待发送给第二区块链的跨链消息写入第一区块链的收据，链下的中继设备从第一区块链获取该收据，将该收据提供给第二区块链。该收据中包括对第二区块链的数据读取请求或者对智能合约的调用请求。在该情况中，为了保证区块链中的数据安全性，如何对第二区块链进行访问权限控制，是亟待解决的问题。
因此，需要一种更有效的跨链访问控制方案。
发明内容
本说明书实施例旨在提供一种更有效的跨链访问控制方案，以解决现有技术中的不足。
为实现上述目的，本说明书一个方面提供一种跨链访问控制方法，所述方法由第一中继设备执行，所述第一中继设备与第一区块链连接，所述第一中继设备中预设有与所述第一区块链对应的访问控制表，所述访问控制表中包括所述第一区块链中的资源的授权信息，所述方法包括：接收对第一区块链的访问请求，所述访问请求用于请求访问的所述第一区块链中的资源；基于所述访问控制表判断所述访问请求是否被授权；在判断 所述访问请求被授权的情况中，进行对所述资源的访问。
在一种实施方式中，所述访问请求中包括发送所述访问请求的第二区块链的标识，其中，基于所述访问控制表判断所述访问请求是否被授权包括：基于所述访问控制表判断所述资源是否为被授权给所述第二区块链的资源。
在一种实施方式中，所述访问请求中还包括请求的对所述资源的访问方式，其中，基于所述访问控制表判断所述访问请求是否被授权包括：基于所述访问控制表判断所述请求的对所述资源的访问方式是否为被授权给所述第二区块链的访问方式。
在一种实施方式中，所述访问请求为对所述第一区块链中的智能合约的调用请求，其中，进行对所述资源的访问包括，向所述第一区块链发送交易以调用所述智能合约。
在一种实施方式中，所述访问请求为对所述第一区块链中的数据的读取请求，其中，进行对所述资源的访问包括，从所述第一区块链读取所述数据。
在一种实施方式中，从所述第一区块链读取所述数据包括，从所述第一区块链读取所述数据及其证明数据。
在一种实施方式中，所述第一中继设备连接于中继设备网络中，所述第一中继设备中存储有查找表，所述查找表中记录了所述中继网络中的预定数目个中继设备各自连接的区块链，所述方法还包括，基于所述查找表将所述数据发送给所述预定数目个中继设备中的至少一个中继设备。
本说明书另一方面提供一种跨链访问控制装置，所述装置部署于第一中继设备，所述第一中继设备与第一区块链连接，所述第一中继设备中预设有与所述第一区块链对应的访问控制表，所述访问控制表中包括所述第一区块链中的资源的授权信息，所述装置包括：接收单元，配置为，接收对第一区块链的访问请求，所述访问请求用于请求访问的所述第一区块链中的资源；判断单元，配置为，基于所述访问控制表判断所述访问请求是否被授权；访问单元，配置为，在判断所述访问请求被授权的情况中，进行对所述资源的访问。
在一种实施方式中，所述访问请求中包括发送所述访问请求的第二区块链的标识，其中，所述判断单元还配置为：基于所述访问控制表判断所述资源是否为被授权给所述第二区块链的资源。
在一种实施方式中，所述访问请求中还包括请求的对所述资源的访问方式，其中，所述判断单元还配置为：基于所述访问控制表判断所述请求的对所述资源的访问方式是 否为被授权给所述第二区块链的访问方式。
在一种实施方式中，所述访问请求为对所述第一区块链中的智能合约的调用请求，其中，所述访问单元还配置为，向所述第一区块链发送交易以调用所述智能合约。
在一种实施方式中，所述访问请求为对所述第一区块链中的数据的读取请求，其中，所述访问单元还配置为，从所述第一区块链读取所述数据。
在一种实施方式中，所述访问单元还配置为，从所述第一区块链读取所述数据及其证明数据。
在一种实施方式中，所述第一中继设备连接于中继设备网络中，所述第一中继设备中存储有查找表，所述查找表中记录了所述中继网络中的预定数目个中继设备各自连接的区块链，所述装置还包括，发送单元，配置为，基于所述查找表将所述数据发送给所述预定数目个中继设备中的至少一个中继设备。
本说明书另一方面提供一种计算机可读存储介质，其上存储有计算机程序，当所述计算机程序在计算机中执行时，令计算机执行上述任一种方法。
本说明书另一方面提供一种计算设备，包括存储器和处理器，所述存储器中存储有计算机程序，所述处理器在执行所述计算机程序时，实现上述任一种方法。
在根据本说明书实施例的跨链访问控制方案中，通过在中继设备中进行区块链访问权限控制，使得区块链接入跨链网络中时，可根据实际需求设置跨链资源访问权限，从而保证区块链中的资源的安全性和可控性。
附图说明
通过结合附图描述本说明书实施例，可以使得本说明书实施例更加清楚：
图1示出根据本说明书实施例的跨链系统的示意图；
图2示出根据本说明书实施例的一种跨链调用合约的方法流程图；
图3示出根据本说明书实施例的跨链读取数据的示意图；
图4示出根据本说明书实施例的一种跨链读取数据的方法流程图；
图5示出根据本说明书实施例的一种跨链访问控制装置500。
具体实施方式
下面将结合附图描述本说明书实施例。
图1示出根据本说明书实施例的跨链系统的示意图。如图1所示，所述跨链系统包括第一区块链11、中继设备网络12和第二区块链13。其中，所述中继设备网络12中包括多个具有预定连接关系的中继设备，图1仅示意示出第一中继设备121和第二中继设备122，其中以虚线示出的云朵表示，第一中继设备121与第二中继设备122有可能直接连接，或者有可能通过其它中继设备连接。中继设备网络12中的每个中继设备与至少一个区块链连接，每个中继设备中存储有查找表，该查找表记录了预定数目个中继设备与其连接的区块链的对应关系，从而通过中继设备网络12中的多个中继设备，中继设备网络可与更多个区块链连接。图1中示意示出了，第一区块链11与第一中继设备121连接，第二区块链13与第二中继设备122连接。
其中，第二区块链13中部署有第一合约和消息发送合约，第二区块链13中部署有消息接收合约和第四合约。其中，所述第一合约和第四合约例如为用于进行跨链转账的合约。第二区块链13中的账户A例如希望给第一区块链11中的账户B进行转账，账户A通过发送调用第一合约的交易而发起转账。当在第二区块链13中执行在该交易时，执行第一合约，从而对账户A的余额减去转账的数目，并执行第一合约中调用的消息发送合约，从而在第二区块链13中存入例如收据m，其中m为收据编号，收据m中包括待发送给第一区块链11中的第四合约的消息。该消息中例如包括该消息的发送链(第二区块链13)标识、接收链(第一区块链11)标识、接收合约(第四合约)账户、发送账户(账户A)、接收账户(账户B)、及对账户B的余额增加的数目等内容。
假设第二区块链13为以太坊链，在第二区块链13中存入收据m之后，第二中继设备122可从第二区块链13中获取所述收据m及对应的简单支付验证(Spv)证明数据。第二中继设备122基于收据m中消息的内容可确定该消息的接收链为第一区块链11，第二中继设备122确定其是否与第一区块链11连接，如果与第一区块链11连接，则第二中继设备122可基于其中的访问控制表确定第二区块链13是否被授权调用第四合约的权限，如果确定第二区块链13被授权调用第四合约的权限，则将收据m及其Spv证明数据提供给第一区块链11(该情况在图1中未示出)。如果第二中继设备122确定其不与第一区块链11连接，则可如图1中所示，通过读取查找表，确定到第一区块链11的路由路径，从而第二中继设备122可将收据m及其Spv证明数据发送到中继设备网络12中，以最后发送给第一中继设备121。
第一中继设备121在接收到收据m及其Spv证明数据之后，可基于其中的访问控制表确定第二区块链13是否被授权调用第四合约的权限，如果确定第二区块链13被授权调用第四合约的权限，则向第一区块链11发送交易n，其中n为交易编号，在交易n中以收据m及其Spv证明数为传入参数调用消息接收合约。当第一区块链11中的节点执行交易n时，也即在执行消息接收合约时，使用Spv证明数据对收据m进行验证，以验证收据m是否确实为第二区块链13中的收据。在验证通过之后，从消息的数据解析出消息。之后，基于消息中的接收合约账户(即第四合约的合约账户)，以该消息作为传入参数调用第四合约，从而将消息传递给第四合约。第四合约在接收到消息之后，根据消息的内容将第一区块链11中的账户B的余额增加与预定数目对应的数目，从而完成所述转账过程。
可以理解，上述参考图1的描述只是示意性的，而不是用于限制本说明书实施例的范围。例如，所述中继设备不限于为图1中所示的形式，所述第一合约和第四合约不限于为用于转账的合约，等等。
下面将具体描述上述跨链中转数据过程中的访问权限控制方法。
图2示出根据本说明书实施例的一种跨链调用合约的方法流程图，所述方法可由图1中的中继设备网络12的任一中继设备执行，下文中以第一中继设备121为例进行示例描述，所述方法包括：步骤S202，接收对第一区块链11中的合约的调用请求；步骤S204，基于访问控制表判断所述调用请求是否被授权；步骤S206，基于所述判断的结果确定是否向第一区块链11提供所述调用请求。
首先，在步骤S202，接收对第一区块链11中的合约的调用请求。
如上文所述，第一中继设备121从中继设备网络中的其它中继设备接收到收据m及其Spv证明，该收据m中包括消息，该消息例如以预定数据结构包括该消息的发送链(第二区块链13)标识、接收链(第一区块链11)标识、接收合约(第四合约)账户、发送账户、接收账户(账户B)、及对账户B的余额增加的数目等内容。从而，上述数据结构可默认指示对第四合约的访问方式是调用方式，因此，根据该消息中包括的接收合约账户(即第四合约的账户)可确定该收据m为对第一区块链11中的第四合约的调用请求。可以理解，在访问请求中也可以另外包括用于指示访问方式的字段，以指示该访问请求是调用请求。
可以理解，所述调用请求不限于为上述形式，例如，该调用请求中可以不包括发送 链标识，如果第一中继设备121仅与第一区块链11和第二区块链13连接，则该调用请求中还可以不包括接收链标识。所述调用请求中可仅包括请求调用的智能合约的标识(如账户地址)，或者，所述调用请求中可包括请求调用的智能合约的标识和传入该智能合约的参数。
在步骤S204，基于访问控制表判断所述调用请求是否被授权。
表1示意示出根据本说明书实施例的与第一区块链11对应的访问控制表：
表1
区块链标识 资源 访问方式
域名2 第四合约账户 调用
  区块p，交易q 读取
域名3 区块p 读取
如表1中所示，其中，“区块链标识”一栏用于记录被授权的区块链的标识，在表1中以区块链的域名作为区块链的标识，“资源”一栏用于记录被授权的区块链具体被授权访问的第一区块链11中的资源，该资源例如包括区块数据、交易数据、合约等，“访问方式”一栏用于记录被授权的区块链具体被授权的访问方式，该访问方式包括对合约的调用和对数据的读取等。具体是，假设第二区块链13的域名为域名2，则表1中记录了，对第二区块链13授权对第一区块链11中的第四合约的调用权限、以及对第一区块链11中的区块p中的交易q的读取权限，表1中还记录了域名为域名3的区块链具有对第一区块链11中的区块p的读取权限。
可以理解，表1所示的访问控制表仅仅是示意性的，而不是限制性的。例如，区块链标识一栏中不限于记录区块链的域名，而可以记录其它用于唯一标识区块链的区块链标识。访问控制表中不限于包括表1中所示的3栏，而是可以仅记录其中的一栏或两栏，例如，访问控制表中仅包括表1中的“资源”栏，这表示，对于所有的区块链都授权对第四合约的调用权限、对区块p中交易q、和区块p的读取权限。
表2示出根据本说明书实施例的另一与第一区块链11对应的访问控制表的示意图。
表2
资源 区块链标识 访问方式
第四合约账户 域名2、域名4 调用
区块q，交易q 域名2 读取
区块p 域名3 读取
相比于表1中的相对于各个区块链记录该区块链被授权的资源及访问方式的信息，在表2中，相对于各个资源记录该资源的授权信息。可以理解，根据本说明书实施例的访问控制表不限于如表2所示。所述访问控制表中还可以包括其它栏，以对其它项进行授权。例如，所述访问控制表可包括发送合约账户一栏，以授权发送资源调用请求的合约的账户。如图1所示，在该访问控制表中还可以限定第四合约账户的被授权的发送合约账户为图1中的第一合约的账户，从而，在基于该访问授权表判断调用请求是否被授权时，可判断发送该调用请求的合约是否为第一合约。
第一中继设备121可基于上述任一种访问控制表判断所述调用请求是否被授权。具体是，例如对于表1所示的访问控制表，获取所述消息中的发送链标识(即第二区块链13的域名2)，确定该域名是否记录在上述访问控制表中，如果记录了，可确定第二区块链13是被授权的区块链，如果未记录，则可确定第二区块链13未被授权访问第一区块链11。从表1可以确定，第二区块链13是被授权访问第一区块链11的区块链。然后，获取消息中的第四合约账户，基于访问控制表确定该合约账户是否被授权给第二区块链13，从表1中可确定，在与域名2对应的资源栏中记录有第四合约账户，并且在与第四合约账户的访问方式中记录有“调用”，因此，可确定第二区块链13被授权了对第四合约的调用。也就是说，基于访问控制表确定了上述调用请求是被授权的调用请求。
例如对于表2所示的访问控制表，可首先在表2中找到调用请求中请求调用的智能合约，如第四合约账户，然后判断第四合约对应的区块链标识中是否包括第二区块链13的标识(即域名2)，之后判断第四合约对应的访问方式是否包括调用方式，从而确定所述调用请求是否被授权。可以理解，如上文所述，所述访问控制表可以具有其它各种形式。例如，所述访问控制表中不包括访问方式一栏，在该情况中，只需要判断第四合约对应的区块链标识中是否包括第二区块链13的标识(即域名2)。
在步骤S206，基于所述判断的结果确定是否向第一区块链11提供所述调用请求。
在确定所述调用请求被授权的情况中，如上文所述，第一中继设备121向第一区块 链11发送交易n，在所述交易n中以收据m和Spv证明为参数调用消息接收合约，从而使得在执行消息接收合约的过程中，以收据m中的消息为传入参数调用第四合约，从而实现对第四合约的调用。可以理解，第一中继设备121不限于以该方式向第一区块链11提供调用请求，例如，第一中继设备121可直接以收据m和Spv证明为参数调用第四合约，从而实现对第四合约的调用。
在确定所述调用请求未被授权的情况中，第一中继设备121将不向第一区块链11提供调用请求，并通过中继设备网络12向第二区块链13返回调用失败信息。
图3示出根据本说明书实施例的跨链读取数据的示意图。实施图3所示过程的系统与图1所示的系统相同，其中，第二区块链13中还部署有第五合约。第五合约例如为用于计算第一区块链11中的账户B的账户余额，在执行第五合约时，需要读取第一区块链中账户B与其它账户之间的转账交易过程，以用于计算账户B的余额，在第一区块链11中例如通过收据b(其中b为收据编号)对该转账交易进行了记录。为此，第五合约中调用消息发送合约，以发出读取第一区块链11中的收据b的请求。当在第二区块链13中执行该消息发送合约时，在第二区块链13中存入收据a，收据a中包括所述读取请求。
当在第二区块链13中存入收据a之后，第二中继设备122可从第二区块链13中获取所述收据a，从而可获取所述读取请求。第二中继设备122基于所述读取请求中的内容可确定该读取请求用于请求读取第一区块链11中的收据b，第二中继设备122确定其是否与第一区块链11连接，如果与第一区块链11连接，则第二中继设备122可直接从第一区块链11读取收据b(该情况在图3中未示出)。如果第二中继设备122确定其不与第一区块链11连接，则可如图3中所示，通过读取查找表，确定到第一区块链11的路由路径，从而第二中继设备122可将所述读取请求发送到中继设备网络12中，以最后发送给第一中继设备121。
第一中继设备121在接收到读取请求之后，可基于其中的访问控制表确定第二区块链13是否被授权读取收据b的权限，如果确定第二区块链13被授权该权限，则从第一区块链11读取收据b及其简单支付验证(Spv)证明数据，并将收据b及其Spv证明数据发回给第二中继设备122。之后，第二中继设备122可通过向第二区块链13发送交易(未示出)而将收据b及其Spv证明数据回传给消息发送合约，其中，在该交易中以收据b及其Spv证明数据为传入参数调用消息发送合约。消息发送合约在收到收据b及其Spv证明数据之后，通过Spv证明数据对收据b进行验证，在验证通过之后，以收据b作为传入参数调用第五合约，从而将收据b提供给第五合约。
下面将具体描述上述跨链读取数据的过程。
图4示出根据本说明书实施例的一种跨链读取数据的方法流程图，所述方法可由图1中的中继设备网络12的任一中继设备执行，下文中以第一中继设备121为例进行示例描述，所述方法包括：步骤S402，接收对第一区块链11中的数据的读取请求；步骤S404，基于访问控制表判断所述读取请求是否被授权；步骤S406，基于所述判断的结果确定是否从第一区块链11读取数据。
首先，在步骤S402，接收对第一区块链11中的数据的读取请求。
参考图3，第一中继设备121从中继设备网络中的其它中继设备接收到对第一区块链11中的收据b的读取请求。该读取请求中例如包括请求发送链(第二区块链13)标识、接收链(第一区块链11)标识、收据b的标识等内容，其中，收据b的标识例如包括区块号(例如区块p)，收据编号(例如收据b)。可以理解，所述读取请求不限于请求第一区块链11中的收据，而是可以读取第一区块链11中记录的任意数据，如交易数据、合约数据、账户状态数据、区块头数据等等，在此不作限定。另外，可以理解，所述读取请求不限于具有上述形式，例如，所述读取请求中可仅包括请求读取的数据的标识。
在步骤S404，基于访问控制表判断所述读取请求是否被授权。
第一中继设备121中的访问控制表如上文表1所示。第一中继设备121可基于该访问控制表判断所述读取请求是否被授权。具体是，获取读取中的发送链标识(即第二区块链13的域名2)，确定该域名是否记录在上述访问控制表中，如果记录了，可确定第二区块链13是被授权的区块链，如果未记录，则可确定第二区块链13未被授权访问第一区块链11。从表1可以确定，第二区块链13是被授权访问第一区块链11的区块链。然后，获取读取请求中的待读取数据的标识(即收据b)，基于访问控制表确定该数据是否被授权给第二区块链13。假设收据b为交易q的交易收据，从表1中可确定，在与域名2对应的资源栏中记录有区块p交易q，并且在该资源对应的访问方式中记录有“读取”，因此，可确定第二区块链13被授权了对收据b的读取。也就是说，基于访问控制表确定了上述读取请求是被授权的读取请求。
在步骤S406，基于所述判断的结果确定是否从第一区块链11读取数据。
在基于上述判断结果确定所述读取请求被授权的情况中，第一中继设备121在第一区块链11中进行对收据m的读取。在基于上述判断结果确定所述读取请求未被授权的情况中，第一中继设备121确定不从第一区块链11进行所述读取，并通过中继设备网络12向第二区块链13返回读取失败信息。
在确定所述读取请求被授权的情况中，第一中继设备121与第一区块链11中的任一节点连接，并从该节点读取收据b。具体是，在第一中继设备121中例如安装了第一区块链11的客户端，该客户端中的界面中直接显示了可连接的区块链的节点选项，该选项中包括第一区块链11中的节点的标识，从而，与第一中继设备121对应的业务人员直接点击第一区块链11中的节点的标识，即可通过客户端连接到第一区块链11。在连接到第一区块链11之后，客户端的界面中将显示用于读取数据的按钮或输入框，业务人员通过在客户端中进行点击或输入，从而可读取到第一区块链11中的相应数据。例如，通过在客户端中选择区块p中的收据b，从而可读取到收据b，通过点击客户端中的与收据b对应的Spv证明数据按钮，从而可读取到收据b的Spv证明数据。在以太坊链中，Spv证明数据为用于对数据进行Spv验证的数据，例如，收据b的Spv证明数据包括：区块p的区块头哈希值、区块p中包括的收据树根哈希值、收据树中从收据b到根节点的树路径中其它各个节点的哈希值。
可以理解，这里，第一中继设备121读取收据b及其证明数据仅仅为本说明书实施例的一种示例描述，而不是用于限制本说明书实施例的范围。例如，在第二区块链13不需要证明数据的情况中，第一中继设备121可以仅读取收据b，以用于传回给第二区块链13。再例如，在第二区块链13请求读取的数据不是可证明数据的情况中，第一中继设备121可以仅读取请求读取的数据，而不需要读取其证明数据。
第一中继设备121在从第一区块链11读取数据b及其Spv证明数据之后，将收据b及其Spv证明数据直接或间接地发送给第二中继设备122。从而第二中继设备122将收据b及其Spv证明数据提供给第一区块链11。
在一种实施方式中，如上文所述，第二中继设备122与第一中继设备121直接连接，从而，第一中继设备121可直接将收据b及其Spv证明数据发送给第二中继设备122。
在一种实施方式中，第二中继设备122在先前发送读取请求时基于其中的查找表确定发送路径，从而通过其它中继设备的中转而将所述读取请求发送给第一中继设备121。所述查找表例如为分布式散列表(DHT表)，第二中继设备122可基于该查找表计算路由路径，使得以最少的中转次数将所述读取请求发送到第一中继设备121。在各个中继设备发送的过程中，可对所述读取请求附加上其从第二中继设备122到第一中继设备121的发送路径，例如，其发送路径为第二中继设备122→第三中继设备(图3中未示出)→第一中继设备121。从而，第一中继设备121在发回与该读取请求对应的读取数据时，可基于该发送路径将读取的数据发送回第二中继设备122。
在一种实施方式中，第一中继设备121可基于其本地的查找表确定将收据b及其Spv 证明数据提供给第二区块链13的路由路径，从而通过该路由路径将收据b及其Spv证明数据发送回第二中继设备122。
图5示出根据本说明书实施例的一种跨链访问控制装置500，所述装置500部署于第一中继设备，所述第一中继设备与第一区块链连接，所述第一中继设备中预设有与所述第一区块链对应的访问控制表，所述访问控制表中包括所述第一区块链中的资源的授权信息，所述装置500包括：接收单元51，配置为，接收对第一区块链的访问请求，所述访问请求用于请求访问的所述第一区块链中的资源；判断单元52，配置为，基于所述访问控制表判断所述访问请求是否被授权；访问单元53，配置为，在判断所述访问请求被授权的情况中，进行对所述资源的访问。
在一种实施方式中，所述访问请求中包括发送所述访问请求的第二区块链的标识，其中，所述判断单元52还配置为：基于所述访问控制表判断所述资源是否为被授权给所述第二区块链的资源。
在一种实施方式中，所述访问请求中还包括请求的对所述资源的访问方式，其中，所述判断单元52还配置为：基于所述访问控制表判断所述请求的对所述资源的访问方式是否为被授权给所述第二区块链的访问方式。
在一种实施方式中，所述访问请求为对所述第一区块链中的智能合约的调用请求，其中，所述访问单元53还配置为，向所述第一区块链发送交易以调用所述智能合约。
在一种实施方式中，所述访问请求为对所述第一区块链中的数据的读取请求，其中，所述访问单元53还配置为，从所述第一区块链读取所述数据。
在一种实施方式中，所述访问单元53还配置为，从所述第一区块链读取所述数据及其证明数据。
在一种实施方式中，所述第一中继设备连接于中继设备网络中，所述第一中继设备中存储有查找表，所述查找表中记录了所述中继网络中的预定数目个中继设备各自连接的区块链，所述装置500还包括，发送单元54，配置为，基于所述查找表将所述数据发送给所述预定数目个中继设备中的至少一个中继设备。
本说明书另一方面提供一种计算机可读存储介质，其上存储有计算机程序，当所述计算机程序在计算机中执行时，令计算机执行上述任一种方法。
本说明书另一方面提供一种计算设备，包括存储器和处理器，所述存储器中存储有计算机程序，所述处理器在执行所述计算机程序时，实现上述任一种方法。
在根据本说明书实施例的跨链访问控制方案中，通过在中继设备中进行区块链访问权限控制，使得区块链接入跨链网络中时，可根据实际需求设置跨链资源访问权限，从 而保证区块链中的资源的安全性和可控性。
本说明书中的各个实施例均采用递进的方式描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。尤其，对于系统实施例而言，由于其基本相似于方法实施例，所以描述的比较简单，相关之处参见方法实施例的部分说明即可。
上述对本说明书特定实施例进行了描述。其它实施例在所附权利要求书的范围内。在一些情况下，在权利要求书中记载的动作或步骤可以按照不同于实施例中的顺序来执行并且仍然可以实现期望的结果。另外，在附图中描绘的过程不一定要求示出的特定顺序或者连续顺序才能实现期望的结果。在某些实施方式中，多任务处理和并行处理也是可以的或者可能是有利的。
本领域普通技术人员应该还可以进一步意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、计算机软件或者二者的结合来实现，为了清楚地说明硬件和软件的可互换性，在上述说明中已经按照功能一般性地描述了各示例的组成及步骤。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。本领域普通技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。其中，软件模块可以置于随机存储器(RAM)、内存、只读存储器(ROM)、电可编程ROM、电可擦除可编程ROM、寄存器、硬盘、可移动磁盘、CD-ROM、或技术领域内所公知的任意其它形式的存储介质中。
以上所述的具体实施方式，对本说明书实施例的目的、技术方案和有益效果进行了进一步详细说明，所应理解的是，以上所述仅为本说明书实施例的具体实施方式而已，并不用于限定本说明书实施例的保护范围，凡在本说明书实施例的精神和原则之内，所做的任何修改、等同替换、改进等，均应包含在本说明书实施例的保护范围之内。

Claims (16)

  1. 一种跨链访问控制方法，所述方法由第一中继设备执行，所述第一中继设备与第一区块链连接，所述第一中继设备中预设有与所述第一区块链对应的访问控制表，所述访问控制表中包括所述第一区块链中的资源的授权信息，所述方法包括：
    接收对第一区块链的访问请求，所述访问请求用于请求访问的所述第一区块链中的资源；
    基于所述访问控制表判断所述访问请求是否被授权；
    在判断所述访问请求被授权的情况中，进行对所述资源的访问。
  2. 根据权利要求1所述的方法，其中，所述访问请求中包括发送所述访问请求的第二区块链的标识，其中，基于所述访问控制表判断所述访问请求是否被授权包括：基于所述访问控制表判断所述资源是否为被授权给所述第二区块链的资源。
  3. 根据权利要求2所述的方法，其中，所述访问请求中还包括请求的对所述资源的访问方式，其中，基于所述访问控制表判断所述访问请求是否被授权包括：基于所述访问控制表判断所述请求的对所述资源的访问方式是否为被授权给所述第二区块链的访问方式。
  4. 根据权利要求1-3中任一项所述的方法，其中，所述访问请求为对所述第一区块链中的智能合约的调用请求，其中，进行对所述资源的访问包括，向所述第一区块链发送交易以调用所述智能合约。
  5. 根据权利要求1-3中任一项所述的方法，其中，所述访问请求为对所述第一区块链中的数据的读取请求，其中，进行对所述资源的访问包括，从所述第一区块链读取所述数据。
  6. 根据权利要求5所述的方法，其中，从所述第一区块链读取所述数据包括，从所述第一区块链读取所述数据及其证明数据。
  7. 根据权利要求5所述的方法，其中，所述第一中继设备连接于中继设备网络中，所述第一中继设备中存储有查找表，所述查找表中记录了所述中继网络中的预定数目个中继设备各自连接的区块链，所述方法还包括，基于所述查找表将所述数据发送给所述预定数目个中继设备中的至少一个中继设备。
  8. 一种跨链访问控制装置，所述装置部署于第一中继设备，所述第一中继设备与第一区块链连接，所述第一中继设备中预设有与所述第一区块链对应的访问控制表，所述访问控制表中包括所述第一区块链中的资源的授权信息，所述装置包括：
    接收单元，配置为，接收对第一区块链的访问请求，所述访问请求用于请求访问的 所述第一区块链中的资源；
    判断单元，配置为，基于所述访问控制表判断所述访问请求是否被授权；
    访问单元，配置为，在判断所述访问请求被授权的情况中，进行对所述资源的访问。
  9. 根据权利要求8所述的装置，其中，所述访问请求中包括发送所述访问请求的第二区块链的标识，其中，所述判断单元还配置为：基于所述访问控制表判断所述资源是否为被授权给所述第二区块链的资源。
  10. 根据权利要求9所述的装置，其中，所述访问请求中还包括请求的对所述资源的访问方式，其中，所述判断单元还配置为：基于所述访问控制表判断所述请求的对所述资源的访问方式是否为被授权给所述第二区块链的访问方式。
  11. 根据权利要求8-10中任一项所述的装置，其中，所述访问请求为对所述第一区块链中的智能合约的调用请求，其中，所述访问单元还配置为，向所述第一区块链发送交易以调用所述智能合约。
  12. 根据权利要求8-10中任一项所述的装置，其中，所述访问请求为对所述第一区块链中的数据的读取请求，其中，所述访问单元还配置为，从所述第一区块链读取所述数据。
  13. 根据权利要求12所述的装置，其中，所述访问单元还配置为，从所述第一区块链读取所述数据及其证明数据。
  14. 根据权利要求12所述的装置，其中，所述第一中继设备连接于中继设备网络中，所述第一中继设备中存储有查找表，所述查找表中记录了所述中继网络中的预定数目个中继设备各自连接的区块链，所述装置还包括，发送单元，配置为，基于所述查找表将所述数据发送给所述预定数目个中继设备中的至少一个中继设备。
  15. 一种计算机可读存储介质，其上存储有计算机程序或指令，当所述计算机程序或指令在计算机中执行时，令计算机执行权利要求1-7中任一项的所述的方法。
  16. 一种计算设备，包括存储器和处理器，所述存储器中存储有计算机程序或指令，所述处理器在执行所述计算机程序或指令时，实现权利要求1-7中任一项所述的方法。
PCT/CN2021/133127 2021-03-30 2021-11-25 一种跨链访问控制方法和装置 WO2022205966A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110339716.4A CN112738139B (zh) 2021-03-30 2021-03-30 一种跨链访问控制方法和装置
CN202110339716.4 2021-03-30

Publications (1)

Publication Number Publication Date
WO2022205966A1 true WO2022205966A1 (zh) 2022-10-06

Family

ID=75596073

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/133127 WO2022205966A1 (zh) 2021-03-30 2021-11-25 一种跨链访问控制方法和装置

Country Status (2)

Country Link
CN (1) CN112738139B (zh)
WO (1) WO2022205966A1 (zh)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112769871B (zh) * 2021-03-30 2021-11-19 支付宝(杭州)信息技术有限公司 跨链访问控制方法和装置
CN112738139B (zh) * 2021-03-30 2021-07-06 支付宝(杭州)信息技术有限公司 一种跨链访问控制方法和装置
CN113283987A (zh) * 2021-05-17 2021-08-20 网易（杭州）网络有限公司 业务处理方法、装置、区块链网关、区块链节点及存储介质

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190340267A1 (en) * 2018-05-01 2019-11-07 International Business Machines Corporation Blockchain implementing cross-chain transactions
CN110751475A (zh) * 2019-10-24 2020-02-04 杭州趣链科技有限公司 一种区块链交易的跨链方法及系统、设备和存储介质
CN112003889A (zh) * 2020-07-10 2020-11-27 南京邮电大学 分布式跨链系统及跨链信息交互与系统访问控制机制
CN112381651A (zh) * 2020-11-19 2021-02-19 深圳前海微众银行股份有限公司 一种基于物联网的区块链跨链交易方法及装置
CN112508560A (zh) * 2020-12-01 2021-03-16 浙商银行股份有限公司 区块链跨链身份认证和权限管控方法、装置及计算机设备
CN112738139A (zh) * 2021-03-30 2021-04-30 支付宝(杭州)信息技术有限公司 一种跨链访问控制方法和装置

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP6617594B2 (ja) * 2016-02-15 2019-12-11 富士通株式会社 パケット中継プログラムおよびパケット中継方法
CN110650189B (zh) * 2019-09-20 2022-01-18 深圳供电局有限公司 一种基于中继的区块链的交互系统及方法
CN112016136A (zh) * 2020-10-22 2020-12-01 浙江网商银行股份有限公司 基于联盟链的数据处理方法及装置

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190340267A1 (en) * 2018-05-01 2019-11-07 International Business Machines Corporation Blockchain implementing cross-chain transactions
CN110751475A (zh) * 2019-10-24 2020-02-04 杭州趣链科技有限公司 一种区块链交易的跨链方法及系统、设备和存储介质
CN112003889A (zh) * 2020-07-10 2020-11-27 南京邮电大学 分布式跨链系统及跨链信息交互与系统访问控制机制
CN112381651A (zh) * 2020-11-19 2021-02-19 深圳前海微众银行股份有限公司 一种基于物联网的区块链跨链交易方法及装置
CN112508560A (zh) * 2020-12-01 2021-03-16 浙商银行股份有限公司 区块链跨链身份认证和权限管控方法、装置及计算机设备
CN112738139A (zh) * 2021-03-30 2021-04-30 支付宝(杭州)信息技术有限公司 一种跨链访问控制方法和装置

Also Published As

Publication number Publication date
CN112738139B (zh) 2021-07-06
CN112738139A (zh) 2021-04-30

Similar Documents

Publication Publication Date Title
WO2022205966A1 (zh) 一种跨链访问控制方法和装置
JP7019697B2 (ja) ブロックチェーン上の動的アクセス制御
CN108881187B (zh) 一种适用于许可链场景的跨链数据传递方法及设备
CN109981679B (zh) 在区块链网络中执行事务的方法和装置
CN110046998B (zh) 跨链用权系统及方法、装置、电子设备、存储介质
CN110069941A (zh) 一种接口访问鉴权方法、装置及计算机可读介质
WO2022046313A1 (en) Cryptographic-asset collateral management
WO2018063167A1 (en) Distributed electronic record and transaction history
US11983787B2 (en) Integration of workflow with digital ID
AU2020315740A1 (en) Secure resource management to prevent fraudulent resource access
CN106170964A (zh) 基于不同身份服务的用户虚拟身份
WO2022205963A1 (zh) 一种跨链访问控制方法和装置
WO2022205965A1 (zh) 跨链访问控制方法和装置
MX2008013941A (es) Transformaciones de reclamacion para relaciones de confianza.
CN116991936A (zh) 基于区块链的权益凭证管理方法、装置、电子设备和介质
US7639629B2 (en) Security model for application and trading partner integration
CN111915308A (zh) 一种区块链网络的交易处理方法及区块链网络
CN113271366B (zh) 基于区块链和安全计算的数据共享系统
CN112350863B (zh) 一种基于交易的去中心化访问控制方法和系统
WO2022205962A1 (zh) 一种基于中继设备网络跨链读取数据的方法和装置
CN114157428A (zh) 一种基于区块链的数字证书管理方法和系统
CN116975901A (zh) 基于区块链的身份验证方法、装置、设备、介质及产品
CN114065238B (zh) 数据管理方法、装置及电子设备
WO2023019903A1 (zh) 跨链交易系统、方法、设备及存储介质
Rajamanickam et al. Strengthening the Privacy of Blockchain with Zero Knowledge Proof Case Study: Online Exam Student Verification

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21934602

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21934602

Country of ref document: EP

Kind code of ref document: A1