WO2023207871A1 - 一种节点集群以及数据备份方法 - Google Patents

一种节点集群以及数据备份方法 Download PDF

Info

Publication number
WO2023207871A1
WO2023207871A1 PCT/CN2023/090186 CN2023090186W WO2023207871A1 WO 2023207871 A1 WO2023207871 A1 WO 2023207871A1 CN 2023090186 W CN2023090186 W CN 2023090186W WO 2023207871 A1 WO2023207871 A1 WO 2023207871A1
Authority
WO
WIPO (PCT)
Prior art keywords
node
transaction
block
data
cluster
Prior art date
Application number
PCT/CN2023/090186
Other languages
English (en)
French (fr)
Inventor
程烁
吕小川
张明阳
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2023207871A1 publication Critical patent/WO2023207871A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/14—Error detection or correction of the data by redundancy in operation
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/14—Error detection or correction of the data by redundancy in operation
    • G06F11/1402—Saving, restoring, recovering or retrying
    • G06F11/1446—Point-in-time backing up or restoration of persistent data
    • G06F11/1458—Management of the backup or restore process
    • G06F11/1464—Management of the backup or restore process for networked environments
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
    • G06Q40/04—Trading; Exchange, e.g. stocks, commodities, derivatives or currency exchange
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2141—Access rights, e.g. capability lists, access control lists, access tables, access matrices

Definitions

  • This application relates to the field of Internet technology, and in particular to a node cluster and data backup method.
  • the blockchain system In the blockchain system, data is stored in blocks, and newly written data forms a new block and is added to the end of the current blockchain. While each block saves data, it also saves a number uniquely corresponding to all recorded data in the previous block (often the hash value of all recorded data), thus forming a chain. Therefore, the blockchain system can be considered as a system in which computers on a distributed network that do not fully trust each other jointly maintain a set of traceable and non-tamperable chained data through consensus rules.
  • Ledger data (which can also be called transaction data in the embodiment of this application) can be backed up to a node cluster.
  • identity of each node is equal, and the same ledger data is stored on each node.
  • requirements for data isolation cannot be met.
  • the embodiment of this application provides a node cluster and data backup method, which can improve the performance of blockchain network data storage.
  • the present application provides a node cluster.
  • the node cluster includes a first node cluster and a second node cluster.
  • the blockchain network is divided into tree-like sub-clusters (zones), and the arrangement of the network structure becomes orderly, which can improve the network topology and increase the synchronization performance and scale limit.
  • the data synchronization process filters out transactions outside of authority, ensuring data isolation across authority domains. And for data in non-authorized domains, only the hash value after hash processing is stored. The hash value is usually much smaller than the data ontology, which can reduce network load and improve performance.
  • the first node cluster also includes nodes other than the first node
  • the second node cluster also includes nodes other than the second node
  • the first node cluster also includes nodes other than the second node. Data is transferred between the node cluster and the second node cluster only through the first node and the second node.
  • the nodes in the second node cluster are configured not to have the authority to actively access the data of the nodes in the first node cluster.
  • data is transferred between node clusters only through nodes with specific roles.
  • first node cluster and the second node cluster As an example, between the first node cluster and the second node cluster Data can be transferred only through the first node and the second node (for example, data can only be transferred through the first node sending data to the second node), and no other nodes in the first node cluster except the first node have Permission to transfer data to the second node cluster. Nodes in the second node cluster do not have permission to transfer data to the first node cluster, and do not have permission to actively obtain data from the first node cluster.
  • the second block also includes transaction data of a third transaction
  • the node cluster also includes a third node cluster, and the third node in the second node cluster and the third The communication connection between the fourth nodes in the node cluster
  • the first node is also used to transfer the second permission information of the third transaction to the second node
  • the third node is used to based on the The second permission information indicates that the third node cluster does not have access permission to the third transaction
  • the transaction data of the third transaction is encrypted to obtain a third block, where the third block includes The encrypted transaction data of the third transaction; transfer the third block to the fourth node, so that the third node cluster performs data backup of the third block.
  • the second block also includes transaction data of the fourth transaction; the second permission information indicates that the cluster to which the third node belongs has access permission to the fourth transaction, so The third block includes transaction data of the fourth transaction.
  • this application provides a data backup method, which is applied to a first node.
  • a data backup method which is applied to a first node.
  • the first node and the second node belong to different clusters.
  • the method includes: the first node obtains a first block and first permission information, the first block includes transaction data of the first transaction, and the first permission information is the permission information of the first transaction.
  • the first node When the first permission information indicates that the second node cluster does not have access permission to the at least one first transaction, the first node encrypts the transaction data of the first transaction to Obtain a second block, which includes the encrypted transaction data of the first transaction; the first node transfers the second block to the second node, so that the second The node cluster performs data backup on the second block.
  • the blockchain network is divided into tree-like sub-clusters (zones), and the arrangement of the network structure becomes orderly, which can improve the network topology and increase the synchronization performance and scale limit.
  • the data synchronization process filters out transactions outside of authority, ensuring data isolation across authority domains. And for data in non-authorized domains, only the hashed hash is stored. Hash value, the hash value is usually much smaller than the data ontology, which can reduce network load and improve performance.
  • the first node belongs to a first node cluster
  • the second node belongs to a second node cluster
  • the first node cluster also includes nodes other than the first node
  • the second node cluster also includes nodes other than the second node, and data is transferred between the first node cluster and the second node cluster only through the first node and the second node.
  • the nodes in the second node cluster are configured not to have the authority to actively access the data of the nodes in the first node cluster.
  • data is transferred between node clusters only through nodes with specific roles.
  • first node cluster and the second node cluster As an example, between the first node cluster and the second node cluster Data can be transferred only through the first node and the second node (for example, data can only be transferred through the first node sending data to the second node), and no other nodes in the first node cluster except the first node have Permission to transfer data to the second node cluster. Nodes in the second node cluster do not have permission to transfer data to the first node cluster, and do not have permission to actively obtain data from the first node cluster.
  • the first block also includes transaction data of the second transaction, and the transaction data is plain text data; the permission information indicates that the second node cluster has permission to the second transaction. Access rights, the second block includes transaction data of the second transaction.
  • the second block is obtained by replacing the transaction data of the first transaction in the first block with the ciphertext data.
  • the second block also includes transaction data of the third transaction, and the transaction data is plain text data;
  • the node cluster also includes a third node cluster, and the node cluster in the second node cluster There is a communication connection between the third node and the fourth node in the third node cluster;
  • the method further includes: the first node transmits the second permission information of the third transaction to the second node;
  • the third node indicates that the third node cluster does not have access rights to the third transaction based on the second permission information, and encrypts the transaction data of the third transaction to obtain the third block,
  • the third block includes encrypted transaction data of the third transaction;
  • the third node transfers the third block to the fourth node so that the third node cluster can Three blocks are used for data backup.
  • the second block also includes transaction data of at least one fourth transaction, and the transaction data is plain text data; the permission information indicates that the second node cluster has the ability to control the at least one fourth transaction. Access rights to a fourth transaction, the third block including transaction data of the at least one fourth transaction.
  • the first authority information includes at least one authority level with access authority to the first transaction; the method further includes: the first node based on the authority of the second node cluster The level is not in the at least one permission level, and it is determined that the first permission information indicates that the second node cluster does not have access to the first communication easy access.
  • the transaction data of the first transaction is data generated by the consensus node.
  • the first node cluster can be a consensus cluster (a node cluster including consensus nodes), the consensus node in the first node cluster can generate the first block, and the first node in the first node cluster can The second block is generated according to the first block (the first block and the second area can be the same or different), and is passed to the first node (linker node) in the second node cluster through the first node cluster.
  • Two nodes master node).
  • the first node cluster can be a non-consensus cluster (node cluster excluding consensus nodes), and the master node in the first node cluster can receive the linker node from the upper-level node cluster.
  • the first node in the first node cluster can generate a second block based on the first block (the first block and the second area can be the same or different), and pass the first node in the first node cluster The node (linker node) is passed to the second node (master node) in the second node cluster.
  • the second node cluster includes multiple nodes including the second node, and the second node cluster performs data backup on the second block, including: the multiple Each node among the nodes performs data backup of the second block.
  • this application provides a data backup device, applied to a first node, the first node and the second node are connected by communication, the first node and the second node belong to different clusters,
  • the first node includes:
  • An acquisition module configured to acquire the first block and first authority information, where the first block includes transaction data of the first transaction, and the first authority information is the authority information of the first transaction;
  • a block generation module configured to, when the first permission information indicates that the second node cluster does not have access permission to the at least one first transaction, the first node's access to the first transaction.
  • the transaction data is encrypted to obtain a second block, where the second block includes the encrypted transaction data of the first transaction;
  • a transfer module configured to transfer the second block to the second node so that the second node cluster performs data backup of the second block.
  • the first node belongs to a first node cluster
  • the second node belongs to a second node cluster
  • the first node cluster also includes nodes other than the first node
  • the second node cluster also includes nodes other than the second node, and data is transferred between the first node cluster and the second node cluster only through the first node and the second node.
  • the nodes in the second node cluster are configured not to have the authority to actively access the data of the nodes in the first node cluster.
  • the first block also includes transaction data of the second transaction
  • the first permission information indicates that the second node cluster has access permission to the second transaction, and the second block includes transaction data of the second transaction.
  • the second block is obtained by replacing the transaction data of the first transaction in the first block with the encrypted transaction data of the first transaction.
  • the second block also includes transaction data of a third transaction
  • the node cluster also includes a third node cluster, and the third node in the second node cluster and the third Communication connection between the fourth nodes in the node cluster
  • the transfer module is also used to:
  • the third node includes:
  • a block generation module configured to indicate that the third node cluster does not have access rights to the third transaction based on the second permission information, and encrypt the transaction data of the third transaction to obtain the third block block, the third block includes encrypted transaction data of the third transaction;
  • a transfer module configured to transfer the third block to the fourth node, so that the third node cluster performs data backup of the third block.
  • the second block also includes transaction data of the fourth transaction
  • the second permission information indicates that the cluster to which the third node belongs has access permission to the fourth transaction, and the third block includes transaction data of the fourth transaction.
  • the first permission information includes at least one permission level with access permission to the first transaction;
  • the block generation module is specifically used to:
  • the first node determines that the first permission information indicates that the second node cluster does not have access permission to the first transaction.
  • the transaction data of the first transaction is data generated by the consensus node.
  • the first node cluster further includes: a consensus node
  • Obtaining the first block includes: receiving the first block delivered from the consensus node.
  • the second node cluster includes multiple nodes including the second node, and the second node cluster performs data backup on the second block, including:
  • Each node in the plurality of nodes performs data backup of the second block.
  • embodiments of the present application provide a device, including a memory, a processor, and a bus system, wherein the memory is used to store programs, and the processor is used to execute the programs in the memory to perform the above-mentioned second aspect and the second aspect. square Any of the options available.
  • embodiments of the present invention further provide a system, which includes at least one processor, at least one memory, and at least one communication interface; the processor, memory, and communication interface are connected through a communication bus and communicate with each other;
  • the memory is used to store the application code that executes the above scheme, and the processor controls the execution.
  • the processor is configured to execute application program code stored in the memory; wherein the code stored in the memory can execute one of the data backup methods provided above.
  • a communication interface used to communicate with other devices or communication networks to send data to said devices or communication networks.
  • embodiments of the present application provide a computer-readable storage medium that stores a computer program that, when run on a computer, causes the computer to execute the above-mentioned second aspect and any one thereof.
  • Optional method a computer-readable storage medium that stores a computer program that, when run on a computer, causes the computer to execute the above-mentioned second aspect and any one thereof.
  • embodiments of the present application provide a computer-readable storage medium that stores one or more instructions that, when executed by one or more computers, cause the one or more The computer implements the above second aspect and any optional system thereof.
  • embodiments of the present application provide a computer program that, when run on a computer, causes the computer to execute the above second aspect and any optional method thereof.
  • the present application provides a chip system that includes a processor to support a terminal device or server to implement the functions involved in the above aspects, for example, sending or processing data involved in the above methods; or ,information.
  • the chip system further includes a memory, and the memory is used to store necessary program instructions and data for the terminal device or server.
  • the chip system may be composed of chips, or may include chips and other discrete devices.
  • Figure 1 is a schematic diagram of enterprise permissions
  • FIG. 2 is a schematic diagram of the architecture of a blockchain network provided by this application.
  • Figure 3 is a schematic diagram of a data backup method provided by an embodiment of the present application.
  • Figure 4 is a schematic diagram of permissions provided by an embodiment of the present application.
  • Figure 5 is a schematic diagram of a block according to an embodiment of the present application.
  • Figure 6 is a permission diagram provided by an embodiment of the present application.
  • Figure 7 is a schematic diagram of a data backup device in an embodiment of the present application.
  • Figure 8 is a schematic structural diagram of a data backup device in an embodiment of the present application.
  • Figure 9 is a schematic structural diagram of a server provided in an embodiment of the present application.
  • Blockchain specifically refers to a P2P network system with a distributed data storage structure reached by each node through a consensus mechanism.
  • the data in the blockchain is distributed in “blocks” that are connected in time. Within “, the latter block contains the data summary of the previous block, and depending on the specific consensus mechanism (such as POW, POS, dPOS or PBFt, etc.), full data backup of all or part of the nodes is achieved.
  • Blockchain can include public chain, alliance chain, private chain, etc. according to the distribution form of its network nodes. In actual applications, especially the actual applications of alliance chains, separate blockchains are usually set up for different scenarios, such as blockchains used to handle house rental business scenarios, and blockchains used to handle music copyright usage business scenarios.
  • Multiple sub-chains can be linked to various sub-chains of house rental businesses, such as a blockchain sub-chain specifically used to record house rental orders, a blockchain sub-chain specifically used to record details of houses available for rent, etc.
  • the above-mentioned sub-chains are multiple instances that follow the above-mentioned blockchain main chain protocol.
  • Ledger data (which can also be called transaction data in the embodiment of this application) can be backed up to a node cluster.
  • identity of each node is equal, and the same ledger data is stored on each node.
  • the requirements for data isolation cannot be met, and the node stores a large amount of data that it cannot access, which will also cause a large waste of resources.
  • Peer to peer Also known as peer-to-peer technology, it is an Internet system that has no central server and relies on user groups (peers) to exchange information.
  • Block in the blockchain, refers to a data structure composed of multiple transactions packaged. It is the unit for sending messages and synchronizing in the blockchain network. Compared with transaction-by-transaction processing, the block-based transaction batch processing model has Higher performance.
  • Transaction refers to the data change request initiated by the client to the blockchain system.
  • the blockchain system will back up the transaction data in all nodes.
  • the process of recording transaction data is called "accounting”.
  • Merkle tree is a hash binary tree, consisting of a root node (root), a set of intermediate nodes and a set of leaf nodes (leaf).
  • the leaf nodes of a Merkle tree in a blockchain are the hashes of the transactions in that block, while the intermediate/root nodes are the hashes of their children.
  • Synchronization in this article specifically refers to the process of backing up the same data by multiple nodes.
  • Zone a sub-cluster divided in the blockchain network.
  • the discovery and management of node members are limited to each zone.
  • the nodes in each zone independently perform data synchronization and member information maintenance.
  • Permission refers to the multiple authority domains of blockchain data. Each node is configured with the authority domain to which it belongs, and can only see transactions within its authority domain.
  • the consensus node is the entrance to blockchain network transactions. It packages transactions from clients into blocks and synchronizes them downstream.
  • the coordinator node (coordinator) is responsible for maintaining meta-information of the zone (such as zone cluster member status) in the zone cluster.
  • Each zone has at least one coordinator node.
  • the master node is the leader node among the coordinator nodes of this zone. It is responsible for managing the coordinator node and communicating with the superior zone (obtaining new data, forwarding transactions) and other functions. Each zone has only one master node.
  • Linker node The node in the upper-level zone that establishes a link with the master of the downstream zone. It is responsible for sending the latest data to the downstream zone, detecting the status of the downstream zone, and other functions.
  • Peer node an ordinary data synchronization node. Each zone can have multiple peer nodes for data synchronization and backup.
  • Seed node The entry node for new nodes to join the zone cluster. When a new node wants to join the current zone cluster, it will first send a request to the Seed node, and the Seed node will forward it to the master node of the current zone for processing.
  • Figure 2 is a schematic diagram of the architecture of a blockchain network provided by this application.
  • the blockchain network provided by this application includes multiple zones.
  • a zone can also be described as a node cluster. Data cannot be actively read between different node clusters. Data can only be processed through nodes with fixed roles. Delivery (such as the linker node and coordinator node shown in Figure 2).
  • the node peers shown in Figure 2 can jointly maintain one or more blockchains.
  • the root area can include consensus nodes.
  • the consensus nodes can only exist in the consensus cluster (such as the root area shown in Figure 2).
  • the consensus node can serve as the data entrance of the blockchain network in the cluster. Specifically , all transactions of the client can first enter the consensus node, and then synchronize the node data step by step downstream (that is, the consensus node can package the transaction data into blocks and pass the blocks to nodes in other areas so that each The node performs data backup of the block).
  • the blockchain stores the transaction list in units of blocks.
  • the blocks in the blockchain are generated in chronological order, and each block is used to record the transaction list generated within a period of time.
  • the list of all transactions recorded on the blockchain is the ledger.
  • the ledger and the blockchain are equivalent concepts that can be replaced by each other without causing ambiguity.
  • a node in the blockchain network is on one physical machine (server), or multiple nodes in multiple blockchain networks.
  • Nodes are on the same server.
  • a node can specifically refer to a process or a series of processes running on the server.
  • different nodes in the blockchain network can be two processes running on the same server.
  • this application can divide the blockchain network into tree-like sub-clusters, and each sub-cluster is called a zone or node cluster.
  • each sub-cluster is called a zone or node cluster.
  • the discovery and management of node members is limited to each zone.
  • Each zone is autonomous in data synchronization between nodes.
  • Inter-zone communication is limited to this zone.
  • Zone (zone) is a network concept, which represents a local synchronization cluster in the blockchain network and has a relatively independent node management and synchronization mode.
  • Each zone cluster has a parent cluster called parent zone, which means that the nodes of the cluster synchronize block data from the Parent zone.
  • Each zone can be configured with a zone Id, which is optional. , the Id of Root zone is empty. Among them, the consensus node can only be in the top-level Root zone.
  • the Root zone where the consensus node is located has the latest full amount of data, and then spreads to the entire network along the tree relationship of the zone.
  • An autonomous synchronization protocol can be set up in each zone. Independent node member management, the data in each zone is consistent, and the data synchronization of the entire blockchain network can be abstracted as data multicast in a tree network composed of zone nodes.
  • Figure 3 is a schematic diagram of a data backup provided by an embodiment of the present application.
  • the data backup method provided by an embodiment of the present application includes:
  • the first node obtains a first block and first permission information.
  • the first block includes transaction data of the first transaction, and the first permission information is the permission information of the first transaction.
  • the data backup method in the embodiment of the present application can be applied to a node cluster.
  • the node cluster can include multiple node clusters, and the connection relationship between the multiple node clusters can form a tree structure.
  • the node cluster may include multiple zones.
  • the cluster as the root node may be a root zone including consensus nodes (embodiments of this application may also be described as a consensus cluster).
  • the root zone may include consensus nodes.
  • Consensus nodes Blocks can be generated based on transactions from the client and passed directly or indirectly to the peer node in the root zone.
  • the linker node in the peer node can pass the block to other node clusters.
  • the consensus node can only exist in the consensus cluster.
  • the consensus node assumes the following functions in the cluster: serving as the data entrance of the entire blockchain network: all transactions on the client first enter the consensus node, and then synchronize data downstream step by step; Pack the transactions into blocks, and the consensus node will perform the process of packaging the transactions.
  • it can facilitate batch processing to improve the synchronization performance of the system.
  • the cluster may include multiple connection branches, and the root nodes of the multiple connection branches are all root areas. Blocks can be propagated along each connection branch of the tree structure to subsequent node clusters (such as multicast ).
  • multiple node clusters may include a first node cluster and a second node cluster.
  • the first node in the first node cluster and the second node in the second node cluster are communicatively connected.
  • the first node cluster and the second node cluster may include manager coordinator nodes and peer nodes. In terms of functional implementation, both coordinator nodes and peer nodes can back up data. In addition to data backup, the coordinator node can also be responsible for the management of the cluster where it is located. For example, when building and configuring a node cluster, it is responsible for the management of the cluster. In addition, the coordinator node can also include a master node, and the master node can lead the cluster composed of coordinator nodes to perform normal functions. For example, the master node can be automatically elected by the coordinator node. The master node can back up data with other coordinator nodes to prevent single points of failure.
  • the second node in the second node cluster may be the master node described above, and the master node may be responsible for managing member information in the cluster and allocating connections. At the same time, the master node can also be used as the entire node set. The data entrance of the group is connected to the consensus cluster or other zone clusters.
  • data is transferred between node clusters only through nodes with specific roles.
  • first node cluster and the second node cluster As an example, between the first node cluster and the second node cluster Data can be transferred only through the first node and the second node (for example, data can only be transferred through the first node sending data to the second node), and no other nodes in the first node cluster except the first node have Permission to transfer data to the second node cluster. Nodes in the second node cluster do not have permission to transfer data to the first node cluster, and do not have permission to actively obtain data from the first node cluster.
  • the peer node can be a data synchronization node.
  • each peer node can be responsible for managing the connection with the node directly connected to itself.
  • synchronized data can be passed one-way between peers to reduce message redundancy.
  • each peer node in order to avoid data synchronization abnormalities caused by single points of failure, can establish multiple connections with multiple peer nodes in the node cluster to ensure reliability.
  • Linker function can be assumed by any node.
  • the node between the upper-level zone and the lower-level zone is called a linker node. Communication between zones is carried out by the linker of the parent zone and the coordinator (for example, master) node of the subordinate zone.
  • the first node cluster can be a parent zone
  • the second node cluster can be a subordinate zone
  • the first node in the first node cluster can be a linker node
  • the linker node can be a coordinator node or a peer node.
  • the second node in a two-node cluster can be the master node
  • the master node can be the coordinator node.
  • the node cluster can also include a seed node, and the seed node is assumed by any node in the node cluster.
  • the seed node is assumed by any node in the node cluster.
  • the seed node is called a seed node.
  • the first node cluster can be a consensus cluster (a node cluster including consensus nodes), the consensus node in the first node cluster can generate the first block, and the first node in the first node cluster can The second block is generated according to the first block (the first block and the second area can be the same or different), and is passed to the first node (linker node) in the second node cluster through the first node cluster.
  • Two nodes master node).
  • the first node cluster can be a non-consensus cluster (node cluster excluding consensus nodes), and the master node in the first node cluster can receive the linker node from the upper-level node cluster.
  • the first node in the first node cluster can generate a second block based on the first block (the first block and the second area can be the same or different), and pass the first node in the first node cluster The node (linker node) is passed to the second node (master node) in the second node cluster.
  • different node clusters can have different data access rights.
  • different node clusters can be assigned to different organizations.
  • Organizations with higher-level access rights can correspond to organizations closer to The node cluster of the root node. That is to say, in the bifurcated tree composed of node clusters, among the node clusters located on the same branch, the node clusters closer to the root node should have access rights no less than those of the node clusters far away from the root node.
  • the first node needs to obtain the data access permission of the second node cluster.
  • Asking permissions can indicate which data in the first block the second node cluster has permission to access and which data does not have permission to access, and process the first block based on the data access permission so that the second node cluster does not have permission to access
  • the data is encrypted and compressed to obtain the second block.
  • each node cluster can be configured with a corresponding access permission level (which can also be called a permission domain (domain) in this embodiment), where the node clusters on the same branch are closer to the root.
  • a node's node cluster has higher access rights.
  • the root zone where the consensus node is located can have full data. When data is synchronized from the upstream zone to the downstream zone, the linker node in the upstream zone will determine whether the authority domain bound to the downstream node has access rights to all transactions in the block.
  • the downstream node does not have access rights to a specific transaction, the transaction in the block will be "compressed" (for example, the data body of the transaction can be deleted and replaced with the hash value of the transaction), and the downstream node will not be able to obtain the transaction data body, ensuring Data isolation while reducing the amount of data that downstream nodes need to store. It can be seen that since the data is filtered step by step from upstream to downstream on demand, the amount of data obtained by the downstream zone may not be higher than that of its upstream, that is, its permissions are inherited from the upstream, that is, the permission inheritance relationship mentioned above is consistent with the data flow.
  • the corresponding permission domain can be bound when the node cluster (zone) is created, so that when the node joins a specific sub-cluster, its permission scope is clear without the need to specify it separately.
  • FIG. 4 is a schematic diagram of access permissions configured for each node cluster.
  • the transaction when specifying the permissions of each transaction, supports a specific domain Path or wildcard pattern when specifying the target domain list, such as: /domain_a/* represents all secondary domains of /domain_a; /domain_a/** represents /domain_a domain The entire subtree of the node.
  • the consensus node can obtain the access level required for the data of each transaction in the first block, and the required access level can be passed along with the block data to other node clusters.
  • the linker nodes in each node cluster can also obtain the above required access level.
  • the linker node can also maintain access rights to the data transfer object (node cluster), based on the required access level and the node cluster. Access permissions determine which data in the block the data transfer object (node cluster) has permission to access and which data it does not have permission to access.
  • the first node in the first node cluster can obtain the first block and the first permission information of the first transaction.
  • the first block includes the first The transaction data of the transaction, which is plain text data.
  • the first transaction may be the data of some or all transactions in the first block.
  • the data of all transactions in the first block can be plain text data.
  • the data of some transactions in the first block can be plain text.
  • Data, the data of some transactions can be ciphertext data, or the data of all transactions in the first block can be plaintext data, depending on the access rights of the first node cluster to each transaction in the first block.
  • the first permission information of the first transaction may include an access level required to access the first transaction.
  • Each transaction needs to specify at least one target domain when it is initiated (if not specified, all domains will be visible by default). Eventually, the transaction will be synchronized to all nodes with permissions for the specified domain (in the domain list associated with the zone where the node is located) Contains any one of the domain lists specified by transaction, then the node can receive the transaction data).
  • the first node When the first authority information indicates that the second node cluster does not have access to the at least one first transaction, If permission is requested, the first node encrypts the transaction data of the first transaction to obtain a second block, where the second block includes the encrypted transaction data of the first transaction.
  • the first node can determine that the second node cluster does not have access rights to the first transaction based on the first permission information, and then can compress the data of the first transaction in the first block. and encryption processing (such as hashing), and then obtain the ciphertext data obtained by hashing the transaction data of the first transaction, and replace the above ciphertext data with the corresponding plaintext data in the first block to obtain the second area piece.
  • encryption processing such as hashing
  • the first permission information includes at least one permission level with access permission to the first transaction; the first node may not be in the at least one permission level based on the permission level of the second node cluster. In one permission level, it is determined that the first permission information indicates that the second node cluster does not have access permission to the first transaction.
  • At least one authority level having access rights to the first transaction may be domain_a, and the authority level of the second node cluster is domain_a1. Since the authority level domain_a1 of the second node cluster is not in the at least one authority level (domain_a ), therefore, the second node cluster does not have access rights to the first transaction.
  • the linker node in the upstream zone when data is synchronized from the upstream zone to the downstream zone, the linker node in the upstream zone will determine whether the authority domain bound to the downstream node has access rights to all transactions in the block. If the downstream node does not have access rights to a specific transaction, the transaction in the block will be "compressed" (that is, the data body of the transaction will be deleted and replaced with the hash value of the transaction), and the downstream node will not be able to obtain the transaction data body, ensuring that the data isolation while reducing the amount of data that downstream nodes need to store.
  • a block can be composed of a block header and a block body.
  • the block body is composed of multiple transactions, and the Merkel root in the block header is tree Root) is the root hash value of the Merkle tree with the hash of each transaction in the block body as the leaf node.
  • the Merkel root can be used to verify whether the transactions in the block have been tampered with (that is, after the receiver receives the block, it will re-construct the Merkel tree for all transactions in the block body to obtain a new merkel tree Root value, and compare it with the value in the block header. If they are consistent, it proves that the transaction has not been tampered with).
  • FIG. 5 is a schematic structural diagram of a block.
  • the parent zone such as the first node cluster in the embodiment of the present application
  • a block such as the first block in the embodiment of the present application
  • the downstream zone such as the second node cluster in the embodiment of the present application
  • the transaction hash value is the leaf node of the block Merkle tree, so the receiver can still reconstruct the Merkle tree through the hash value and verify whether the block data has been tampered with.
  • the hash value is usually much smaller than the data ontology, which can reduce network load and improve performance.
  • the first block also includes transaction data of the second transaction, and the transaction data is plain text data; accordingly, the permission information indicates that the second node cluster has the ability to When accessing the second transaction, the transaction data of the second transaction in the first block can be retained, and further, the obtained second block can include Include the transaction plaintext data of the second transaction.
  • the blockchain network is divided into tree-like sub-clusters (zones), and the arrangement of the network structure becomes orderly, which can improve the network topology and increase the synchronization performance and scale limit.
  • the data synchronization process filters out transactions outside of authority, ensuring data isolation across authority domains. And for data in non-authorized domains, only the hash value after hash processing is stored. The hash value is usually much smaller than the data ontology, which can reduce network load and improve performance.
  • the first node transfers the second block to the second node, so that the second node cluster performs data backup of the second block.
  • the first node after obtaining the second block, can transfer the second block to the second node. Furthermore, each node in the second node cluster can perform data backup (that is, perform data storage) on the second block.
  • the second node cluster includes multiple nodes including the second node, and the second node cluster performs data backup on the second block. Specifically, it may include: Each node in the plurality of nodes performs data backup of the second block. For example, there may be a data transmission path between each node in the second node cluster, through which the second block can be propagated to each node, and then each node in the second node cluster can perform processing on the second block. data backup.
  • the third node cluster can serve as a downstream zone of the second node cluster, and further, the linker node in the second node cluster (such as the third node in the embodiment of this application) can transfer the block data Go to the third node cluster for data backup.
  • the second block also includes transaction data of the third transaction, and the transaction data is plain text data;
  • the node cluster also includes a third node cluster, and the node cluster in the second node cluster There is a communication connection between the third node and the fourth node in the third node cluster;
  • the third node can obtain the second authority information of the third transaction;
  • the third node is based on the second authority information Indicate that the third node cluster does not have access rights to the third transaction, generate a third block according to the second block, and the third block includes processing of the transaction data of the third transaction.
  • the ciphertext data obtained by hash processing;
  • the third node transfers the third block to the fourth node, so that the third node cluster performs data backup of the third block.
  • the second block also includes transaction data of at least one fourth transaction, and the transaction data is plain text data; the permission information indicates that the second node cluster has the ability to control the at least one fourth transaction. Access rights to a fourth transaction, the third block including transaction data of the at least one fourth transaction.
  • the permission domain domain can be created by the client making a request to the cluster. After a domain is created, a zone associated with it can be created and transactions directed to the domain can be sent.
  • Each zone must be bound to at least one existing domain.
  • the bound domain needs to meet the permission restrictions of the domain with the Parent zone (the tree synchronization of the zone needs to meet the tree permissions of the domain: the data required by the Child zone can be completely obtained from the Parent zone).
  • the new node that joins sends its node information to the master node through any node (seed node) in the cluster.
  • the master node completes the allocation of IDs and connections, and then synchronizes the new member information to the entire cluster to complete the node joining process. .
  • the following blockchain network can be created, and transactions with different permissions can be sent and the synchronization process can be demonstrated.
  • you can send a request to the blockchain network through the client to create domain_a, domain_a/domain_a1, domain_b, domain_b/domain_b1, domain_c.
  • zone_b In the process of creating a zone, you can send a request to the blockchain network through the client to create zone_b, zone_a/zone_a1, zone_b, zone_b/zone_b1, and zone_c, which are associated with domain_a, domain_a/domain_a1, domain_b, domain_b/domain_b1, and domain_c respectively.
  • zone_b After zone_b completes the transaction data synchronization, it will synchronize with the downstream zone (zone_b::zone_b1). Since the downstream zone does not have permission, tx_1 in the block will also be compressed.
  • zone_a The downstream zones of zone_a have no permission and can only obtain the compressed blocks of tx_1. It can be seen that the branch and level of the zone will determine the upper limit of the data rights it can obtain, achieving safer data isolation.
  • zone_b After zone_b completes the transaction data synchronization, it will synchronize to the downstream zone (zone_b::zone_b1). Since the downstream zones have permissions, the block containing tx_2 data will be synchronized downstream.
  • zone_a and zone_b After zone_a and zone_b complete the transaction data synchronization, they will be synchronized to the downstream zone. Since /** indicates that all subdomains under the root domain have permissions, blocks containing tx_3 will be sent to all downstream zones.
  • the embodiment of the present application provides a data backup method, which is applied to a node cluster.
  • the node cluster includes a first node cluster and a second node cluster.
  • the first node and the second node cluster in the first node cluster Communication connection between second nodes in the method includes: the first node obtains the first block and the first permission information of the first transaction, the first block includes the transaction data of the first transaction , the transaction data is plain text data; the first node indicates that the second node cluster does not have access rights to the first transaction based on the first permission information, and generates the first block according to the first block.
  • the second block includes ciphertext data obtained by hashing the transaction data of the first transaction; the first node transfers the second block to the second node, so that the second The node cluster performs data backup on the second block.
  • the blockchain network is divided into tree-like sub-clusters (zones), and the arrangement of the network structure becomes orderly, which can improve the network topology and increase the synchronization performance and scale limit.
  • the data synchronization process filters out transactions outside of authority, ensuring data isolation across authority domains. And for data in non-authorized domains, only the hash value after hash processing is stored. The hash value is usually much smaller than the data ontology, which can reduce network load and improve performance.
  • Figure 7 is a schematic structural diagram of a data backup device provided by an embodiment of the present application. It is applied to a first node. There is a communication connection between the first node and a second node. The first node and the The second node belongs to a different cluster, and the first node 700 includes:
  • the acquisition module 701 is used to obtain the first block and the first permission information, the first block includes the transaction data of the first transaction, and the first permission information is the permission information of the first transaction;
  • Block generation module 702 configured to: when the first permission information indicates that the second node cluster does not have access permission to the at least one first transaction, the first node Encrypt the transaction data to obtain a second block, where the second block includes the encrypted transaction data of the first transaction;
  • block generation module 702 For a specific description of the block generation module 702, reference may be made to the description of step 302 in the above embodiment, and similarities will not be described again.
  • the transfer module 703 is used to transfer the second block to the second node, so that the second node cluster performs data backup of the second block.
  • transfer module 703 For the specific description of the transfer module 703, reference may be made to the description of step 303 in the above embodiment, and similarities will not be described again.
  • the first node cluster also includes nodes other than the first node
  • the second node cluster also includes nodes other than the second node
  • the first node cluster also includes nodes other than the second node. Data is transferred between the node cluster and the second node cluster only through the first node and the second node.
  • the nodes in the second node cluster are configured not to have the authority to actively access the data of the nodes in the first node cluster.
  • the first block also includes transaction data of the second transaction
  • the permission information indicates that the second node cluster has access permission to the second transaction, and the second block includes transaction data of the second transaction.
  • the second block is obtained by replacing the transaction data of the first transaction in the first block with the encrypted transaction data of the first transaction.
  • the second block also includes transaction data of a third transaction
  • the node cluster also includes a third node cluster, and the third node in the second node cluster and the third Communication connection between the fourth nodes in the node cluster
  • the transfer module is also used to:
  • the third node includes:
  • a block generation module configured to indicate that the third node cluster does not have access rights to the third transaction based on the second permission information, and encrypt the transaction data of the third transaction to obtain the third block block, the third block includes encrypted transaction data of the third transaction;
  • a transfer module configured to transfer the third block to the fourth node, so that the third node cluster performs data backup of the third block.
  • the second block also includes transaction data of the fourth transaction
  • the second permission information indicates that the cluster to which the third node belongs has access permission to the fourth transaction, and the third block includes transaction data of the fourth transaction.
  • the first permission information includes at least one permission level with access permission to the first transaction;
  • the block generation module is specifically used to:
  • the first node determines that the first permission information indicates that the second node cluster does not have access permission to the first transaction.
  • the transaction data of the first transaction is data generated by the consensus node.
  • the first node cluster further includes: a consensus node
  • Obtaining the first block includes: receiving the first block delivered from the consensus node.
  • the second node cluster includes multiple nodes including the second node, and the second node cluster performs data backup on the second block, including:
  • Each node in the plurality of nodes performs data backup of the second block.
  • the embodiment of the present application also provides a data backup device, as shown in Figure 8.
  • Figure 8 is a schematic structural diagram of the data backup device in the embodiment of the present application.
  • the data backup device runs on a terminal.
  • the terminal can be any terminal device including a mobile phone, a tablet computer, a personal digital assistant (PdA), a point of sales (POs), a vehicle-mounted computer, etc.
  • the terminal is a mobile phone. example:
  • the mobile phone includes: radio frequency (RF) circuit 810, memory 820, input unit 830, display unit 840, sensor 850, audio circuit 860, wireless fidelity (WiFi) module 870, processor 880, and power supply 890 and other parts.
  • RF radio frequency
  • the RF circuit 810 can be used to receive and transmit information or signals during a call. In particular, after receiving downlink information from the base station, it is processed by the processor 880; in addition, the designed uplink data is sent to the base station.
  • the RF circuit 810 includes, but is not limited to, an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier (lNA), a duplexer, and the like.
  • RF circuitry 810 can also communicate with networks and other devices through wireless communications.
  • the above wireless communication can use any communication standard or protocol, including but not limited to global system of mobile communication (Gsm), general packet radio service (GPRs), code division multiple access (code division multiple access) multiple access (CdmA), wideband code division multiple access (WCdmA), long term evolution (long term evolution, ltE), email, short messaging service (sms), etc.
  • Gsm global system of mobile communication
  • GPRs general packet radio service
  • code division multiple access code division multiple access
  • CdmA code division multiple access
  • WdmA wideband code division multiple access
  • long term evolution long term evolution
  • ltE long term evolution
  • email short messaging service
  • the memory 820 can be used to store software programs and modules.
  • the processor 880 executes various functional applications and data processing of the mobile phone by running the software programs and modules stored in the memory 820 .
  • the memory 820 may mainly include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application program required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the storage data area may store a program according to Data created by the use of mobile phones (such as audio data, phone books, etc.), etc.
  • memory 820 may include high-speed random access memory and may also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other volatile solid-state storage device.
  • the input unit 830 may be used to receive input numeric or character information, and generate key signal input related to user settings and function control of the mobile phone.
  • the input unit 830 may include a touch panel 831 and other input devices 832.
  • the touch panel 831 also known as a touch screen, can collect the user's touch operations on or near the touch panel 831 (such as the user using a finger, stylus, or any suitable object or accessory on or near the touch panel 831). operation), and drive the corresponding connection device according to the preset program.
  • the touch panel 831 may include two parts: a touch detection device and a touch controller.
  • the touch detection device detects the user's touch orientation, detects the signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts it into contact point coordinates, and then sends it to the touch controller. to the processor 880, and can receive commands sent by the processor 880 and execute them.
  • the touch panel 831 can be implemented using various types such as resistive, capacitive, infrared, and surface acoustic wave.
  • the input unit 830 may also include other input devices 832.
  • other input devices 832 may include, but are not limited to, one or more of a physical keyboard, function keys (such as volume control keys, switch keys, etc.), trackball, mouse, joystick, etc.
  • the display unit 840 may be used to display information input by the user or information provided to the user as well as various menus of the mobile phone.
  • the display unit 840 may include a display panel 841.
  • the display panel 841 may be configured in the form of a liquid crystal display (LCd), an organic light-emitting diode (OlEd), etc.
  • the touch panel 831 can cover the display panel 841. When the touch panel 831 detects a touch operation on or near it, it is sent to the processor 880 to determine the type of the touch event. The processor 880 then determines the type of the touch event. Type provides corresponding visual output on display panel 841.
  • the touch panel 881 and the display panel 841 are used as two independent components to implement the input and input functions of the mobile phone, in some embodiments, the touch panel 831 and the display panel 841 can be integrated. Realize the input and output functions of mobile phone.
  • the phone may also include at least one sensor 850, such as a light sensor, a motion sensor, and other sensors.
  • the light sensor may include an ambient light sensor and a proximity sensor.
  • the ambient light sensor may adjust the brightness of the display panel 841 according to the brightness of the ambient light.
  • the proximity sensor may close the display panel 841 and/or when the mobile phone is moved to the ear. or backlight.
  • the accelerometer sensor can detect the magnitude of acceleration in various directions (usually three axes). It can detect the magnitude and direction of gravity when stationary.
  • the audio circuit 860, speaker 861, and microphone 862 can provide an audio interface between the user and the mobile phone.
  • audio circuit 860 can transmit the electrical signal converted from the received audio data to the speaker 861, and the speaker 861 converts it into a sound signal for output; on the other hand, the microphone 862 converts the collected sound signal into an electrical signal, which is received by the audio circuit 860 It is converted into audio data, and then processed by the audio data output processor 880, and then sent to, for example, another mobile phone through the RF circuit 810, or the audio data is output to the memory 820 for further processing.
  • WiFi is a short-distance wireless transmission technology.
  • the mobile phone can help users send and receive emails, browse the web, and access streaming media through the WiFi module 870. It provides users with wireless broadband Internet access.
  • FIG. 8 shows the WiFi module 870, it can be understood that it is not a necessary component of the mobile phone and can be omitted as needed without changing the essence of the application.
  • the processor 880 is the control center of the mobile phone, using various interfaces and lines to connect various parts of the entire mobile phone, by running or executing software programs and/or modules stored in the memory 820, and calling data stored in the memory 820 to execute Various functions of the mobile phone and processing data, thereby conducting overall monitoring of the mobile phone.
  • the processor 880 may include one or more processing units; optionally, the processor 880 may integrate an application processor and a modem processor, where the application processor mainly processes the operating system, user interface and application programs. etc., the modem processor mainly handles wireless communications. It can be understood that the above modem processor may not be integrated into the processor 880 .
  • the mobile phone also includes a power supply 890 (such as a battery) that supplies power to various components.
  • a power supply 890 (such as a battery) that supplies power to various components.
  • the power supply can be logically connected to the processor 880 through a power management system, thereby managing functions such as charging, discharging, and power consumption management through the power management system.
  • the processor 880 included in the terminal can perform the steps described in the embodiment corresponding to the above figure.
  • the data backup device provided by the embodiment of the present application can also be deployed in a server.
  • the server can be a single server or a server cluster composed of multiple servers. Below, a single server is used for description. Please refer to Figure 9.
  • Figure 9 is a schematic structural diagram of a server provided in an embodiment of the present application.
  • the server 900 may vary greatly due to different configurations or performance, and may include one or more central processing units (central processing units). , CPU) 922 (eg, one or more processors) and memory 932, one or more storage media 930 (eg, one or more mass storage devices) that stores applications 942 or data 944.
  • the memory 932 and the storage medium 930 may be short-term storage or persistent storage.
  • the program stored in the storage medium 930 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations on the server. Furthermore, the central processor 922 may be configured to communicate with the storage medium 930 and execute a series of instruction operations in the storage medium 930 on the server 900 .
  • Server 900 may also include one or more power supplies 926, one or more wired or wireless network interfaces 950, one or more input and output interfaces 958, and/or, one or more operating systems 941, such as Windows server, mac Os Xtm, Unixtm, linuxtm, FreeBsdtm and so on.
  • operating systems 941 such as Windows server, mac Os Xtm, Unixtm, linuxtm, FreeBsdtm and so on.
  • the steps performed by the server in the above embodiment may be based on the server structure shown in FIG. 9 .
  • the CPU 922 can perform the steps described in the embodiment corresponding to Figure 3 above.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transferred from a website, computer, server, or data center Transmission to another website, computer, server or data center through wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) means.
  • wired such as coaxial cable, optical fiber, digital subscriber line (DSL)
  • wireless such as infrared, wireless, microwave, etc.
  • the computer-readable storage medium may be any available medium that a computer can store, or a data storage device such as a server or data center integrated with one or more available media.
  • the available media may be magnetic media (eg, floppy disk, hard disk, tape), optical media (eg, DVD), or semiconductor media (eg, solid state disk (SSD)), etc.
  • the disclosed systems, devices and methods can be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined or can be integrated into another system, or some features can be ignored, or not implemented.
  • the coupling or direct coupling or communication connection between each other shown or discussed may be through some interfaces, and the indirect coupling or communication connection of the devices or units may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or they may be distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in each embodiment of the present application can be integrated into one processing unit, each unit can exist physically alone, or two or more units can be integrated into one unit.
  • the above integrated units can be implemented in the form of hardware or software functional units.
  • the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it may be stored in a computer-readable storage medium.
  • the technical solution of the present application is essentially or contributes to the existing technology, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , including several instructions to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of this application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROm, Read-Only memory), random access memory (RAm, Random Access memory), magnetic disk or optical disk and other media that can store program code. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • Finance (AREA)
  • Accounting & Taxation (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • General Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • Health & Medical Sciences (AREA)
  • Development Economics (AREA)
  • Quality & Reliability (AREA)
  • General Business, Economics & Management (AREA)
  • Economics (AREA)
  • Technology Law (AREA)
  • Strategic Management (AREA)
  • Marketing (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Databases & Information Systems (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)

Abstract

本申请实施例提供了一种节点集群以及数据备份方法，应用于区块链领域，包括：第一节点，用于获取第一区块以及第一交易的第一权限信息，第一区块包括第一交易的交易数据；在所述第一权限信息指示所述第二节点集群不具备对所述至少一个第一交易的访问权限的情况下，对所述第一交易的交易数据进行加密，以得到第二区块；将第二区块传递至第二节点，以便第二节点集群对第二区块进行数据备份。本申请可以保证跨权限域的数据隔离。

Description

一种节点集群以及数据备份方法
本申请要求于2022年4月29日提交中国专利局、申请号为202210468559.1、发明名称为“一种节点集群以及数据备份方法”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及互联网技术领域，尤其涉及一种节点集群以及数据备份方法。
背景技术
区块链(Blockchain)系统中，数据均保存在区块中，新写入的数据组成新的区块，添加在当前区块链的末端。每个区块在保存数据的同时，还要保存前一个区块中所有记录的数据唯一对应的一个数(往往是所有记录的数据的哈希值)，从而形成链。因此，区块链系统可以认为是由分布式网络上的互相不完全信任的计算机，通过共识规则，共同维护一套可追溯、不可篡改的链式数据的系统。
在区块链结合企业的业务场景中，数据隔离性要求高，由于实行分层管理的机制，父级机构拥有更高的权限，拥有所有子级机构的数据访问权限，而子级机构的权限相对较低，只能访问本机构相关的数据，以及本机构及其子级机构的数据。且同一级别的子级机构之间还可能需要进行数据隔离，具体可以参照图1所示。
账本数据(本申请实施例中也可以称之为交易数据)可以备份至节点集群中，在传统区块链中，各个节点的身份平等，各节点上存储相同的账本数据，在面对上述场景时，无法满足数据隔离的要求。
发明内容
本申请实施例提供了一种节点集群以及数据备份方法，可以提高区块链网络存储数据的性能。
第一方面，本申请提供了一种节点集群，所述节点集群包括第一节点集群以及第二节点集群，所述第一节点集群中的第一节点和所述第二节点集群中的第二节点之间通信连接，所述方法包括：所述第一节点，用于获取第一区块以及第一权限信息，所述第一区块包括第一交易的交易数据，所述第一权限信息为所述第一交易的权限信息；在所述第一权限信息指示所述第二节点集群不具备对所述至少一个第一交易的访问权限的情况下，对所述第一交易的交易数据进行加密，以得到第二区块，所述第二区块包括加密后的所述第一交易的交易数据；将所述第二区块传递至所述第二节点，以便所述第二节点集群对所述第二区块进行数据备份。
本申请实施例中，将区块链网络划分为树状子集群(zone)，将网络结构的排布变得有序，可以改善网络拓扑结构，提升同步性能与规模上限。此外，数据同步过程过滤权限外的交易，可以保证跨权限域的数据隔离。且对于非权限域内的数据仅存储哈希处理后的哈希值，哈希值通常远小于数据本体，可以减少网络负载，提高性能。
在一种可能的实现中，所述第一节点集群还包括除所述第一节点之外的节点，所述第二节点集群还包括除所述第二节点之外的节点，所述第一节点集群和所述第二节点集群之间仅通过所述第一节点和所述第二节点进行数据的传递。
在一种可能的实现中，所述第二节点集群中的节点被配置为：不具备主动访问所述第一节点集群中节点的数据的权限。
其中，本申请实施例为了保证数据的隔离，节点集群之间仅仅通过特定角色的节点进行数据的传递，以第一节点集群和第二节点集群为例，第一节点集群和第二节点集群之间可以仅仅通过第一节点和第二节点进行数据的传递(例如仅仅通过第一节点向第二节点的数据发送来进行数据传递)，第一节点集群中除了第一节点之外的其他节点没有权限向第二节点集群传递数据，第二节点集群的节点没有权限向第一节点集群传递数据，且没有权限从第一节点集群中主动获取数据。
在一种可能的实现中，所述第二区块还包括第三交易的交易数据；所述节点集群还包括第三节点集群，所述第二节点集群中的第三节点和所述第三节点集群中的第四节点之间通信连接；所述第一节点，还用于将所述第三交易的第二权限信息传递至所述第二节点；所述第三节点，用于基于所述第二权限信息指示所述第三节点集群不具备对所述第三交易的访问权限，对所述第三交易的交易数据进行加密，以得到第三区块，所述第三区块包括加密后的所述第三交易的交易数据；将所述第三区块传递至所述第四节点，以便所述第三节点集群对所述第三区块进行数据备份。
在一种可能的实现中，所述第二区块还包括第四交易的交易数据；所述第二权限信息指示所述第三节点所属的集群具备对所述第四交易的访问权限，所述第三区块包括所述第四交易的交易数据。
第二方面，本申请提供了一种数据备份方法，应用于第一节点，所述第一节点与第二节点之间通信连接，所述第一节点与所述第二节点属于不同的集群，所述方法包括：所述第一节点获取第一区块以及第一权限信息，所述第一区块包括第一交易的交易数据，所述第一权限信息为所述第一交易的权限信息；在所述第一权限信息指示所述第二节点集群不具备对所述至少一个第一交易的访问权限的情况下，所述第一节点对所述第一交易的交易数据进行加密，以得到第二区块，所述第二区块包括加密后的所述第一交易的交易数据；所述第一节点将所述第二区块传递至所述第二节点，以便所述第二节点集群对所述第二区块进行数据备份。
本申请实施例中，将区块链网络划分为树状子集群(zone)，将网络结构的排布变得有序，可以改善网络拓扑结构，提升同步性能与规模上限。此外，数据同步过程过滤权限外的交易，可以保证跨权限域的数据隔离。且对于非权限域内的数据仅存储哈希处理后的哈 希值，哈希值通常远小于数据本体，可以减少网络负载，提高性能。
在一种可能的实现中，所述第一节点属于第一节点集群，所述第二节点属于第二节点集群，所述第一节点集群还包括除所述第一节点之外的节点，所述第二节点集群还包括除所述第二节点之外的节点，所述第一节点集群和所述第二节点集群之间仅通过所述第一节点和所述第二节点进行数据的传递。
在一种可能的实现中，所述第二节点集群中的节点被配置为：不具备主动访问所述第一节点集群中节点的数据的权限。
其中，本申请实施例为了保证数据的隔离，节点集群之间仅仅通过特定角色的节点进行数据的传递，以第一节点集群和第二节点集群为例，第一节点集群和第二节点集群之间可以仅仅通过第一节点和第二节点进行数据的传递(例如仅仅通过第一节点向第二节点的数据发送来进行数据传递)，第一节点集群中除了第一节点之外的其他节点没有权限向第二节点集群传递数据，第二节点集群的节点没有权限向第一节点集群传递数据，且没有权限从第一节点集群中主动获取数据。
在一种可能的实现中，所述第一区块还包括第二交易的交易数据，所述交易数据为明文数据；所述权限信息指示所述第二节点集群具备对所述第二交易的访问权限，所述第二区块包括所述第二交易的交易数据。
在一种可能的实现中，所述第二区块为将所述第一区块中的所述第一交易的交易数据替换为所述密文数据得到的。
在一种可能的实现中，所述第二区块还包括第三交易的交易数据，所述交易数据为明文数据；所述节点集群还包括第三节点集群，所述第二节点集群中的第三节点和所述第三节点集群中的第四节点之间通信连接；所述方法还包括：所述第一节点将所述第三交易的第二权限信息传递至所述第二节点；所述第三节点基于所述第二权限信息指示所述第三节点集群不具备对所述第三交易的访问权限，对所述第三交易的交易数据进行加密，以得到第三区块，所述第三区块包括加密后的所述第三交易的交易数据；所述第三节点将所述第三区块传递至所述第四节点，以便所述第三节点集群对所述第三区块进行数据备份。
在一种可能的实现中，所述第二区块还包括至少一个第四交易的交易数据，所述交易数据为明文数据；所述权限信息指示所述第二节点集群具备对所述至少一个第四交易的访问权限，所述第三区块包括所述至少一个第四交易的交易数据。
在一种可能的实现中，所述第一权限信息包括对所述第一交易具备访问权限的至少一个权限级别；所述方法还包括：所述第一节点基于所述第二节点集群的权限级别不在所述至少一个权限级别中，确定所述第一权限信息指示所述第二节点集群不具备对所述第一交 易的访问权限。
在一种可能的实现中，所述第一交易的交易数据为共识节点生成的数据。
在一种可能的实现中，第一节点集群可以为共识集群(包括共识节点的节点集群)，第一节点集群中的共识节点可以生成第一区块，第一节点集群中的第一节点可以根据第一区块来生成第二区块(第一区块和第二区可以相同或不同)，并通过第一节点集群中的第一节点(linker节点)传递至第二节点集群中的第二节点(master节点)。
在一种可能的实现中，第一节点集群可以为非共识集群(不包括共识节点的节点集群)，第一节点集群中的master节点可以接收到来自上一级节点集群的linker节点发送的第一区块，第一节点集群中的第一节点可以根据第一区块来生成第二区块(第一区块和第二区可以相同或不同)，并通过第一节点集群中的第一节点(linker节点)传递至第二节点集群中的第二节点(master节点)。
在一种可能的实现中，所述第二节点集群包括所述第二节点在内的多个节点，所述第二节点集群对所述第二区块进行数据备份，包括：所述多个节点中的每个节点对所述第二区块进行数据备份。
第三方面，本申请提供了一种数据备份装置，应用于第一节点，所述第一节点与第二节点之间通信连接，所述第一节点与所述第二节点属于不同的集群，所述第一节点包括：
获取模块，用于获取第一区块以及第一权限信息，所述第一区块包括第一交易的交易数据，所述第一权限信息为所述第一交易的权限信息；
区块生成模块，用于在所述第一权限信息指示所述第二节点集群不具备对所述至少一个第一交易的访问权限的情况下，所述第一节点对所述第一交易的交易数据进行加密，以得到第二区块，所述第二区块包括加密后的所述第一交易的交易数据；
传递模块，用于将所述第二区块传递至所述第二节点，以便所述第二节点集群对所述第二区块进行数据备份。
在一种可能的实现中，所述第一节点属于第一节点集群，所述第二节点属于第二节点集群，所述第一节点集群还包括除所述第一节点之外的节点，所述第二节点集群还包括除所述第二节点之外的节点，所述第一节点集群和所述第二节点集群之间仅通过所述第一节点和所述第二节点进行数据的传递。
在一种可能的实现中，所述第二节点集群中的节点被配置为：不具备主动访问所述第一节点集群中节点的数据的权限。
在一种可能的实现中，所述第一区块还包括第二交易的交易数据；
所述第一权限信息指示所述第二节点集群具备对所述第二交易的访问权限，所述第二区块包括所述第二交易的交易数据。
在一种可能的实现中，所述第二区块为将所述第一区块中的所述第一交易的交易数据替换为所述加密后的所述第一交易的交易数据得到的。
在一种可能的实现中，所述第二区块还包括第三交易的交易数据；所述节点集群还包括第三节点集群，所述第二节点集群中的第三节点和所述第三节点集群中的第四节点之间通信连接；所述传递模块，还用于：
将所述第三交易的第二权限信息传递至所述第二节点；
所述第三节点包括：
区块生成模块，用于基于所述第二权限信息指示所述第三节点集群不具备对所述第三交易的访问权限，对所述第三交易的交易数据进行加密，以得到第三区块，所述第三区块包括加密后的所述第三交易的交易数据；
传递模块，用于将所述第三区块传递至所述第四节点，以便所述第三节点集群对所述第三区块进行数据备份。
在一种可能的实现中，所述第二区块还包括第四交易的交易数据；
所述第二权限信息指示所述第三节点所属的集群具备对所述第四交易的访问权限，所述第三区块包括所述第四交易的交易数据。
在一种可能的实现中，所述第一权限信息包括对所述第一交易具备访问权限的至少一个权限级别；所述区块生成模块，具体用于：
所述第一节点基于所述第二节点集群的权限级别不在所述至少一个权限级别中，确定所述第一权限信息指示所述第二节点集群不具备对所述第一交易的访问权限。
在一种可能的实现中，所述第一交易的交易数据为共识节点生成的数据。
在一种可能的实现中，所述第一节点集群还包括：共识节点；
所述获取第一区块，包括：接收来自所述共识节点传递的所述第一区块。
在一种可能的实现中，所述第二节点集群包括所述第二节点在内的多个节点，所述第二节点集群对所述第二区块进行数据备份，包括：
所述多个节点中的每个节点对所述第二区块进行数据备份。
第四方面，本申请实施例提供了一种装置，包括存储器、处理器以及总线系统，其中，存储器用于存储程序，处理器用于执行存储器中的程序，以执行如上述第二方面及第二方 面任一可选的方法。
第五方面，本发明实施例还提供一种系统，该系统包括至少一个处理器，至少一个存储器以及至少一个通信接口；处理器、存储器和通信接口通过通信总线连接并完成相互间的通信；
存储器用于存储执行以上方案的应用程序代码，并由处理器来控制执行。所述处理器用于执行所述存储器中存储的应用程序代码；其中存储器存储的代码可执行以上提供的一种数据备份方法。
通信接口，用于与其他设备或通信网络通信，以将数据发送至所述设备或通信网络。
第六方面，本申请实施例提供了一种计算机可读存储介质，所述计算机可读存储介质中存储有计算机程序，当其在计算机上运行时，使得计算机执行上述第二方面及其任一可选的方法。
第七方面，本申请实施例提供了一种计算机可读存储介质，所述计算机存储介质存储有一个或多个指令，所述指令在由一个或多个计算机执行时使得所述一个或多个计算机实施上述第二方面及其任一可选的系统。
第八方面，本申请实施例提供了一种计算机程序，当其在计算机上运行时，使得计算机执行上述第二方面及其任一可选的方法。
第九方面，本申请提供了一种芯片系统，该芯片系统包括处理器，用于支持终端设备或服务器实现上述方面中所涉及的功能，例如，发送或处理上述方法中所涉及的数据；或，信息。在一种可能的设计中，所述芯片系统还包括存储器，所述存储器，用于保存终端设备或服务器必要的程序指令和数据。该芯片系统，可以由芯片构成，也可以包括芯片和其他分立器件。
附图说明
图1为一种企业权限的示意图；
图2为本申请提供的一种区块链网络的架构示意图；
图3为本申请实施例提供的一种数据备份方法的示意图；
图4为本申请实施例提供的一种权限示意图；
图5为本申请实施例的一种区块的示意图；
图6为本申请实施例提供的一种权限示意图；
图7为本申请实施例中数据备份装置的实施例示意图；
图8为本申请实施例中数据备份装置的一种结构示意图；
图9为本申请实施例中提供的一种服务器结构示意图。
具体实施方式
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”、“第三”、“第四”等(如果存在)是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的本申请的实施例例如能够以除 了在这里图示或描述的那些以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包括，例如，包括了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
“区块链”，具体可指一个各节点通过共识机制达成的、具有分布式数据存储结构的P2P网络系统，该区块链内的数据分布在时间上相连的一个个“区块(block)”之内，后一区块包含前一区块的数据摘要，且根据具体的共识机制(如POW、POS、dPOS或PBFt等)的不同，达成全部或部分节点的数据全备份。区块链根据其网络节点的分布形式，可包括公有链、联盟链、私有链等。在实际的应用中，尤其是对联盟链的实际应用中，通常为不同的场景设置单独的区块链，例如用于处理房屋租赁业务场景的区块链、用于处理音乐作品版权使用业务场景的区块链等；而且对于在一个较大的应用场景中设置的区块链，还会为其开发相关的业务细化子链，例如用于处理房屋租赁业务场景的区块链主链，可以下挂多条房屋租赁下多种细分业务的区块链子链，如专门用于收录房屋租赁订单的区块链子链，专门用于收录可供租赁的房屋详情的区块链子链等，上述子链即为遵循上述区块链主链协议的多个实例。
在一些特定应用场景中，会对区块链网络的数据隔离性与大规模集群的性能提出更高的要求，对传统区块链网络提出挑战。
以区块链结合企业的业务场景为例：
在区块链结合企业的业务场景中，数据隔离性要求高，由于实行分层管理的机制，父级机构拥有更高的权限，拥有所有子级机构的数据访问权限，而子级机构的权限相对较低，只能访问本机构相关的数据，以及本机构及其子级机构的数据。且同一级别的子级机构之间还可能需要进行数据隔离，具体可以参照图1所示。
账本数据(本申请实施例中也可以称之为交易数据)可以备份至节点集群中，在传统区块链中，各个节点的身份平等，各节点上存储相同的账本数据，在面对上述场景时，无法满足数据隔离的要求，且节点存储大量自身不能访问的数据，也会造成较大的资源浪费。
首先介绍本申请实施例涉及的一些名词定义：
点对点(peer to peer，P2P)：又称点对点技术，是无中心服务器、依靠用户群(peers)交换信息的互联网体系。
区块(block)，在区块链中指有多笔交易打包组成的数据结构，是区块链网络中发送消息与同步的单位，相比逐笔交易处理，基于区块的交易批处理模式有更高的性能。
交易(transaction)，指客户端向区块链系统发起的数据变更请求，区块链系统会在所有节点备份该交易数据，记录交易数据的过程被称为“记账”。
默克尔树(merkle tree)，是一种哈希二叉树，由一个根节点(root)、一组中间节点和一组叶节点(leaf)组成。区块链中默克尔树的叶子节点是该区块中交易的哈希，而中间节点/根节点是其孩子节点的哈希值。
同步(synchronize)，本文中特指多个节点对同一份数据进行备份的过程。
区(zone)，区块链网络中划分的子集群，节点成员的发现和管理限制在每个zone内， 每个zone内的节点自主进行数据同步与成员信息维护。
权限(domain)，指区块链的数据的多个权限域，每一个节点都有配置其所属的权限域，且只能看到其权限域范围内的交易。
共识节点(consensus node)，是区块链网络交易的入口，将来自客户端的交易打包成区块并下下游同步。
协调者节点(coordinator)，在zone集群中负责维护本zone元信息(如zone集群成员状态)，每个zone至少有一个coordinator节点。
master节点，本zone的coordinator(协调者)节点中的领导者节点，负责管理coordinator节点，与上级zone进行通信(获取新数据、转发交易)等职能，每个zone有且只有一个master节点。
linker节点：上级zone中与下游zone的master建立链接的节点，负责向下游zone发送最新数据、检测下游zone状态等功能。
Peer节点：普通数据同步节点，每个zone可以有多个peer节点，进行数据同步与备份。
Seed节点：新节点加入zone集群的入口节点，在新节点要加入当前zone集群时，会首先向Seed节点发送请求，并由Seed节点转发给当前zone的master节点进行处理。
参照图2，图2为本申请提供的一种区块链网络的架构示意图。
如图2所示，本申请提供的区块链网络包括多个区，其中，区也可以描述为节点集群，不同节点集群之间无法主动读取数据，可以仅仅通过固定角色的节点进行数据的传递(例如图2中所示的linker节点和coordinator节点)。
其中，图2所示的节点peer可以共同维护一个或多个区块链。
其中，root区可以包括共识节点(consensus node)，共识节点可以仅存在于共识集群(例如图2所示的root区)中，共识节点在集群中可以作为区块链网络的数据入口，具体的，客户端的所有交易可以先进入共识节点，随后逐级向下游进行节点的数据同步(也就是，共识节点可以将交易的数据打包成区块，并将区块传递至其他区的节点，以便各个节点进行区块的数据备份)。
需要说明的是，区块链是以区块为单位存储交易清单，区块链中的区块按照时间顺序生成，每个区块用于记录一段时间内产生的交易清单。区块链上所记录的所有交易清单即为账本(ledger)，本申请中，在不引起歧义的情况下，账本和区块链是可以互相替代的同等概念。
需要说明的是，上述系统架构仅为一种逻辑上的示意；在物理上，区块链网络中的一个节点在一台物理机(服务器)上，或者，多个区块链网络中的多个节点在同一个服务器上，一个节点具体可以是指服务器中运行的一个进程或者一系列进程，例如，区块链网络中的不同节点可以为一个服务器上运行的两个进程。
其中，本申请可以将区块链网络划分为树状子集群，每个子集群称为区zone或者节点集群，通过改善网络通信拓扑结构，提升区块链同步性能与规模上限。节点成员的发现和管理限制在每个zone内，每个zone在节点间的数据同步上是自治的，zone间通信局限在本 zone的master节点与上级zone的linker节点之间。zone(区)是网络概念，表示区块链网络中的一个局部同步集群，有着相对独立的节点管理和同步模式。
其中，链上可以配置多个zone集群，每个zone集群都有一个父集群称为parent zone，表示该集群的节点从Parent zone同步区块数据，每个zone可以配置一个zone Id，可选的，Root zone的Id为空。其中，共识节点可以只在最顶层的Root zone中。
链上所有最新的区块都由共识集群生成，共识节点所在Root zone拥有最新的全量数据，然后再沿着zone的树形关系扩散到整个网络，每个zone内可设置自治的同步协议，有独立的节点成员管理，每个zone内的数据是一致的，整个区块链网络的数据同步可以抽象为数据在一个由zone节点构成的树形网络中组播。
参照图3，图3为本申请实施例提供的一种数据备份的示意图，如图3中示出的那样，本申请实施例提供的数据备份方法，包括：
301、所述第一节点获取第一区块以及第一权限信息，所述第一区块包括第一交易的交易数据，所述第一权限信息为所述第一交易的权限信息。
在一种可能的实现中，本申请实施例中的数据备份方法可以应用于节点集群，节点集群可以包括多个节点集群，多个节点集群之间的连接关系可以形成树状结构。参照图2，节点集群可以包括多个区(zone)，作为根节点的集群可以为包括共识节点的root区(本申请实施例也可以描述为共识集群)，root区可以包括共识节点，共识节点可以基于来自客户端的交易生成区块，并将区块直接或间接传递至root区内的peer节点，peer节点中的linker节点可以将区块传递至其他节点集群中。
其中，共识节点可以仅存在于共识集群中，共识节点在集群中承担如下职能：作为整个区块链网络的数据入口：客户端的所有交易都先进入共识节点，随后逐级向下游进行数据同步；将交易打包成区块，共识节点会进行将交易打包的流程，可选的，可以利于批处理提升系统的同步性能。
在一种可能的实现中，集群可以包括多个连接分支，多个连接分支的根节点都为root区，可以区块沿着树状结构的各个连接分支向后续的节点集群传播(例如组播)。
以多个节点集群可以包括第一节点集群以及第二节点集群为例，所述第一节点集群中的第一节点和所述第二节点集群中的第二节点之间通信连接。
其中，第一节点集群和第二节点集群可以包括管理者coordinator节点和peer节点。从功能实现上，coordinator节点和peer节点都可以进行数据的备份，coordinator节点除了数据备份之外还可以负责所在集群的管理，例如在构建并配置节点集群时，负责集群的管理。此外，coordinator节点还可以包括一个master节点，master节点可以领导coordinator节点组成的集群执行正常功能。例如，master节点可以由coordinator节点自动选举产生的。master节点可以和其他coordinator节点之间会进行数据的备份以防止单点故障。
本申请实施例中，第二节点集群中的第二节点可以为上述描述的master节点，master节点可以负责管理集群中的成员信息并分配连接。同时master节点还可以作为整个节点集 群的数据入口，与共识集群或其他zone集群相连。
其中，本申请实施例为了保证数据的隔离，节点集群之间仅仅通过特定角色的节点进行数据的传递，以第一节点集群和第二节点集群为例，第一节点集群和第二节点集群之间可以仅仅通过第一节点和第二节点进行数据的传递(例如仅仅通过第一节点向第二节点的数据发送来进行数据传递)，第一节点集群中除了第一节点之外的其他节点没有权限向第二节点集群传递数据，第二节点集群的节点没有权限向第一节点集群传递数据，且没有权限从第一节点集群中主动获取数据。
其中，peer节点可以为数据同步节点，可选的，每个peer节点可以负责管理与自己直接相连节点的连接。可选的，同步的数据可以在peer之间进行单向传递，以便减少消息冗余。同时为了避免出现单点故障导致数据同步异常，每个peer节点可以和所在的节点集群中的多个peer节点之间建立多个连接，以保证可靠性。
其中，集群中的peer节点以及coordinator节点除其本职外，其中部分节点还可以承担如下附属职能：linker职能：可以由任意节点承担。在zone级联时，上级zone连接下级zone的节点称为linker节点。zone之间的通信是由parent zone的linker与下级zone的coordinator(例如，master)节点进行的。
本申请实施例中，第一节点集群可以为parent zone，第二节点集群可以为下级zone，第一节点集群中的第一节点可以为linker节点，该linker节点可以为coordinator节点或者peer节点，第二节点集群中的第二节点可以为master节点，该master节点可以为coordinator节点。
可选的，节点集群中还可以包括seed节点，seed节点由节点集群中的任意节点承担。在节点加入zone时，可指定当前已在zone中的节点做为种子节点，以便从种子节点获取master节点的信息，并连接到master节点上进行注册。种子节点称为seed节点。
在一种可能的实现中，第一节点集群可以为共识集群(包括共识节点的节点集群)，第一节点集群中的共识节点可以生成第一区块，第一节点集群中的第一节点可以根据第一区块来生成第二区块(第一区块和第二区可以相同或不同)，并通过第一节点集群中的第一节点(linker节点)传递至第二节点集群中的第二节点(master节点)。
在一种可能的实现中，第一节点集群可以为非共识集群(不包括共识节点的节点集群)，第一节点集群中的master节点可以接收到来自上一级节点集群的linker节点发送的第一区块，第一节点集群中的第一节点可以根据第一区块来生成第二区块(第一区块和第二区可以相同或不同)，并通过第一节点集群中的第一节点(linker节点)传递至第二节点集群中的第二节点(master节点)。
接下来介绍如何根据第一区块生成第二区块。
本申请实施例中，不同的节点集群可以具备不同的数据访问权限，例如图1中所描述的，可以对不同的组织分配不同的节点集群，具备更高级别访问权限的组织可以对应于更靠近根节点的节点集群。也就是说，在节点集群构成的分叉树中，位于同一分支的节点集群中，更靠近根节点的节点集群应该具备不低于远离根节点的节点集群的访问权限。
在一种可能的实现中，第一节点需要获取到第二节点集群的数据访问权限，该数据访 问权限可以指示第二节点集群对于第一区块中的哪些数据有权限访问，哪些数据没有权限访问，并基于数据访问权限来对第一区块进行处理，以便对第二节点集群没有权限访问的数据进行加密以及压缩处理，以得到第二区块。
在一种可能的实现中，各个节点集群可以配置有对应的访问权限级别(本申请实施例中也可以称之为权限域(domain))，其中，同一个分支上的节点集群中更靠近根节点的节点集群具备更高的访问权限。共识节点所在的root zone可以拥有全量数据，在数据从上游zone向下游zone同步时，上游zone中的linker节点会判断下游节点绑定的权限域，是否有区块中所有交易的访问权。若下游节点没有特定交易的访问权，则会将区块中该交易进行“压缩”(例如可以删除交易的数据本体，以交易的哈希值替代)，进而下游节点无法获取交易数据本体，保证数据隔离性，同时降低下游节点需存储的数据量。可见，由于数据是上游到下游按需逐级进行过滤的，因此下游zone获取的数据量可以不高于其上游，即其权限继承自上游，即前文提到的权限继承关系与数据流一致。
其中，可以在节点集群(zone)创建时即绑定对应的权限域(domain)，使节点加入特定子集群时就明确其权限范围，无需另行指定。
示例性的，可以参照图4，图4为各个节点集群配置的访问权限的示意。
此外，在指定各个交易的权限时，交易transaction指定目标domain列表时支持具体的domain Path或通配符模式，如：/domain_a/*表示/domain_a的所有次级domain；/domain_a/**表示/domain_a domain节点的整个子树。
在一种可能的实现中，共识节点可以获取到第一区块中各个交易的数据所需的访问级别，该所需的访问级别可以随着区块数据一起被传递至其他节点集群。相应的，各个节点集群中的linker节点也可以获取到上述所需的访问级别，此外，linker节点也可以维护有数据传递对象(节点集群)的访问权限，基于所需的访问级别和节点集群的访问权限来确定数据传递对象(节点集群)对于区块中哪些数据有权限访问，哪些数据没有权限访问。
以第一节点集群和第二节点集群为例，第一节点集群中的第一节点可以获取到第一区块以及第一交易的第一权限信息，所述第一区块包括所述第一交易的交易数据，所述交易数据为明文数据。其中，第一交易可以为第一区块中的部分或全部交易的数据。
其中，在第一节点集群为共识集群时，第一区块中的全部交易的数据可以为明文数据，在第一节点集群不为共识集群时，第一区块中部分交易的数据可以为明文数据，部分交易的数据可以为密文数据，或者第一区块中的全部交易的数据可以为明文数据，具体取决于第一节点集群对第一区块中各个交易的访问权限。
在一种可能的实现中，第一交易的第一权限信息可以包括访问第一交易所需的访问级别。
每一笔交易transaction在发起时需要指定至少1个目标domain(不指定则默认所有domain均可见)，最终该交易会同步到拥有指定domain权限的所有节点中(节点所在的zone关联的domain列表中包含transaction指定的domain列表中的任一，则该节点可以接收该交易数据)。
302、在所述第一权限信息指示所述第二节点集群不具备对所述至少一个第一交易的访 问权限的情况下，所述第一节点对所述第一交易的交易数据进行加密，以得到第二区块，所述第二区块包括加密后的所述第一交易的交易数据。
在一种可能的实现中，第一节点可以基于第一权限信息确定出第二节点集群不具备对所述第一交易的访问权限，进而可以对第一区块中第一交易的数据进行压缩以及加密处理(例如哈希处理)，进而得到第一交易的交易数据进行哈希处理得到的密文数据，并将上述密文数据替换第一区块中对应的明文数据，以得到第二区块。
在一种可能的实现中，所述第一权限信息包括对所述第一交易具备访问权限的至少一个权限级别；所述第一节点可以基于所述第二节点集群的权限级别不在所述至少一个权限级别中，确定所述第一权限信息指示所述第二节点集群不具备对所述第一交易的访问权限。
示例性的，对所述第一交易具备访问权限的至少一个权限级别可以为domain_a，第二节点集群的权限级别为domain_a1，由于第二节点集群的权限级别domain_a1不在所述至少一个权限级别(domain_a)中，因此，第二节点集群不具备对所述第一交易的访问权限。
本申请实施例中，在数据从上游zone向下游zone同步时，上游zone中的linker节点会判断下游节点绑定的权限域，是否有区块中所有交易的访问权。若下游节点没有特定交易的访问权，则会将区块中该交易进行“压缩”(即删除交易的数据本体，以交易的哈希值替代)，进而下游节点无法获取交易数据本体，保证数据隔离性，同时降低下游节点需存储的数据量。可见，由于数据是上游到下游按需逐级进行过滤的，因此下游zone获取的数据量不可能高于其上游，即其权限继承自上游，即前文提到的权限继承关系与数据流一致。
接下来介绍上述哈希处理的一个示意：
区块(block)可以由区块头(block header)与区块体(block body)组成，其中区块体(block body)中由多笔交易组成，而区块头中的默克尔树根(merkel tree Root)是以区块体中每一笔交易的哈希作为叶子节点的默克尔树的根哈希值。默克尔根可以用于校验区块中的交易是否被篡改(即在接收方收到区块后，会将区块体中的所有交易重新进行默克尔树的构建，获取新的merkel tree Root值，并与区块头中的值进行对比，若一致则证明交易未被篡改)。
示例性的，可以参照图5，图5为一个区块的结构示意图。
在parent zone(例如本申请实施例中的第一节点集群)向下游zone(例如本申请实施例中的第二节点集群)发送区块(例如本申请实施例中的第一区块)时，若发现下级zone无权获取区块中至少一个交易(即下级zone关联的所有domain权限与交易所指定的domain没有交集)，则会对该交易进行压缩。而压缩的过程，就是用该交易的哈希替换该交易的数据本体。通过哈希处理，可以保证交易数据的隔离性，下级无法获取与保存数据本体。保留了交易的哈希值。交易哈希值是区块默克尔树的叶子节点，因此接收方仍然可以通过该哈希值重建默克尔树，对区块数据是否被篡改进行校验。此外，哈希值通常远小于数据本体，可以减少网络负载，提高性能。
在一种可能的实现中，所述第一区块还包括第二交易的交易数据，所述交易数据为明文数据；相应的，在所述权限信息指示所述第二节点集群具备对所述第二交易的访问权限时，可以对第一区块中第二交易的交易数据进行保留，进而，得到的所述第二区块可以包 括所述第二交易的交易明文数据。
本申请实施例中，将区块链网络划分为树状子集群(zone)，将网络结构的排布变得有序，可以改善网络拓扑结构，提升同步性能与规模上限。此外，数据同步过程过滤权限外的交易，可以保证跨权限域的数据隔离。且对于非权限域内的数据仅存储哈希处理后的哈希值，哈希值通常远小于数据本体，可以减少网络负载，提高性能。
303、所述第一节点将所述第二区块传递至所述第二节点，以便所述第二节点集群对所述第二区块进行数据备份。
在一种可能的实现中，在得到第二区块后，第一节点可以将第二区块传递至第二节点。进而，第二节点集群中的各个节点可以对第二区块进行数据备份(也就是进行数据存储)。
在一种可能的实现中，所述第二节点集群包括所述第二节点在内的多个节点，所述第二节点集群对所述第二区块进行数据备份，具体可以包括：所述多个节点中的每个节点对所述第二区块进行数据备份。例如，第二节点集群中的各个节点之间可以存在数据传输通路，通过数据传输通路可以将第二区块传播到各个节点中，进而第二节点集群中的各个节点可以对第二区块进行数据备份。
在一种可能的实现中，第三节点集群可以作为第二节点集群的下游zone，进而，第二节点集群中的linker节点(例如本申请实施例中的第三节点)可以将区块数据传递至第三节点集群进行数据备份。
在一种可能的实现中，所述第二区块还包括第三交易的交易数据，所述交易数据为明文数据；所述节点集群还包括第三节点集群，所述第二节点集群中的第三节点和所述第三节点集群中的第四节点之间通信连接；所述第三节点可以获取所述第三交易的第二权限信息；所述第三节点基于所述第二权限信息指示所述第三节点集群不具备对所述第三交易的访问权限，根据所述第二区块，生成第三区块，所述第三区块包括对所述第三交易的交易数据进行哈希处理得到的密文数据；所述第三节点将所述第三区块传递至所述第四节点，以便所述第三节点集群对所述第三区块进行数据备份。
在一种可能的实现中，所述第二区块还包括至少一个第四交易的交易数据，所述交易数据为明文数据；所述权限信息指示所述第二节点集群具备对所述至少一个第四交易的访问权限，所述第三区块包括所述至少一个第四交易的交易数据。
接下来介绍本申请实施例中的一种区块链网络创建的流程示意：
(1)创建domain
权限域domain可通过客户端向集群发起请求进行创建。domain创建后，才可创建与之进行关联的zone，以及发送指向该domain的交易。
(2)创建zone
每个zone必须绑定至少一个已经存在的domain。
需要注意的是，绑定的domain需要与Parent zone满足domain的权限限制(zone的树形同步与domain的树形权限需要满足：Child zone所需的数据可以从Parent zone完整获取)。
(3)节点加入zone
加入的新节点将自己的节点信息通过集群中的任一节点(种子节点)发送给master节点，由master节点完成Id和连接的分配，再将新的成员信息同步给整个集群，完成节点加入流程。
示例性的，参照图6，可以创建如下区块链网络，并发送不同权限的交易并展示其同步过程。在创建domian的过程中，可以可以通过客户端向区块链网络发送请求，创建domain_a，domain_a/domain_a1，domain_b，domain_b/domain_b1，domain_c。
在创建zone的过程中，可以通过客户端向区块链网络发送请求，创建zone_b，zone_a/zone_a1，zone_b，zone_b/zone_b1，zone_c，分别关联domain_a，domain_a/domain_a1，domain_b，domain_b/domain_b1，domain_c。
在向zone添加节点的过程中，可以通过客户端向区块链网络发送请求，向根zone在内的所有zone添加一定数量的节点，保证每个zone都至少有一个节点。
在进行数据备份的过程中，可以发送交易，区块链网络实现数据同步。
示例性的，以交易tx_1、交易tx_2和交易tx_3为例；可以发送交易tx_1，指定权限域为/domain_b，在共识集群完成交易打包区块后，向三个下游zone(zone_a，zone_b，zone_c)同步数据时，只有关联/domain_b的zone_b有权限，因此只会向zone_b发送含tx_1的区块，而向zone_a，zone_c发送的区块中对tx_1进行压缩；
zone_b完成交易数据同步后，会向下游zone(zone_b::zone_b1)进行同步，因下游zone无权限，因此也会将区块中tx_1进行压缩。
zone_a下游zone均无权限，只能获取对tx_1进行压缩后的区块。可见zone所在分支与层级，会决定其所能获取的数据权上限，实现了更加安全的数据隔离。
发送交易tx_2，指定权限域为/domain_b/*；
在共识集群完成交易打包区块后，处理同上；
zone_b完成交易数据同步后，会向下游zone(zone_b::zone_b1)进行同步，因下游zone均有权限，因此会将含tx_2数据的区块向下游同步。
发送交易tx_3，未指定权限域(使用默认值/**)；
在共识集群完成交易打包区块后，向三个下游zone(zone_a，zone_b，zone_c)同步数据时，所有下游zone均有权限，因此会向所有下游zone发送含tx_3的区块。
zone_a、zone_b完成交易数据同步后，会向下游zone同步，因/**表示根domain下所有子domain均有权限，因此会向所有下游zone发送含tx_3的区块。
本申请实施例提供了一种数据备份方法，应用于节点集群，所述节点集群包括第一节点集群以及第二节点集群，所述第一节点集群中的第一节点和所述第二节点集群中的第二节点之间通信连接，所述方法包括：所述第一节点获取第一区块以及第一交易的第一权限信息，所述第一区块包括所述第一交易的交易数据，所述交易数据为明文数据；所述第一节点基于所述第一权限信息指示所述第二节点集群不具备对所述第一交易的访问权限，根据所述第一区块，生成第二区块，所述第二区块包括对所述第一交易的交易数据进行哈希处理得到的密文数据；所述第一节点将所述第二区块传递至所述第二节点，以便所述第二 节点集群对所述第二区块进行数据备份。本申请实施例中，将区块链网络划分为树状子集群(zone)，将网络结构的排布变得有序，可以改善网络拓扑结构，提升同步性能与规模上限。此外，数据同步过程过滤权限外的交易，可以保证跨权限域的数据隔离。且对于非权限域内的数据仅存储哈希处理后的哈希值，哈希值通常远小于数据本体，可以减少网络负载，提高性能。
参照图7，图7为本申请实施例提供的一种数据备份装置的结构示意，应用于第一节点，所述第一节点与第二节点之间通信连接，所述第一节点与所述第二节点属于不同的集群，所述第一节点700包括：
获取模块701，用于获取第一区块以及第一权限信息，所述第一区块包括第一交易的交易数据，所述第一权限信息为所述第一交易的权限信息；
其中，关于获取模块701的具体描述可以参照上述实施例中步骤301的描述，相似之处不再赘述。
区块生成模块702，用于在所述第一权限信息指示所述第二节点集群不具备对所述至少一个第一交易的访问权限的情况下，所述第一节点对所述第一交易的交易数据进行加密，以得到第二区块，所述第二区块包括加密后的所述第一交易的交易数据；
其中，关于区块生成模块702的具体描述可以参照上述实施例中步骤302的描述，相似之处不再赘述。
传递模块703，用于将所述第二区块传递至所述第二节点，以便所述第二节点集群对所述第二区块进行数据备份。
其中，关于传递模块703的具体描述可以参照上述实施例中步骤303的描述，相似之处不再赘述。
在一种可能的实现中，所述第一节点集群还包括除所述第一节点之外的节点，所述第二节点集群还包括除所述第二节点之外的节点，所述第一节点集群和所述第二节点集群之间仅通过所述第一节点和所述第二节点进行数据的传递。
在一种可能的实现中，所述第二节点集群中的节点被配置为：不具备主动访问所述第一节点集群中节点的数据的权限。
在一种可能的实现中，所述第一区块还包括第二交易的交易数据；
所述权限信息指示所述第二节点集群具备对所述第二交易的访问权限，所述第二区块包括所述第二交易的交易数据。
在一种可能的实现中，所述第二区块为将所述第一区块中的所述第一交易的交易数据替换为所述加密后的所述第一交易的交易数据得到的。
在一种可能的实现中，所述第二区块还包括第三交易的交易数据；所述节点集群还包括第三节点集群，所述第二节点集群中的第三节点和所述第三节点集群中的第四节点之间通信连接；所述传递模块，还用于：
将所述第三交易的第二权限信息传递至所述第二节点；
所述第三节点包括：
区块生成模块，用于基于所述第二权限信息指示所述第三节点集群不具备对所述第三交易的访问权限，对所述第三交易的交易数据进行加密，以得到第三区块，所述第三区块包括加密后的所述第三交易的交易数据；
传递模块，用于将所述第三区块传递至所述第四节点，以便所述第三节点集群对所述第三区块进行数据备份。
在一种可能的实现中，所述第二区块还包括第四交易的交易数据；
所述第二权限信息指示所述第三节点所属的集群具备对所述第四交易的访问权限，所述第三区块包括所述第四交易的交易数据。
在一种可能的实现中，所述第一权限信息包括对所述第一交易具备访问权限的至少一个权限级别；所述区块生成模块，具体用于：
所述第一节点基于所述第二节点集群的权限级别不在所述至少一个权限级别中，确定所述第一权限信息指示所述第二节点集群不具备对所述第一交易的访问权限。
在一种可能的实现中，所述第一交易的交易数据为共识节点生成的数据。
在一种可能的实现中，所述第一节点集群还包括：共识节点；
所述获取第一区块，包括：接收来自所述共识节点传递的所述第一区块。
在一种可能的实现中，所述第二节点集群包括所述第二节点在内的多个节点，所述第二节点集群对所述第二区块进行数据备份，包括：
所述多个节点中的每个节点对所述第二区块进行数据备份。
本申请实施例还提供了一种数据备份装置，如图8所示，图8为本申请实施例中数据备份装置的一种结构示意图，为了便于说明，仅示出了与本申请实施例相关的部分，具体技术细节未揭示的，请参照本申请实施例方法部分。该数据备份装置运行于终端，终端可以为包括手机、平板电脑、个人数字助理(personal digital assistant，PdA)、销售终端(point of sales，POs)、车载电脑等任意终端设备，以终端为手机为例：
手机包括：射频(radio frequency，RF)电路810、存储器820、输入单元830、显示单元840、传感器850、音频电路860、无线保真(wireless fidelity，WiFi)模块870、处理器880、以及电源890等部件。本领域技术人员可以理解，图8中示出的手机结构并不构成对手机的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。
RF电路810可用于收发信息或通话过程中，信号的接收和发送，特别地，将基站的下行信息接收后，给处理器880处理；另外，将设计上行的数据发送给基站。通常，RF电路810包括但不限于天线、至少一个放大器、收发信机、耦合器、低噪声放大器(low noise amplifier，lNA)、双工器等。此外，RF电路810还可以通过无线通信与网络和其他设备通信。上述无线通信可以使用任一通信标准或协议，包括但不限于全球移动通讯系统(global system of mobile communication，Gsm)、通用分组无线服务(general packet radio service，GPRs)、码分多址(code division multiple access，CdmA)、宽带码分多址(wideband code division multiple access,WCdmA)、长期演进(long term evolution， ltE)、电子邮件、短消息服务(short messaging service，sms)等。
存储器820可用于存储软件程序以及模块，处理器880通过运行存储在存储器820的软件程序以及模块，从而执行手机的各种功能应用以及数据处理。存储器820可主要包括存储程序区和存储数据区，其中，存储程序区可存储操作系统、至少一个功能所需的应用程序(比如声音播放功能、图像播放功能等)等；存储数据区可存储根据手机的使用所创建的数据(比如音频数据、电话本等)等。此外，存储器820可以包括高速随机存取存储器，还可以包括非易失性存储器，例如至少一个磁盘存储器件、闪存器件、或其他易失性固态存储器件。
输入单元830可用于接收输入的数字或字符信息，以及产生与手机的用户设置以及功能控制有关的键信号输入。具体地，输入单元830可包括触控面板831以及其他输入设备832。触控面板831，也称为触摸屏，可收集用户在其上或附近的触摸操作(比如用户使用手指、触笔等任何适合的物体或附件在触控面板831上或在触控面板831附近的操作)，并根据预先设定的程式驱动相应的连接装置。可选的，触控面板831可包括触摸检测装置和触摸控制器两个部分。其中，触摸检测装置检测用户的触摸方位，并检测触摸操作带来的信号，将信号传送给触摸控制器；触摸控制器从触摸检测装置上接收触摸信息，并将它转换成触点坐标，再送给处理器880，并能接收处理器880发来的命令并加以执行。此外，可以采用电阻式、电容式、红外线以及表面声波等多种类型实现触控面板831。除了触控面板831，输入单元830还可以包括其他输入设备832。具体地，其他输入设备832可以包括但不限于物理键盘、功能键(比如音量控制按键、开关按键等)、轨迹球、鼠标、操作杆等中的一种或多种。
显示单元840可用于显示由用户输入的信息或提供给用户的信息以及手机的各种菜单。显示单元840可包括显示面板841，可选的，可以采用液晶显示器(liquid crystal display，lCd)、有机发光二极管(organic light-emitting diode，OlEd)等形式来配置显示面板841。进一步的，触控面板831可覆盖显示面板841，当触控面板831检测到在其上或附近的触摸操作后，传送给处理器880以确定触摸事件的类型，随后处理器880根据触摸事件的类型在显示面板841上提供相应的视觉输出。虽然在图8中，触控面板881与显示面板841是作为两个独立的部件来实现手机的输入和输入功能，但是在某些实施例中，可以将触控面板831与显示面板841集成而实现手机的输入和输出功能。
手机还可包括至少一种传感器850，比如光传感器、运动传感器以及其他传感器。具体地，光传感器可包括环境光传感器及接近传感器，其中，环境光传感器可根据环境光线的明暗来调节显示面板841的亮度，接近传感器可在手机移动到耳边时，关闭显示面板841和/或背光。作为运动传感器的一种，加速计传感器可检测各个方向上(一般为三轴)加速度的大小，静止时可检测出重力的大小及方向，可用于识别手机姿态的应用(比如横竖屏切换、相关游戏、磁力计姿态校准)、振动识别相关功能(比如计步器、敲击)等；至于手机还可配置的陀螺仪、气压计、湿度计、温度计、红外线传感器等其他传感器，在此不再赘述。
音频电路860、扬声器861，传声器862可提供用户与手机之间的音频接口。音频电路 860可将接收到的音频数据转换后的电信号，传输到扬声器861，由扬声器861转换为声音信号输出；另一方面，传声器862将收集的声音信号转换为电信号，由音频电路860接收后转换为音频数据，再将音频数据输出处理器880处理后，经RF电路810以发送给比如另一手机，或者将音频数据输出至存储器820以便进一步处理。
WiFi属于短距离无线传输技术，手机通过WiFi模块870可以帮助用户收发电子邮件、浏览网页和访问流式媒体等，它为用户提供了无线的宽带互联网访问。虽然图8示出了WiFi模块870，但是可以理解的是，其并不属于手机的必须构成，完全可以根据需要在不改变申请的本质的范围内而省略。
处理器880是手机的控制中心，利用各种接口和线路连接整个手机的各个部分，通过运行或执行存储在存储器820内的软件程序和/或模块，以及调用存储在存储器820内的数据，执行手机的各种功能和处理数据，从而对手机进行整体监控。可选的，处理器880可包括一个或多个处理单元；可选的，处理器880可集成应用处理器和调制解调处理器，其中，应用处理器主要处理操作系统、用户界面和应用程序等，调制解调处理器主要处理无线通信。可以理解的是，上述调制解调处理器也可以不集成到处理器880中。
手机还包括给各个部件供电的电源890(比如电池)，可选的，电源可以通过电源管理系统与处理器880逻辑相连，从而通过电源管理系统实现管理充电、放电、以及功耗管理等功能。
在本申请实施例中，该终端所包括的处理器880可以执行上述图对应的实施例描述的步骤。
本申请实施例提供的数据备份装置还可以部署于服务器中，该服务器可以为单个服务器也可以为多个服务器组成的服务器集群，下面，以单个服务器进行描述。请参阅图9，图9为本申请实施例中提供的一种服务器结构示意图，该服务器900可因配置或性能不同而产生比较大的差异，可以包括一个或一个以上中央处理器(central processing units，CPU)922(例如，一个或一个以上处理器)和存储器932，一个或一个以上存储应用程序942或数据944的存储介质930(例如一个或一个以上海量存储设备)。其中，存储器932和存储介质930可以是短暂存储或持久存储。存储在存储介质930的程序可以包括一个或一个以上模块(图示没标出)，每个模块可以包括对服务器中的一系列指令操作。更进一步地，中央处理器922可以设置为与存储介质930通信，在服务器900上执行存储介质930中的一系列指令操作。
服务器900还可以包括一个或一个以上电源926，一个或一个以上有线或无线网络接口950，一个或一个以上输入输出接口958，和/或，一个或一个以上操作系统941，例如Windows servertm，mac Os Xtm，Unixtm,linuxtm，FreeBsdtm等等。
上述实施例中由服务器所执行的步骤可以基于该图9所示的服务器结构。
CPU 922可以执行上述图3对应的实施例描述的步骤。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。 当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。
所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本发明实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(digital subscriber line，dsl))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存储的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，dVd)、或者半导体介质(例如固态硬盘solid state disk(ssd))等。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROm，Read-Only memory)、随机存取存储器(RAm，Random Access memory)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修 改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的精神和范围。

Claims (26)

  1. 一种节点集群，其特征在于，所述节点集群包括第一节点集群以及第二节点集群，所述第一节点集群中的第一节点和所述第二节点集群中的第二节点之间通信连接，所述方法包括：
    所述第一节点，用于获取第一区块以及第一权限信息，所述第一区块包括第一交易的交易数据，所述第一权限信息为所述第一交易的权限信息；
    在所述第一权限信息指示所述第二节点集群不具备对所述至少一个第一交易的访问权限的情况下，对所述第一交易的交易数据进行加密，以得到第二区块，所述第二区块包括加密后的所述第一交易的交易数据；
    将所述第二区块传递至所述第二节点，以便所述第二节点集群对所述第二区块进行数据备份。
  2. 根据权利要求1所述的节点集群，其特征在于，所述第一节点集群还包括除所述第一节点之外的节点，所述第二节点集群还包括除所述第二节点之外的节点，所述第一节点集群和所述第二节点集群之间仅通过所述第一节点和所述第二节点进行数据的传递。
  3. 根据权利要求1或2所述的节点集群，其特征在于，所述第二节点集群中的节点被配置为：不具备主动访问所述第一节点集群中节点的数据的权限。
  4. 根据权利要求1至3任一所述的节点集群，其特征在于，所述第二区块还包括第三交易的交易数据；所述节点集群还包括第三节点集群，所述第二节点集群中的第三节点和所述第三节点集群中的第四节点之间通信连接；
    所述第一节点，还用于将所述第三交易的第二权限信息传递至所述第二节点；
    所述第三节点，用于基于所述第二权限信息指示所述第三节点集群不具备对所述第三交易的访问权限，对所述第三交易的交易数据进行加密，以得到第三区块，所述第三区块包括加密后的所述第三交易的交易数据；
    将所述第三区块传递至所述第四节点，以便所述第三节点集群对所述第三区块进行数据备份。
  5. 根据权利要求4所述的节点集群，其特征在于，所述第二区块还包括第四交易的交易数据；
    所述第二权限信息指示所述第三节点所属的集群具备对所述第四交易的访问权限，所述第三区块包括所述第四交易的交易数据。
  6. 一种数据备份方法，其特征在于，应用于第一节点，所述第一节点与第二节点之间通信连接，所述第一节点与所述第二节点属于不同的集群，所述方法包括：
    所述第一节点获取第一区块以及第一权限信息，所述第一区块包括第一交易的交易数 据，所述第一权限信息为所述第一交易的权限信息；
    在所述第一权限信息指示所述第二节点集群不具备对所述至少一个第一交易的访问权限的情况下，所述第一节点对所述第一交易的交易数据进行加密，以得到第二区块，所述第二区块包括加密后的所述第一交易的交易数据；
    所述第一节点将所述第二区块传递至所述第二节点，以便所述第二节点集群对所述第二区块进行数据备份。
  7. 根据权利要求6所述的方法，其特征在于，所述第一节点属于第一节点集群，所述第二节点属于第二节点集群，所述第一节点集群还包括除所述第一节点之外的节点，所述第二节点集群还包括除所述第二节点之外的节点，所述第一节点集群和所述第二节点集群之间仅通过所述第一节点和所述第二节点进行数据的传递。
  8. 根据权利要求6或7所述的方法，其特征在于，所述第二节点集群中的节点被配置为：不具备主动访问所述第一节点集群中节点的数据的权限。
  9. 根据权利要求6至8任一所述的方法，其特征在于，所述第一区块还包括第二交易的交易数据；
    所述第一权限信息指示所述第二节点集群具备对所述第二交易的访问权限，所述第二区块包括所述第二交易的交易数据。
  10. 根据权利要求6至9任一所述的方法，其特征在于，所述第二区块为将所述第一区块中的所述第一交易的交易数据替换为所述加密后的所述第一交易的交易数据得到的。
  11. 根据权利要求6至10任一所述的方法，其特征在于，所述第一权限信息包括对所述第一交易具备访问权限的至少一个权限级别；所述方法还包括：
    所述第一节点基于所述第二节点集群的权限级别不在所述至少一个权限级别中，确定所述第一权限信息指示所述第二节点集群不具备对所述第一交易的访问权限。
  12. 根据权利要求6至11任一所述的方法，其特征在于，所述第一交易的交易数据为共识节点生成的数据。
  13. 根据权利要求6至12任一所述的方法，其特征在于，所述第一节点集群还包括：共识节点；
    所述获取第一区块，包括：接收来自所述共识节点传递的所述第一区块。
  14. 根据权利要求6至13任一所述的方法，其特征在于，所述第二节点集群包括所述第二节点在内的多个节点，所述第二节点集群对所述第二区块进行数据备份，包括：
    所述多个节点中的每个节点对所述第二区块进行数据备份。
  15. 一种数据备份装置，其特征在于，应用于第一节点，所述第一节点与第二节点之间通信连接，所述第一节点与所述第二节点属于不同的集群，所述第一节点包括：
    获取模块，用于获取第一区块以及第一权限信息，所述第一区块包括第一交易的交易数据，所述第一权限信息为所述第一交易的权限信息；
    区块生成模块，用于在所述第一权限信息指示所述第二节点集群不具备对所述至少一个第一交易的访问权限的情况下，所述第一节点对所述第一交易的交易数据进行加密，以得到第二区块，所述第二区块包括加密后的所述第一交易的交易数据；
    传递模块，用于将所述第二区块传递至所述第二节点，以便所述第二节点集群对所述第二区块进行数据备份。
  16. 根据权利要求15所述的装置，其特征在于，所述第一节点属于第一节点集群，所述第二节点属于第二节点集群，所述第一节点集群还包括除所述第一节点之外的节点，所述第二节点集群还包括除所述第二节点之外的节点，所述第一节点集群和所述第二节点集群之间仅通过所述第一节点和所述第二节点进行数据的传递。
  17. 根据权利要求15或16所述的装置，其特征在于，所述第二节点集群中的节点被配置为：不具备主动访问所述第一节点集群中节点的数据的权限。
  18. 根据权利要求15至17任一所述的装置，其特征在于，所述第一区块还包括第二交易的交易数据；
    所述第一权限信息指示所述第二节点集群具备对所述第二交易的访问权限，所述第二区块包括所述第二交易的交易数据。
  19. 根据权利要求15至18任一所述的装置，其特征在于，所述第二区块为将所述第一区块中的所述第一交易的交易数据替换为所述加密后的所述第一交易的交易数据得到的。
  20. 根据权利要求15至19任一所述的装置，其特征在于，所述第一权限信息包括对所述第一交易具备访问权限的至少一个权限级别；所述区块生成模块，具体用于：
    所述第一节点基于所述第二节点集群的权限级别不在所述至少一个权限级别中，确定所述第一权限信息指示所述第二节点集群不具备对所述第一交易的访问权限。
  21. 根据权利要求15至20任一所述的装置，其特征在于，所述第一交易的交易数据为共识节点生成的数据。
  22. 根据权利要求15至21任一所述的装置，其特征在于，所述第一节点集群还包括： 共识节点；
    所述获取模块，具体用于：接收来自所述共识节点传递的所述第一区块。
  23. 根据权利要求15至22任一所述的装置，其特征在于，所述第二节点集群包括所述第二节点在内的多个节点，所述第二节点集群对所述第二区块进行数据备份，包括：
    所述多个节点中的每个节点对所述第二区块进行数据备份。
  24. 一种数据备份装置，包括：存储器、收发器、处理器以及总线系统；其中，所述存储器用于存储程序和指令；所述收发器用于在所述处理器的控制下接收或发送信息；所述处理器用于执行所述存储器中的程序；所述总线系统用于连接所述存储器、所述收发器以及所述处理器，以使所述存储器、所述收发器以及所述处理器进行通信；所述处理器用于调用所述存储器中的程序指令，执行如权利要求6至14中任一所述的数据备份方法。
  25. 一种计算机可读存储介质，所述计算机可读存储介质中存储有指令，所述指令在计算机上运行时，使得所述计算机执行如权利要求6至14中任一所述的数据备份方法。
  26. 一种计算机程序产品，其特征在于，所述计算机程序产品包括代码，当所述代码被执行时，用于实现权利要求6至14任一所述的数据备份方法。
PCT/CN2023/090186 2022-04-29 2023-04-24 一种节点集群以及数据备份方法 WO2023207871A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210468559.1 2022-04-29
CN202210468559.1A CN117009983A (zh) 2022-04-29 2022-04-29 一种节点集群以及数据备份方法

Publications (1)

Publication Number Publication Date
WO2023207871A1 true WO2023207871A1 (zh) 2023-11-02

Family

ID=88517773

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/090186 WO2023207871A1 (zh) 2022-04-29 2023-04-24 一种节点集群以及数据备份方法

Country Status (2)

Country Link
CN (1) CN117009983A (zh)
WO (1) WO2023207871A1 (zh)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111553670A (zh) * 2020-04-28 2020-08-18 腾讯科技（深圳）有限公司 一种交易处理方法、装置及计算机可读存储介质
CN111899104A (zh) * 2018-11-27 2020-11-06 创新先进技术有限公司 一种业务执行方法及装置
US20210006400A1 (en) * 2018-03-19 2021-01-07 Huawei Technologies Co., Ltd. Method and apparatus for controlling data access right
CN112615847A (zh) * 2020-12-14 2021-04-06 上海交通大学 基于区块链的数据共享和隐私保护方法
CN113822675A (zh) * 2021-09-29 2021-12-21 平安银行股份有限公司 基于区块链的报文处理方法、装置、设备及存储介质

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210006400A1 (en) * 2018-03-19 2021-01-07 Huawei Technologies Co., Ltd. Method and apparatus for controlling data access right
CN111899104A (zh) * 2018-11-27 2020-11-06 创新先进技术有限公司 一种业务执行方法及装置
CN111553670A (zh) * 2020-04-28 2020-08-18 腾讯科技（深圳）有限公司 一种交易处理方法、装置及计算机可读存储介质
CN112615847A (zh) * 2020-12-14 2021-04-06 上海交通大学 基于区块链的数据共享和隐私保护方法
CN113822675A (zh) * 2021-09-29 2021-12-21 平安银行股份有限公司 基于区块链的报文处理方法、装置、设备及存储介质

Also Published As

Publication number Publication date
CN117009983A (zh) 2023-11-07

Similar Documents

Publication Publication Date Title
US11296937B2 (en) Decentralized data storage and processing for IoT devices
CN110163004B (zh) 一种区块链生成的方法、相关设备及系统
US11799955B2 (en) Data synchronization across multiple devices
JP6602369B2 (ja) 記憶不具合後の安全なデータアクセス
JP2022503686A (ja) 通信接続方法、装置、コンピュータ機器、及びコンピュータプログラム
JP6220338B2 (ja) フォールトトレラント外部アプリケーションサーバ
US8725682B2 (en) Distribution and synchronization of digital objects
CN103329503B (zh) Ad hoc文件共享
US10064026B2 (en) Unified message delivery between portable electronic devices
US9113319B2 (en) Method of generating a virtual private community and network using the virtual private community
US20200380984A1 (en) Synchronization of remote context data
CN110839078A (zh) 代理推送
WO2016040213A1 (en) Implementing file-based protocol for request processing
Maqsood et al. Scalability issues in online social networks
CN113259460A (zh) 跨链交互方法及装置
CN113420007A (zh) 数据库访问的审计处理方法、装置及电子设备
US20190207880A1 (en) Techniques for data reads from secondary stores
WO2023207871A1 (zh) 一种节点集群以及数据备份方法
CN103685497A (zh) 一种在线存储共享方法和系统
WO2014180436A1 (zh) 一种终端间进行通信的方法及终端
Durao et al. Usto. re: A private cloud storage software system
US20190205466A1 (en) Techniques for consistent reads in a split message store
CN108306964A (zh) 服务器节点信息集中显示方法、系统、设备及存储介质
CN101369951B (zh) 一种可管理的对等网络系统
CN111935290B (zh) 一种基于智联网的分布式数据管理系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23795304

Country of ref document: EP

Kind code of ref document: A1