WO2023078097A1 - 一种区块链攻击拦截方法及装置 - Google Patents

一种区块链攻击拦截方法及装置 Download PDF

Info

Publication number
WO2023078097A1
WO2023078097A1 PCT/CN2022/126517 CN2022126517W WO2023078097A1 WO 2023078097 A1 WO2023078097 A1 WO 2023078097A1 CN 2022126517 W CN2022126517 W CN 2022126517W WO 2023078097 A1 WO2023078097 A1 WO 2023078097A1
Authority
WO
WIPO (PCT)
Prior art keywords
sub
transaction
read
write
directed
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2022/126517
Other languages
English (en)
French (fr)
Inventor
何嘉浩
张俊麒
苏小康
张开翔
范瑞彬
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
WeBank Co Ltd
Original Assignee
WeBank Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by WeBank Co Ltd filed Critical WeBank Co Ltd
Publication of WO2023078097A1 publication Critical patent/WO2023078097A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3829—Payment protocols; Details thereof insuring higher security of transaction involving key management
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/405—Establishing or using transaction specific rules

Definitions

  • the invention relates to the fields of blockchain and smart contracts, in particular to a method and device for intercepting blockchain attacks.
  • deposits, withdrawals, loans and other businesses in the financial industry can rely on the underlying virtual machine as an execution machine to obtain business processing results after running in the smart contract of the blockchain, and update the blockchain ledger according to the processing results.
  • the security of business processing is improved and the speed of business processing is accelerated.
  • Embodiments of the present invention provide a block chain attack interception method and device, which can realize pre-interception of re-entry attacks and eliminate re-entry attack losses.
  • the embodiment of the present invention provides a blockchain attack interception method, the method comprising:
  • the blockchain platform After the execution of the transaction request is completed, the blockchain platform performs a conflict check on the read-write records of each sub-transaction operation; if there are different sub-transaction identifiers for the read-write conflict of the same read-write address to form a call to the smart contract operation, Then roll back the transaction request.
  • a sub-transaction identifier is generated for the sub-transaction operation command calling the smart contract, and a read/write record of the sub-transaction operation is generated for each sub-transaction operation corresponding to the read/write operation of the persistent storage space.
  • the dependency relationship forms a complete external call operation of the sub-transaction to another sub-transaction, that is, when the sub-transaction is executed During the transaction, after executing another sub-transaction, return to this sub-transaction and continue to execute the remaining sub-transaction operations, then it can be determined that the transaction is a transaction with a reentrancy attack, and an alarm is generated.
  • the present invention effectively intercepts the re-entry attack before processing the transaction processing request, that is, before the attack is executed.
  • generating the sub-transaction identifiers of the sub-transaction operations includes: incrementally generating sub-transaction identifiers for the sub-transaction operations according to the execution sequence of the sub-transaction operations in the transaction request. Transaction ID.
  • sub-transaction identifiers are incrementally generated, and a unique number is assigned to each sub-transaction to ensure the uniqueness of the sub-transaction identifiers in the transaction request, which facilitates the construction of subsequent directed relationship graphs.
  • performing a conflict check on the read and write records of each sub-transaction operation includes: generating a directed relationship graph according to the read and write records of each sub-transaction operation, wherein the directed relationship graph includes Each node and a directed edge indicating that there is a read-write conflict between the nodes; and checking for conflict based on whether there is a loop between nodes in the directed relationship graph.
  • a directed relationship graph is generated through the read and write records of each sub-transaction operation to realize the record of the sub-transaction operation sequence, and judge whether the previous sub-transaction operation and the subsequent sub-transaction have read and write operations through the read and write records.
  • Conflicts are used to generate directed edges in the directed graph, which facilitates the judgment of circuits in the directed graph and ensures the reliability of attack interception.
  • performing a conflict check based on whether there is a loop between nodes in the directed relational graph includes: determining whether there is a node with an in-degree of 0 in the directed relational graph; deleting the Each directed edge sent by a node with an in-degree of 0, thereby updating the directed relationship graph; adding the node with an in-degree of 0 to the summary record and returning to determine whether there is a node with an in-degree of 0 in the directed relationship graph nodes until there is no node with an in-degree of 0 in the directed relational graph; based on whether all the nodes in the directed relational graph are included in the summary record, it is determined whether there is a loop between nodes.
  • the number of nodes with an in-degree of 0 in the directed relationship graph is the number of all sub-transactions, that is, whether the number of all nodes in the directed relationship graph is included, if it is included, it is determined that there is no loop in the directed relationship graph, Otherwise, there are cycles in the directed graph (there is a reentrancy attack).
  • the read-write conflict between the read-write record of the first sub-transaction operation and the read-write record of the second sub-transaction operation determine the directed edge forming a closed loop between the first node and the second node, then determine There is a complete external call smart contract operation between the sub-transactions corresponding to the first node and the second node, that is, there is a reentrancy attack. Otherwise, there is no reentrancy attack. In this way, the call relationship between sub-transactions in the transaction request can be clearly and quickly obtained, and requests with re-entry attacks can be intercepted.
  • the first sub-transaction operation may be located before the second sub-transaction operation in execution sequence.
  • generating a directed relational graph according to the read-write records of each sub-transaction operation includes: generating each node in the directed relational graph according to each sub-transaction identifier in the read-write record of each sub-transaction operation;
  • the read-write record of the sub-transaction operation obtains the read-write record of the j-th sub-transaction operation; wherein, the j-th sub-transaction operation is any sub-transaction operation after the i-th sub-transaction operation in the execution order; if the i-th sub-transaction operation
  • the read-write record of the sub-transaction operation is the same as the read-write address in the read-write record of the jth sub-transaction operation and there is a conflict in the read-write type, then add the i-th sub-transaction operation corresponding to the directed relationship graph
  • the i-th node points to the directed edge of the j-th node corresponding to the j-th sub-transaction operation;
  • the directed edges between the nodes corresponding to the two sub-transaction operations are generated, and a directed relationship graph containing directed edges is obtained, which is convenient for the relationship graph
  • the judgment of the middle circuit ensures the reliability of attack interception.
  • it also includes: if no different sub-transaction identifiers are found in the conflict check to call the smart contract operation due to the read-write conflict of the same read-write address, updating the processing result of the transaction request to the blockchain ledger.
  • the smart contract of the sub-transaction does not have an external call, that is, there is a directed relationship If there is no loop in the diagram, there is no reentrancy attack in the transaction processing request, and the transaction processing request can be processed, and the blockchain ledger can be updated according to the processing result.
  • the method after invoking the smart contract operation if there is a read-write conflict of different sub-transaction identifiers for the same read-write address, the method also includes: recording the relevant information of the transaction request in a log file and giving an alarm.
  • an embodiment of the present invention provides a block chain attack interception device, the device comprising:
  • the analysis module is used to generate the sub-transaction identifier of the sub-transaction operation for the sub-transaction operation calling the smart contract during the execution of the transaction request; for the read/write operation of the persistent storage space in the sub-transaction operation, Generate a read-write record of the sub-transaction operation; the read-write record includes a read-write type, a sub-transaction identifier and a read-write address; wherein, each sub-transaction identifier generated by calling the smart contract is different;
  • the processing module is used to perform conflict check on the read and write records of each sub-transaction operation after the execution of the transaction request is completed; Rollback said transaction request.
  • the embodiment of the present invention also provides a computing device, including: a memory for storing programs; a processor for invoking the programs stored in the memory, and executing various methods according to the first aspect according to the obtained programs. methods described in Possible Designs.
  • the embodiment of the present invention also provides a computer-readable non-volatile storage medium, including a computer-readable program, and when the computer reads and executes the computer-readable program, the computer executes the computer-readable program according to the first aspect.
  • a computer-readable non-volatile storage medium including a computer-readable program
  • the computer executes the computer-readable program according to the first aspect.
  • Fig. 1 is a schematic diagram of the architecture of a blockchain attack interception system provided by an embodiment of the present invention
  • Fig. 2 is a schematic diagram of the architecture of a blockchain attack interception system provided by an embodiment of the present invention
  • Fig. 3 is a schematic flow diagram of a blockchain attack interception method provided by an embodiment of the present invention.
  • FIG. 4 is a schematic flowchart of a method for generating a directed relational graph provided by an embodiment of the present invention
  • FIG. 5 is a directed relationship graph provided by an embodiment of the present invention.
  • FIG. 6 is a directed relationship graph provided by an embodiment of the present invention.
  • FIG. 7 is a directed relationship graph provided by an embodiment of the present invention.
  • FIG. 8 is a directed relationship graph provided by an embodiment of the present invention.
  • FIG. 9 is a directed relationship graph provided by an embodiment of the present invention.
  • FIG. 10 is a directed relationship graph provided by an embodiment of the present invention.
  • Fig. 11 is a schematic flow diagram of a blockchain attack interception method provided by an embodiment of the present invention.
  • Fig. 12 is a schematic diagram of a blockchain attack interception device provided by an embodiment of the present invention.
  • Figure 1 is a schematic diagram of the architecture of a block chain attack interception system provided by the embodiment of the present invention.
  • the identification generation module determines the sub-transaction operation used to call the smart contract.
  • the sub-transaction ID is incrementally generated for each sub-transaction operation. In this way, a unique number is maintained for the sub-transaction corresponding to each sub-transaction operation.
  • the record generating module For each read operation/write operation in each sub-transaction operation, the record generating module records the read-write address of the read operation/write operation and the sub-transaction identifier corresponding to the sub-transaction operation of the read operation/write operation.
  • the conflict checking module is based on the read-write record of each sub-transaction operation (the read-write record contains the read-write address of each read operation/write operation in the sub-transaction operation and the sub-transaction of the read operation/write operation corresponding to the sub-transaction operation flag) to check for conflicts.
  • the sub-transaction identifiers of the read operation/write operation of the two sub-transaction operations are different, the read-write address is the same, and the read operation/write operation of the two sub-transaction operations are read operation and write operation respectively /Write operation and write operation/Write operation and read operation, if it exists, it proves that there is a conflict between the two sub-transaction operations. Further, check whether the read-write conflict of the two sub-transaction operations results in calling the smart contract operation.
  • the read-write conflict between the read/write operations of the two sub-transaction operations is: one sub-transaction operation also carries out another sub-transaction during the progress of the sub-transaction, and returns to the sub-transaction after the completion of the other sub-transaction In the transaction, execute the rest of the process, then determine that the transaction request needs to be rolled back, and generate an alarm.
  • the embodiment of the present invention provides a schematic diagram of the architecture of another block chain attack interception system, as shown in Figure 2,
  • the receiving module is used to receive the transaction request sent by the smart contract user, and the block chain platform executes the transaction
  • the identification generation and recording module generates and records sub-transaction identifications for each sub-transaction operation in an incremental manner according to the execution sequence of each sub-transaction operation.
  • the operation monitoring module monitors the read/write operations corresponding to each sub-transaction operation.
  • the relationship diagram construction module generates the sub-transaction identification of the sub-transaction operation in the record module and the read operation/write operation of the sub-transaction operation of the operation monitoring module according to the identification.
  • the loop detection module detects whether there is a loop in the directed relationship graph. If there is a loop, the transaction request processing is rolled back. If not, the update module completes the storage of the transaction processing request result in the blockchain ledger.
  • the relevant information of the transaction request can also be recorded in a log file, and an alarm can be initiated for a transaction request with a loop in the directed relationship graph. In this way, the staff can analyze and obtain the attacker in time, and take measures such as putting it into the blacklist, which not only intercepts the re-entry attack, but also improves the security of the smart contract call.
  • the embodiment of the present invention provides a block chain attack interception method flow, as shown in Figure 3, including:
  • Step 301 in the process of executing the transaction request on the blockchain platform, for the sub-transaction operation of calling the smart contract, generate the sub-transaction identifier of the sub-transaction operation;
  • the transaction request can be transactions such as deposit, withdrawal, and data update
  • the smart contract invoked by the corresponding sub-transaction operation can be a deposit smart contract, a withdrawal smart contract, or a data update smart contract, etc.
  • a sub-transaction operation may be: a CALL instruction, a CALLCODE instruction, a STATICCALL instruction, a DELEGATECALL instruction, etc. are used to initiate an external call to a smart contract other than the currently running smart contract. Therefore, this instruction-sub-transaction operation can also be regarded as creating a new sub-transaction.
  • Step 302 for the read/write operation of the persistent storage space in the sub-transaction operation, generate the read-write record of the sub-transaction operation;
  • the read-write record includes the read-write type, sub-transaction identifier and read-write Address; among them, each sub-transaction ID generated by calling the smart contract is different;
  • the read-write record of the sub-transaction operation includes the read-write type, sub-transaction identifier and read-write address corresponding to each read operation/write operation in the sub-transaction operation.
  • the read and write addresses can include smart contract addresses and persistent storage space addresses.
  • the read and write records can be recorded in a table, for example, the read operation/write operation is a row, and the read/write type, sub-transaction identifier, and read/write address corresponding to the read/write operation are respectively listed.
  • read and write records can be recorded in the form of an array. For example, each element in the array represents a read and write record of a read operation/write operation.
  • the corresponding element of the read operation in the array can be recorded as: (Read, 1, (1,1)); Read indicates that the read and write type is a read operation, the first "1" from left to right indicates sub-transaction ID 1, the second 1 indicates smart contract address 1, and the third 1 means persistent storage space address 1.
  • the read-write type, sub-transaction identifier, and read-write address of the operation are generated, and added to the read-write record table or read-write record array in turn.
  • the recording method is not specifically limited.
  • Step 303 After the execution of the transaction request is completed, the blockchain platform performs a conflict check on the read and write records of each sub-transaction operation; contract operation, the transaction request is rolled back.
  • a sub-transaction identifier is generated for the sub-transaction operation command calling the smart contract, and a read-write record of the sub-transaction operation is generated for each sub-transaction operation corresponding to the read-write operation of the persistent storage space.
  • the dependency relationship forms a complete external call operation of the sub-transaction to another sub-transaction, that is, when the sub-transaction is executed During the transaction, after executing another sub-transaction, return to this sub-transaction and continue to execute the remaining sub-transaction operations, then it can be determined that the transaction is a transaction with a reentrancy attack, and an alarm is generated. Effectively, the re-entry attack is intercepted before the transaction processing request is processed, that is, before the attack is executed.
  • An embodiment of the present invention provides a method for generating a sub-transaction identifier.
  • generating the sub-transaction identifier of the sub-transaction operation includes: according to the execution sequence of each sub-transaction operation in the transaction request, Sub-transaction identifiers are incrementally generated for each sub-transaction operation. That is to say, in the present invention, the sub-transaction identification generated for each sub-transaction operation is incremental, for example, the sub-transaction identification of the first executed sub-transaction operation is 0, then the sub-transaction identification of the second executed sub-transaction operation is 1 , the sub-transaction ID of the third executed sub-transaction operation is 2.
  • the present invention can set the Context Num, and initialize the Context Num to 0 when the user initiates a message call to the blockchain platform, and use the value of the Context Num as the Context ID of the current sub-transaction.
  • Context ID is the unique number of this sub-transaction. As such, a distinction can be made within one or more sub-transactions in the transaction request. Context Num will be incremented with the creation of sub-transactions during the operation of each sub-transaction of the entire transaction request, and is used to maintain the unique number of each sub-transaction.
  • the embodiment of the present invention provides a block chain attack interception method, which performs conflict check on the read and write records of each sub-transaction operation, including: generating a directed relationship graph according to the read and write records of each sub-transaction operation, wherein the The directed relationship graph includes nodes indicating each sub-transaction identifier and directed edges indicating read-write conflicts between nodes; conflict checks are performed based on whether there are inter-node loops in the directed relationship graph.
  • each sub-transaction operation takes the sub-transaction identifier of each sub-transaction operation as a node, and determine whether the read/write operation between two sub-transaction operations exists through the read-write records of the corresponding read/write operations of each sub-transaction operation Conflict, if there is a read-write conflict, determine the directed edge between the nodes of the two sub-transaction operations according to the read/write operation between the two sub-transaction operations.
  • the nodes contained in the finally generated directed relationship graph are nodes with read-write conflicts, and it is also possible to clearly know whether there is a loop formed by a directed edge between two nodes, and if so, determine the corresponding Sub-transaction operation - sub-transaction is a relationship with an external call - there is a re-entry attack, and the transaction request is rolled back.
  • An embodiment of the present invention provides a method for detecting loops between nodes based on a directed relationship graph, and performing a conflict check based on whether there are loops between nodes in the directed relationship graph, including:
  • the summary record can be obtained according to whether the in-degree of the node is 0. If the summary record contains all the nodes corresponding to the sub-transaction identifiers, it is determined that there is no loop in the directed relationship graph. The transaction request does not have a re-entry attack. If the summary record does not contain the nodes corresponding to all sub-transaction identifiers, it is determined that the directed relationship graph contains a loop, and further according to the directed relationship graph determined by the summary record, it is determined that the transaction request has re-entry attack.
  • An embodiment of the present invention provides a method for generating a directed relationship graph based on the read and write records of each sub-transaction operation to generate a directed relationship graph, including:
  • the read-write record of the i-th sub-transaction operation obtain the read-write record of the j-th sub-transaction operation; wherein, the j-th sub-transaction operation is any sub-transaction operation after the i-th sub-transaction operation in the order of execution; if all The read-write record of the i-th sub-transaction operation is the same as the read-write address in the read-write record of the j-th sub-transaction operation and there is a conflict in the read-write type, then add the i-th sub-transaction in the directed relationship graph
  • the i-th node corresponding to the operation points to the directed edge of the j-th node corresponding to the j-th sub-transaction operation; the conflicts of the read and write types include read operation and write operation/write operation and write operation/write operation and read operation operate.
  • the embodiment of the present application provides a flow of a method for generating a directed relationship graph, as shown in FIG. 4 , including:
  • Step 401 initialize i to 0.
  • Step 402 Take out the triplet (action i , context i , item i ) element with subscript i from the array, and initialize j to i+1.
  • the read-write type action in the triplet (action i , context i , item i ) is "Write or Read", and context is the sub-transaction identifier Context ID of the current sub-transaction. item is composed of the address of the persistent storage space pointed to by the instruction and the address of the currently executed smart contract.
  • Step 403 take out the triplet (action j , context j , item j ) with the subscript j from the array, and determine whether there is a read-write conflict between the i element and the j element, that is, whether there is a same-oriented If there is a write operation, or a read operation and a write operation, of an item, step 404 is performed. Otherwise, no directed edge is added to the directed relationship graph, and step 405 is performed.
  • Step 404 Determine that there is a read-write conflict between element i and element j, and add a directed edge context j ⁇ context i to the directed relationship graph.
  • Read and write conflicts are mainly divided into read operation and write operation conflicts (in two sub-transaction operations, element j of a sub-transaction operation is a read operation, and element i of a sub-transaction operation is a write operation), write operation and read operation conflicts (two In two sub-transaction operations, the element j of a sub-transaction operation is a write operation, and the element i of a sub-transaction operation is a read operation), the write operation and the write operation conflict (in two sub-transaction operations, the element j of a sub-transaction operation is a write operation operation, the element i of a sub-transaction operation is a write operation) three types.
  • Judgment criteria are as follows: read and write conflicts: context i is not equal to context j , item i is equal to item j , action j is "Read” and action i is “Write”.
  • Write and read conflicts context i is not equal to context j , item i is equal to item j , action j is "Write” and action i is "Read”.
  • Write and write conflict context i is not equal to context j , item i is equal to item j , action i and action j are both "Write”.
  • Step 407 complete the construction of the directed relationship graph.
  • the transaction request is a withdrawal transaction request
  • the withdrawal transaction request contains three CALL instructions
  • the read and write record method is an array
  • the withdrawal smart contract address is 1
  • the persistent storage space The address is 1
  • the sub-transaction identifiers of the three CALL instructions are 0, 1, and 2 respectively in the order of execution
  • the final obtained array is ⁇ (Read 0 ,0 0 ,(1,1) 0 ), (Read 1 ,1 1 ,(1,1) 1 ), (Read 2 ,2 2 ,(1,1) 2 ), (Write 3 ,2 3 ,(1,1) 3 ), (Write 4 ,1 4 ,(1, 1) 4 ), (Write 5 ,0 5 ,(1,1) 5 ), ⁇ .
  • the subscripts 0, 1...5 are used to represent the execution sequence of the read operation/write operation corresponding to each read/write record.
  • Step 401 initialize i to 0.
  • Step 403 take out (Read 1 ,1 1 ,(1,1) 1 , (Read 1 ,1 1 ,(1,1) 1 and (Read 0 ,0 0 ,(1,1) 0 ) from the array If it belongs to any type of read-write conflict, write-read conflict, and write-write conflict, no directed edge is added to the directed relationship graph, and step 405 is executed.
  • Step 403 take out (Read 2 ,2 2 ,(1,1) 2 ), (Read 2 ,2 2 ,(1,1) 2 ) and (Read 0 ,0 0 ,(1,1) 0 ) from the array ) does not belong to any type of read-write conflict, write-read conflict, and write-write conflict, do not add directed edges to the directed relationship graph, and execute step 405 .
  • Step 403 take (Write 3 ,2 3 ,(1,1) 3 ), (Write 3 ,2 3 ,(1,1) 3 ) and (Read 0 ,0 0 ,(1,1) 0 ) from the array ) belongs to a read-write conflict, and a directed edge is added to the directed relationship graph, and step 404 is executed.
  • Step 404 Determine that there is a read-write conflict between element i and element j, and add a directed edge context 3 ⁇ context 0 to the directed relational graph to obtain a directed relational graph, as shown in FIG. 5 .
  • Step 403 take (Write 4 ,1 4 ,(1,1) 4 ), (Write 4 ,1 4 ,(1,1) 4 ) and (Read 0 ,0 0 ,(1,1) 0 ) from the array ) belongs to a read-write conflict, and a directed edge is added to the directed relationship graph, and step 404 is executed.
  • Step 404 Determine that there is a read-write conflict between element i and element j, and add a directed edge context 4 ⁇ context 0 to the directed relational graph to obtain a directed relational graph, as shown in FIG. 6 .
  • Step 403 take (Write 5 ,0 5 ,(1,1) 5 ), (Write 5 ,0 5 ,(1,1) 5 ) and (Read 0 ,0 0 ,(1,1) 0 ) from the array ) does not belong to any type of read-write conflict, write-read conflict, and write-write conflict, do not add directed edges to the directed relationship graph, and execute step 405 .
  • Step 403 take out (Read 2 ,2 2 ,(1,1) 2 ), (Read 2 ,2 2 ,(1,1) 2 ) and (Read 1 ,1 1 ,(1,1) 1 ) from the array ) does not belong to any type of read-write conflict, write-read conflict, and write-write conflict, do not add directed edges to the directed relationship graph, and execute step 405 .
  • Step 403 take (Write 3 ,2 3 ,(1,1) 3 ), (Write 3 ,2 3 ,(1,1) 3 ) and (Read 1 ,1 1 ,(1,1) 1 ) from the array ) is a write-read conflict. Add a directed edge to the directed relationship graph, and execute step 404 .
  • Step 404 Determine that there is a read-write conflict between element i and element j, and add a directed edge context 3 ⁇ context 1 to the directed relational graph to obtain a directed relational graph, as shown in FIG. 7 .
  • Step 403 take out (Write 4 ,1 4 ,(1,1) 4 ), (Write 4 ,1 4 ,(1,1) 4 ) and (Read 1 ,1 1 ,(1,1) 1 ) from the array ) does not belong to any type of read-write conflict, write-read conflict, and write-write conflict, do not add directed edges to the directed relationship graph, and execute step 405 .
  • Step 403 take out (Write 5 ,0 5 ,(1,1) 5 ), (Write 5 ,0 5 ,(1,1) 5 ) and (Read 1 ,1 1 ,(1,1) 1 ) from the array ) belongs to a read-write conflict, and a directed edge is added to the directed relationship graph, and step 404 is executed.
  • Step 404 Determine that there is a read-write conflict between element i and element j, and add a directed edge context 5 ⁇ context 1 to the directed relational graph to obtain a directed relational graph, as shown in FIG. 8 .
  • Step 403 take out (Write 3 ,2 3 ,(1,1) 3 ), (Write 3 ,2 3 ,(1,1) 3 ) and (Read 2 ,2 2 ,(1,1) 2 ) from the array ) does not belong to any type of read-write conflict, write-read conflict, and write-write conflict, do not add directed edges to the directed relationship graph, and execute step 405 .
  • Step 403 take out (Write 4 ,1 4 ,(1,1) 4 ), (Write 4 ,1 4 ,(1,1) 4 ) and (Read 2 ,2 2 ,(1,1) 2 ) from the array ) belongs to any type of read-write conflict, write-read conflict, and write-write conflict, add a directed edge to the directed relationship graph, and execute step 404 .
  • Step 404 Determine that there is a read-write conflict between element i and element j, and add a directed edge context 4 ⁇ context 2 to the directed relational graph to obtain a directed relational graph, as shown in FIG. 9 .
  • Step 403 take out (Write 5 ,0 5 ,(1,1) 5 , (Write 5 ,0 5 ,(1,1) 5 and (Read 2 ,2 2 ,(1,1) 2 ) from the array For write-read conflicts, add directed edges to the directed relationship graph, and execute step 404 .
  • Step 404 Determine that there is a read-write conflict between element i and element j, and add a directed edge context 5 ⁇ context 2 to the directed relationship graph.
  • a directed relationship graph is obtained, as shown in Figure 10.
  • Step 403 take out (Write 4 ,1 4 ,(1,1) 4 ), (Write 4 ,1 4 ,(1,1) 4 ) and (Write 3 ,2 3 ,(1,1) 3 ) from the array ) belongs to any type of read-write conflict, write-read conflict, and write-write conflict, add a directed edge to the directed relationship graph, and execute step 404 .
  • Step 404 Determine that there is a read-write conflict between element i and element j, and there is already a directed edge from node 1 to node 2, and a directed edge context 4 ⁇ context 3 can be added to the directed relationship graph.
  • a directed relationship graph is obtained, as shown in Figure 10.
  • Step 403 take out (Write 5 ,0 5 ,(1,1) 5 , (Write 5 ,0 5 ,(1,1) 5 and (Write 3 ,2 3 ,(1,1) 3 ) from the array If there is a write-write conflict, add a directed edge to the directed relationship graph, and execute step 404 .
  • Step 404 Determine that there is a read-write conflict between element i and element j, and there is already a directed edge from node 0 to node 2, and a directed edge context 5 ⁇ context 3 can be added to the directed relationship graph.
  • a directed relationship graph is obtained, as shown in Figure 10.
  • Step 403 take (Write 5 ,0 5 ,(1,1) 5 , (Write 5 ,0 5 ,(1,1) 5 and (Write 4 ,1 4 ,(1,1) 4 ) from the array If there is a write-write conflict, add a directed edge to the directed relationship graph, and execute step 404 .
  • Step 404 Determine that there is a read-write conflict between element i and element j, and there is already a directed edge from node 0 to node 1, and a directed edge context 5 ⁇ context 4 can be added to the directed relationship graph.
  • a directed relationship graph is obtained, as shown in Figure 10.
  • the embodiment of the present invention also provides a block chain attack interception method, which also includes: if no different sub-transaction identifiers are found in the conflict check to form a smart contract operation for the read-write conflict of the same read-write address, then the The processing result of the transaction request is updated to the blockchain ledger. That is to say, if there is no re-entry attack in the transaction request, the transaction processing result will be stored in the blockchain ledger to complete the final transaction processing.
  • the embodiment of the present invention also provides a block chain attack interception method. If there are different sub-transaction identifiers for the same read-write address, the read-write conflict is formed to call the smart contract operation, and it also includes: the relevant information of the transaction request Recorded in the log file and alerted. That is to say, for each transaction request, the directed relationship graph of the transaction request, the read and write records of sub-transaction operations, source address, destination address, etc. can be recorded, which can be used for subsequent analysis to determine the attacker.
  • the embodiment of the present invention provides a flow of a block chain attack interception method, as shown in Figure 11, including:
  • Step 1101 receiving a transaction request.
  • Step 1102 for each sub-transaction operation in the transaction request, according to the execution order of the sub-transaction operations, generate a sub-transaction identifier for each sub-transaction operation in an incremental manner.
  • Step 1103 for the read operation/write operation corresponding to the sub-transaction operation, generate a read-write record including the read-write type, the sub-transaction identifier, the address of the smart contract called, and the persistent storage space of the operation.
  • Step 1104 Generate a directed relationship graph according to the read-write records of each sub-transaction operation, or in other words, according to the read-write records of the read/write operations corresponding to each sub-transaction operation.
  • Step 1105 judging whether there is a loop in the directed relational graph. If yes, go to step 1006, otherwise go to step 1008.
  • Step 1106 rolling back the transaction request.
  • Step 1107 generate an alarm.
  • Step 1108 update the transaction processing result into the blockchain ledger.
  • Step 1109 generate a log file or update the log file according to the relevant information of the transaction request.
  • step 1109 can update the log file according to the relevant information of the transaction request generated in the current step before or after any step after step 1101.
  • Figure 12 is a schematic diagram of a block chain attack interception device provided by the embodiment of the present invention, as shown in Figure 12, including:
  • the analysis module 1201 is used to generate the sub-transaction identification of the sub-transaction operation for the sub-transaction operation of calling the smart contract during the execution of the transaction request; for the read operation/write operation of the persistent storage space in the sub-transaction operation , generating a read-write record of the sub-transaction operation; the read-write record includes a read-write type, a sub-transaction identifier and a read-write address; wherein, each sub-transaction identifier generated by calling the smart contract is different;
  • the processing module 1202 is used to perform conflict check on the read and write records of each sub-transaction operation after the transaction request is executed; Then roll back the transaction request.
  • the analysis module 1201 is specifically configured to incrementally generate sub-transaction identifiers for each sub-transaction operation according to the execution sequence of each sub-transaction operation in the transaction request.
  • the processing module 1202 is specifically configured to generate a directed relational graph according to the read and write records of each sub-transaction operation, wherein the directed relational graph includes each node indicating each sub-transaction identifier and the The directed edges with read-write conflicts are checked for conflicts based on whether there are inter-node loops in the directed relational graph.
  • the processing module 1202 is specifically configured to determine whether there is a node with an in-degree of 0 in the directed relationship graph; side, thereby updating the directed relational graph; adding the node whose in-degree is 0 to the summary record and returning to determine whether there is a node with an in-degree of 0 in the directed relational graph until the directed relational graph Until there is no node with an in-degree of 0; based on whether the summary record contains all the nodes of the directed graph, determine whether there is an inter-node loop.
  • the processing module 1202 is specifically configured to generate each node in the directed relationship graph according to each sub-transaction identifier in the read-write record of each sub-transaction operation; for the read-write record of the i-th sub-transaction operation, Obtain the read-write record of the jth sub-transaction operation; wherein, the j-th sub-transaction operation is any sub-transaction operation after the i-th sub-transaction operation in execution order; if the read-write record of the i-th sub-transaction operation and In the read-write record of the jth sub-transaction operation, the read-write address is the same and the read-write type conflicts, then add the i-th node corresponding to the i-th sub-transaction operation in the directed relationship graph to point to the j-th sub-transaction operation The directed edge of the j-th node corresponding to the sub-transaction operation; the read-write type conflicts include read operation and write operation/write operation and write operation/write operation and read operation.
  • the processing module 1202 is also configured to update the processing result of the transaction request if no different sub-transaction identifiers have read-write conflicts for the same read-write address and call the smart contract operation during the conflict check. to the blockchain ledger.
  • processing module 1202 is further configured to record the relevant information of the transaction request in a log file and give an alarm.
  • the embodiments of the present invention may be provided as methods, systems, or computer program products. Accordingly, the present invention can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.
  • computer-usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions
  • the device realizes the function specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

Landscapes

  • Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Finance (AREA)
  • Strategic Management (AREA)
  • Computer Security & Cryptography (AREA)
  • General Business, Economics & Management (AREA)
  • General Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Development Economics (AREA)
  • Economics (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

本发明实施例提供一种区块链攻击拦截方法及装置，该方法包括：区块链平台执行交易请求过程中，针对调用智能合约的子交易操作，生成所述子交易操作的子交易标识；针对所述子交易操作中对持久化存储空间的读操作/写操作，生成所述子交易操作的读写记录；所述读写记录中包括读写类型、子交易标识和读写地址；其中，每次调用智能合约生成的各子交易标识均不同；所述区块链平台在所述交易请求执行完成后，针对各子交易操作的读写记录进行冲突检查；若存在不同的子交易标识针对同一读写地址的读写冲突形成调用智能合约操作，则回滚所述交易请求。上述方法能够实现重入攻击的预先拦截，消除重入攻击损失。

Description

一种区块链攻击拦截方法及装置
相关申请的交叉引用
本申请要求在2021年11月04日提交中国专利局、申请号为202111300723.X、申请名称为“一种区块链攻击拦截方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及区块链和智能合约领域，尤其涉及一种区块链攻击拦截方法及装置。
背景技术
近年来，随着计算机技术的发展，越来越多的技术应用在金融领域，传统金融业正在逐步向金融科技(Fintech)转变，但由于金融行业的安全性、实时性要求，也对技术提出更高的要求。由于区块链所基于的密码学技术和去中心化思想使链上的历史信息无法被篡改的优势，区块链技术也在金融行业有着普遍应用。
如，目前金融行业中的存款、取款、借贷等业务都可以依赖底层虚拟机作为执行机器，在区块链的智能合约中运行后获取业务处理结果，并根据处理结果更新区块链账本。相比于现有技术中通过中心服务器完成上述存取款等业务来说，提高业务处理安全性和加快业务处理速度。但是通过区块链进行业务处理仍存在安全隐患。如，在恶名昭彰的TheDAO事件中，攻击者在利用withdraw函数被第一次合法调用后会非法的再次调用自己的可能,然后不断重复这个自己非法调用自己的过程，这样的递归调用可以使得攻击者的数字资产在被清零之前,数十次的从TheDAO的资产池里重复分离出来理应被清零的攻击者的数字资产。攻击者还在递归调用结束前把自己的数字资产转移到了其他账户,以避免这部分数字资产被销毁。如此，攻击者通过组合上述2个漏洞攻击，盗窃超过6000万美元，最终导致以太坊区块链系统平台的硬分叉。现在为了解决这种重入攻击的安全隐患，一般通过监控智能合约运行时的数据，如，资金流。但这种监控方式都是在重入攻击已经发生后，才能根据资金流的调用数据的异常，监控到重入攻击。因此，并不能完全做到重入攻击的拦截。
因此，现在亟需一种区块链攻击拦截方法和装置，能够实现重入攻击的预先拦截，消除重入攻击损失。
发明内容
本发明实施例提供一种区块链攻击拦截方法和装置，能够实现重入攻击的预先拦截，消除重入攻击损失。
第一方面，本发明实施例提供一种区块链攻击拦截方法，该方法包括：
区块链平台执行交易请求过程中，针对调用智能合约的子交易操作，生成所述子交易操作的子交易标识；针对所述子交易操作中对持久化存储空间的读操作/写操作，生成所述子交易操作的读写记录；所述读写记录中包括读写类型、子交易标识和读写地址；其中，每次调用智能合约生成的各子交易标识均不同；
所述区块链平台在所述交易请求执行完成后，针对各子交易操作的读写记录进行冲突检查；若存在不同的子交易标识针对同一读写地址的读写冲突形成调用智能合约操作，则回滚所述交易请求。
上述方法中，通过对调用智能合约的子交易操作指令生成子交易标识，针对每个子交易操作对应的对持久化存储空间的读操作/写操作，生成子交易操作的读写记录。如此，若一笔交易中存在多个子交易标识，则可以通过各子交易标识对应的读写记录，确定各子交易之间是否存在冲突性的依赖关系。若存在冲突性的依赖关系，则确定该子交易与另一个子交易存在外部调用关系，进一步，若依赖关系形成该子交易对另一个子交易的完整的外部调用操作，即，在执行该子交易的过程中，执行完另一个子交易后，回到该子交易继续执行剩余的该子交易操作，则可以确定交易为存在重入攻击的交易，产生告警。相比于现有技术中通过分析历史交易数据、资金流等，确定交易是否存在重入攻击来说，本发明有效的在对交易处理请求处理之前，即，攻击执行之前，拦截重入攻击。
可选的，针对智能合约调用的子交易操作，生成所述子交易操作的子交易标识，包括：根据所述交易请求中各子交易操作的执行顺序，为所述各子交易操作递增生成子交易标识。
上述方法中，针对每个交易请求中的子交易操作，递增生成子交易标识，为每个子交易赋予唯一的编号，保证交易请求中子交易标识的唯一性，便于后续有向关系图的构建。
可选的，针对各子交易操作的读写记录进行冲突检查，包括：根据各子交易操作的读写记录生成有向关系图，其中，所述有向关系图中包括指示各子交易标识的各节点及指示节点间存在读写冲突的有向边；基于所述有向关系图中是否存在节点间回路进行冲突检查。
上述方法中，通过各子交易操作的读写记录生成有向关系图，实现对子交易操作顺序的记录，且通过读写记录判断在前的子交易操作和在后的子交易是否存在读写冲突来生成有向关系图中的有向边，便于有向关系图中回路的判断，保证攻击拦截的可靠性。
可选的，基于所述有向关系图中是否存在节点间回路进行冲突检查，包括：确定所述有向关系图中是否存在入度为0节点；从所述有向关系图中删 除所述入度为0节点发出的各有向边，从而更新所述有向关系图；将所述入度为0的节点加入汇总记录并返回确定所述有向关系图中是否存在入度为0的节点，直至所述有向关系图中不存在入度为0的节点时为止；基于所述汇总记录中是否包含所述有向关系图的所有节点，确定是否存在节点间回路。
上述方法中，根据统计有向关系图中入度为0的节点数量是否为所有子交易数量，即是否包含有向关系图中所有节点数量，若是包含，则确定有向关系图中没有回路，否则，有向关系图中有回路(存在重入攻击)。另外，还可以根据第一子交易操作的读写记录与第二子交易操作的读写记录中的读写冲突，确定第一节点和第二节点之间形成闭合回路的有向边，则确定第一节点和第二节点对应的子交易之间存在完整的外部调用智能合约操作，即，存在重入攻击。否则，不存在重入攻击。如此，可以清晰快速获取交易请求中各子交易之间的调用关系，拦截存在重入攻击的请求。其中，第一子交易操作可以在执行顺序上位于所述第二子交易操作之前。
可选的，根据各子交易操作的读写记录生成有向关系图，包括：根据各子交易操作的读写记录中的各子交易标识，生成有向关系图中的各节点；针对第i子交易操作的读写记录，获取第j子交易操作的读写记录；其中，第j子交易操作为在执行顺序上位于第i子交易操作之后的任一子交易操作；若所述第i子交易操作的读写记录和所述第j子交易操作的读写记录中读写地址相同且读写类型存在冲突，则在所述有向关系图中增加所述第i子交易操作对应的第i节点指向所述第j子交易操作对应的第j节点的有向边；所述读写类型存在冲突包括分别为读操作和写操作/写操作和写操作/写操作和读操作。
上述方法中，根据存在读写冲突的两个子交易操作的读操作/写操作顺序，生成两个子交易操作对应的节点间的有向边，得到包含有向边的有向关系图，便于关系图中回路的判断，保证攻击拦截的可靠性。
可选的，还包括：若冲突检查中未发现存在不同的子交易标识针对同一读写地址的读写冲突形成调用智能合约操作，则将所述交易请求的处理结果更新至区块链账本。
上述方法中，若冲突检查中，若未发现存在不同的子交易标识且针对同一读写地址的读写冲突形成调用智能合约操作，则子交易的智能合约没有发生外部调用，即，有向关系图中没有回路，则交易处理请求中没有重入攻击，可以对该交易处理请求进行处理，根据处理结果更新区块链账本。
可选的，若存在不同的子交易标识针对同一读写地址的读写冲突形成调用智能合约操作之后，还包括：将所述交易请求的相关信息记录在日志文件中并告警。
上述方法中，便于根据日志文件分析，获取攻击者。
第二方面，本发明实施例提供一种区块链攻击拦截装置，该装置包括：
分析模块，用于执行交易请求过程中，针对调用智能合约的子交易操作，生成所述子交易操作的子交易标识；针对所述子交易操作中对持久化存储空间的读操作/写操作，生成所述子交易操作的读写记录；所述读写记录中包括读写类型、子交易标识和读写地址；其中，每次调用智能合约生成的各子交 易标识均不同；
处理模块，用于在所述交易请求执行完成后，针对各子交易操作的读写记录进行冲突检查；若存在不同的子交易标识针对同一读写地址的读写冲突形成调用智能合约操作，则回滚所述交易请求。
第三方面，本发明实施例还提供一种计算设备，包括：存储器，用于存储程序；处理器，用于调用所述存储器中存储的程序，按照获得的程序执行如第一方面的各种可能的设计中所述的方法。
第四方面，本发明实施例还提供一种计算机可读非易失性存储介质，包括计算机可读程序，当计算机读取并执行所述计算机可读程序时，使得计算机执行如第一方面的各种可能的设计中所述的方法。
本发明的这些实现方式或其他实现方式在以下实施例的描述中会更加简明易懂。
附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简要介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域的普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1为本发明实施例提供的一种区块链攻击拦截系统的架构示意图；
图2为本发明实施例提供的一种区块链攻击拦截系统的架构示意图；
图3为本发明实施例提供的一种区块链攻击拦截方法的流程示意图；
图4为本发明实施例提供的一种生成有向关系图的方法的流程示意图；
图5为本发明实施例提供的一种有向关系图；
图6为本发明实施例提供的一种有向关系图；
图7为本发明实施例提供的一种有向关系图；
图8为本发明实施例提供的一种有向关系图；
图9为本发明实施例提供的一种有向关系图；
图10为本发明实施例提供的一种有向关系图；
图11为本发明实施例提供的一种区块链攻击拦截方法的流程示意图；
图12为本发明实施例提供的一种区块链攻击拦截装置示意图。
具体实施方式
为了使本发明的目的、技术方案和优点更加清楚，下面将结合附图对本发明作进一步地详细描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其它实施例，都属于本发明保护的范围。
图1为本发明实施例提供的一种区块链攻击拦截系统的架构示意图，区块链平台接收用户发送的交易请求后，标识生成模块确定用于调用智能合约的子交易操作，在子交易操作调用智能合约过程中，随着子交易操作的子交 易创建，为各子交易操作递增式的生成子交易标识。如此，为每个子交易操作对应的子交易维护一个唯一编号。记录生成模块针对每个子交易操作中的每个读操作/写操作，记录该读操作/写操作的读写地址和该读操作/写操作对应该子交易操作的子交易标识。冲突检查模块根据每个子交易操作的读写记录(该读写记录中包含该子交易操作中每个读操作/写操作的读写地址和该读操作/写操作对应该子交易操作的子交易标识)进行冲突检查。即，是否存在两个子交易操作，该两个子交易操作的读操作/写操作的子交易标识不同、读写地址相同，且该两个子交易操作的读操作/写操作分别为读操作和写操作/写操作和写操作/写操作和读操作，若存在，则证明该两个子交易操作存在冲突。进一步，检查两个子交易操作的读写冲突是否形成调用智能合约操作。即，该两个子交易操作的读操作/写操作之间的读写冲突为：一个子交易操作的子交易进行过程中还进行了另一个子交易，在另一个子交易完成后回到该子交易中，执行剩下的过程，则确定交易请求需要回滚，产生告警。
基于上述系统架构，本发明实施例提供的又一种区块链攻击拦截系统的架构示意图，如图2所示，接收模块用于接收智能合约用户发送的交易请求，区块链平台执行该交易请求过程中，标识生成记录模块根据各子交易操作的执行顺序，以递增的方式为每个子交易操作生成子交易标识并记录该子交易标识。操作监控模块针对各子交易操作对应的读操作/写操作进行监控。关系图构建模块根据标识生成记录模块中的子交易操作的子交易标识和操作监控模块的子交易操作的读操作/写操作，针对每个读操作/写操作生成包含读写类型、子交易标识和读写地址的读写记录，并根据各子交易操作对应的读操作/写操作的读写记录(子交易操作的读写记录中包含每个读操作/写操作的读写记录)生成有向关系图。回路检测模块检测该有向关系图是否存在回路，若存在，则将该交易请求处理回滚，若不存在，则更新模块将交易处理请求结果在区块链账本中完成存储。另外，还可以将该交易请求的相关信息记录在日志文件中，并针对有向关系图中存在回路的交易请求发起告警。如此，工作人员可以及时分析获得攻击者，采取将其放入黑名单等措施，既拦截了重入攻击，还可以提高智能合约调用的安全性。
基于此，本发明实施例提供了一种区块链攻击拦截方法的流程，如图3所示，包括：
步骤301、区块链平台执行交易请求过程中，针对调用智能合约的子交易操作，生成所述子交易操作的子交易标识；
此处，交易请求可以是存款、取款、更新数据等交易，相应的子交易操作调用的智能合约可以是存款智能合约、取款智能合约或更新数据的智能合约等。在一种示例中，一种子交易操作可以为：CALL指令、CALLCODE指令、STATICCALL指令、DELEGATECALL指令等用于对当前运行的智能合约外的智能合约发起外部调用。因此，也可以将这种指令-子交易操作看做是创建新的子交易。
步骤302、针对所述子交易操作中对持久化存储空间的读操作/写操作，生成所述子交易操作的读写记录；所述读写记录中包括读写类型、子交易标 识和读写地址；其中，每次调用智能合约生成的各子交易标识均不同；
此处，持久化存储空间，即，STORAGE持久化存储空间。子交易操作的读写记录中包含子交易操作中各读操作/写操作对应的读写类型、子交易标识和读写地址。这里读写地址可以包括智能合约地址和持久化存储空间地址。在一种示例中，读写记录可以通过表格方式记录，如，以读操作/写操作为行，以读操作/写操作对应的读写类型、子交易标识和读写地址分别为列。或者读写记录可以通过数组的方式记录，如，数组中的每个元素代表一个读操作/写操作的读写记录，若为读操作，则该数组中的读操作对应的元素可以记录为：(Read，1，(1,1))；Read表示读写类型为读操作、从左向右第1个“1”表示子交易标识1，第2个1表示智能合约地址1，第3个1表示持久化存储空间地址1。这里，针对每个读操作或写操作，在操作完成后，即生成该操作的读写类型、子交易标识和读写地址，依次加入到读写记录表格中或读写记录数组中，这里对记录方式具体不做限定。
步骤303、所述区块链平台在所述交易请求执行完成后，针对各子交易操作的读写记录进行冲突检查；若存在不同的子交易标识针对同一读写地址的读写冲突形成调用智能合约操作，则回滚所述交易请求。
上述方法中，通过对调用智能合约的子交易操作指令生成子交易标识，针对每个子交易操作对应的对持久化存储空间的读写操作，生成子交易操作的读写记录。如此，若一笔交易中存在多个子交易标识，则可以通过各子交易标识对应的读写记录，确定各子交易之间是否存在冲突性的依赖关系。若存在冲突性的依赖关系，则确定该子交易与另一个子交易存在外部调用关系，进一步，若依赖关系形成该子交易对另一个子交易的完整的外部调用操作，即，在执行该子交易的过程中，执行完另一个子交易后，回到该子交易继续执行剩余的该子交易操作，则可以确定交易为存在重入攻击的交易，产生告警。有效的在对交易处理请求处理之前，即，攻击执行之前，拦截重入攻击。
本发明实施例提供了一种子交易标识的生成方法，针对智能合约调用的子交易操作，生成所述子交易操作的子交易标识，包括：根据所述交易请求中各子交易操作的执行顺序，为所述各子交易操作递增生成子交易标识。也就是说，本发明中针对每个子交易操作生成子交易标识为递增的，如，首先执行的子交易操作的子交易标识为0，则第二个执行的子交易操作的子交易标识为1，第三个执行的子交易操作的子交易标识为2。在一种示例中，本发明可以设置Context Num，在用户向区块链平台发起消息调用时，将Context Num初始化为0，并以Context Num的值作为当前子交易的Context ID。Context ID是本次子交易的唯一编号。如此，可以在该交易请求中的一个或多个子交易中进行区分。Context Num在整个交易请求的各子交易操作的过程中会随子交易的创建进行递增，用于维护各个子交易的唯一编号。在上述示例中，可以在CALL指令、CALLCODE指令、STATICCALL指令、DELEGATECALL指令等指令的语义函数的末尾增加两个新操作：递增Context Num、将递增后的Context Num作为当前创建的子交易的唯一编号Context ID。如此，实现为按照各子交易操作的执行顺序，为每个子交易操作生成对应的子交易标识。
本发明实施例提供了一种区块链攻击拦截方法，针对各子交易操作的读写记录进行冲突检查，包括：根据各子交易操作的读写记录生成有向关系图，其中，所述有向关系图中包括指示每个子交易标识的各节点及指示节点间存在读写冲突的有向边；基于所述有向关系图中是否存在节点间回路进行冲突检查。也就是说，以各子交易操作的子交易标识为节点，通过各子交易操作对应的读操作/写操作的读写记录，确定两个子交易操作之间的读操作/写操作是否存在读写冲突，若存在读写冲突，则根据两个子交易操作之间的读操作/写操作确定两个子交易操作的节点间的有向边。如此，使得最后生成的有向关系图中包含的节点为存在读写冲突的节点，还可以清晰获知两个节点间是否存在有向边形成的回路，若存在，则确定该两个节点对应的子交易操作-子交易为存在外部调用的关系-存在重入攻击，交易请求回滚。
本发明实施例提供了一种根据有向关系图检测节点间回路的方法，基于所述有向关系图中是否存在节点间回路进行冲突检查，包括：
确定所述有向关系图中是否存在入度为0节点；
从所述有向关系图中删除所述入度为0节点发出的各有向边，从而更新所述有向关系图；
将所述入度为0的节点加入汇总记录并返回确定所述有向关系图中是否存在入度为0的节点，直至所述有向关系图中不存在入度为0的节点时为止；
基于所述汇总记录中是否包含所述有向关系图的所有节点，确定是否存在节点间回路。也就是说，在构建有向关系图后，可以根据节点的入度是否为0，得到汇总记录，若汇总记录中包含所有子交易标识对应的节点，则确定该有向关系图中没有回路，该交易请求没有重入攻击，若汇总记录中没有包含所有子交易标识对应的节点，则确定该有向关系图中包含回路，进一步根据汇总记录确定的有向关系图确定该交易请求存在重入攻击。
本发明实施例提供了一种根据有向关系图生成方法，根据各子交易操作的读写记录生成有向关系图，包括：
根据各子交易操作的读写记录中的各子交易标识，生成有向关系图中的各节点；
针对第i子交易操作的读写记录，获取第j子交易操作的读写记录；其中，第j子交易操作为在执行顺序上位于第i子交易操作之后的任一子交易操作；若所述第i子交易操作的读写记录和所述第j子交易操作的读写记录中读写地址相同且读写类型存在冲突，则在所述有向关系图中增加所述第i子交易操作对应的第i节点指向所述第j子交易操作对应的第j节点的有向边；所述读写类型存在冲突包括分别为读操作和写操作/写操作和写操作/写操作和读操作。也就是说，根据各子交易操作的读写记录，确定出读写地址相同、子交易标识不同和读写类型分别为读操作和写操作/写操作和写操作/写操作和读操作的存在读写冲突的两个子交易操作；根据所述两个子交易操作的读操作/写操作顺序生成所述两个子交易操作对应的节点间的有向边，得到有向关系图，所述有向边为读操作/写操作在前的节点指向读操作/写操作在后的节点。此处，本申请实施例提供了一种生成有向关系图的方法流程，如图4所示，包括：
步骤401、初始化i为0。
步骤402、在数组中取出下标为i的三元组(action i,context i,item i)元素，初始化j为i+1。
此处，三元组(action i,context i,item i)中读写类型action为“Write或Read”，context为当前子交易的子交易标识Context ID。item是指令指向的持久化存储空间地址和当前所执行的智能合约地址的组成。
步骤403、从数组中取出下标为j的三元组(action j,context j,item j)，确定i元素和j元素间是否存在读写冲突，即，i元素和j元素是否存在面向同个item的写操作，或读操作和写操作，若存在，则执行步骤404。否则，不对有向关系图添加有向边，执行步骤405。
步骤404、确定元素i和元素j存在读写冲突，向有向关系图中添加有向边context j→context i。
有向关系图中的该有向边的物理意义是编号为context j对应的子交易必须等待context i对应的子交易执行完毕后方可执行，否则会导致子交易操作的读写冲突。读写冲突主要分为读操作和写操作冲突(两个子交易操作中，一个子交易操作的元素j为读操作，一个子交易操作的元素i为写操作)、写操作和读操作冲突(两个子交易操作中，一个子交易操作的元素j为写操作，一个子交易操作的元素i为读操作)、写操作和写操作冲突(两个子交易操作中，一个子交易操作的元素j为写操作，一个子交易操作的元素i为写操作)三种。判断标准如下：读和写冲突：context i不等于context j，item i等于item j，action j是“Read”而action i是“Write”。写和读冲突：context i不等于context j，item i等于item j，action j是“Write”而action i是“Read”。写和写冲突：context i不等于context j，item i等于item j，action i和action j都是“Write”。
步骤405、若数组的长度大于或等于j+1,则令j＝j+1，回到步骤403，否则执行步骤406。
步骤406、若数组的长度小于j+1且大于i+1,则令i＝i+1，回到步骤402，否则，执行步骤407。
步骤407、完成有向关系图的构建。
基于图4中的有向关系图和上述示例，若交易请求为取款交易请求，取款交易请求中包含三个CALL指令，读写记录方式为数组方式，取款智能合约地址为1，持久化存储空间地址为1，三个CALL指令的子交易标识按照执行顺序分别为0、1、2，则最终获取的数组为{(Read 0,0 0,(1,1) 0)、(Read 1,1 1,(1,1) 1)、(Read 2,2 2,(1,1) 2)、(Write 3,2 3,(1,1) 3)、(Write 4,1 4,(1,1) 4)、(Write 5,0 5,(1,1) 5)、}。其中，下角标0、1…5用于表征各读写记录对应的读操作/写操作的执行顺序。
则该示例的有向关系图生成步骤包括：
步骤401、初始化i为0。
步骤402、在数组中取出下标为i的三元组(Read 0,0 0,(1,1) 0)元素，初始化j为i+1，j＝i+1＝1，跳至步骤403。
步骤403、从数组中取出(Read 1,1 1,(1,1) 1，(Read 1,1 1,(1,1) 1和(Read 0,0 0,(1,1) 0)不属于读写冲突、写读冲突、写写冲突中的任一种读写类型，不对有向关系 图添加有向边，执行步骤405。
步骤405、数组的长度5大于或等于j+1＝2,则令j＝j+1＝2，回到步骤403。
步骤403、从数组中取出(Read 2,2 2,(1,1) 2)，(Read 2,2 2,(1,1) 2)和(Read 0,0 0,(1,1) 0)不属于读写冲突、写读冲突、写写冲突中的任一种读写类型，不对有向关系图添加有向边，执行步骤405。
步骤405、数组的长度5大于或等于j+1＝3,则令j＝j+1＝3，回到步骤403。
步骤403、从数组中取出(Write 3,2 3,(1,1) 3)，(Write 3,2 3,(1,1) 3)和(Read 0,0 0,(1,1) 0)属于读写冲突，对有向关系图添加有向边，执行步骤404。
步骤404、确定元素i和元素j存在读写冲突，向有向关系图中添加有向边context 3→context 0，得到有向关系图，如图5所示。
步骤405、数组的长度5大于或等于j+1＝4,则令j＝j+1＝4，回到步骤403。
步骤403、从数组中取出(Write 4,1 4,(1,1) 4)，(Write 4,1 4,(1,1) 4)和(Read 0,0 0,(1,1) 0)属于读写冲突，对有向关系图添加有向边，执行步骤404。
步骤404、确定元素i和元素j存在读写冲突，向有向关系图中添加有向边context 4→context 0，得到有向关系图，如图6所示。
步骤405、数组的长度5大于或等于j+1＝5,则令j＝j+1＝5，回到步骤403。
步骤403、从数组中取出(Write 5,0 5,(1,1) 5)，(Write 5,0 5,(1,1) 5)和(Read 0,0 0,(1,1) 0)不属于读写冲突、写读冲突、写写冲突中的任一种读写类型，不对有向关系图添加有向边，执行步骤405。
步骤405、数组的长度5小于j+1＝6,则令j＝j+1＝6，执行步骤406。
步骤406、数组的长度5小于j+1＝6且大于i+1＝1,则令i＝i+1＝1，回到步骤402。
步骤402、在数组中取出下标为i的三元组(Read 1,1 1,(1,1) 1)元素，初始化j为i+1，j＝i+1＝2，跳至步骤403。
步骤403、从数组中取出(Read 2,2 2,(1,1) 2)，(Read 2,2 2,(1,1) 2)和(Read 1,1 1,(1,1) 1)不属于读写冲突、写读冲突、写写冲突中的任一种读写类型，不对有向关系图添加有向边，执行步骤405。
步骤405、数组的长度5大于或等于j+1＝3,则令j＝j+1＝3，回到步骤403。
步骤403、从数组中取出(Write 3,2 3,(1,1) 3)，(Write 3,2 3,(1,1) 3)和(Read 1,1 1,(1,1) 1)属于写读冲突。对有向关系图添加有向边，执行步骤404。
步骤404、确定元素i和元素j存在读写冲突，向有向关系图中添加有向边context 3→context 1，得到有向关系图，如图7所示。
步骤405、数组的长度5大于或等于j+1＝4,则令j＝j+1＝4，回到步骤403。
步骤403、从数组中取出(Write 4,1 4,(1,1) 4)，(Write 4,1 4,(1,1) 4)和(Read 1,1 1,(1,1) 1)不属于读写冲突、写读冲突、写写冲突中的任一种读写类型，不对有向关系图添加有向边，执行步骤405。
步骤405、数组的长度5大于或等于j+1＝5,则令j＝j+1＝5，回到步骤403。
步骤403、从数组中取出(Write 5,0 5,(1,1) 5)，(Write 5,0 5,(1,1) 5)和(Read 1,1 1,(1,1) 1)属于读写冲突，对有向关系图添加有向边，执行步骤404。
步骤404、确定元素i和元素j存在读写冲突，向有向关系图中添加有向 边context 5→context 1，得到有向关系图，如图8所示。
步骤405、数组的长度5小于j+1＝6,则令j＝j+1＝6，回到步骤406。
步骤406、数组的长度5小于j+1＝6且大于i+1＝2,则令i＝i+1＝2，回到步骤402。
步骤402、在数组中取出下标为i的三元组(Read 2,2 2,(1,1) 2)元素，初始化j为i+1，j＝i+1＝3，跳至步骤403。
步骤403、从数组中取出(Write 3,2 3,(1,1) 3)，(Write 3,2 3,(1,1) 3)和(Read 2,2 2,(1,1) 2)不属于读写冲突、写读冲突、写写冲突中的任一种读写类型，不对有向关系图添加有向边，执行步骤405。
步骤405、数组的长度5小于j+1＝4,则令j＝j+1＝4，回到步骤403。
步骤403、从数组中取出(Write 4,1 4,(1,1) 4)，(Write 4,1 4,(1,1) 4)和(Read 2,2 2,(1,1) 2)属于读写冲突、写读冲突、写写冲突中的任一种读写类型，对有向关系图添加有向边，执行步骤404。
步骤404、确定元素i和元素j存在读写冲突，向有向关系图中添加有向边context 4→context 2，得到有向关系图，如图9所示。
步骤405、数组的长度5小于j+1＝5,则令j＝j+1＝5，回到步骤403。
步骤403、从数组中取出(Write 5,0 5,(1,1) 5，(Write 5,0 5,(1,1) 5和(Read 2,2 2,(1,1) 2)属于写读冲突，对有向关系图添加有向边，执行步骤404。
步骤404、确定元素i和元素j存在读写冲突，向有向关系图中添加有向边context 5→context 2。得到有向关系图，如图10所示。
步骤405、数组的长度5小于j+1＝6,则令j＝j+1＝6，回到步骤406。
步骤406、数组的长度5小于j+1＝6且大于i+1＝3,则令i＝i+1＝3，回到步骤402。
步骤402、在数组中取出下标为i的三元组(Write 3,2 3,(1,1) 3)元素，初始化j为i+1，j＝i+1＝4，跳至步骤403。
步骤403、从数组中取出(Write 4,1 4,(1,1) 4)，(Write 4,1 4,(1,1) 4)和(Write 3,2 3,(1,1) 3)属于读写冲突、写读冲突、写写冲突中的任一种读写类型，对有向关系图添加有向边，执行步骤404。
步骤404、确定元素i和元素j存在读写冲突，已经存在节点1指向节点2的有向边，可以向有向关系图中添加有向边context 4→context 3。得到有向关系图，如图10所示。
步骤405、数组的长度5小于j+1＝5,则令j＝j+1＝5，回到步骤403。
步骤403、从数组中取出(Write 5,0 5,(1,1) 5，(Write 5,0 5,(1,1) 5和(Write 3,2 3,(1,1) 3)属于写写冲突，对有向关系图添加有向边，执行步骤404。
步骤404、确定元素i和元素j存在读写冲突，已经存在节点0指向节点2的有向边，可以向有向关系图中添加有向边context 5→context 3。得到有向关系图，如图10所示。
步骤405、数组的长度5小于j+1＝6,则令j＝j+1＝6，回到步骤406。
步骤406、数组的长度5小于j+1＝6且大于i+1＝4,则令i＝i+1＝4，回到步骤402。
步骤402、在数组中取出下标为i的三元组(Write 4,1 4,(1,1) 4)元素，初始化j为i+1，j＝i+1＝5，跳至步骤403。
步骤403、从数组中取出(Write 5,0 5,(1,1) 5，(Write 5,0 5,(1,1) 5和(Write 4,1 4,(1,1) 4)属于写写冲突，对有向关系图添加有向边，执行步骤404。
步骤404、确定元素i和元素j存在读写冲突，已经存在节点0指向节点1的有向边，可以向有向关系图中添加有向边context 5→context 4。得到有向关系图，如图10所示。
本发明实施例还提供了一种区块链攻击拦截方法，还包括：若冲突检查中未发现存在不同的子交易标识针对同一读写地址的读写冲突形成调用智能合约操作，则将所述交易请求的处理结果更新至区块链账本。也就是说，若交易请求中没有重入攻击，则将交易处理结果存储至区块链账本，完成最终的交易处理。
本发明实施例还提供了一种区块链攻击拦截方法，若存在不同的子交易标识针对同一读写地址的读写冲突形成调用智能合约操作之后，还包括：将所述交易请求的相关信息记录在日志文件中并告警。也就是说，针对每个交易请求，可以记录该交易请求的有向关系图、子交易操作的读写记录、源地址、目的地址等等，可以用于后续分析确定攻击者。
基于上述方法，本发明实施例提供了一种区块链攻击拦截方法的流程，如图11所示，包括：
步骤1101、接收交易请求。
步骤1102、针对交易请求中的各子交易操作，按照子交易操作的执行顺序，以递增的方式为每个子交易操作生成子交易标识。
步骤1103、针对子交易操作对应的读操作/写操作生成包含读写类型、子交易标识和调用的智能合约地址和操作的持久化存储空间的读写记录。
步骤1104、根据各子交易操作的读写记录，也可以说，根据各子交易操作对应的读操作/写操作的读写记录生成有向关系图。
步骤1105、判断有向关系图是否存在回路。若存在，则执行步骤1006，否则执行步骤1008。
步骤1106、将该交易请求回滚。
步骤1107、产生告警。
步骤1108、将交易处理结果更新到区块链账本中。
步骤1109、生成日志文件或根据该交易请求的相关信息更新日志文件。
需要说明的是，上述流程步骤并不唯一，如，步骤1109可以在步骤1101后的任一步骤前后，根据当前步骤产生的交易请求的而相关信息更新日志文件。
基于同样的构思，本发明实施例提供一种区块链攻击拦截装置，图12为本发明实施例提供的一种区块链攻击拦截装置示意图，如图12示，包括：
分析模块1201，用于执行交易请求过程中，针对调用智能合约的子交易操作，生成所述子交易操作的子交易标识；针对所述子交易操作中对持久化存储空间的读操作/写操作，生成所述子交易操作的读写记录；所述读写记录 中包括读写类型、子交易标识和读写地址；其中，每次调用智能合约生成的各子交易标识均不同；
处理模块1202，用于在所述交易请求执行完成后，针对各子交易操作的读写记录进行冲突检查；若存在不同的子交易标识针对同一读写地址的读写冲突形成调用智能合约操作，则回滚所述交易请求。
可选的，所述分析模块1201具体用于，根据所述交易请求中各子交易操作的执行顺序，为所述各子交易操作递增生成子交易标识。
可选的，所述处理模块1202具体用于，根据各子交易操作的读写记录生成有向关系图，其中，所述有向关系图中包括指示每个子交易标识的各节点及指示节点间存在读写冲突的有向边基于所述有向关系图中是否存在节点间回路进行冲突检查。
可选的，所述处理模块1202具体用于，确定所述有向关系图中是否存在入度为0节点；从所述有向关系图中删除所述入度为0节点发出的各有向边，从而更新所述有向关系图；将所述入度为0的节点加入汇总记录并返回确定所述有向关系图中是否存在入度为0的节点，直至所述有向关系图中不存在入度为0的节点时为止；基于所述汇总记录中是否包含所述有向关系图的所有节点，确定是否存在节点间回路。
可选的，所述处理模块1202具体用于，根据各子交易操作的读写记录中的各子交易标识，生成有向关系图中的各节点；针对第i子交易操作的读写记录，获取第j子交易操作的读写记录；其中，第j子交易操作为在执行顺序上位于第i子交易操作之后的任一子交易操作；若所述第i子交易操作的读写记录和所述第j子交易操作的读写记录中读写地址相同且读写类型存在冲突，则在所述有向关系图中增加所述第i子交易操作对应的第i节点指向所述第j子交易操作对应的第j节点的有向边；所述读写类型存在冲突包括分别为读操作和写操作/写操作和写操作/写操作和读操作。
可选的，所述处理模块1202还用于，若冲突检查中未发现存在不同的子交易标识针对同一读写地址的读写冲突形成调用智能合约操作，则将所述交易请求的处理结果更新至区块链账本。
可选的，所述处理模块1202还用于，将所述交易请求的相关信息记录在日志文件中并告警。
本领域内的技术人员应明白，本发明的实施例可提供为方法、系统、或计算机程序产品。因此，本发明可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本发明可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本发明是参照根据本发明的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计 算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
显然，本领域的技术人员可以对本发明进行各种改动和变型而不脱离本发明的精神和范围。这样，倘若本发明的这些修改和变型属于本发明权利要求及其等同技术的范围之内，则本发明也意图包含这些改动和变型在内。

Claims (10)

  1. 一种区块链攻击拦截方法，其特征在于，所述的方法包括：
    区块链平台执行交易请求过程中，针对调用智能合约的子交易操作，生成所述子交易操作的子交易标识；针对所述子交易操作中对持久化存储空间的读操作/写操作，生成所述子交易操作的读写记录；所述读写记录中包括读写类型、子交易标识和读写地址；其中，每次调用智能合约生成的各子交易标识均不同；
    所述区块链平台在所述交易请求执行完成后，针对各子交易操作的读写记录进行冲突检查；若存在不同的子交易标识针对同一读写地址的读写冲突形成调用智能合约操作，则回滚所述交易请求。
  2. 如权利要求1中所述的方法，其特征在于，针对智能合约调用的子交易操作，生成所述子交易操作的子交易标识，包括：
    根据所述交易请求中各子交易操作的执行顺序，为所述各子交易操作递增生成子交易标识。
  3. 如权利要求1中所述的方法，其特征在于，针对各子交易操作的读写记录进行冲突检查，包括：
    根据各子交易操作的读写记录生成有向关系图，其中，所述有向关系图中包括指示每个子交易标识的各节点及指示节点间存在读写冲突的有向边；基于所述有向关系图中是否存在节点间回路进行冲突检查。
  4. 如权利要求3中所述的方法，其特征在于，基于所述有向关系图中是否存在节点间回路进行冲突检查，包括：
    确定所述有向关系图中是否存在入度为0节点；
    从所述有向关系图中删除所述入度为0节点发出的各有向边，从而更新所述有向关系图；
    将所述入度为0的节点加入汇总记录并返回确定所述有向关系图中是否存在入度为0的节点，直至所述有向关系图中不存在入度为0的节点时为止；
    基于所述汇总记录中是否包含所述有向关系图的所有节点，确定是否存在节点间回路。
  5. 如权利要求3中所述的方法，其特征在于，根据各子交易操作的读写记录生成有向关系图，包括：
    根据各子交易操作的读写记录中的各子交易标识，生成有向关系图中的各节点；
    针对第i子交易操作的读写记录，获取第j子交易操作的读写记录；其中，第j子交易操作为在执行顺序上位于第i子交易操作之后的任一子交易操作；若所述第i子交易操作的读写记录和所述第j子交易操作的读写记录中读写地址相同且读写类型存在冲突，则在所述有向关系图中增加所述第i子交易操作对应的第i节点指向所述第j子交易操作对应的第j节点的有向边；所述读写类型存在冲突包括分别为读操作和写操作/写操作和写操作/写操作和读操作。
  6. 如权利要求1-5中任一所述的方法，其特征在于，还包括：
    若冲突检查中未发现存在不同的子交易标识针对同一读写地址的读写冲突形成调用智能合约操作，则将所述交易请求的处理结果更新至区块链账本。
  7. 如权利要求1-5中任一所述的方法，其特征在于，若存在不同的子交易标识针对同一读写地址的读写冲突形成调用智能合约操作之后，还包括：
    将所述交易请求的相关信息记录在日志文件中并告警。
  8. 一种区块链攻击拦截装置，其特征在于，所述的装置包括：
    分析模块，用于执行交易请求过程中，针对调用智能合约的子交易操作，生成所述子交易操作的子交易标识；针对所述子交易操作中对持久化存储空间的读写操作，生成所述子交易操作的读写记录；所述读写记录中包括读写类型、子交易标识和读写地址；其中，每次调用智能合约生成的各子交易标识均不同；
    处理模块，用于在所述交易请求执行完成后，针对各子交易操作的读写记录进行冲突检查；若存在不同的子交易标识针对同一读写地址的读写冲突形成调用智能合约操作，则回滚所述交易请求。
  9. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质存储有程序，当所述程序在计算机上运行时，使得计算机实现执行权利要求1至7中任一项所述的方法。
  10. 一种计算机设备，其特征在于，包括：
    存储器，用于存储计算机程序；
    处理器，用于调用所述存储器中存储的计算机程序，按照获得的程序执行如权利要求1至7任一权利要求所述的方法。
PCT/CN2022/126517 2021-11-04 2022-10-20 一种区块链攻击拦截方法及装置 Ceased WO2023078097A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111300723.X 2021-11-04
CN202111300723.XA CN114049118B (zh) 2021-11-04 2021-11-04 一种区块链攻击拦截方法及装置

Publications (1)

Publication Number Publication Date
WO2023078097A1 true WO2023078097A1 (zh) 2023-05-11

Family

ID=80207312

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/126517 Ceased WO2023078097A1 (zh) 2021-11-04 2022-10-20 一种区块链攻击拦截方法及装置

Country Status (2)

Country Link
CN (1) CN114049118B (zh)
WO (1) WO2023078097A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN118093613A (zh) * 2024-03-21 2024-05-28 杭州高新区(滨江)区块链与数据安全研究院 数据交互处理方法、区块构建节点、终端设备及存储介质

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114049118B (zh) * 2021-11-04 2025-05-30 深圳前海微众银行股份有限公司 一种区块链攻击拦截方法及装置

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109559226A (zh) * 2018-11-28 2019-04-02 杭州有盾网络科技有限公司 区块链交易执行方法、系统及电子设备和存储介质
CN111563093A (zh) * 2020-05-15 2020-08-21 电子科技大学 一种联盟区块链冲突交易检测与规避系统及方法
WO2020201024A1 (en) * 2019-03-29 2020-10-08 Tollen Software Limited Blockchain identities
CN113469811A (zh) * 2021-07-05 2021-10-01 支付宝(杭州)信息技术有限公司 区块链交易处理方法及装置
CN114049118A (zh) * 2021-11-04 2022-02-15 深圳前海微众银行股份有限公司 一种区块链攻击拦截方法及装置
CN115098863A (zh) * 2022-06-08 2022-09-23 成都安恒信息技术有限公司 一种基于静态与动态分析的智能合约重入漏洞检测方法

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106878247B (zh) * 2016-08-11 2020-06-16 阿里巴巴集团控股有限公司 一种攻击识别方法和装置
US11487749B2 (en) * 2018-05-30 2022-11-01 Aenco Technologies Limited Method and system for verifying and maintaining integrity of data transactions using distributed ledger
WO2020199703A1 (zh) * 2019-04-01 2020-10-08 杜晓楠 一种区块链交易的方法、装置和系统
CN110349029B (zh) * 2019-07-17 2022-04-15 中国银行股份有限公司 一种基于区块链的交易一致性的处理方法、设备以及系统
CN111798289A (zh) * 2020-06-24 2020-10-20 杭州云象网络技术有限公司 一种基于区块链的技术成果交易方法及系统
CN111985929A (zh) * 2020-09-03 2020-11-24 深圳壹账通智能科技有限公司 区块链中的交易验证方法、装置、节点设备及存储介质
CN112508573B (zh) * 2021-01-29 2021-04-30 腾讯科技（深圳）有限公司 一种交易数据处理方法、装置以及计算机设备
CN112837153A (zh) * 2021-02-10 2021-05-25 北京航空航天大学 一种基于有向无环图的智能合约冲突检测方法

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109559226A (zh) * 2018-11-28 2019-04-02 杭州有盾网络科技有限公司 区块链交易执行方法、系统及电子设备和存储介质
WO2020201024A1 (en) * 2019-03-29 2020-10-08 Tollen Software Limited Blockchain identities
CN111563093A (zh) * 2020-05-15 2020-08-21 电子科技大学 一种联盟区块链冲突交易检测与规避系统及方法
CN113469811A (zh) * 2021-07-05 2021-10-01 支付宝(杭州)信息技术有限公司 区块链交易处理方法及装置
CN114049118A (zh) * 2021-11-04 2022-02-15 深圳前海微众银行股份有限公司 一种区块链攻击拦截方法及装置
CN115098863A (zh) * 2022-06-08 2022-09-23 成都安恒信息技术有限公司 一种基于静态与动态分析的智能合约重入漏洞检测方法

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN118093613A (zh) * 2024-03-21 2024-05-28 杭州高新区(滨江)区块链与数据安全研究院 数据交互处理方法、区块构建节点、终端设备及存储介质

Also Published As

Publication number Publication date
CN114049118B (zh) 2025-05-30
CN114049118A (zh) 2022-02-15

Similar Documents

Publication Publication Date Title
US11615078B2 (en) Blockchain-based transaction methods
US11074245B2 (en) Method and device for writing service data in block chain system
KR101203297B1 (ko) 직접 업데이트 소프트웨어 트랜잭션 메모리
CN110020542B (zh) 数据读写方法及装置、电子设备
CN110032599B (zh) 数据结构的读取及更新方法、装置、电子设备
TW202008196A (zh) 基於中心化結算與區塊鏈存證的交易方法及系統
TWI730690B (zh) 在區塊鏈中同時執行交易的方法和裝置及電腦可讀儲存媒體與計算設備
CN110032568B (zh) 数据结构的读取及更新方法、装置、电子设备
WO2023078097A1 (zh) 一种区块链攻击拦截方法及装置
EP3739471A1 (en) Device and method for managing ledger data on blockchain
CN108845866A (zh) 处理分布式事务的方法和装置
CN105335143A (zh) 一种业务处理方法及装置
US12461990B2 (en) Model-based data transformation
US11250438B2 (en) Blockchain-based reimbursement splitting
WO2023165271A1 (zh) 知识图谱的构建、和图计算
He et al. TokenCat: detect flaw of authentication on ERC20 tokens
CN110490742B (zh) 一种区块链中的交易执行方法及装置
CN119538246B (zh) 一种基于数据动态存储的智能合约恶意交易检测分析方法
CN107291777A (zh) 一种热点数据识别和处理的方法和装置
CN113535772A (zh) 一种商户退款执行方法和装置
CN115760366B (zh) 批量业务处理方法及系统
CN115293776A (zh) 区块链智能合约攻击行为检测方法、存储介质和电子设备
CN115456775A (zh) 一种交易核准方法及装置、存储介质及电子设备
CN111737357A (zh) 一种智能合约污点追踪方法及装置
CN120147041B (zh) 一种系统间抹账业务处理方法、设备及介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22889122

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 16/08/2024)

122 Ep: pct application non-entry in european phase

Ref document number: 22889122

Country of ref document: EP

Kind code of ref document: A1