WO2024001035A1 - Message transmission method and apparatus based on blockchain relay communication network system - Google Patents

Message transmission method and apparatus based on blockchain relay communication network system Download PDF

Info

Publication number
WO2024001035A1
WO2024001035A1 PCT/CN2022/135553 CN2022135553W WO2024001035A1 WO 2024001035 A1 WO2024001035 A1 WO 2024001035A1 CN 2022135553 W CN2022135553 W CN 2022135553W WO 2024001035 A1 WO2024001035 A1 WO 2024001035A1
Authority
WO
WIPO (PCT)
Prior art keywords
blockchain
node
blockchain node
communication network
network system
Prior art date
Application number
PCT/CN2022/135553
Other languages
French (fr)
Chinese (zh)
Inventor
魏长征
闫莺
Original Assignee
蚂蚁区块链科技(上海)有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 蚂蚁区块链科技(上海)有限公司 filed Critical 蚂蚁区块链科技(上海)有限公司
Publication of WO2024001035A1 publication Critical patent/WO2024001035A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/083—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
    • H04L9/0833—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] involving conference or group key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0838—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures

Definitions

  • the embodiments of this specification belong to the field of blockchain technology, and particularly relate to a message transmission method and device based on a blockchain relay communication network system.
  • Blockchain is a new application model of computer technology such as distributed data storage, point-to-point transmission, consensus mechanism, and encryption algorithm.
  • data blocks are combined into a chained data structure in a chronological manner and are cryptographically guaranteed to be an untamperable and unforgeable distributed ledger.
  • P2P Peer to Peer, point-to-point
  • communication delays are high and Poor stability and unable to meet application requirements.
  • Blockchain nodes can be respectively connected to the blockchain relay communication network system, so that communication between blockchain nodes can be achieved through the blockchain relay communication network system.
  • the blockchain relay communication network system is a backbone relay communication network system for real-time transmission of blockchain, the various relay nodes it contains can communicate with each other through high-quality bandwidth guaranteed by high QoS (Quality of Service, Quality of Service). Communication interaction, so the blockchain relay communication network system takes over the middle mile of communication between blockchain nodes, which can reduce communication delays and improve stability, thereby significantly improving the communication between blockchain nodes. Communication quality.
  • the purpose of this specification is to provide a message transmission method and device based on a blockchain relay communication network system.
  • a message transmission method based on a blockchain relay communication network system is proposed.
  • the blockchain relay communication network system is connected to the source blockchain node and The destination blockchain nodes are connected, each blockchain node in the blockchain node group to which the source blockchain node and the destination blockchain node belong maintains the same shared key, and the blockchain The relay node in the relay communication network system does not maintain the shared key; the method includes:
  • the source blockchain node encrypts plaintext information based on the shared key to obtain encrypted information, encapsulates an IP header for the encrypted information to generate an encrypted message, and sends the encrypted message to the blockchain relay communication network system;
  • the blockchain relay communication network system forwards the encrypted message to the destination blockchain node based on the IP header;
  • the destination blockchain node decrypts the encrypted message based on the shared key to obtain the plaintext information.
  • a message transmission method based on a blockchain relay communication network system is proposed, applied to the source blockchain node, the blockchain relay communication network system are respectively connected to the source blockchain node and the destination blockchain node.
  • Each blockchain node in the blockchain node group to which the source blockchain node and the destination blockchain node belong maintains the same
  • the shared key is shared, and the relay node in the blockchain relay communication network system does not maintain the shared key; the method includes:
  • a message transmission method based on a blockchain relay communication network system is proposed, which is applied to the destination blockchain node.
  • the blockchain relay communication network system Connected to the source blockchain node and the destination blockchain node respectively.
  • Each blockchain node in the blockchain node group to which the source blockchain node and the destination blockchain node belong maintains the same
  • the encrypted message is decrypted based on the shared key to obtain the plaintext information.
  • a message transmission method based on a blockchain relay communication network system is proposed, which is applied to the blockchain relay communication network system.
  • the blockchain The relay communication network system is connected to the source blockchain node and the destination blockchain node respectively.
  • Each blockchain node in the blockchain node group to which the source blockchain node and the destination blockchain node belong maintains have the same shared key, and the relay node in the blockchain relay communication network system does not maintain the shared key; the method includes:
  • the encrypted message is forwarded to the destination blockchain node based on the IP header.
  • a message transmission system based on a blockchain relay communication network system is proposed.
  • the blockchain relay communication network system is respectively connected with the source blockchain node and The destination blockchain nodes are connected, each blockchain node in the blockchain node group to which the source blockchain node and the destination blockchain node belong maintains the same shared key, and the blockchain The relay node in the relay communication network system does not maintain the shared key; the system includes:
  • the source blockchain node is used to encrypt plain text information based on the shared key to obtain encrypted information, encapsulate an IP header for the encrypted information to generate an encrypted message, and send the encrypted message to the zone.
  • Blockchain relay communication network system
  • the blockchain relay communication network system is used to forward the encrypted message to the destination blockchain node based on the IP header;
  • the destination blockchain node is used to decrypt the encrypted message based on the shared key to obtain the plaintext information.
  • a message transmission device based on a blockchain relay communication network system is proposed, which is applied to the source blockchain node.
  • the blockchain relay communication network system are respectively connected to the source blockchain node and the destination blockchain node.
  • Each blockchain node in the blockchain node group to which the source blockchain node and the destination blockchain node belong maintains the same
  • the shared key is shared, and the relay node in the blockchain relay communication network system does not maintain the shared key; the device includes:
  • a plaintext information encryption unit configured to encrypt plaintext information based on the shared key to obtain encrypted information
  • An encrypted message generating unit configured to encapsulate an IP header for the encrypted information to generate an encrypted message
  • An encrypted message sending unit configured to send the encrypted message to the blockchain relay communication network system, and the blockchain relay communication network system is configured to forward the encrypted message to the The destination blockchain node.
  • a message transmission device based on a blockchain relay communication network system is proposed, which is applied to a destination blockchain node.
  • the blockchain relay communication network system Connected to the source blockchain node and the destination blockchain node respectively.
  • Each blockchain node in the blockchain node group to which the source blockchain node and the destination blockchain node belong maintains the same A shared key is shared, and the relay node in the blockchain relay communication network system does not maintain the shared key; the device includes:
  • the first encrypted message receiving unit is configured to receive the encrypted message forwarded by the blockchain relay communication network system to the destination blockchain node based on the IP header of the encrypted message.
  • the encrypted message is forwarded by the source
  • the blockchain node encapsulates the IP header to generate the encrypted information obtained by encrypting the plaintext information based on the shared key;
  • An encrypted message decryption unit configured to decrypt the encrypted message based on the shared key to obtain the plaintext information.
  • a message transmission device based on a blockchain relay communication network system is proposed, which is applied to the blockchain relay communication network system.
  • the blockchain The relay communication network system is connected to the source blockchain node and the destination blockchain node respectively.
  • Each blockchain node in the blockchain node group to which the source blockchain node and the destination blockchain node belong maintains have the same shared key, and the relay node in the blockchain relay communication network system does not maintain the shared key; the device includes:
  • the second encrypted message receiving unit is configured to receive an encrypted message generated by the source blockchain node by encapsulating the IP header of the encrypted information obtained by encrypting the plaintext information based on the shared key;
  • An encrypted message forwarding unit configured to forward the encrypted message to the destination blockchain node based on the IP header.
  • an electronic device including:
  • Memory used to store instructions executable by the processor
  • the processor implements the method described in any one of the first to fourth aspects by running the executable instructions.
  • a computer-readable storage medium on which computer instructions are stored, and when the instructions are executed by a processor, any one of the first to fourth aspects is implemented. The steps of the method.
  • the source blockchain node and the destination blockchain node are connected through the blockchain relay communication network system.
  • the source blockchain node and the destination blockchain node belong to the same blockchain node group.
  • the same shared key is maintained, which allows the source blockchain node to use the shared key for encryption when it needs to send plaintext information to the destination blockchain node, ensuring the confidentiality of the system, and due to the blockchain relay communication All relay nodes in the network do not maintain this shared key, which makes it impossible for relay nodes in the relay network system to directly obtain plaintext information through decryption, thereby preventing the plaintext information from being transmitted through the blockchain relay communication network system.
  • the process is exposed, which enhances the security of communication between blockchain nodes.
  • the blockchain relay communication network system does not need to perform complex decapsulation or parsing processes after obtaining the encrypted message. Instead, it can directly forward the encrypted message based on the IP header at the network layer, and the entire source blockchain node The data transfer process to the destination blockchain node does not add additional computing overhead, achieving efficient data transfer.
  • Figure 1 is a schematic diagram of a scenario in which blockchain nodes interact through a blockchain relay communication network system provided by an exemplary embodiment.
  • Figure 2 is a flow chart of a message transmission method based on a blockchain relay communication network system provided by an exemplary embodiment.
  • Figure 3 is a flow chart of another message transmission method based on a blockchain relay communication network system provided by an exemplary embodiment.
  • Figure 4 is a flow chart of yet another message transmission method based on a blockchain relay communication network system provided by an exemplary embodiment.
  • Figure 5 is a flow chart of yet another message transmission method based on a blockchain relay communication network system provided by an exemplary embodiment.
  • Figure 6 is an interactive flow chart of a message transmission method based on a blockchain relay communication network system provided by an exemplary embodiment.
  • Figure 7 is a schematic architectural diagram of a message transmission system based on a blockchain relay communication network system provided by an exemplary embodiment.
  • Figure 8 is a schematic structural diagram of a device provided by an exemplary embodiment.
  • Figure 9 is a block diagram of a message transmission device based on a blockchain relay communication network system provided by an exemplary embodiment.
  • Figure 10 is a block diagram of another message transmission device based on a blockchain relay communication network system provided by an exemplary embodiment.
  • Figure 11 is a block diagram of yet another message transmission device based on a blockchain relay communication network system provided by an exemplary embodiment.
  • the blockchain relay communication network system involved in the embodiments of this specification refers to the backbone relay communication network system oriented to real-time transmission of the blockchain, which may also be called a blockchain relay communication network or a blockchain relay communication network.
  • the external docking terminal is the blockchain node in the blockchain network.
  • the types of the above-mentioned blockchain network can include public chains, private chains, alliance chains, etc.
  • the blockchain relay communication network used in the public chain mainly includes Falcon, Fast Bitcoin Relay Network (FBRN), Fast Internet Bitcoin Relay Engine (FIBRE), etc.
  • the blockchain relay communication network used in the alliance chain mainly includes Including BloXRoute, Blockchain Transmission Network (BTN), etc. This manual does not limit the blockchain relay communication network used.
  • TLS Transport Layer Security, Transport Layer Security Protocol
  • blockchain node Node 1 needs to send a blockchain message to blockchain node Node 2
  • Node 1 serves as the source blockchain node
  • Node 2 serves as the destination blockchain node.
  • Node 1 and Node 2 can perform key negotiation based on the TLS protocol, thereby establishing a TLS link between Node 1 and Node 2 based on the negotiated transmission key.
  • the blockchain messages are in ciphertext state (encrypted by the above-mentioned transmission key) when transmitted within the TLS link, and only Node 1 and Node 2 holding the transmission key can decrypt the corresponding message plaintext. .
  • Figure 1 is a schematic diagram of a scenario in which blockchain nodes interact through a blockchain relay communication network system according to an exemplary embodiment.
  • the blockchain relay communication network system contains three relay nodes, namely relay node a, relay node b and relay node c.
  • relay node a and blockchain node Node A is connected through TLS link 1
  • relay node b is connected to blockchain node Node B through TLS link 2
  • relay node b is also connected to blockchain node Node Node D through TLS link 3
  • relay node Node c is connected to the blockchain node Node Node C through TLS link 4.
  • relay node a, relay node b, and relay node c are connected to each other through high-speed links (large-bandwidth, low-latency non-encrypted links). Since a TLS link is established between the relay node inside the blockchain relay communication network and the blockchain node as the external terminal of the blockchain relay communication network, during the transmission process of the TLS link, even if the message Intercepted by the attacker. Since the attacker did not participate in the key negotiation process for the corresponding key of the encrypted link, the attacker cannot decrypt the message before encryption. However, for the relay node, since it participates in the key negotiation process, it can decrypt to obtain the message of the blockchain node before it is encrypted by the key corresponding to the encryption link.
  • a common approach is to use asymmetric encryption to protect messages at the application layer of the source blockchain node and the destination blockchain node.
  • this method adds additional computing overhead and does not Conducive to efficient data transmission, it violates the original intention of the blockchain relay communication network to accelerate the data transmission process.
  • this specification proposes a message transmission scheme based on the blockchain relay communication network system, which uses a shared key shared only within the blockchain node group to The information is encrypted so that the source blockchain node and the destination blockchain node can avoid exposing plaintext information to the blockchain relay communication network system when transmitting data, thereby enhancing the security of communication between blockchain nodes.
  • the entire data transfer process does not add additional computing overhead, achieving efficient data transfer.
  • FIG. 2 is a flow chart of a message transmission method based on a blockchain relay communication network system provided by an exemplary embodiment, wherein the blockchain relay communication network system communicates with the source blockchain node and destination respectively.
  • Blockchain nodes are connected, each block chain node in the block chain node group to which the source block chain node and the destination block chain node belong maintain the same shared key, and in the block chain
  • the relay node in the relay communication network system does not maintain the shared key; the method includes:
  • the source blockchain node encrypts plaintext information based on the shared key to obtain encrypted information, encapsulates an IP header for the encrypted information to generate an encrypted message, and sends the encrypted message to the block Chain relay communication network system.
  • the operations of the source blockchain node to encrypt the plaintext information and encapsulate the IP header are all implemented based on the network layer protocol, that is, the plaintext information specifically refers to the network layer IP packet containing the IP header. message or network layer IP message with the IP header removed.
  • This plain text information can be directly forwarded at the network layer if it contains the IP header.
  • the encrypted information obtained by encrypting it does not have an IP header. Therefore, in order to enable the encrypted information to be correctly forwarded to the destination blockchain node at the network layer, it is necessary to encapsulate the IP for the encrypted information. header to generate an encrypted message.
  • the IP header is created based on the network information of the blockchain relay communication network system.
  • the original message involved in the embodiment of this specification belongs to the above-mentioned network layer IP message containing an IP header.
  • the source IP address contained in the original IP header corresponding to the original message is the IP address of the source blockchain node, and the original The destination IP address contained in the IP header is the IP address corresponding to the destination blockchain node.
  • the original message containing the original IP header is encrypted as plain text information as encrypted information
  • the IP header re-encapsulated by the source blockchain node for the encrypted information needs to refer to the blockchain relay network System network information.
  • the re-encapsulated IP header can be The source IP address is set to the IP address of the source relay node, and the destination IP address in the re-encapsulated IP header is set to the IP address of the destination blockchain node, so that the encrypted message can be used in the blockchain relay communication network system
  • the IP address of the source blockchain node is hidden from the blockchain relay communication network system, which plays a certain role in information protection.
  • the IPsec ESP Internet Protocol Security, Encapsulation Security Protocol
  • IPsec ESP Internet Protocol Security, Encapsulation Security Protocol
  • the source blockchain node first determines the blockchain node group to which the destination blockchain node belongs, obtains the shared key corresponding to the blockchain node group, and pairs the original
  • the message is encrypted to obtain the encrypted information, and the encrypted information is encapsulated with an ESP header and an ESP tail.
  • the ESP header carries the SPI (security parameters index) corresponding to the blockchain node group.
  • the ESP tail includes some padding data and the padding length corresponding to the padding data.
  • the structure obtained at this time consisting of the ESP header, encryption information and ESP tail is called enchilada (authentication area structure).
  • the source blockchain node further calculates a hash digest for the authentication zone structure, and encapsulates the hash digest at the end of the authentication zone structure. Finally, based on this, a new authentication zone structure containing the hash digest is encapsulated.
  • IP header to generate an encrypted message.
  • the destination IP address and source IP address in the new IP header can be the same as or different from the destination IP address and source IP address in the original IP header.
  • the protocol type contained in the new IP header is 50, indicating that it contains is an IPsec message.
  • the IP header is the original IP header.
  • the IPsec ESP protocol in transport mode can be used to implement the embodiments of this specification. Under the IPsec ESP protocol in transport mode, the source blockchain node first determines the blockchain node group to which the destination blockchain node belongs, obtains the shared key corresponding to the blockchain node group, and pairs it based on the shared key The original message with the original IP header removed is encrypted to obtain the encrypted information.
  • the encrypted information is encapsulated with an ESP header and an ESP trailer to generate an authentication zone structure.
  • the authentication zone is The hash digest corresponding to the structure is encapsulated at the tail of the authentication zone structure, and the original IP header is encapsulated at the head of the authentication zone structure to generate an encrypted message.
  • the encrypted messages involved in the embodiments of this specification can be generated based on the IPsec ESP protocol, specifically including the IPsec ESP protocol in transport mode or the IPsec ESP protocol in tunnel mode, thereby taking into account data integrity during the data transfer process. properties, and anti-replay attacks.
  • the source blockchain node After the source blockchain node generates an encrypted message containing an IP header, it can send the encrypted message to the blockchain relay communication network system, so that the relay communication network system can communicate based on the IP header.
  • the encrypted message is forwarded and ultimately routed to the destination blockchain node.
  • the blockchain nodes as external terminals of the blockchain relay communication network system can be managed according to the group management method of the blockchain node group, so that all nodes in the same blockchain node group Each blockchain node maintains the same shared key.
  • several blockchain nodes can maintain a common shared key through group key negotiation in advance, and thus be organized into a blockchain node group based on online negotiation; or, several blockchain nodes can be organized offline The same key is manually entered as a shared key, and is organized into a blockchain node group based on offline entry; or, the node devices where several blockchain nodes are located are bound to the same key.
  • these several blockchain nodes will read the same key from the node device where they are located and use it as a shared key, and then they will be jointly organized into a blockchain node group based on device binding.
  • they will first encrypt the plaintext information according to the jointly maintained shared key to obtain the encrypted information, and then encapsulate the IP header for the encrypted information to generate Encrypt the message, and finally transmit the encrypted message. From this point on, no matter whether the encrypted message undergoes any processing during the transmission process or is stolen by an attacker, since the shared key is only used by the blockchain within the same blockchain node group, It is maintained by the node, so the possibility of plain text information being exposed during the data transfer process is theoretically eliminated.
  • the shared key involved in the embodiments of this specification is a symmetric key. Therefore, when a blockchain node receives encrypted messages from other blockchain nodes belonging to the same blockchain node group, it can directly use the shared key based on the shared key. Decrypt the key to obtain the plain text information.
  • the same blockchain node can belong to multiple different blockchain node groups at the same time. Therefore, for any blockchain node, it can locally maintain multiple nodes that it belongs to. List of members of the blockchain node group and their corresponding shared keys.
  • the source blockchain node When the source blockchain node needs to transmit data to the destination blockchain node, the source blockchain node first searches for at least one pre-maintained blockchain node group locally and determines the relationship between itself and the destination blockchain node.
  • the blockchain node group to which they belong together (there may be multiple), and then the plaintext information is encrypted based on the shared key corresponding to the blockchain node group that is maintained locally to obtain the encrypted information, and then the IP header is further encapsulated To generate an encrypted message, so that after receiving the encrypted message, the destination blockchain node can decrypt it and obtain the plaintext information based on the shared key of the blockchain node group.
  • S204 The blockchain relay communication network system forwards the encrypted message to the destination blockchain node based on the IP header.
  • the blockchain relay communication network system is connected to the source blockchain node and the destination blockchain node through non-encrypted links respectively, which means that the relay in the blockchain relay communication network system
  • the node does not need to undertake the work of decrypting the encrypted message, but only needs to decapsulate it to the network layer and forward the encrypted message based on the destination IP address in the IP header (that is, the IP address of the destination blockchain node), thereby making the encryption Messages achieve efficient data transmission within the blockchain relay network system.
  • the blockchain relay communication network system is a relay node; or,
  • the blockchain relay communication network system includes a source relay node and a destination relay node.
  • the source relay node is connected to the source blockchain node, and the destination relay node is connected to the destination blockchain node.
  • the blockchain relay communication network system forwards the encrypted message to the destination blockchain node based on the IP header, including:
  • the source relay node sends the encrypted message received from the source blockchain node to the destination relay node;
  • the destination relay node sends the encrypted message to the destination blockchain node.
  • the blockchain relay communication network system may include at least one relay node, and in the case of only one relay node, the relay node communicates with the source blockchain node and the destination blockchain at the same time.
  • the nodes have established connections respectively; and in the case where the blockchain relay communication network system includes at least two relay nodes including an active relay node and a destination relay node, the source relay node and the source relay node.
  • the blockchain nodes are connected, the destination relay node is connected to the destination blockchain node, and the relay nodes within the blockchain relay communication network system will also be connected through high-speed links (large bandwidth, Low-latency non-encrypted links), therefore, encrypted messages can be routed and forwarded through high-speed links in the blockchain relay communication network system, during which each relay node does not involve other than forwarding and routing of encrypted messages.
  • the calculation process enables the encrypted message to be efficiently forwarded to the destination relay node.
  • the destination blockchain node decrypts the encrypted message based on the shared key to obtain the plaintext information.
  • the blockchain relay communication is received at the destination blockchain node.
  • the encrypted message can be decrypted based on the shared key to finally obtain the plaintext information.
  • the entire process of the message transmission solution based on the blockchain relay communication network system is realized.
  • the destination blockchain node When the source blockchain node generates encrypted messages based on the IPsec ESP protocol, the destination blockchain node also needs to process the encrypted messages based on the IPsec ESP protocol. For example, under IPsec ESP in tunnel mode, after receiving the encrypted message, the destination blockchain node checks that the protocol type in the IP header is 50, so it knows that this is an IPsec packet. Therefore, the destination blockchain node first performs a hash operation on the authentication area structure contained in the encrypted information to obtain a hash digest, compares it with the hash digest at the end of the encrypted message, and confirms if the comparison is consistent. The authentication zone structure in the encrypted message has not been tampered with.
  • the destination blockchain node further checks the ESP header in the authentication zone structure, and determines the next need to use SA (security assist, security association strategy) through the SPI contained in the ESP header, because the SPI corresponds to the source block
  • SA security assist, security association strategy
  • the chain node and the destination blockchain node jointly belong to the blockchain node group. Therefore, the destination blockchain node retrieves the local pre-stored SA corresponding to the blockchain node group and obtains the corresponding blockchain node group from it.
  • the shared key and corresponding decryption method After removing the ESP header and ESP trailer from the authentication area structure, the encrypted information is obtained.
  • the encrypted information is decrypted according to the decryption method and shared key in the retrieved SA to obtain the plaintext information.
  • the plaintext information still contains an original IP header.
  • the destination blockchain node can further forward the plaintext information based on the obtained original IP header.
  • the destination blockchain node Under IPsec ESP in transport mode, after receiving the encrypted message, the destination blockchain node checks that the protocol type in its IP header is 50, so it knows that this is an IPsec packet. Therefore, similar to IPsec ESP in tunnel mode, the destination blockchain node first performs a hash operation on the authentication zone structure contained in the encrypted information to obtain a hash digest, and compares it with the hash digest at the end of the encrypted message. If the comparison is consistent, it is confirmed that the authentication area structure in the encrypted message has not been tampered with. Then, the destination blockchain node further checks the ESP header in the authentication zone structure, and retrieves the corresponding shared key and corresponding decryption method locally through the SPI contained in the ESP header. The encrypted information obtained by removing the ESP header and ESP trailer from the authentication area structure is decrypted according to the corresponding decryption method and shared key to obtain plaintext information. The plaintext information does not contain other IP headers.
  • the source blockchain node and the destination blockchain node are connected through the blockchain relay communication network system.
  • the source blockchain node and the destination blockchain node belong to the same blockchain node group.
  • the same shared key is maintained, which allows the source blockchain node to use the shared key for encryption when it needs to send plaintext information to the destination blockchain node, ensuring the confidentiality of the system, and due to the blockchain relay communication All relay nodes in the network do not maintain this shared key, which makes it impossible for relay nodes in the relay network system to directly obtain plaintext information through decryption, thereby preventing the plaintext information from being transmitted through the blockchain relay communication network system.
  • the process is exposed, which enhances the security of communication between blockchain nodes.
  • the blockchain relay communication network system does not need to perform complex decapsulation or parsing processes after obtaining the encrypted message. Instead, it can directly forward the encrypted message based on the IP header at the network layer, and the entire source blockchain node The data transfer process to the destination blockchain node does not add additional computing overhead, achieving efficient data transfer.
  • the shared key is maintained at each blockchain node through group key negotiation by each blockchain node in the blockchain node group.
  • each blockchain node belonging to the same blockchain node group realizes joint maintenance of a shared key by performing group key negotiation in advance.
  • Group key agreement is different from the end-to-end key agreement between two peers, but refers to the key agreement between at least three peers.
  • the purpose is to enable at least three peers to communicate through online interaction.
  • the peers jointly maintain the same shared key, while preventing the shared key from being leaked to third parties other than the at least three peers.
  • the protocols corresponding to the end-to-end key negotiation involved in the embodiments of this specification may include TLS protocol, IKE (Internet key exchange, network key exchange protocol) protocol, DH (Diffie-Hellman) key exchange protocol, etc. This specification will This is not a limitation.
  • each blockchain node in the blockchain node group performs group key negotiation, including: the master node in the blockchain node group communicates with each node in the blockchain node group except the master node.
  • Other blockchain nodes other than the node jointly maintain the shared key through key negotiation.
  • a method for group key negotiation is provided. In this method, it is first necessary to determine a master node in the blockchain node group as the host of the group key negotiation. Then, the master node will Conduct end-to-end key negotiation with other blockchain nodes (slave nodes) in the blockchain node group except the master node.
  • Node A serves as the master node and wants to form a blockchain node group including Node A, Node B and Node C
  • Node A can interact with Node B and Node C respectively or simultaneously.
  • Key negotiation, and the shared key maintained by Node B after key negotiation is the same as the shared key maintained by Node C after key negotiation.
  • Node A itself will also maintain the shared key, so that ultimately This allows Node A, Node B and Node C to maintain the same shared key, thereby jointly participating in forming a new blockchain node group.
  • the master node conducts key negotiation with any blockchain node (slave node) among the other blockchain nodes, including: the master node and any blockchain node communicate through DH
  • the key exchange protocol generates and maintains the shared key; or, the master node and any blockchain node jointly maintain the session key through the DH key exchange protocol, and transfers the session key generated by the master node to
  • the shared key is encrypted based on the session key and sent to any blockchain node, and the any blockchain node is used to decrypt the encrypted shared key based on the session key to Get the shared secret key.
  • the master node when the master node performs key negotiation with any slave node, it can jointly maintain the same shared key directly or indirectly based on the DH key exchange protocol.
  • the DH key exchange protocol is a type of A scheme for generating symmetric keys in an insecure network, which mainly uses the method of two key negotiation parties to disclose generators and publicly computable values to each other, so that each key negotiation party can calculate only the key negotiation Only the other party can learn the same key seed, thereby further generating and maintaining the same symmetric key based on the same key seed.
  • the master node and the slave node can use the keys directly generated by each other through the DH key exchange protocol as a shared key, so that the master node and the slave node maintain the same shared key.
  • the shared key obtained through the DH key exchange protocol each time is uncertain, in order to ensure that the master node and all other slave nodes maintain the same shared key, this is done directly through the DH key agreement protocol.
  • the method of directly generating a shared key is usually only used when the master node performs key negotiation with the first slave node during the group key negotiation process. Subsequently, other methods need to be used to ensure that all slave nodes can maintain the same key. Shared key.
  • the master node and the slave node can first use the key directly generated by the DH key exchange protocol as the session key for subsequent encrypted communication. At this time, the master node can use the randomly generated key.
  • the symmetric key is used as a shared key (or a shared key generated through key negotiation with the first slave node) and is encrypted by the session key and sent to the slave node, so that the slave node decrypts it according to the session key maintained by itself.
  • Shared key and since the session key generated directly by the DH key exchange protocol is not directly used as a shared key, but as a basis for building encrypted communication, this allows each slave node in the blockchain node group to pass This method maintains the same shared key, ultimately achieving group key agreement.
  • the shared key and/or the session key are recorded in the security association policy maintained by the master node and any blockchain node.
  • different security association strategies need to be applied to different types of messages so that they can be encrypted in a prescribed manner.
  • the security involved in the embodiments of this specification The association policy specifically refers to the SA (security assist) in the IKE protocol.
  • SAs security assist
  • Different SAs can be indexed through the SPI (security parameters index) field on the message to be processed.
  • messages used for key negotiation (such as messages sent during the DH key negotiation process) can be set to be encrypted with the session key, so the SPI field on the corresponding message will point to the session key.
  • Security association strategy for encryption and decryption using the key messages used for ordinary communication can be set to be encrypted through the shared key, so the SPI field on the message corresponding to such a message will point to the corresponding blockchain node.
  • Security association policy for encryption and decryption using the shared key corresponding to the group
  • the master node conducts key negotiation with any blockchain node (slave node) among the other blockchain nodes, including: the master node generates the shared key and transfers the The ciphertext key obtained by encrypting the shared key based on the public key of any blockchain node is sent to the any blockchain node; the any blockchain node encrypts the ciphertext key based on the Decrypt the private key of any blockchain node to obtain the shared key.
  • the key negotiation between the master node and the slave node is realized through the asymmetric encryption feature, while avoiding leaking the shared key to other third parties during the key negotiation process, so as to further realize the group operation. Key agreement.
  • any other blockchain node encrypts the shared key based on the public key of the master node and returns it to the master node; the master node encrypts the shared key based on the private key of the master node.
  • the encrypted shared key obtained from any other blockchain node is decrypted to obtain the shared key, it is determined that the key negotiation with any other blockchain node has been completed. .
  • the slave node decrypts and obtains the shared key, although objectively both the master node and the slave node have maintained the same shared key at this time, the master node cannot actually determine that the slave node has maintained the shared key without receiving the relevant certificate.
  • the slave node can further use the master node's public key to encrypt and return after decrypting the shared key. to the master node, and after the master node decrypts and obtains the shared key, it can be determined that the slave node has successfully obtained the shared key, which facilitates the arrangement of subsequent key negotiation tasks, or determines that the group key negotiation has been completed (in the determination area When all slave nodes in the blockchain node group maintain shared keys).
  • the master node generates a digital signature for the ciphertext key based on the private key of the master node, and sends the digital signature to any blockchain node;
  • a blockchain node verifies the digital signature based on the public key of the master node, and determines that the ciphertext key originates from the master node if the signature verification is successful.
  • digital signature technology can be used to enable the master node to digitally sign the ciphertext key , and then the slave node verifies the digital signature, and determines the legitimacy of the source of the ciphertext key if the verification is successful. It also ensures that the ciphertext key has not been tampered with during the transmission process.
  • each of the blockchain nodes is respectively connected to at least one relay node in the blockchain relay communication network system, and each blockchain node needs to interact with at least part of the negotiation when performing group key negotiation.
  • Messages are forwarded via the blockchain relay communication network system.
  • the blockchain nodes in the blockchain node group before they perform encrypted message transmission through shared keys, they also need to send some negotiation messages to each other when performing group key negotiation, such as The generators and publicly computed values in the DH key agreement protocol, or the key ciphertext in the asymmetric encryption method, and at least some of these negotiation messages can be forwarded through the blockchain relay communication network system. Due to the block Chain relay communication network systems usually have high message transmission efficiency, thus speeding up the efficiency of group key negotiation.
  • negotiation messages that the above-mentioned blockchain nodes need to interact when performing group key negotiation can also directly go through other dedicated lines or public networks outside the blockchain relay communication network system; or, part of these negotiation messages can be sent through the blockchain
  • the chain relay communication network system is used for forwarding, and the other part is forwarded through other dedicated lines or public networks.
  • the source blockchain node and the destination blockchain node are in the same blockchain network or different blockchain networks. It should be pointed out that blockchain node groups and blockchain networks are not the same concept, which means that blockchain node members belonging to the same blockchain node group are not necessarily in the same blockchain network. Each blockchain node in the same blockchain network is not necessarily in the same blockchain node group.
  • the original intention of the blockchain node group involved in the embodiments of this specification is to realize secure communication among members of the blockchain node group.
  • the source blockchain node and the destination blockchain node are in different blockchain networks
  • the source blockchain network where the source blockchain node is located and the destination blockchain node Whether the intended blockchain network is homogeneous or heterogeneous, the blockchain nodes in the blockchain node group are not required to have the same blockchain architecture, that is, each blockchain node in a blockchain node group
  • the multiple blockchain networks involved do not necessarily need to be isomorphic and have the same blockchain protocol, consensus protocol, etc.
  • the multiple blockchain networks involved can also be heterogeneous.
  • heterogeneous blockchains in a narrow sense usually refer to obvious differences in the values circulating on the blockchain; that is, between two blockchains with obvious differences in the values circulating, it is usually possible to Call it a heterogeneous blockchain.
  • the Bitcoin network and Ethereum are heterogeneous blockchains in a narrow sense.
  • Heterogeneous blockchain in a broad sense means that there are obvious differences in the types of blockchains and/or the blockchain protocols adopted; that is, there are obvious differences in the types of blockchains and/or the blockchain protocols adopted. Between two blockchains, it can usually be called a heterogeneous blockchain.
  • ANT CHAIN and hyperledger fabric blockchain are heterogeneous blockchains in a broad sense.
  • the message transmission method based on the blockchain relay communication network system involved in the embodiments of this specification can be implemented based on the network layer protocol.
  • the network layer protocol can be IPsec (Internet Protocol Security, Internet Security Protocol), specifically the IPsec ESP protocol.
  • IPsec Internet Protocol Security, Internet Security Protocol
  • the encryption and decryption process based on the shared key and the encapsulation process of the IP header all occur at the network layer, compared with the application layer protocol, transport layer protocol or TLS protocol, the blockchain relay communication network in the embodiment of this specification
  • the system does not need to deeply decapsulate and parse forwarded messages (i.e. encrypted messages), but only needs to decapsulate them to the network layer and forward them directly based on the IP header, which has a small performance loss on forwarding efficiency.
  • the encrypted objects in the network layer are IP messages
  • the encrypted objects in the application layer protocol are data structures defined by the application
  • the encryption scope of the network layer protocol (including application layer encapsulation, transport layer encapsulation, etc.) are larger and have stronger data protection capabilities.
  • FIG 3 is a flow chart of another message transmission method based on a blockchain relay communication network system provided by an exemplary embodiment. As shown in Figure 3, this method is applied to the source blockchain node.
  • the blockchain relay communication network system is connected to the source blockchain node and the destination blockchain node respectively.
  • the source blockchain node Each blockchain node in the blockchain node group to which the destination blockchain node belongs maintains the same shared key, and the relay node in the blockchain relay communication network system does not maintain any the shared key; the method includes:
  • S302 Encrypt plaintext information based on the shared key to obtain encrypted information.
  • S304 Encapsulate the IP header for the encrypted information to generate an encrypted message.
  • S306 Send the encrypted message to the blockchain relay communication network system, which is used to forward the encrypted message to the destination block based on the IP header. chain node.
  • Figure 4 is a flow chart of yet another message transmission method based on a blockchain relay communication network system provided by an exemplary embodiment. As shown in Figure 4, this method is applied to the destination blockchain node.
  • the blockchain relay communication network system is connected to the source blockchain node and the destination blockchain node respectively.
  • the source blockchain node Each blockchain node in the blockchain node group to which the destination blockchain node belongs maintains the same shared key, and the relay node in the blockchain relay communication network system does not maintain any the shared key; the method includes:
  • S402 Receive the encrypted message forwarded to the destination blockchain node by the blockchain relay communication network system based on the IP header of the encrypted message.
  • the encrypted message is forwarded by the source blockchain node based on the IP header of the encrypted message.
  • the encrypted information obtained by encrypting the plain text information with the shared key is encapsulated in the IP header to generate.
  • FIG. 5 is a flow chart of yet another message transmission method based on a blockchain relay communication network system provided by an exemplary embodiment. As shown in Figure 5, this method is applied to the blockchain relay communication network system.
  • the blockchain relay communication network system is connected to the source blockchain node and the destination blockchain node respectively.
  • the source area The blockchain node and each blockchain node in the blockchain node group to which the destination blockchain node belongs maintain the same shared key, and the relay node in the blockchain relay communication network system has not The shared key is maintained; the method includes:
  • S502 Receive the encrypted message generated by the source blockchain node by encapsulating the IP header with the encrypted information obtained by encrypting the plaintext information based on the shared key.
  • S504 Forward the encrypted message to the destination blockchain node based on the IP header.
  • Figure 6 is an interactive flow chart of a message transmission method based on a blockchain relay communication network system provided by an exemplary embodiment.
  • Figure 6 is based on the mutual cooperation between Node A, relay node a, relay node b and Node B in the scenario shown in Figure 1. It is assumed that Node A is the source blockchain node, and Node A locally maintains a Members also include the shared key key_1 corresponding to the blockchain node groups of Node A and Node B. Assume that Node B is the destination blockchain node, and Node B also maintains the shared key key_1 locally.
  • the blockchain Relay node a as the source relay node in the relay communication network system is connected to Node A
  • relay node b as the destination relay node in the blockchain relay communication network system is connected to Node B
  • the relay node A and relay node b are connected through a high-speed link.
  • Node A locally searches for the blockchain node group that belongs to the same blockchain node group as Node B, and determines the shared key key_1 corresponding to the same blockchain node group, and encrypts the original information original_msg based on the shared key key_1 and encapsulates the new IP.
  • the header gets the encrypted message encrypted_msg, in which the source IP address in the newly encapsulated IP header is the IP address of relay node a, and the destination IP address is the IP address of Node B.
  • Node A sends encrypted_msg to relay node a.
  • relay node a After relay node a receives encrypted_msg, it searches the local routing table based on the destination IP address in its IP header (Node B's IP address) and finds that the next hop is relay node b, so it passes encrypted_msg directly to each other. The connected high-speed link is sent to relay node b.
  • encrypted_msg can also be forwarded to relay node b via relay node c according to other routing strategies (for example, supporting load balancing).
  • relay node b After receiving the encapsulated encrypted_msg, relay node b determines through its IP header that the destination it needs to send is Node B, and relay node b itself also has routing information leading to Node B, so the relay node b Node B further forwards encrypted_msg to Node B.
  • Node B After Node B receives encrypted_msg, it finds that the destination of the encrypted message is itself through its IP header, so it decapsulates the IP header and further obtains the blockchain corresponding to the encrypted_msg used to encrypt and decrypt the encrypted message.
  • the index field of the node group (such as SPI), Node B indexes to the corresponding blockchain node group, and uses the shared key key_1 corresponding to the blockchain node group to decrypt encrypted_msg to obtain original_msg.
  • FIG. 7 is a schematic architectural diagram of a message transmission system based on a blockchain relay communication network system provided by an exemplary embodiment.
  • the blockchain relay communication network system 702 is connected to the source blockchain node 701 and the destination blockchain node 703 respectively.
  • the source blockchain node 701 and the destination blockchain node Each blockchain node in the blockchain node group to which 703 belongs maintains the same shared key, and the relay node in the blockchain relay communication network system 702 does not maintain the shared key; so
  • the systems described include:
  • the source blockchain node 701 is configured to encrypt plaintext information based on the shared key to obtain encrypted information, encapsulate an IP header for the encrypted information to generate an encrypted message, and send the encrypted message to the Blockchain relay communication network system 702.
  • the blockchain relay communication network system 702 is used to forward the encrypted message to the destination blockchain node 703 based on the IP header.
  • the destination blockchain node 703 is configured to decrypt the encrypted message based on the shared key to obtain the plaintext information.
  • the blockchain relay communication network system 702 is a relay node; or,
  • the blockchain relay communication network system 702 includes a source relay node 7021 and a destination relay node 7022.
  • the source relay node 7021 is connected to the source blockchain node 701, and the destination relay node 7022 is connected to the destination area.
  • the blockchain node 703 is connected, and the blockchain relay communication network system 702 forwards the encrypted message to the destination blockchain node 703 based on the IP header, including:
  • the source relay node 7021 sends the encrypted message received from the source blockchain node 701 to the destination relay node 7022;
  • the destination relay node 7022 sends the encrypted message to the destination blockchain node 703.
  • the shared key is maintained at each blockchain node through group key negotiation by each blockchain node in the blockchain node group.
  • each of the blockchain nodes is connected to at least one relay node in the blockchain relay communication network system 702, and at least part of the interaction required by each of the blockchain nodes during group key negotiation is The negotiation message is forwarded via the blockchain relay communication network system 702.
  • each blockchain node in the blockchain node group conducts group key negotiation, including:
  • the master node in the blockchain node group jointly maintains the shared key through key negotiation with other blockchain nodes in the blockchain node group except the master node.
  • the master node conducts key negotiation with any of the other blockchain nodes, including:
  • the master node and any blockchain node generate and maintain the shared key through a DH key exchange protocol; or,
  • the master node and any blockchain node jointly maintain a session key through the DH key exchange protocol, and encrypt the shared key generated by the master node based on the session key and send it to the Any blockchain node, the any blockchain node is configured to decrypt the encrypted shared key based on the session key to obtain the shared key.
  • the shared key and/or the session key are recorded in the security association policy maintained by the master node and any blockchain node.
  • the master node conducts key negotiation with any of the other blockchain nodes, including:
  • the master node generates the shared key and sends the ciphertext key obtained by encrypting the shared key based on the public key of any blockchain node to the any blockchain node;
  • the any blockchain node decrypts the ciphertext key based on the private key of any blockchain node to obtain the shared key.
  • Optional also includes:
  • the master node generates a digital signature for the ciphertext key based on the private key of the master node, and sends the digital signature to any blockchain node;
  • the any blockchain node verifies the digital signature based on the public key of the master node, and determines that the ciphertext key originates from the master node if the signature verification is successful.
  • the source blockchain node 701 and the destination blockchain node 703 are in the same blockchain network or different blockchain networks.
  • the source blockchain network where the source blockchain node 701 is located is the same as the source blockchain node 703.
  • the destination blockchain network where the destination blockchain node 703 is located may be homogeneous or heterogeneous.
  • the IP header is created based on the network information of the blockchain relay communication network system 702;
  • the IP header is the original IP header.
  • the encrypted message is generated based on IPsec ESP protocol.
  • Figure 8 is a schematic structural diagram of a device provided by an exemplary embodiment. Please refer to Figure 8.
  • the device includes a processor 802, an internal bus 804, a network interface 806, a memory 808 and a non-volatile memory 810.
  • the processor 802 reads the corresponding computer program from the non-volatile memory 810 into the memory 808 and then runs it.
  • the execution subject of the following processing flow is not limited to each A logic unit can also be a hardware or logic device.
  • Figure 9 is a block diagram of a message transmission device based on a blockchain relay communication network system provided by an exemplary embodiment.
  • This device can be applied to the equipment shown in Figure 8 to implement The technical solution of this specification; the device is applied to a source blockchain node, the blockchain relay communication network system is connected to the source blockchain node and the destination blockchain node respectively, and the source blockchain Each blockchain node in the blockchain node group to which the node and the destination blockchain node belong maintains the same shared key, and the relay node in the blockchain relay communication network system does not maintain a shared key.
  • the shared key; the device includes:
  • the plaintext information encryption unit 901 is configured to encrypt plaintext information based on the shared key to obtain encrypted information.
  • the encrypted message generating unit 902 is configured to encapsulate an IP header for the encrypted information to generate an encrypted message.
  • the encrypted message sending unit 903 is used to send the encrypted message to the blockchain relay communication network system, and the blockchain relay communication network system is used to forward the encrypted message based on the IP header. to the destination blockchain node.
  • Figure 10 is a block diagram of another message transmission device based on the blockchain relay communication network system provided by an exemplary embodiment.
  • This device can be applied to the equipment shown in Figure 8, to Implement the technical solution of this specification; the device is applied to a destination blockchain node, the blockchain relay communication network system is connected to the source blockchain node and the destination blockchain node respectively, and the source block
  • Each blockchain node in the blockchain node group to which the chain node and the destination blockchain node belong maintains the same shared key, and the relay node in the blockchain relay communication network system is not maintained.
  • the shared key the device includes:
  • the first encrypted message receiving unit 1001 is configured to receive the encrypted message forwarded by the blockchain relay communication network system to the destination blockchain node based on the IP header of the encrypted message, where the encrypted message is forwarded by the
  • the source blockchain node encapsulates the IP header to generate the encrypted information obtained by encrypting the plaintext information based on the shared key.
  • the encrypted message decryption unit 1002 is configured to decrypt the encrypted message based on the shared key to obtain the plaintext information.
  • FIG 11 is a block diagram of yet another message transmission device based on a blockchain relay communication network system provided by an exemplary embodiment.
  • This device can be applied to the equipment shown in Figure 8, to Implement the technical solution of this specification; the device is applied to the blockchain relay communication network system, and the blockchain relay communication network system is connected to the source blockchain node and the destination blockchain node respectively, and the Each blockchain node in the blockchain node group to which the source blockchain node and the destination blockchain node belong maintains the same shared key, and the relay in the blockchain relay communication network system The node does not maintain the shared key; the device includes:
  • the second encrypted message receiving unit 1101 is configured to receive an encrypted message generated by the source blockchain node by encapsulating the IP header of the encrypted information obtained by encrypting the plaintext information based on the shared key.
  • the encrypted message forwarding unit 1102 is configured to forward the encrypted message to the destination blockchain node based on the IP header.
  • PLD Programmable Logic Device
  • FPGA Field Programmable Gate Array
  • HDL Hardware Description Language
  • the controller may be implemented in any suitable manner, for example, the controller may take the form of, for example, a microprocessor or processor and a computer readable medium storing computer readable program code (eg, software or firmware) executable by the (micro)processor. , logic gates, switches, Application Specific Integrated Circuit (ASIC), programmable logic controllers and embedded microcontrollers.
  • controllers include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, For Microchip PIC18F26K20 and Silicone Labs C8051F320, the memory controller can also be implemented as part of the memory's control logic.
  • the controller in addition to implementing the controller in the form of pure computer-readable program code, the controller can be completely programmed with logic gates, switches, application-specific integrated circuits, programmable logic controllers and embedded logic by logically programming the method steps. Microcontroller, etc. to achieve the same function. Therefore, this controller can be considered as a hardware component, and the devices included therein for implementing various functions can also be considered as structures within the hardware component. Or even, the means for implementing various functions can be considered as structures within hardware components as well as software modules implementing methods.
  • the systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions.
  • a typical implementation device is a server system.
  • the computer that implements the functions of the above embodiments may be, for example, a personal computer, a laptop computer, a vehicle-mounted human-computer interaction device, a cellular phone, a camera phone, a smart phone, or a personal digital assistant. , media player, navigation device, email device, game console, tablet, wearable device, or a combination of any of these devices.
  • the functions are divided into various modules and described separately.
  • the functions of each module can be implemented in the same or multiple software and/or hardware, or the modules that implement the same function can be implemented by a combination of multiple sub-modules or sub-units, etc. .
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined or integrated. to another system, or some features can be ignored, or not implemented.
  • the coupling or direct coupling or communication connection between each other shown or discussed may be through some interfaces, and the indirect coupling or communication connection of the devices or units may be in electrical, mechanical or other forms.
  • These computer program instructions may also be stored in a computer-readable memory that causes a computer or other programmable data processing apparatus to operate in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction means, the instructions
  • the device implements the functions specified in a process or processes of the flowchart and/or a block or blocks of the block diagram.
  • These computer program instructions may also be loaded onto a computer or other programmable data processing device, causing a series of operating steps to be performed on the computer or other programmable device to produce computer-implemented processing, thereby executing on the computer or other programmable device.
  • Instructions provide steps for implementing the functions specified in a process or processes of a flowchart diagram and/or a block or blocks of a block diagram.
  • a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.
  • processors CPUs
  • input/output interfaces network interfaces
  • memory volatile and non-volatile memory
  • Memory may include non-permanent storage in computer-readable media, random access memory (RAM) and/or non-volatile memory in the form of read-only memory (ROM) or flash memory (flash RAM). Memory is an example of computer-readable media.
  • RAM random access memory
  • ROM read-only memory
  • flash RAM flash random access memory
  • Computer-readable media includes both persistent and non-volatile, removable and non-removable media that can be implemented by any method or technology for storage of information.
  • Information may be computer-readable instructions, data structures, modules of programs, or other data.
  • Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), and read-only memory.
  • PRAM phase change memory
  • SRAM static random access memory
  • DRAM dynamic random access memory
  • RAM random access memory
  • read-only memory read-only memory
  • ROM read-only memory
  • EEPROM electrically erasable programmable read-only memory
  • flash memory or other memory technology
  • compact disc read-only memory CD-ROM
  • DVD digital versatile disc
  • Magnetic tape magnetic tape storage, graphene storage or other magnetic storage devices or any other non-transmission medium can be used to store information that can be accessed by a computing device.
  • computer-readable media does not include transitory media, such as modulated data signals and carrier waves.
  • one or more embodiments of the present description may be provided as a method, system, or computer program product. Accordingly, one or more embodiments of the present description may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment that combines software and hardware aspects. Furthermore, one or more embodiments of the present description may employ a computer program implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein. Product form.
  • computer-usable storage media including, but not limited to, disk storage, CD-ROM, optical storage, etc.
  • program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types.
  • program modules may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communications network.
  • program modules may be located in both local and remote computer storage media including storage devices.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

The present description provides a message transmission method and apparatus based on a blockchain relay communication network system. The blockchain relay communication network system is separately connected to a source blockchain node and a destination blockchain node, blockchain nodes in a blockchain node group to which the source blockchain node and the destination blockchain node belong all maintain a same shared key, and relay nodes in the blockchain relay communication network system do not maintain the shared key. The method comprises: a source blockchain node encrypts plaintext information on the basis of a shared key to obtain encrypted information, encapsulates an IP header for the encrypted information to generate an encrypted message, and sends the encrypted message to a blockchain relay communication network system; the blockchain relay communication network system forwards the encrypted message to a destination blockchain node on the basis of the IP header; and the destination blockchain node decrypts the encrypted message on the basis of the shared key to obtain the plaintext information.

Description

基于区块链中继通信网络系统的消息传输方法及装置Message transmission method and device based on blockchain relay communication network system
本申请要求于2022年06月29日提交中国专利局、申请号为202210760932.0、发明名称为“基于区块链中继通信网络系统的消息传输方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。This application requires the priority of the Chinese patent application submitted to the China Patent Office on June 29, 2022, with the application number 202210760932.0 and the invention title "Message transmission method and device based on blockchain relay communication network system", all of which The contents are incorporated into this application by reference.
技术领域Technical field
本说明书实施例属于区块链技术领域，尤其涉及一种基于区块链中继通信网络系统的消息传输方法及装置。The embodiments of this specification belong to the field of blockchain technology, and particularly relate to a message transmission method and device based on a blockchain relay communication network system.
背景技术Background technique
区块链(Blockchain)是分布式数据存储、点对点传输、共识机制、加密算法等计算机技术的新型应用模式。区块链系统中按照时间顺序将数据区块以顺序相连的方式组合成链式数据结构，并以密码学方式保证的不可篡改和不可伪造的分布式账本。由于区块链具有去中心化、信息不可篡改、自治性等特性，区块链也受到人们越来越多的重视和应用。在传统的区块链技术中，各个区块链节点之间直接采用P2P(Peer to Peer，点对点)技术进行通信，以传输交易、区块等，但由于各种网络因素导致通信时延高、稳定性差，无法满足应用需求。Blockchain is a new application model of computer technology such as distributed data storage, point-to-point transmission, consensus mechanism, and encryption algorithm. In the blockchain system, data blocks are combined into a chained data structure in a chronological manner and are cryptographically guaranteed to be an untamperable and unforgeable distributed ledger. Due to the characteristics of blockchain, such as decentralization, non-tamperable information, and autonomy, blockchain has also received more and more attention and applications. In traditional blockchain technology, P2P (Peer to Peer, point-to-point) technology is used directly to communicate between various blockchain nodes to transmit transactions, blocks, etc. However, due to various network factors, communication delays are high and Poor stability and unable to meet application requirements.
因此，相关技术中提出了基于区块链中继通信网络系统的区块链通信技术。区块链节点可以分别接入区块链中继通信网络系统，使得区块链节点之间能通过区块链中继通信网络系统来实现通信。由于区块链中继通信网络系统是面向区块链实时传输的骨干中继通信网络系统，其包含的各个中继节点之间能够通过高QoS(Quality of Service，服务质量)保障的优质带宽进行通信交互，因而由区块链中继通信网络系统接管区块链节点之间通信的中间链路(middle mile)，能够降低通信时延、提高稳定性，从而显著提升区块链节点之间的通信质量。Therefore, blockchain communication technology based on a blockchain relay communication network system has been proposed in related technologies. Blockchain nodes can be respectively connected to the blockchain relay communication network system, so that communication between blockchain nodes can be achieved through the blockchain relay communication network system. Since the blockchain relay communication network system is a backbone relay communication network system for real-time transmission of blockchain, the various relay nodes it contains can communicate with each other through high-quality bandwidth guaranteed by high QoS (Quality of Service, Quality of Service). Communication interaction, so the blockchain relay communication network system takes over the middle mile of communication between blockchain nodes, which can reduce communication delays and improve stability, thereby significantly improving the communication between blockchain nodes. Communication quality.
发明内容Contents of the invention
本说明书的目的在于提供一种基于区块链中继通信网络系统的消息传输方法及装置。The purpose of this specification is to provide a message transmission method and device based on a blockchain relay communication network system.
根据本说明书一个或多个实施例的第一方面，提出了一种基于区块链中继通信网络系统的消息传输方法，所述区块链中继通信网络系统分别与源区块链节点和目的区块链节点相连，所述源区块链节点和所述目的区块链节点所属的区块链节点组中的各区块链节点均维护有相同的共享密钥，且所述区块链中继通信网络系统中的中继节点未维护有所述共享密钥；所述方法包括：According to the first aspect of one or more embodiments of this specification, a message transmission method based on a blockchain relay communication network system is proposed. The blockchain relay communication network system is connected to the source blockchain node and The destination blockchain nodes are connected, each blockchain node in the blockchain node group to which the source blockchain node and the destination blockchain node belong maintains the same shared key, and the blockchain The relay node in the relay communication network system does not maintain the shared key; the method includes:
所述源区块链节点基于所述共享密钥对明文信息加密以获取加密信息，为所述加密信息封装IP头部以生成加密消息，并将所述加密消息发送至所述区块链中继通信网络系统；The source blockchain node encrypts plaintext information based on the shared key to obtain encrypted information, encapsulates an IP header for the encrypted information to generate an encrypted message, and sends the encrypted message to the blockchain relay communication network system;
所述区块链中继通信网络系统基于所述IP头部将所述加密消息转发至所述目的区块链节点；The blockchain relay communication network system forwards the encrypted message to the destination blockchain node based on the IP header;
所述目的区块链节点基于所述共享密钥对所述加密消息解密以获取所述明文信息。The destination blockchain node decrypts the encrypted message based on the shared key to obtain the plaintext information.
根据本说明书一个或多个实施例的第二方面，提出了一种基于区块链中继通信网络系统的消息传输方法，应用于源区块链节点，所述区块链中继通信网络系统分别与所述源区块链节点和目的区块链节点相连，所述源区块链节点和所述目的区块链节点所属的区块链节点组中的各区块链节点均维护有相同的共享密钥，且所述区块链中继通信网络系统中的中继节点未维护有所述共享密钥；所述方法包括：According to the second aspect of one or more embodiments of this specification, a message transmission method based on a blockchain relay communication network system is proposed, applied to the source blockchain node, the blockchain relay communication network system are respectively connected to the source blockchain node and the destination blockchain node. Each blockchain node in the blockchain node group to which the source blockchain node and the destination blockchain node belong maintains the same The shared key is shared, and the relay node in the blockchain relay communication network system does not maintain the shared key; the method includes:
基于所述共享密钥对明文信息加密以获取加密信息；Encrypt plaintext information based on the shared key to obtain encrypted information;
为所述加密信息封装IP头部以生成加密消息；encapsulating an IP header for the encrypted information to generate an encrypted message;
将所述加密消息发送至所述区块链中继通信网络系统，所述区块链中继通信网络系统用于基于所述IP头部将所述加密消息转发至所述目的区块链节点。Send the encrypted message to the blockchain relay communication network system, which is used to forward the encrypted message to the destination blockchain node based on the IP header. .
根据本说明书一个或多个实施例的第三方面，提出了一种基于区块链中继通信网络系统的消息传输方法，应用于目的区块链节点，所述区块链中继通信网络系统分别与源区块链节点和所述目的区块链节点相连，所述源区块链节点和所述目的区块链节点所属的区块链节点组中的各区块链节点均维护有相同的共享密钥，且所述区块链中继通信网络系统中的中继节点未维护有所述共享密钥；所述方法包括：According to the third aspect of one or more embodiments of this specification, a message transmission method based on a blockchain relay communication network system is proposed, which is applied to the destination blockchain node. The blockchain relay communication network system Connected to the source blockchain node and the destination blockchain node respectively. Each blockchain node in the blockchain node group to which the source blockchain node and the destination blockchain node belong maintains the same The shared key is shared, and the relay node in the blockchain relay communication network system does not maintain the shared key; the method includes:
接收所述区块链中继通信网络系统基于加密消息的IP头部转发至所述目的区块链节点的所述加密消息，所述加密消息由所述源区块链节点为基于所述共享密钥对明文信息加密获取的加密信息封装所述IP头部以生成；Receive the encrypted message forwarded to the destination blockchain node based on the IP header of the encrypted message by the blockchain relay communication network system, and the encrypted message is forwarded by the source blockchain node based on the shared The encrypted information obtained by encrypting the plaintext information with the key encapsulates the IP header to generate;
基于所述共享密钥对所述加密消息解密以获取所述明文信息。The encrypted message is decrypted based on the shared key to obtain the plaintext information.
根据本说明书一个或多个实施例的第四方面，提出了一种基于区块链中继通信网络系统的消息传输方法，应用于所述区块链中继通信网络系统，所述区块链中继通信网络系统分别与源区块链节点和目的区块链节点相连，所述源区块链节点和所述目的区块链节点所属的区块链节点组中的各区块链节点均维护有相同的共享密钥，且所述区块链中继通信网络系统中的中继节点未维护有所述共享密钥；所述方法包括：According to the fourth aspect of one or more embodiments of this specification, a message transmission method based on a blockchain relay communication network system is proposed, which is applied to the blockchain relay communication network system. The blockchain The relay communication network system is connected to the source blockchain node and the destination blockchain node respectively. Each blockchain node in the blockchain node group to which the source blockchain node and the destination blockchain node belong maintains have the same shared key, and the relay node in the blockchain relay communication network system does not maintain the shared key; the method includes:
接收所述源区块链节点为基于所述共享密钥对明文信息加密获取的加密信息封装IP头部以生成的加密消息；Receive the encrypted message generated by the source blockchain node encapsulating the IP header with the encrypted information obtained by encrypting the plaintext information based on the shared key;
基于所述IP头部将所述加密消息转发至所述目的区块链节点。The encrypted message is forwarded to the destination blockchain node based on the IP header.
根据本说明书一个或多个实施例的第五方面，提出了一种基于区块链中继通信网络系统的消息传输系统，所述区块链中继通信网络系统分别与源区块链节点和目的区块链节点相连，所述源区块链节点和所述目的区块链节点所属的区块链节点组中的各区块链节点均维护有相同的共享密钥，且所述区块链中继通信网络系统中的中继节点未维护有所述共享密钥；所述系统包括：According to the fifth aspect of one or more embodiments of this specification, a message transmission system based on a blockchain relay communication network system is proposed. The blockchain relay communication network system is respectively connected with the source blockchain node and The destination blockchain nodes are connected, each blockchain node in the blockchain node group to which the source blockchain node and the destination blockchain node belong maintains the same shared key, and the blockchain The relay node in the relay communication network system does not maintain the shared key; the system includes:
所述源区块链节点，用于基于所述共享密钥对明文信息加密以获取加密信息，为所述加密信息封装IP头部以生成加密消息，并将所述加密消息发送至所述区块链中继通信网络系统；The source blockchain node is used to encrypt plain text information based on the shared key to obtain encrypted information, encapsulate an IP header for the encrypted information to generate an encrypted message, and send the encrypted message to the zone. Blockchain relay communication network system;
所述区块链中继通信网络系统，用于基于所述IP头部将所述加密消息转发至所述目的区块链节点；The blockchain relay communication network system is used to forward the encrypted message to the destination blockchain node based on the IP header;
所述目的区块链节点，用于基于所述共享密钥对所述加密消息解密以获取所述明文信息。The destination blockchain node is used to decrypt the encrypted message based on the shared key to obtain the plaintext information.
根据本说明书一个或多个实施例的第六方面，提出了一种基于区块链中继通信网络系统的消息传输装置，应用于源区块链节点，所述区块链中继通信网络系统分别与所述源区块链节点和目的区块链节点相连，所述源区块链节点和所述目的区块链节点所属的区块链节点组中的各区块链节点均维护有相同的共享密钥，且所述区块链中继通信网络系统中的中继节点未维护有所述共享密钥；所述装置包括：According to the sixth aspect of one or more embodiments of this specification, a message transmission device based on a blockchain relay communication network system is proposed, which is applied to the source blockchain node. The blockchain relay communication network system are respectively connected to the source blockchain node and the destination blockchain node. Each blockchain node in the blockchain node group to which the source blockchain node and the destination blockchain node belong maintains the same The shared key is shared, and the relay node in the blockchain relay communication network system does not maintain the shared key; the device includes:
明文信息加密单元，用于基于所述共享密钥对明文信息加密以获取加密信息；A plaintext information encryption unit, configured to encrypt plaintext information based on the shared key to obtain encrypted information;
加密消息生成单元，用于为所述加密信息封装IP头部以生成加密消息；An encrypted message generating unit, configured to encapsulate an IP header for the encrypted information to generate an encrypted message;
加密消息发送单元，用于将所述加密消息发送至所述区块链中继通信网络系统，所述区块链中继通 信网络系统用于基于所述IP头部将所述加密消息转发至所述目的区块链节点。An encrypted message sending unit, configured to send the encrypted message to the blockchain relay communication network system, and the blockchain relay communication network system is configured to forward the encrypted message to the The destination blockchain node.
根据本说明书一个或多个实施例的第七方面，提出了一种基于区块链中继通信网络系统的消息传输装置，应用于目的区块链节点，所述区块链中继通信网络系统分别与源区块链节点和所述目的区块链节点相连，所述源区块链节点和所述目的区块链节点所属的区块链节点组中的各区块链节点均维护有相同的共享密钥，且所述区块链中继通信网络系统中的中继节点未维护有所述共享密钥；所述装置包括：According to the seventh aspect of one or more embodiments of this specification, a message transmission device based on a blockchain relay communication network system is proposed, which is applied to a destination blockchain node. The blockchain relay communication network system Connected to the source blockchain node and the destination blockchain node respectively. Each blockchain node in the blockchain node group to which the source blockchain node and the destination blockchain node belong maintains the same A shared key is shared, and the relay node in the blockchain relay communication network system does not maintain the shared key; the device includes:
第一加密消息接收单元，用于接收所述区块链中继通信网络系统基于加密消息的IP头部转发至所述目的区块链节点的所述加密消息，所述加密消息由所述源区块链节点为基于所述共享密钥对明文信息加密获取的加密信息封装所述IP头部以生成；The first encrypted message receiving unit is configured to receive the encrypted message forwarded by the blockchain relay communication network system to the destination blockchain node based on the IP header of the encrypted message. The encrypted message is forwarded by the source The blockchain node encapsulates the IP header to generate the encrypted information obtained by encrypting the plaintext information based on the shared key;
加密消息解密单元，用于基于所述共享密钥对所述加密消息解密以获取所述明文信息。An encrypted message decryption unit, configured to decrypt the encrypted message based on the shared key to obtain the plaintext information.
根据本说明书一个或多个实施例的第八方面，提出了一种基于区块链中继通信网络系统的消息传输装置，应用于所述区块链中继通信网络系统，所述区块链中继通信网络系统分别与源区块链节点和目的区块链节点相连，所述源区块链节点和所述目的区块链节点所属的区块链节点组中的各区块链节点均维护有相同的共享密钥，且所述区块链中继通信网络系统中的中继节点未维护有所述共享密钥；所述装置包括：According to the eighth aspect of one or more embodiments of this specification, a message transmission device based on a blockchain relay communication network system is proposed, which is applied to the blockchain relay communication network system. The blockchain The relay communication network system is connected to the source blockchain node and the destination blockchain node respectively. Each blockchain node in the blockchain node group to which the source blockchain node and the destination blockchain node belong maintains have the same shared key, and the relay node in the blockchain relay communication network system does not maintain the shared key; the device includes:
第二加密消息接收单元，用于接收所述源区块链节点为基于所述共享密钥对明文信息加密获取的加密信息封装IP头部以生成的加密消息；The second encrypted message receiving unit is configured to receive an encrypted message generated by the source blockchain node by encapsulating the IP header of the encrypted information obtained by encrypting the plaintext information based on the shared key;
加密消息转发单元，用于基于所述IP头部将所述加密消息转发至所述目的区块链节点。An encrypted message forwarding unit, configured to forward the encrypted message to the destination blockchain node based on the IP header.
根据本说明书一个或多个实施例的第九方面，提出了一种电子设备，包括：According to a ninth aspect of one or more embodiments of this specification, an electronic device is provided, including:
处理器；processor;
用于存储处理器可执行指令的存储器；Memory used to store instructions executable by the processor;
其中，所述处理器通过运行所述可执行指令以实现如第一至第四方面中任一项所述的方法。Wherein, the processor implements the method described in any one of the first to fourth aspects by running the executable instructions.
根据本说明书一个或多个实施例的第十方面，提出了一种计算机可读存储介质，其上存储有计算机指令，该指令被处理器执行时实现如第一至第四方面中任一项所述方法的步骤。According to a tenth aspect of one or more embodiments of this specification, a computer-readable storage medium is proposed, on which computer instructions are stored, and when the instructions are executed by a processor, any one of the first to fourth aspects is implemented. The steps of the method.
在本说明书实施例中，源区块链节点与目的区块链节点通过区块链中继通信网络系统相连，源区块链节点与目的区块链节点同属于一个区块链节点组，共同维护有相同的共享密钥，这使得源区块链节点在需要向目的区块链节点发送明文信息时可以利用共享密钥进行加密，确保了系统的机密性，又由于区块链中继通信网络中的所有中继节点均未维护有该共享密钥，这使得中继网络系统中的中继节点无法通过解密直接获取明文信息，从而避免明文信息在途径区块链中继通信网络系统的过程中被暴露，增强了区块链节点之间通信的安全性。另外，区块链中继通信网络系统在获取到加密消息后无需进行复杂的解封装或解析过程，而是可以在网络层基于加密消息的IP头部直接实现转发，整个从源区块链节点到目的区块链节点的数据传递过程没有增加额外的计算开销，实现了高效的数据传递。In the embodiment of this specification, the source blockchain node and the destination blockchain node are connected through the blockchain relay communication network system. The source blockchain node and the destination blockchain node belong to the same blockchain node group. The same shared key is maintained, which allows the source blockchain node to use the shared key for encryption when it needs to send plaintext information to the destination blockchain node, ensuring the confidentiality of the system, and due to the blockchain relay communication All relay nodes in the network do not maintain this shared key, which makes it impossible for relay nodes in the relay network system to directly obtain plaintext information through decryption, thereby preventing the plaintext information from being transmitted through the blockchain relay communication network system. The process is exposed, which enhances the security of communication between blockchain nodes. In addition, the blockchain relay communication network system does not need to perform complex decapsulation or parsing processes after obtaining the encrypted message. Instead, it can directly forward the encrypted message based on the IP header at the network layer, and the entire source blockchain node The data transfer process to the destination blockchain node does not add additional computing overhead, achieving efficient data transfer.
附图说明Description of drawings
为了更清楚地说明本说明书实施例的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本说明书中记载的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。In order to explain the technical solutions of the embodiments of this specification more clearly, the drawings needed to be used in the description of the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some of the embodiments recorded in this specification. , for those of ordinary skill in the art, other drawings can also be obtained based on these drawings without exerting creative labor.
图1是一示例性实施例提供的一种区块链节点通过区块链中继通信网络系统进行交互的场景示意图。Figure 1 is a schematic diagram of a scenario in which blockchain nodes interact through a blockchain relay communication network system provided by an exemplary embodiment.
图2是一示例性实施例提供的一种基于区块链中继通信网络系统的消息传输方法的流程图。Figure 2 is a flow chart of a message transmission method based on a blockchain relay communication network system provided by an exemplary embodiment.
图3是一示例性实施例提供的另一种基于区块链中继通信网络系统的消息传输方法的流程图。Figure 3 is a flow chart of another message transmission method based on a blockchain relay communication network system provided by an exemplary embodiment.
图4是一示例性实施例提供的又一种基于区块链中继通信网络系统的消息传输方法的流程图。Figure 4 is a flow chart of yet another message transmission method based on a blockchain relay communication network system provided by an exemplary embodiment.
图5是一示例性实施例提供的再一种基于区块链中继通信网络系统的消息传输方法的流程图。Figure 5 is a flow chart of yet another message transmission method based on a blockchain relay communication network system provided by an exemplary embodiment.
图6是一示例性实施例提供的一种基于区块链中继通信网络系统的消息传输方法的交互流程图。Figure 6 is an interactive flow chart of a message transmission method based on a blockchain relay communication network system provided by an exemplary embodiment.
图7是一示例性实施例提供的一种基于区块链中继通信网络系统的消息传输系统的架构示意图。Figure 7 is a schematic architectural diagram of a message transmission system based on a blockchain relay communication network system provided by an exemplary embodiment.
图8是一示例性实施例提供的一种设备的结构示意图。Figure 8 is a schematic structural diagram of a device provided by an exemplary embodiment.
图9是一示例性实施例提供的一种基于区块链中继通信网络系统的消息传输装置的框图。Figure 9 is a block diagram of a message transmission device based on a blockchain relay communication network system provided by an exemplary embodiment.
图10是一示例性实施例提供的另一种基于区块链中继通信网络系统的消息传输装置的框图。Figure 10 is a block diagram of another message transmission device based on a blockchain relay communication network system provided by an exemplary embodiment.
图11是一示例性实施例提供的又一种基于区块链中继通信网络系统的消息传输装置的框图。Figure 11 is a block diagram of yet another message transmission device based on a blockchain relay communication network system provided by an exemplary embodiment.
具体实施方式Detailed ways
为了使本技术领域的人员更好地理解本说明书中的技术方案，下面将结合本说明书实施例中的附图，对本说明书实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本说明书一部分实施例，而不是全部的实施例。基于本说明书中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都应当属于本说明书保护的范围。In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of this specification. Obviously, the described The embodiments are only some of the embodiments of this specification, but not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by those of ordinary skill in the art without creative efforts should fall within the scope of protection of this specification.
本说明书实施例所涉及的区块链中继通信网络系统是指面向区块链实时传输的骨干中继通信网络系统，也可称为区块链中继通信网络，区块链中继通信网络外部对接的终端为区块链网络中的区块链节点，上述区块链网络的类型可以包括公有链、私有链和联盟链等。譬如，应用于公有链的区块链中继通信网络主要包括Falcon、Fast Bitcoin Relay Network(FBRN)、Fast Internet Bitcoin Relay Engine(FIBRE)等，而应用于联盟链的区块链中继通信网络主要包括BloXRoute、Blockchain Transmission Network(BTN)等。本说明书并不限制所采用的区块链中继通信网络。The blockchain relay communication network system involved in the embodiments of this specification refers to the backbone relay communication network system oriented to real-time transmission of the blockchain, which may also be called a blockchain relay communication network or a blockchain relay communication network. The external docking terminal is the blockchain node in the blockchain network. The types of the above-mentioned blockchain network can include public chains, private chains, alliance chains, etc. For example, the blockchain relay communication network used in the public chain mainly includes Falcon, Fast Bitcoin Relay Network (FBRN), Fast Internet Bitcoin Relay Engine (FIBRE), etc., while the blockchain relay communication network used in the alliance chain mainly includes Including BloXRoute, Blockchain Transmission Network (BTN), etc. This manual does not limit the blockchain relay communication network used.
当区块链节点之间在基于P2P技术进行端到端直连时，可以使用TLS(Transport Layer Security，传输层安全协议)实现加密通信。例如，当区块链节点Node 1需要向区块链节点Node 2发送区块链消息时，Node 1作为源区块链节点，而Node 2作为目的区块链节点。Node 1与Node 2之间可以基于TLS协议进行密钥协商，从而基于协商出的传输密钥在该Node 1与Node 2之间建立起TLS链路。那么，区块链消息在该TLS链路内部传输时都处于密文状态(由上述的传输密钥加密)，仅由持有该传输密钥的Node 1与Node 2能够解密出相应的消息明文。When blockchain nodes are directly connected end-to-end based on P2P technology, TLS (Transport Layer Security, Transport Layer Security Protocol) can be used to implement encrypted communication. For example, when blockchain node Node 1 needs to send a blockchain message to blockchain node Node 2, Node 1 serves as the source blockchain node, and Node 2 serves as the destination blockchain node. Node 1 and Node 2 can perform key negotiation based on the TLS protocol, thereby establishing a TLS link between Node 1 and Node 2 based on the negotiated transmission key. Then, the blockchain messages are in ciphertext state (encrypted by the above-mentioned transmission key) when transmitted within the TLS link, and only Node 1 and Node 2 holding the transmission key can decrypt the corresponding message plaintext. .
但是，当区块链节点之间通过区块链中继通信网络进行通信时，情况则有所不同。假定Node A对接区块链中继通信网络中的中继节点1。虽然可以通过在Node 1与中继节点1之间建立TLS链路，使得区块链消息在该TLS链路内部传输时均处于密文状态，但是由于传输密钥是在Node 1与中继节点1之间协商得到，所以中继节点1能够通过该传输密钥对收到的消息密文进行解密，使得消息明文被暴露给区块链中继通信网络。However, the situation is different when blockchain nodes communicate with each other through a blockchain relay communication network. Assume that Node A is connected to relay node 1 in the blockchain relay communication network. Although a TLS link can be established between Node 1 and relay node 1, so that the blockchain messages are in a ciphertext state when transmitted within the TLS link, but since the transmission key is between Node 1 and relay node 1, so the relay node 1 can decrypt the received message ciphertext through the transmission key, so that the message plaintext is exposed to the blockchain relay communication network.
以图1为例，图1是一示例性实施例提供的一种区块链节点通过区块链中继通信网络系统进行交互的场景示意图。如图1所示，区块链中继通信网络系统中包含有三个中继节点，分别为中继节点a、中继节点b和中继节点c，假设中继节点a与区块链节点Node A通过TLS链路1相连接，中继节点b与区块链节点Node B通过TLS链路2相连接，中继节点b还与区块链节点Node D通过TLS链路3相连接，中继节点c与区块链节点Node C通过TLS链路4相连接。而在区块链中继系统网络系统内部，中继节点a、中继节点b和中继节点c三者通过高速链路(大带宽、低延迟的非加密链路)彼此两两相互连接。由于作为区块链中继通信网络内部的中继节点与作为区块链中继通信网络外部终端的区块链节点 之间建立有TLS链路，因此在TLS链路的传输过程中，即使消息被攻击者截获，由于攻击者未参与该加密链路对应密钥的密钥协商过程，因此攻击者无法解密得到加密前的消息。但对于中继节点而言，由于其参与了密钥协商过程，因此能够解密以获取区块链节点在通过加密链路对应的密钥进行加密前的消息，那么在区块链节点之间直接传输明文信息且区块链中继通信网络系统被攻击者控制的情况下，将导致大规模的数据泄露，带来极大的安全隐患。另外，TLS链路的性质要求中继节点对从区块链节点接收到的加密后的消息进行多层解封装、解密并进一步封装后才能再用于转发，不利于进行高效的数据传递。Taking Figure 1 as an example, Figure 1 is a schematic diagram of a scenario in which blockchain nodes interact through a blockchain relay communication network system according to an exemplary embodiment. As shown in Figure 1, the blockchain relay communication network system contains three relay nodes, namely relay node a, relay node b and relay node c. Assume that relay node a and blockchain node Node A is connected through TLS link 1, relay node b is connected to blockchain node Node B through TLS link 2, relay node b is also connected to blockchain node Node D through TLS link 3, relay node Node c is connected to the blockchain node Node C through TLS link 4. Within the blockchain relay system network system, relay node a, relay node b, and relay node c are connected to each other through high-speed links (large-bandwidth, low-latency non-encrypted links). Since a TLS link is established between the relay node inside the blockchain relay communication network and the blockchain node as the external terminal of the blockchain relay communication network, during the transmission process of the TLS link, even if the message Intercepted by the attacker. Since the attacker did not participate in the key negotiation process for the corresponding key of the encrypted link, the attacker cannot decrypt the message before encryption. However, for the relay node, since it participates in the key negotiation process, it can decrypt to obtain the message of the blockchain node before it is encrypted by the key corresponding to the encryption link. Then, there is a direct connection between the blockchain nodes. When plaintext information is transmitted and the blockchain relay communication network system is controlled by an attacker, it will lead to large-scale data leakage and bring great security risks. In addition, the nature of the TLS link requires the relay node to perform multi-layer decapsulation, decryption and further encapsulation of the encrypted message received from the blockchain node before it can be used for forwarding, which is not conducive to efficient data transmission.
为消除上述安全隐患，一种常规的做法是在源区块链节点与目的区块链节点的应用层使用非对称加密的方式进行消息的保护，但这种方式增加了额外的计算开销，不利于高效的数据传递，违背了区块链中继通信网络加速数据传递过程的初衷。In order to eliminate the above security risks, a common approach is to use asymmetric encryption to protect messages at the application layer of the source blockchain node and the destination blockchain node. However, this method adds additional computing overhead and does not Conducive to efficient data transmission, it violates the original intention of the blockchain relay communication network to accelerate the data transmission process.
因此，为了消除安全隐患的同时实现高效的数据传递，本说明书提出了一种基于区块链中继通信网络系统的消息传输方案，通过仅在区块链节点组内部共享的共享密钥对明文信息进行加密，使源区块链节点与目的区块链节点在进行数据传递时能够避免向区块链中继通信网络系统暴露明文信息，增强了区块链节点之间通信的安全性，同时整个数据传递过程没有增加额外的计算开销，实现了高效的数据传递。Therefore, in order to eliminate security risks while achieving efficient data transmission, this specification proposes a message transmission scheme based on the blockchain relay communication network system, which uses a shared key shared only within the blockchain node group to The information is encrypted so that the source blockchain node and the destination blockchain node can avoid exposing plaintext information to the blockchain relay communication network system when transmitting data, thereby enhancing the security of communication between blockchain nodes. At the same time, The entire data transfer process does not add additional computing overhead, achieving efficient data transfer.
下面结合图2对本说明书涉及的基于区块链中继通信网络系统的消息传输方法进行详细说明。图2是一示例性实施例提供的一种基于区块链中继通信网络系统的消息传输方法的流程图，其中，所述区块链中继通信网络系统分别与源区块链节点和目的区块链节点相连，所述源区块链节点和所述目的区块链节点所属的区块链节点组中的各区块链节点均维护有相同的共享密钥，且所述区块链中继通信网络系统中的中继节点未维护有所述共享密钥；所述方法包括：The message transmission method based on the blockchain relay communication network system involved in this specification will be described in detail below with reference to Figure 2. Figure 2 is a flow chart of a message transmission method based on a blockchain relay communication network system provided by an exemplary embodiment, wherein the blockchain relay communication network system communicates with the source blockchain node and destination respectively. Blockchain nodes are connected, each block chain node in the block chain node group to which the source block chain node and the destination block chain node belong maintain the same shared key, and in the block chain The relay node in the relay communication network system does not maintain the shared key; the method includes:
S202：所述源区块链节点基于所述共享密钥对明文信息加密以获取加密信息，为所述加密信息封装IP头部以生成加密消息，并将所述加密消息发送至所述区块链中继通信网络系统。S202: The source blockchain node encrypts plaintext information based on the shared key to obtain encrypted information, encapsulates an IP header for the encrypted information to generate an encrypted message, and sends the encrypted message to the block Chain relay communication network system.
在本说明书实施例中，源区块链节点对明文信息进行加密并封装IP头部的操作均是基于网络层协议实现的，即所述明文信息具体是指包含IP头部的网络层IP报文或去掉IP头部的网络层IP报文，该明文信息在包含IP头部的情况下可以直接在网络层实现转发。而无论明文信息是否包含IP头部，其被加密得到的加密信息都不存在IP头部，因此为了能够使加密信息能够在网络层被正确转发至目的区块链节点，需要为加密信息封装IP头部以生成加密消息。In the embodiment of this specification, the operations of the source blockchain node to encrypt the plaintext information and encapsulate the IP header are all implemented based on the network layer protocol, that is, the plaintext information specifically refers to the network layer IP packet containing the IP header. message or network layer IP message with the IP header removed. This plain text information can be directly forwarded at the network layer if it contains the IP header. Regardless of whether the plaintext information contains an IP header, the encrypted information obtained by encrypting it does not have an IP header. Therefore, in order to enable the encrypted information to be correctly forwarded to the destination blockchain node at the network layer, it is necessary to encapsulate the IP for the encrypted information. header to generate an encrypted message.
在所述明文信息包含有原始报文对应的原始IP头部的情况下，所述IP头部基于区块链中继通信网络系统的网络信息所创建。本说明书实施例涉及的原始报文属于上述的包含IP头部的网络层IP报文，原始报文对应的原始IP头部中包含的源IP地址为源区块链节点的IP地址，而原始IP头部中包含的目的IP地址为目的区块链节点对应的IP地址。本说明书实施例中，如果包含原始IP头部的原始报文作为明文信息被整体加密为加密信息，那么源区块链节点为加密信息所重新封装的IP头部需要参考区块链中继网络系统的网络信息。例如，当区块链中继通信网络系统包括与源区块链节点相连的源中继节点、与目的区块链节点相连的目的中继节点的情况下，可以将重新封装的IP头部中的源IP地址设置为源中继节点的IP地址，将重新封装的IP头部中的目的IP地址设置为目的区块链节点的IP地址，从而使加密消息在区块链中继通信网络系统中转发时向区块链中继通信网络系统隐藏源区块链节点的IP地址，起到一定的信息保护的作用。In the case where the plaintext information includes the original IP header corresponding to the original message, the IP header is created based on the network information of the blockchain relay communication network system. The original message involved in the embodiment of this specification belongs to the above-mentioned network layer IP message containing an IP header. The source IP address contained in the original IP header corresponding to the original message is the IP address of the source blockchain node, and the original The destination IP address contained in the IP header is the IP address corresponding to the destination blockchain node. In the embodiment of this specification, if the original message containing the original IP header is encrypted as plain text information as encrypted information, then the IP header re-encapsulated by the source blockchain node for the encrypted information needs to refer to the blockchain relay network System network information. For example, when the blockchain relay communication network system includes a source relay node connected to the source blockchain node and a destination relay node connected to the destination blockchain node, the re-encapsulated IP header can be The source IP address is set to the IP address of the source relay node, and the destination IP address in the re-encapsulated IP header is set to the IP address of the destination blockchain node, so that the encrypted message can be used in the blockchain relay communication network system When forwarding, the IP address of the source blockchain node is hidden from the blockchain relay communication network system, which plays a certain role in information protection.
在所述明文信息包含有原始报文对应的原始IP头部的情况下，具体可以采用隧道模式的IPsec ESP(Internet Protocol Security，互联网安全协议；Encapsulation Security Protocol，封装安全协议)协议实现。在隧道模式的IPsec ESP下，源区块链节点首先确定与目的区块链节点所同属的区块链节点组，获取该区块链节点组对应的共享密钥并基于该共享密钥对原始报文进行加密以获取得到加密信息，为加密信息分别封装一个ESP头部和一个ESP尾部，其中，ESP头部携带有对应于该区块链节点组的SPI(security parameters index，安全参数索引)，ESP尾部包括一些填充数据以及填充数据对应的填充长度等信息，此时得到的由ESP头部、加密信息和ESP尾部共同构成的结构体称为enchilada(认证区结构体)。源区块链节点进一步对该认证区结构体计算哈希摘要，并将该哈希摘要封装在认证区结构体的尾部，最后 在此基础上为包含哈希摘要的认证区结构体封装一个新的IP头部以生成加密消息。新的IP头部里的目的IP地址、源IP地址可以与原始IP头部中的目的IP地址、源IP地址相同或不同，新的IP头部中包含的协议类型为50,说明它里面装的是一个IPsec报文。In the case where the plaintext information contains the original IP header corresponding to the original message, the IPsec ESP (Internet Protocol Security, Encapsulation Security Protocol) protocol in tunnel mode can be implemented. Under IPsec ESP in tunnel mode, the source blockchain node first determines the blockchain node group to which the destination blockchain node belongs, obtains the shared key corresponding to the blockchain node group, and pairs the original The message is encrypted to obtain the encrypted information, and the encrypted information is encapsulated with an ESP header and an ESP tail. The ESP header carries the SPI (security parameters index) corresponding to the blockchain node group. , the ESP tail includes some padding data and the padding length corresponding to the padding data. The structure obtained at this time consisting of the ESP header, encryption information and ESP tail is called enchilada (authentication area structure). The source blockchain node further calculates a hash digest for the authentication zone structure, and encapsulates the hash digest at the end of the authentication zone structure. Finally, based on this, a new authentication zone structure containing the hash digest is encapsulated. IP header to generate an encrypted message. The destination IP address and source IP address in the new IP header can be the same as or different from the destination IP address and source IP address in the original IP header. The protocol type contained in the new IP header is 50, indicating that it contains is an IPsec message.
在所述明文信息为去除所述原始IP头部的所述原始报文的情况下，所述IP头部为所述原始IP头部。本说明书实施例中，如果原始报文被去除原始IP头部后作为明文信息被加密为加密信息，那么源区块链节点为加密信息所重新封装的IP头部则可以设置为原始IP头部。具体而言，可以采用传输模式的IPsec ESP协议来实现本说明书实施例。在传输模式的IPsec ESP协议下，源区块链节点首先确定与目的区块链节点所同属的区块链节点组，获取该区块链节点组对应的共享密钥并基于该共享密钥对去除原始IP头部的原始报文进行加密以获取得到加密信息，与隧道模式的IPsec ESP协议类似，为加密信息分别封装一个ESP头部和一个ESP尾部以生成认证区结构体，将该认证区结构体对应的哈希摘要封装在该认证区结构体的尾部，同时将原始IP头部封装在该认证区结构体的首部以生成加密消息。When the plaintext information is the original message with the original IP header removed, the IP header is the original IP header. In the embodiment of this specification, if the original message is encrypted as plaintext information after removing the original IP header, then the IP header re-encapsulated by the source blockchain node for the encrypted information can be set as the original IP header. . Specifically, the IPsec ESP protocol in transport mode can be used to implement the embodiments of this specification. Under the IPsec ESP protocol in transport mode, the source blockchain node first determines the blockchain node group to which the destination blockchain node belongs, obtains the shared key corresponding to the blockchain node group, and pairs it based on the shared key The original message with the original IP header removed is encrypted to obtain the encrypted information. Similar to the IPsec ESP protocol in tunnel mode, the encrypted information is encapsulated with an ESP header and an ESP trailer to generate an authentication zone structure. The authentication zone is The hash digest corresponding to the structure is encapsulated at the tail of the authentication zone structure, and the original IP header is encapsulated at the head of the authentication zone structure to generate an encrypted message.
如前所述，本说明书实施例所涉及的所述加密消息可以基于IPsec ESP协议生成，具体包括传输模式的IPsec ESP协议或隧道模式的IPsec ESP协议，从而在数据传递的过程中兼顾了数据完整性、防重放攻击等特性。As mentioned above, the encrypted messages involved in the embodiments of this specification can be generated based on the IPsec ESP protocol, specifically including the IPsec ESP protocol in transport mode or the IPsec ESP protocol in tunnel mode, thereby taking into account data integrity during the data transfer process. properties, and anti-replay attacks.
源区块链节点在生成包含有IP头部的加密消息后，就可以将所述加密消息发送至所述区块链中继通信网络系统，以使中继通信网络系统基于该IP头部对所述加密消息进行转发，并使其最终路由至目的区块链节点。After the source blockchain node generates an encrypted message containing an IP header, it can send the encrypted message to the blockchain relay communication network system, so that the relay communication network system can communicate based on the IP header. The encrypted message is forwarded and ultimately routed to the destination blockchain node.
在本说明书实施例中，作为区块链中继通信网络系统外部终端的区块链节点，可以按照区块链节点组的群组管理方式进行管理，从而使得处于同一区块链节点组中的各个区块链节点维护有相同的共享密钥。例如，若干个区块链节点可以事先通过组密钥协商来维护共同的共享密钥，从而基于线上协商的方式共同组织成为一个区块链节点组；或者，若干个区块链节点在线下被手动录入了相同的密钥作为共享密钥，从而基于线下录入的方式共同组织成为一个区块链节点组；或者，若干个区块链节点所处的节点设备绑定有相同的密钥，那么这若干个区块链节点会从自身所处节点设备上读取得到该相同的密钥并作为共享密钥，从而基于设备绑定的方式共同组织成为一个区块链节点组。区块链节点组内的区块链节点在进行相互通信的过程中，首先会根据共同维护的共享密钥对明文信息进行加密以获得加密信息，然后为所述加密信息封装IP头部以生成加密消息，最后再对加密消息进行传输，由此以来，无论加密消息在传输过程中经过任何处理、或者被攻击者所窃取，由于共享密钥仅被同一区块链节点组内的区块链节点所维护，因此从理论上排除了数据传递过程中明文信息被暴露的可能性。本说明书实施例所涉及的共享密钥为对称密钥，因此，在区块链节点接收到来自与其属于同一区块链节点组内的其他区块链节点的加密消息时，可以直接基于共享密钥进行解密以获取明文信息。In the embodiment of this specification, the blockchain nodes as external terminals of the blockchain relay communication network system can be managed according to the group management method of the blockchain node group, so that all nodes in the same blockchain node group Each blockchain node maintains the same shared key. For example, several blockchain nodes can maintain a common shared key through group key negotiation in advance, and thus be organized into a blockchain node group based on online negotiation; or, several blockchain nodes can be organized offline The same key is manually entered as a shared key, and is organized into a blockchain node group based on offline entry; or, the node devices where several blockchain nodes are located are bound to the same key. , then these several blockchain nodes will read the same key from the node device where they are located and use it as a shared key, and then they will be jointly organized into a blockchain node group based on device binding. During the process of mutual communication between the blockchain nodes in the blockchain node group, they will first encrypt the plaintext information according to the jointly maintained shared key to obtain the encrypted information, and then encapsulate the IP header for the encrypted information to generate Encrypt the message, and finally transmit the encrypted message. From this point on, no matter whether the encrypted message undergoes any processing during the transmission process or is stolen by an attacker, since the shared key is only used by the blockchain within the same blockchain node group, It is maintained by the node, so the possibility of plain text information being exposed during the data transfer process is theoretically eliminated. The shared key involved in the embodiments of this specification is a symmetric key. Therefore, when a blockchain node receives encrypted messages from other blockchain nodes belonging to the same blockchain node group, it can directly use the shared key based on the shared key. Decrypt the key to obtain the plain text information.
在本说明书实施例中，同一个区块链节点可以同时隶属于多个不同的区块链节点组，因而对于任一区块链节点而言，其本地可以分别维护有自身共同所属的多个区块链节点组的成员列表及其对应的共享密钥。而在源区块链节点需要向目的区块链节点传输数据的情况下，源区块链节点首先通过在本地查找预先维护的至少一个区块链节点组，并确定自身与目的区块链节点共同所属的区块链节点组(可能有多个)，然后基于本地维护的该共同所属的区块链节点组对应的共享密钥对明文信息进行加密以获取加密信息，再进一步封装IP头部以生成加密消息，从而使得目的区块链节点在接收到该加密消息后能够基于该区块链节点组的共享密钥从中解密得到明文信息。In the embodiment of this specification, the same blockchain node can belong to multiple different blockchain node groups at the same time. Therefore, for any blockchain node, it can locally maintain multiple nodes that it belongs to. List of members of the blockchain node group and their corresponding shared keys. When the source blockchain node needs to transmit data to the destination blockchain node, the source blockchain node first searches for at least one pre-maintained blockchain node group locally and determines the relationship between itself and the destination blockchain node. The blockchain node group to which they belong together (there may be multiple), and then the plaintext information is encrypted based on the shared key corresponding to the blockchain node group that is maintained locally to obtain the encrypted information, and then the IP header is further encapsulated To generate an encrypted message, so that after receiving the encrypted message, the destination blockchain node can decrypt it and obtain the plaintext information based on the shared key of the blockchain node group.
S204：所述区块链中继通信网络系统基于所述IP头部将所述加密消息转发至所述目的区块链节点。S204: The blockchain relay communication network system forwards the encrypted message to the destination blockchain node based on the IP header.
在本说明书实施例中，区块链中继通信网络系统分别与源区块链节点和目的区块链节点通过非加密链路相连，这意味着区块链中继通信网络系统中的中继节点不需要承担对加密消息的解密工作，而只需要解封装至网络层后，基于IP头部中的目的IP地址(即目的区块链节点的IP地址)对加密消息进行转发，从而使得加密消息在区块链中继网络系统内部实现了高效的数据传递。In the embodiment of this specification, the blockchain relay communication network system is connected to the source blockchain node and the destination blockchain node through non-encrypted links respectively, which means that the relay in the blockchain relay communication network system The node does not need to undertake the work of decrypting the encrypted message, but only needs to decapsulate it to the network layer and forward the encrypted message based on the destination IP address in the IP header (that is, the IP address of the destination blockchain node), thereby making the encryption Messages achieve efficient data transmission within the blockchain relay network system.
在本说明书实施例中，所述区块链中继通信网络系统为一个中继节点；或者，In the embodiment of this specification, the blockchain relay communication network system is a relay node; or,
所述区块链中继通信网络系统包括源中继节点和目的中继节点，所述源中继节点与源区块链节点相连，所述目的中继节点与目的区块链节点相连，所述区块链中继通信网络系统基于所述IP头部将所述加密消息转发至所述目的区块链节点，包括：The blockchain relay communication network system includes a source relay node and a destination relay node. The source relay node is connected to the source blockchain node, and the destination relay node is connected to the destination blockchain node. The blockchain relay communication network system forwards the encrypted message to the destination blockchain node based on the IP header, including:
所述源中继节点将从所述源区块链节点接收的所述加密消息发送至所述目的中继节点；The source relay node sends the encrypted message received from the source blockchain node to the destination relay node;
所述目的中继节点将所述加密消息发送至所述目的区块链节点。The destination relay node sends the encrypted message to the destination blockchain node.
在本说明书实施例中，区块链中继通信网络系统可以包括至少一个中继节点，而在只有一个中继节点的情况下，该中继节点同时与源区块链节点和目的区块链节点分别建立有连接；而在区块链中继通信网络系统包括有源中继节点与目的中继节点在内的至少两个中继节点的情况下，所述源中继节点与所述源区块链节点相连接，所述目的中继节点与所述目的区块链节点相连接，而区块链中继通信网络系统内部的中继节点之间也会通过高速链路(大带宽、低延迟的非加密链路)相连接，因此，加密消息可以在区块链中继通信网络系统中通过高速链路进行路由转发，期间各中继节点不涉及除为加密消息进行转发路由以外的计算过程，从而使得加密消息被高效转发至目的中继节点。In the embodiment of this specification, the blockchain relay communication network system may include at least one relay node, and in the case of only one relay node, the relay node communicates with the source blockchain node and the destination blockchain at the same time. The nodes have established connections respectively; and in the case where the blockchain relay communication network system includes at least two relay nodes including an active relay node and a destination relay node, the source relay node and the source relay node The blockchain nodes are connected, the destination relay node is connected to the destination blockchain node, and the relay nodes within the blockchain relay communication network system will also be connected through high-speed links (large bandwidth, Low-latency non-encrypted links), therefore, encrypted messages can be routed and forwarded through high-speed links in the blockchain relay communication network system, during which each relay node does not involve other than forwarding and routing of encrypted messages. The calculation process enables the encrypted message to be efficiently forwarded to the destination relay node.
S206：所述目的区块链节点基于所述共享密钥对所述加密消息解密以获取所述明文信息。S206: The destination blockchain node decrypts the encrypted message based on the shared key to obtain the plaintext information.
如前所述，由于目的区块链节点与源区块链节点处于同一区块链节点组，同时维护有相同的共享密钥，因此，在目的区块链节点接收到区块链中继通信网络系统发送的加密消息的情况下，可以基于所述共享密钥对所述加密消息进行解密以最终获取明文信息，至此实现基于区块链中继通信网络系统的消息传输方案的全流程。As mentioned before, since the destination blockchain node and the source blockchain node are in the same blockchain node group and maintain the same shared key, the blockchain relay communication is received at the destination blockchain node In the case of encrypted messages sent by the network system, the encrypted message can be decrypted based on the shared key to finally obtain the plaintext information. At this point, the entire process of the message transmission solution based on the blockchain relay communication network system is realized.
在源区块链节点基于IPsec ESP协议生成加密消息的情况下，目的区块链节点也需要基于IPsec ESP协议对加密消息进行处理。例如，在隧道模式的IPsec ESP下，目的区块链节点接收到加密消息后检查其IP头部中的协议类型为50，故知道这是一个IPsec包。于是，目的区块链节点首先对加密信息包含的认证区结构体进行哈希运算以获得一个哈希摘要，将其与加密消息尾部的哈希摘要进行比对，在比对一致的情况下确认该加密消息中的认证区结构体未被篡改。然后，目的区块链节点进一步查看认证区结构体中的ESP头部,通过ESP头部包含的SPI决定接下来所需使用SA(security assist，安全关联策略)，由于在SPI对应于源区块链节点与目的区块链节点共同所属的区块链节点组，因此目的区块链节点因此检索得到该区块链节点组对应的本地预先存储的SA，并从中获取该区块链节点组对应的共享密钥以及对应的解密方式。将认证区结构体去除ESP头部和ESP尾部后得到加密信息，按照检索得到的SA中的解密方式与共享密钥对加密信息进行解密以获取明文信息，该明文信息仍然包含有一个原始IP头部，目的区块链节点还可以根据得到的原始IP头部对该明文信息进行进一步转发。When the source blockchain node generates encrypted messages based on the IPsec ESP protocol, the destination blockchain node also needs to process the encrypted messages based on the IPsec ESP protocol. For example, under IPsec ESP in tunnel mode, after receiving the encrypted message, the destination blockchain node checks that the protocol type in the IP header is 50, so it knows that this is an IPsec packet. Therefore, the destination blockchain node first performs a hash operation on the authentication area structure contained in the encrypted information to obtain a hash digest, compares it with the hash digest at the end of the encrypted message, and confirms if the comparison is consistent. The authentication zone structure in the encrypted message has not been tampered with. Then, the destination blockchain node further checks the ESP header in the authentication zone structure, and determines the next need to use SA (security assist, security association strategy) through the SPI contained in the ESP header, because the SPI corresponds to the source block The chain node and the destination blockchain node jointly belong to the blockchain node group. Therefore, the destination blockchain node retrieves the local pre-stored SA corresponding to the blockchain node group and obtains the corresponding blockchain node group from it. The shared key and corresponding decryption method. After removing the ESP header and ESP trailer from the authentication area structure, the encrypted information is obtained. The encrypted information is decrypted according to the decryption method and shared key in the retrieved SA to obtain the plaintext information. The plaintext information still contains an original IP header. The destination blockchain node can further forward the plaintext information based on the obtained original IP header.
在传输模式的IPsec ESP下，目的区块链节点接收到加密消息后检查其IP头部中的协议类型为50，故知道这是一个IPsec包。于是，与隧道模式的IPsec ESP类似，目的区块链节点首先对加密信息包含的认证区结构体进行哈希运算以获得一个哈希摘要，将其与加密消息尾部的哈希摘要进行比对，在比对一致的情况下确认该加密消息中的认证区结构体未被篡改。然后，目的区块链节点进一步查看认证区结构体中的ESP头部,通过ESP头部包含的SPI在本地检索得到对应的共享密钥以及对应的解密方式。将认证区结构体去除ESP头部和ESP尾部后得到的加密信息按照对应的解密方式和共享密钥进行解密以获取明文信息，该明文信息中不包含其他IP头部。Under IPsec ESP in transport mode, after receiving the encrypted message, the destination blockchain node checks that the protocol type in its IP header is 50, so it knows that this is an IPsec packet. Therefore, similar to IPsec ESP in tunnel mode, the destination blockchain node first performs a hash operation on the authentication zone structure contained in the encrypted information to obtain a hash digest, and compares it with the hash digest at the end of the encrypted message. If the comparison is consistent, it is confirmed that the authentication area structure in the encrypted message has not been tampered with. Then, the destination blockchain node further checks the ESP header in the authentication zone structure, and retrieves the corresponding shared key and corresponding decryption method locally through the SPI contained in the ESP header. The encrypted information obtained by removing the ESP header and ESP trailer from the authentication area structure is decrypted according to the corresponding decryption method and shared key to obtain plaintext information. The plaintext information does not contain other IP headers.
在本说明书实施例中，源区块链节点与目的区块链节点通过区块链中继通信网络系统相连，源区块链节点与目的区块链节点同属于一个区块链节点组，共同维护有相同的共享密钥，这使得源区块链节点在需要向目的区块链节点发送明文信息时可以利用共享密钥进行加密，确保了系统的机密性，又由于区块链中继通信网络中的所有中继节点均未维护有该共享密钥，这使得中继网络系统中的中继节点无法通过解密直接获取明文信息，从而避免明文信息在途径区块链中继通信网络系统的过程中被暴露，增强了区块链节点之间通信的安全性。另外，区块链中继通信网络系统在获取到加密消息后无需进行复杂的解封装或解析过程，而是可以在网络层基于加密消息的IP头部直接实现转发，整个从源区块链节点到目的区块链节点的数据传递过程没有增加额外的计算开销，实现了高效的数据传递。In the embodiment of this specification, the source blockchain node and the destination blockchain node are connected through the blockchain relay communication network system. The source blockchain node and the destination blockchain node belong to the same blockchain node group. The same shared key is maintained, which allows the source blockchain node to use the shared key for encryption when it needs to send plaintext information to the destination blockchain node, ensuring the confidentiality of the system, and due to the blockchain relay communication All relay nodes in the network do not maintain this shared key, which makes it impossible for relay nodes in the relay network system to directly obtain plaintext information through decryption, thereby preventing the plaintext information from being transmitted through the blockchain relay communication network system. The process is exposed, which enhances the security of communication between blockchain nodes. In addition, the blockchain relay communication network system does not need to perform complex decapsulation or parsing processes after obtaining the encrypted message. Instead, it can directly forward the encrypted message based on the IP header at the network layer, and the entire source blockchain node The data transfer process to the destination blockchain node does not add additional computing overhead, achieving efficient data transfer.
可选的，所述共享密钥通过所述区块链节点组中的各区块链节点进行组密钥协商以维护于所述各区块链节点。在本说明书实施例中，同属于一个区块链节点组中的各区块链节点通过事先进行组密钥协商实现共同维护有共享密钥。组密钥协商不同于两个对等体之间的端到端的密钥协商，而是指至少三个对等体之间的密钥协商，其目的在于通过线上交互的方式，使至少三个对等体共同维护有相同的共享密钥，同时避免该共享密钥泄露给除是所述至少三个对等体以外的第三方。本说明书实施例所涉及的端到端的密钥协商对应的协议可以包括TLS协议、IKE(Internet key exchange，网络密钥交换协议)协议、DH(Diffie-Hellman)密钥交换协议等，本说明书对此并不做限制。Optionally, the shared key is maintained at each blockchain node through group key negotiation by each blockchain node in the blockchain node group. In the embodiment of this specification, each blockchain node belonging to the same blockchain node group realizes joint maintenance of a shared key by performing group key negotiation in advance. Group key agreement is different from the end-to-end key agreement between two peers, but refers to the key agreement between at least three peers. The purpose is to enable at least three peers to communicate through online interaction. The peers jointly maintain the same shared key, while preventing the shared key from being leaked to third parties other than the at least three peers. The protocols corresponding to the end-to-end key negotiation involved in the embodiments of this specification may include TLS protocol, IKE (Internet key exchange, network key exchange protocol) protocol, DH (Diffie-Hellman) key exchange protocol, etc. This specification will This is not a limitation.
可选的，所述区块链节点组中的各区块链节点进行组密钥协商，包括：所述区块链节点组中的主节点分别与所述区块链节点组中除所述主节点以外的其他区块链节点通过密钥协商以共同维护所述共享密钥。在本说明书实施例中，提供了一种组密钥协商的方法，在该方法中，首先需要在区块链节点组中确定一个主节点作为组密钥协商的主持者，然后，主节点会与所述区块链节点组中除所述主节点以外的其他区块链节点(从节点)分别进行端到端的密钥协商。例如在图1所示的场景，假设Node A作为主节点且希望组建一个包含Node A、Node B与Node C的区块链节点组，那么Node A可以依次或同时分别与Node B和Node C进行密钥协商，并且使Node B在密钥协商后所维护的共享密钥与Node C在密钥协商后所维护的共享密钥相同，同时Node A自身也会维护有该共享密钥，从而最终使得Node A、Node B与Node C维护有相同的共享密钥，从而共同参与组成一个新的区块链节点组。Optionally, each blockchain node in the blockchain node group performs group key negotiation, including: the master node in the blockchain node group communicates with each node in the blockchain node group except the master node. Other blockchain nodes other than the node jointly maintain the shared key through key negotiation. In the embodiment of this specification, a method for group key negotiation is provided. In this method, it is first necessary to determine a master node in the blockchain node group as the host of the group key negotiation. Then, the master node will Conduct end-to-end key negotiation with other blockchain nodes (slave nodes) in the blockchain node group except the master node. For example, in the scenario shown in Figure 1, assuming Node A serves as the master node and wants to form a blockchain node group including Node A, Node B and Node C, then Node A can interact with Node B and Node C respectively or simultaneously. Key negotiation, and the shared key maintained by Node B after key negotiation is the same as the shared key maintained by Node C after key negotiation. At the same time, Node A itself will also maintain the shared key, so that ultimately This allows Node A, Node B and Node C to maintain the same shared key, thereby jointly participating in forming a new blockchain node group.
可选的，所述主节点与所述其他区块链节点中的任一区块链节点(从节点)进行密钥协商，包括：所述主节点与所述任一区块链节点通过DH密钥交换协议生成并维护所述共享密钥；或者，所述主节点与所述任一区块链节点通过DH密钥交换协议共同维护会话密钥，并将所述主节点生成的所述共享密钥基于所述会话密钥加密后发送至所述任一区块链节点，所述任一区块链节点用于将加密后的所述共享密钥基于所述会话密钥进行解密以获取所述共享密钥。在本说明书实施例中，主节点在与任一从节点进行密钥协商时，都可以直接或间接基于DH密钥交换协议来实现共同维护相同的共享密钥，DH密钥交换协议是一类在不安全网络中生成对称密钥的方案，其主要通过两个密钥协商方之间相互公开生成元和可公开计算值的方式，使每一密钥协商方都能计算出只有密钥协商方才能获知的相同的密钥种子，从而进一步基于相同的密钥种子生成并维护相同的对称密钥。Optionally, the master node conducts key negotiation with any blockchain node (slave node) among the other blockchain nodes, including: the master node and any blockchain node communicate through DH The key exchange protocol generates and maintains the shared key; or, the master node and any blockchain node jointly maintain the session key through the DH key exchange protocol, and transfers the session key generated by the master node to The shared key is encrypted based on the session key and sent to any blockchain node, and the any blockchain node is used to decrypt the encrypted shared key based on the session key to Get the shared secret key. In the embodiment of this specification, when the master node performs key negotiation with any slave node, it can jointly maintain the same shared key directly or indirectly based on the DH key exchange protocol. The DH key exchange protocol is a type of A scheme for generating symmetric keys in an insecure network, which mainly uses the method of two key negotiation parties to disclose generators and publicly computable values to each other, so that each key negotiation party can calculate only the key negotiation Only the other party can learn the same key seed, thereby further generating and maintaining the same symmetric key based on the same key seed.
在一实施例中，主节点与从节点之间可以将彼此之间通过DH密钥交换协议直接生成的密钥作为共享密钥，从而使得主节点与该从节点之间维护相同的共享密钥，但由于每次通过DH密钥交换协议得到的共享密钥是不确定的，因此为了确保主节点与其他所有从节点均维护有相同的共享密钥，这种直接通过DH密钥协商协议来直接生成共享密钥的做法通常只会用在主节点进行组密钥协商过程中与第一个从节点进行密钥协商时，而后续则需要采用其他方式来确保所有从节点均能维护相同的共享密钥。In one embodiment, the master node and the slave node can use the keys directly generated by each other through the DH key exchange protocol as a shared key, so that the master node and the slave node maintain the same shared key. , but since the shared key obtained through the DH key exchange protocol each time is uncertain, in order to ensure that the master node and all other slave nodes maintain the same shared key, this is done directly through the DH key agreement protocol. The method of directly generating a shared key is usually only used when the master node performs key negotiation with the first slave node during the group key negotiation process. Subsequently, other methods need to be used to ensure that all slave nodes can maintain the same key. Shared key.
在另一实施例中，主节点与从节点之间可以首先将DH密钥交换协议直接生成的密钥作为会话密钥，以用于后续进行加密通信，此时主节点就能够将随机生成的对称密钥作为共享密钥(或与第一个从节点通过密钥协商生成的共享密钥)并通过会话密钥加密后发送给从节点，从而使得从节点根据自身维护的会话密钥解密得到共享密钥，并且由于DH密钥交换协议直接生成的会话密钥并不直接作为共享密钥，而是作为构建加密通信的基础，这使得区块链节点组中的每个从节点均可通过该方式维护相同的共享密钥，从而最终实现组密钥协商。In another embodiment, the master node and the slave node can first use the key directly generated by the DH key exchange protocol as the session key for subsequent encrypted communication. At this time, the master node can use the randomly generated key. The symmetric key is used as a shared key (or a shared key generated through key negotiation with the first slave node) and is encrypted by the session key and sent to the slave node, so that the slave node decrypts it according to the session key maintained by itself. Shared key, and since the session key generated directly by the DH key exchange protocol is not directly used as a shared key, but as a basis for building encrypted communication, this allows each slave node in the blockchain node group to pass This method maintains the same shared key, ultimately achieving group key agreement.
可选的，所述共享密钥和/或所述会话密钥记录在所述主节点与所述任一区块链节点维护的安全关联策略中。为了区分不同的加密策略，同时有效地安排密钥协商的流程，因此需要对不同类型的消息施加以不同的安全关联策略，以使其按照规定的方式进行加密，本说明书实施例所涉及的安全关联策略具体是指IKE协议中的SA(security assist)，不同SA可以通过待处理消息上的SPI(security parameters index，安全参数索引)字段进行索引。例如，用于进行密钥协商的消息(如DH密钥协商过程中发送的消息)就可以被设置为通过会话密钥进行加密，因此这类消息对应的报文上的SPI字段将指向使用会话密钥进行加解密的安全关联策略；而用于进行普通通讯的消息就可以被设置为通过共享密钥进行加密，因此这 类消息对应的报文上的SPI字段将指向使用相应区块链节点组对应的共享密钥进行加解密的安全关联策略。Optionally, the shared key and/or the session key are recorded in the security association policy maintained by the master node and any blockchain node. In order to distinguish different encryption strategies and effectively arrange the key negotiation process, different security association strategies need to be applied to different types of messages so that they can be encrypted in a prescribed manner. The security involved in the embodiments of this specification The association policy specifically refers to the SA (security assist) in the IKE protocol. Different SAs can be indexed through the SPI (security parameters index) field on the message to be processed. For example, messages used for key negotiation (such as messages sent during the DH key negotiation process) can be set to be encrypted with the session key, so the SPI field on the corresponding message will point to the session key. Security association strategy for encryption and decryption using the key; messages used for ordinary communication can be set to be encrypted through the shared key, so the SPI field on the message corresponding to such a message will point to the corresponding blockchain node. Security association policy for encryption and decryption using the shared key corresponding to the group.
可选的，所述主节点与所述其他区块链节点中的任一区块链节点(从节点)进行密钥协商，包括：所述主节点生成所述共享密钥，并将所述共享密钥基于所述任一区块链节点的公钥加密得到的密文密钥发送至所述任一区块链节点；所述任一区块链节点将所述密文密钥基于所述任一区块链节点的私钥进行解密以获取所述共享密钥。在本说明书实施例中，通过非对称加密特性来实现主节点与从节点之间密钥协商的工作，同时避免在密钥协商的过程中向其他第三方泄露共享密钥，从而在进一步实现组密钥协商。Optionally, the master node conducts key negotiation with any blockchain node (slave node) among the other blockchain nodes, including: the master node generates the shared key and transfers the The ciphertext key obtained by encrypting the shared key based on the public key of any blockchain node is sent to the any blockchain node; the any blockchain node encrypts the ciphertext key based on the Decrypt the private key of any blockchain node to obtain the shared key. In the embodiment of this specification, the key negotiation between the master node and the slave node is realized through the asymmetric encryption feature, while avoiding leaking the shared key to other third parties during the key negotiation process, so as to further realize the group operation. Key agreement.
可选的，还包括：所述其他任一区块链节点将所述共享密钥基于所述主节点公钥加密后返回所述主节点；所述主节点在基于所述主节点的私钥对从所述其他任一区块链节点获取的加密后的所述共享密钥进行解密得到所述共享密钥的情况下，确定与所述其他任一区块链节点的密钥协商已完成。在从节点解密得到共享密钥后，虽然客观上主节点与从节点此刻均已维护有相同的共享密钥，但主节点其实在未接收到相关证明的情况下无法确定从节点已经维护有共享密钥，因此为了使主节点能够确定参与某一次密钥协商的从节点确实已经获取了共享密钥，可以让从节点在解密得到共享密钥后，进一步使用主节点的公钥进行加密后返回至主节点，而主节点解密得到共享密钥后，便可以确定该从节点已经成功获取共享密钥，从而方便安排进行后续的密钥协商任务，或确定组密钥协商已经完成(在确定区块链节点组中所有从节点均维护有共享密钥的情况下)。Optionally, it also includes: any other blockchain node encrypts the shared key based on the public key of the master node and returns it to the master node; the master node encrypts the shared key based on the private key of the master node. When the encrypted shared key obtained from any other blockchain node is decrypted to obtain the shared key, it is determined that the key negotiation with any other blockchain node has been completed. . After the slave node decrypts and obtains the shared key, although objectively both the master node and the slave node have maintained the same shared key at this time, the master node cannot actually determine that the slave node has maintained the shared key without receiving the relevant certificate. key, so in order for the master node to be able to determine that the slave node participating in a certain key negotiation has indeed obtained the shared key, the slave node can further use the master node's public key to encrypt and return after decrypting the shared key. to the master node, and after the master node decrypts and obtains the shared key, it can be determined that the slave node has successfully obtained the shared key, which facilitates the arrangement of subsequent key negotiation tasks, or determines that the group key negotiation has been completed (in the determination area When all slave nodes in the blockchain node group maintain shared keys).
可选的，还包括：所述主节点基于所述主节点的私钥为所述密文密钥生成数字签名，并将所述数字签名发送至所述任一区块链节点；所述任一区块链节点基于所述主节点的公钥对所述数字签名进行验签，在验签成功的情况下确定所述密文密钥来源于所述主节点。在本说明书实施例中，为了使从节点能够验证主节点的身份，防止其他第三方假冒主节点与从节点进行密钥验证，可以利用数字签名技术，使主节点对密文密钥进行数字签名，而后从节点对数字签名进行验签，并在验签成功的情况下确定密文密钥来源的合法性，同时还可以确保密文密钥在传输过程中未被篡改。Optionally, it also includes: the master node generates a digital signature for the ciphertext key based on the private key of the master node, and sends the digital signature to any blockchain node; A blockchain node verifies the digital signature based on the public key of the master node, and determines that the ciphertext key originates from the master node if the signature verification is successful. In the embodiment of this specification, in order to enable the slave node to verify the identity of the master node and prevent other third parties from impersonating the master node and performing key verification with the slave node, digital signature technology can be used to enable the master node to digitally sign the ciphertext key , and then the slave node verifies the digital signature, and determines the legitimacy of the source of the ciphertext key if the verification is successful. It also ensures that the ciphertext key has not been tampered with during the transmission process.
可选的，所述各区块链节点分别与所述区块链中继通信网络系统中至少一个中继节点相连，所述各区块链节点在进行组密钥协商时所需交互的至少部分协商消息经由与所述区块链中继通信网络系统实现转发。本说明书实施例中，在区块链节点组中的区块链节点之间通过共享密钥进行消息加密传输之前，其彼此之间在进行组密钥协商时也需要互相发送一些协商消息，例如DH密钥协商协议中的生成元以及可公开计算值，或者非对称加密方式中的密钥密文，而这些协商消息中至少部分可以通过区块链中继通信网络系统实现转发，由于区块链中继通信网络系统通常具有较高的消息传输效率，从而加快了组密钥协商的效率。当然，上述各区块链节点在进行组密钥协商时所需交互的协商消息也可以直接走区块链中继通信网络系统之外的其他专线或公网；或者，这些协商消息一部分通过区块链中继通信网络系统进行转发，另一部分通过其他专线或公网进行转发。Optionally, each of the blockchain nodes is respectively connected to at least one relay node in the blockchain relay communication network system, and each blockchain node needs to interact with at least part of the negotiation when performing group key negotiation. Messages are forwarded via the blockchain relay communication network system. In the embodiment of this specification, before the blockchain nodes in the blockchain node group perform encrypted message transmission through shared keys, they also need to send some negotiation messages to each other when performing group key negotiation, such as The generators and publicly computed values in the DH key agreement protocol, or the key ciphertext in the asymmetric encryption method, and at least some of these negotiation messages can be forwarded through the blockchain relay communication network system. Due to the block Chain relay communication network systems usually have high message transmission efficiency, thus speeding up the efficiency of group key negotiation. Of course, the negotiation messages that the above-mentioned blockchain nodes need to interact when performing group key negotiation can also directly go through other dedicated lines or public networks outside the blockchain relay communication network system; or, part of these negotiation messages can be sent through the blockchain The chain relay communication network system is used for forwarding, and the other part is forwarded through other dedicated lines or public networks.
在本说明书实施例中，所述源区块链节点与所述目的区块链节点处于相同的区块链网络或不同的区块链网络。需要指出的是，区块链节点组与区块链网络之间并非同一概念，这意味着，同属于一个区块链节点组中的区块链节点成员并非一定处于同一区块链网络中，同一区块链网络中的各区块链节点也不一定处于同一区块链节点组中，本说明书实施例所涉及的区块链节点组其初衷在于实现区块链节点组内成员的安全通信，这不仅可以适应区块链网络内部各区块链节点针对交易共识、区块同步的链内交互需求(通过将统同一区块链网络中的所有区块链节点设置为同一区块链节点组)，也可以适应不同区块链网络中的区块链节点之间的跨链交互需求(通过将处于不同区块链网络中的区块链节点设置为同一区块链节点组)。在所述源区块链节点与所述目的区块链节点处于不同的区块链网络的情况下，所述源区块链节点所处的源区块链网络与所述目的区块链节点所处的目的区块链网络同构或异构，区块链节点组中的区块链节点并不被要求需要具有相同的区块链架构，即一个区块链节点组中各区块链节点所涉及的多个区块链网络并非一定要求同构，具有相同的区块链协议、共识协议等，涉及的多个区块链网络之间也可以是异构的。In the embodiment of this specification, the source blockchain node and the destination blockchain node are in the same blockchain network or different blockchain networks. It should be pointed out that blockchain node groups and blockchain networks are not the same concept, which means that blockchain node members belonging to the same blockchain node group are not necessarily in the same blockchain network. Each blockchain node in the same blockchain network is not necessarily in the same blockchain node group. The original intention of the blockchain node group involved in the embodiments of this specification is to realize secure communication among members of the blockchain node group. This can not only adapt to the intra-chain interaction needs of each blockchain node within the blockchain network for transaction consensus and block synchronization (by unifying all blockchain nodes in the same blockchain network into the same blockchain node group) , and can also adapt to the cross-chain interaction needs between blockchain nodes in different blockchain networks (by setting blockchain nodes in different blockchain networks to the same blockchain node group). In the case where the source blockchain node and the destination blockchain node are in different blockchain networks, the source blockchain network where the source blockchain node is located and the destination blockchain node Whether the intended blockchain network is homogeneous or heterogeneous, the blockchain nodes in the blockchain node group are not required to have the same blockchain architecture, that is, each blockchain node in a blockchain node group The multiple blockchain networks involved do not necessarily need to be isomorphic and have the same blockchain protocol, consensus protocol, etc. The multiple blockchain networks involved can also be heterogeneous.
需要说明的是，狭义上的异构区块链，通常是指在区块链上流通的价值存在明显差异；也即，所流通的价值存在明显差异的两个区块链之间，通常可以称之为异构区块链。比如，比特币网络和以太坊就是狭义上的异构区块链。It should be noted that heterogeneous blockchains in a narrow sense usually refer to obvious differences in the values circulating on the blockchain; that is, between two blockchains with obvious differences in the values circulating, it is usually possible to Call it a heterogeneous blockchain. For example, the Bitcoin network and Ethereum are heterogeneous blockchains in a narrow sense.
而广义上的异构区块链，是指区块链的类型和/或采用的区块链协议存在明显差异；也即，区块链的类型和/或采用的区块链协议存在明显的两个区块链之间，通常也可以称之为异构区块链。比如，蚂蚁区块链(ANT CHAIN)和hyperledger fabric区块链就是广义上的异构区块链。Heterogeneous blockchain in a broad sense means that there are obvious differences in the types of blockchains and/or the blockchain protocols adopted; that is, there are obvious differences in the types of blockchains and/or the blockchain protocols adopted. Between two blockchains, it can usually be called a heterogeneous blockchain. For example, ANT CHAIN and hyperledger fabric blockchain are heterogeneous blockchains in a broad sense.
本说明书实施例所涉及的基于区块链中继通信网络系统的消息传输方法可以基于网络层协议实现，例如该网络层协议可以是IPsec(Internet Protocol Security，互联网安全协议)，具体为IPsec ESP协议。由于基于共享密钥的加解密过程、IP头部的封装过程均发生在网络层，故相较于应用层协议、传输层协议或TLS协议，本说明书实施例中的区块链中继通信网络系统无需对转发报文(即加密消息)进行深度解封装和解析，而只需要解封装至网络层后直接基于IP头部进行转发，对转发效率具有较小的性能损耗。同时，由于网络层中加密的对象为IP报文，而应用层协议中加密的对象为应用程序定义的数据结构体，因此网络层协议相较于应用层协议而言，其加密范围(包含应用层封装、传输层封装等)更大，具有更强的数据保护能力。The message transmission method based on the blockchain relay communication network system involved in the embodiments of this specification can be implemented based on the network layer protocol. For example, the network layer protocol can be IPsec (Internet Protocol Security, Internet Security Protocol), specifically the IPsec ESP protocol. . Since the encryption and decryption process based on the shared key and the encapsulation process of the IP header all occur at the network layer, compared with the application layer protocol, transport layer protocol or TLS protocol, the blockchain relay communication network in the embodiment of this specification The system does not need to deeply decapsulate and parse forwarded messages (i.e. encrypted messages), but only needs to decapsulate them to the network layer and forward them directly based on the IP header, which has a small performance loss on forwarding efficiency. At the same time, since the encrypted objects in the network layer are IP messages, and the encrypted objects in the application layer protocol are data structures defined by the application, the encryption scope of the network layer protocol (including application layer encapsulation, transport layer encapsulation, etc.) are larger and have stronger data protection capabilities.
图3是一示例性实施例提供的另一种基于区块链中继通信网络系统的消息传输方法的流程图。如图3所示，该方法应用于源区块链节点，所述区块链中继通信网络系统分别与所述源区块链节点和目的区块链节点相连，所述源区块链节点和所述目的区块链节点所属的区块链节点组中的各区块链节点均维护有相同的共享密钥，且所述区块链中继通信网络系统中的中继节点未维护有所述共享密钥；所述方法包括：Figure 3 is a flow chart of another message transmission method based on a blockchain relay communication network system provided by an exemplary embodiment. As shown in Figure 3, this method is applied to the source blockchain node. The blockchain relay communication network system is connected to the source blockchain node and the destination blockchain node respectively. The source blockchain node Each blockchain node in the blockchain node group to which the destination blockchain node belongs maintains the same shared key, and the relay node in the blockchain relay communication network system does not maintain any the shared key; the method includes:
S302：基于所述共享密钥对明文信息加密以获取加密信息。S302: Encrypt plaintext information based on the shared key to obtain encrypted information.
S304：为所述加密信息封装IP头部以生成加密消息。S304: Encapsulate the IP header for the encrypted information to generate an encrypted message.
S306：将所述加密消息发送至所述区块链中继通信网络系统，所述区块链中继通信网络系统用于基于所述IP头部将所述加密消息转发至所述目的区块链节点。S306: Send the encrypted message to the blockchain relay communication network system, which is used to forward the encrypted message to the destination block based on the IP header. chain node.
图4是一示例性实施例提供的又一种基于区块链中继通信网络系统的消息传输方法的流程图。如图4所示，该方法应用于目的区块链节点，所述区块链中继通信网络系统分别与源区块链节点和所述目的区块链节点相连，所述源区块链节点和所述目的区块链节点所属的区块链节点组中的各区块链节点均维护有相同的共享密钥，且所述区块链中继通信网络系统中的中继节点未维护有所述共享密钥；所述方法包括：Figure 4 is a flow chart of yet another message transmission method based on a blockchain relay communication network system provided by an exemplary embodiment. As shown in Figure 4, this method is applied to the destination blockchain node. The blockchain relay communication network system is connected to the source blockchain node and the destination blockchain node respectively. The source blockchain node Each blockchain node in the blockchain node group to which the destination blockchain node belongs maintains the same shared key, and the relay node in the blockchain relay communication network system does not maintain any the shared key; the method includes:
S402：接收所述区块链中继通信网络系统基于加密消息的IP头部转发至所述目的区块链节点的所述加密消息，所述加密消息由所述源区块链节点为基于所述共享密钥对明文信息加密获取的加密信息封装所述IP头部以生成。S402: Receive the encrypted message forwarded to the destination blockchain node by the blockchain relay communication network system based on the IP header of the encrypted message. The encrypted message is forwarded by the source blockchain node based on the IP header of the encrypted message. The encrypted information obtained by encrypting the plain text information with the shared key is encapsulated in the IP header to generate.
S404：基于所述共享密钥对所述加密消息解密以获取所述明文信息。S404: Decrypt the encrypted message based on the shared key to obtain the plaintext information.
图5是一示例性实施例提供的再一种基于区块链中继通信网络系统的消息传输方法的流程图。如图5所示，该方法应用于所述区块链中继通信网络系统，所述区块链中继通信网络系统分别与源区块链节点和目的区块链节点相连，所述源区块链节点和所述目的区块链节点所属的区块链节点组中的各区块链节点均维护有相同的共享密钥，且所述区块链中继通信网络系统中的中继节点未维护有所述共享密钥；所述方法包括：Figure 5 is a flow chart of yet another message transmission method based on a blockchain relay communication network system provided by an exemplary embodiment. As shown in Figure 5, this method is applied to the blockchain relay communication network system. The blockchain relay communication network system is connected to the source blockchain node and the destination blockchain node respectively. The source area The blockchain node and each blockchain node in the blockchain node group to which the destination blockchain node belongs maintain the same shared key, and the relay node in the blockchain relay communication network system has not The shared key is maintained; the method includes:
S502：接收所述源区块链节点为基于所述共享密钥对明文信息加密获取的加密信息封装IP头部以生成的加密消息。S502: Receive the encrypted message generated by the source blockchain node by encapsulating the IP header with the encrypted information obtained by encrypting the plaintext information based on the shared key.
S504：基于所述IP头部将所述加密消息转发至所述目的区块链节点。S504: Forward the encrypted message to the destination blockchain node based on the IP header.
图6是一示例性实施例提供的一种基于区块链中继通信网络系统的消息传输方法的交互流程图。图6是基于图1所示的场景中Node A、中继节点a、中继节点b和Node B之间的相互配合实现，假设Node A为源区块链节点，且Node A本地维护有一个成员同时包含有Node A与Node B的区块链节点组对应 的共享密钥key_1，假设Node B为目的区块链节点，且Node B本地也维护有共享密钥key_1，另外，区块链中继通信网络系统中作为源中继节点的中继节点a与Node A相连接，区块链中继通信网络系统中作为目的中继节点的中继节点b与Node B相连接，而中继节点a与中继节点b之间通过高速链路相连接。下面以图1中Node A经由区块链中继通信网络系统中的中继节点a与中继节点b向Node B发送明文信息为例，对本说明书基于区块链中继通信网络系统的消息传输的方案进行详细说明。请参考图6，该方法包括以下步骤：Figure 6 is an interactive flow chart of a message transmission method based on a blockchain relay communication network system provided by an exemplary embodiment. Figure 6 is based on the mutual cooperation between Node A, relay node a, relay node b and Node B in the scenario shown in Figure 1. It is assumed that Node A is the source blockchain node, and Node A locally maintains a Members also include the shared key key_1 corresponding to the blockchain node groups of Node A and Node B. Assume that Node B is the destination blockchain node, and Node B also maintains the shared key key_1 locally. In addition, in the blockchain Relay node a as the source relay node in the relay communication network system is connected to Node A, relay node b as the destination relay node in the blockchain relay communication network system is connected to Node B, and the relay node A and relay node b are connected through a high-speed link. Taking Node A in Figure 1 as an example to send plaintext information to Node B via relay node a and relay node b in the blockchain relay communication network system, this description is based on the message transmission of the blockchain relay communication network system. The plan is explained in detail. Referring to Figure 6, the method includes the following steps:
S601：Node A在本地查找与Node B同属的区块链节点组，同时确定同属的区块链节点组对应的共享密钥key_1，并基于共享密钥key_1对原始信息original_msg加密同时封装新的IP头部得到加密消息encrypted_msg，其中，新封装的IP头部中的源IP地址为中继节点a的IP地址，目的IP地址为Node B的IP地址。S601: Node A locally searches for the blockchain node group that belongs to the same blockchain node group as Node B, and determines the shared key key_1 corresponding to the same blockchain node group, and encrypts the original information original_msg based on the shared key key_1 and encapsulates the new IP. The header gets the encrypted message encrypted_msg, in which the source IP address in the newly encapsulated IP header is the IP address of relay node a, and the destination IP address is the IP address of Node B.
S602：Node A将encrypted_msg发送至中继节点a。S602: Node A sends encrypted_msg to relay node a.
S603：中继节点a接收到encrypted_msg后，基于其IP头部中的目的IP地址(Node B的IP地址)，查找本地路由表，发现下一跳为中继节点b，于是将encrypted_msg直接通过彼此相连接的高速链路发送至中继节点b，当然，也可以根据其他路由策略(例如支持负载均衡)将encrypted_msg经由中继节点c转发至中继节点b。S603: After relay node a receives encrypted_msg, it searches the local routing table based on the destination IP address in its IP header (Node B's IP address) and finds that the next hop is relay node b, so it passes encrypted_msg directly to each other. The connected high-speed link is sent to relay node b. Of course, encrypted_msg can also be forwarded to relay node b via relay node c according to other routing strategies (for example, supporting load balancing).
S604：中继节点b接收到封装有encrypted_msg后，通过其IP头部确定其所需发往的目的地为Node B，而中继节点b自身也具有通向Node B的路由信息，于是中继节点b将encrypted_msg进一步转发至Node B。S604: After receiving the encapsulated encrypted_msg, relay node b determines through its IP header that the destination it needs to send is Node B, and relay node b itself also has routing information leading to Node B, so the relay node b Node B further forwards encrypted_msg to Node B.
S605：Node B接收到encrypted_msg后，通过其IP头部发现该加密消息的目的地为自身，于是将IP头部进行解封装，并进一步获取encrypted_msg中用于加解密该加密消息对应的区块链节点组的索引字段(例如SPI)，Node B由此索引到对应的区块链节点组，并使用该区块链节点组对应的共享密钥key_1对encrypted_msg进行解密得到original_msg。S605: After Node B receives encrypted_msg, it finds that the destination of the encrypted message is itself through its IP header, so it decapsulates the IP header and further obtains the blockchain corresponding to the encrypted_msg used to encrypt and decrypt the encrypted message. The index field of the node group (such as SPI), Node B indexes to the corresponding blockchain node group, and uses the shared key key_1 corresponding to the blockchain node group to decrypt encrypted_msg to obtain original_msg.
图7是一示例性实施例提供的一种基于区块链中继通信网络系统的消息传输系统的架构示意图。如图7所示，所述区块链中继通信网络系统702分别与源区块链节点701和目的区块链节点703相连，所述源区块链节点701和所述目的区块链节点703所属的区块链节点组中的各区块链节点均维护有相同的共享密钥，且所述区块链中继通信网络系统702中的中继节点未维护有所述共享密钥；所述系统包括：Figure 7 is a schematic architectural diagram of a message transmission system based on a blockchain relay communication network system provided by an exemplary embodiment. As shown in Figure 7, the blockchain relay communication network system 702 is connected to the source blockchain node 701 and the destination blockchain node 703 respectively. The source blockchain node 701 and the destination blockchain node Each blockchain node in the blockchain node group to which 703 belongs maintains the same shared key, and the relay node in the blockchain relay communication network system 702 does not maintain the shared key; so The systems described include:
所述源区块链节点701，用于基于所述共享密钥对明文信息加密以获取加密信息，为所述加密信息封装IP头部以生成加密消息，并将所述加密消息发送至所述区块链中继通信网络系统702。The source blockchain node 701 is configured to encrypt plaintext information based on the shared key to obtain encrypted information, encapsulate an IP header for the encrypted information to generate an encrypted message, and send the encrypted message to the Blockchain relay communication network system 702.
所述区块链中继通信网络系统702，用于基于所述IP头部将所述加密消息转发至所述目的区块链节点703。The blockchain relay communication network system 702 is used to forward the encrypted message to the destination blockchain node 703 based on the IP header.
所述目的区块链节点703，用于基于所述共享密钥对所述加密消息解密以获取所述明文信息。The destination blockchain node 703 is configured to decrypt the encrypted message based on the shared key to obtain the plaintext information.
可选的，所述区块链中继通信网络系统702为一个中继节点；或者，Optionally, the blockchain relay communication network system 702 is a relay node; or,
所述区块链中继通信网络系统702包括源中继节点7021和目的中继节点7022，所述源中继节点7021与源区块链节点701相连，所述目的中继节点7022与目的区块链节点703相连，所述区块链中继通信网络系统702基于所述IP头部将所述加密消息转发至所述目的区块链节点703，包括：The blockchain relay communication network system 702 includes a source relay node 7021 and a destination relay node 7022. The source relay node 7021 is connected to the source blockchain node 701, and the destination relay node 7022 is connected to the destination area. The blockchain node 703 is connected, and the blockchain relay communication network system 702 forwards the encrypted message to the destination blockchain node 703 based on the IP header, including:
所述源中继节点7021将从所述源区块链节点701接收的所述加密消息发送至所述目的中继节点7022；The source relay node 7021 sends the encrypted message received from the source blockchain node 701 to the destination relay node 7022;
所述目的中继节点7022将所述加密消息发送至所述目的区块链节点703。The destination relay node 7022 sends the encrypted message to the destination blockchain node 703.
可选的，所述共享密钥通过所述区块链节点组中的各区块链节点进行组密钥协商以维护于所述各区块链节点。Optionally, the shared key is maintained at each blockchain node through group key negotiation by each blockchain node in the blockchain node group.
可选的，所述各区块链节点分别与所述区块链中继通信网络系统702中至少一个中继节点相连，所述各区块链节点在进行组密钥协商时所需交互的至少部分协商消息经由所述区块链中继通信网络系统702实现转发。Optionally, each of the blockchain nodes is connected to at least one relay node in the blockchain relay communication network system 702, and at least part of the interaction required by each of the blockchain nodes during group key negotiation is The negotiation message is forwarded via the blockchain relay communication network system 702.
可选的，所述区块链节点组中的各区块链节点进行组密钥协商，包括：Optionally, each blockchain node in the blockchain node group conducts group key negotiation, including:
所述区块链节点组中的主节点分别与所述区块链节点组中除所述主节点以外的其他区块链节点通过密钥协商以共同维护所述共享密钥。The master node in the blockchain node group jointly maintains the shared key through key negotiation with other blockchain nodes in the blockchain node group except the master node.
可选的，所述主节点与所述其他区块链节点中的任一区块链节点进行密钥协商，包括：Optionally, the master node conducts key negotiation with any of the other blockchain nodes, including:
所述主节点与所述任一区块链节点通过DH密钥交换协议生成并维护所述共享密钥；或者，The master node and any blockchain node generate and maintain the shared key through a DH key exchange protocol; or,
所述主节点与所述任一区块链节点通过DH密钥交换协议共同维护会话密钥，并将所述主节点生成的所述共享密钥基于所述会话密钥加密后发送至所述任一区块链节点，所述任一区块链节点用于将加密后的所述共享密钥基于所述会话密钥进行解密以获取所述共享密钥。The master node and any blockchain node jointly maintain a session key through the DH key exchange protocol, and encrypt the shared key generated by the master node based on the session key and send it to the Any blockchain node, the any blockchain node is configured to decrypt the encrypted shared key based on the session key to obtain the shared key.
可选的，所述共享密钥和/或所述会话密钥记录在所述主节点与所述任一区块链节点维护的安全关联策略中。Optionally, the shared key and/or the session key are recorded in the security association policy maintained by the master node and any blockchain node.
可选的，所述主节点与所述其他区块链节点中的任一区块链节点进行密钥协商，包括：Optionally, the master node conducts key negotiation with any of the other blockchain nodes, including:
所述主节点生成所述共享密钥，并将所述共享密钥基于所述任一区块链节点的公钥加密得到的密文密钥发送至所述任一区块链节点；The master node generates the shared key and sends the ciphertext key obtained by encrypting the shared key based on the public key of any blockchain node to the any blockchain node;
所述任一区块链节点将所述密文密钥基于所述任一区块链节点的私钥进行解密以获取所述共享密钥。The any blockchain node decrypts the ciphertext key based on the private key of any blockchain node to obtain the shared key.
可选的，还包括：Optional, also includes:
所述主节点基于所述主节点的私钥为所述密文密钥生成数字签名，并将所述数字签名发送至所述任一区块链节点；The master node generates a digital signature for the ciphertext key based on the private key of the master node, and sends the digital signature to any blockchain node;
所述任一区块链节点基于所述主节点的公钥对所述数字签名进行验签，在验签成功的情况下确定所述密文密钥来源于所述主节点。The any blockchain node verifies the digital signature based on the public key of the master node, and determines that the ciphertext key originates from the master node if the signature verification is successful.
可选的，所述源区块链节点701与所述目的区块链节点703处于相同的区块链网络或不同的区块链网络。Optionally, the source blockchain node 701 and the destination blockchain node 703 are in the same blockchain network or different blockchain networks.
可选的，在所述源区块链节点701与所述目的区块链节点703处于不同的区块链网络的情况下，所述源区块链节点701所处的源区块链网络与所述目的区块链节点703所处的目的区块链网络同构或异构。Optionally, in the case where the source blockchain node 701 and the destination blockchain node 703 are in different blockchain networks, the source blockchain network where the source blockchain node 701 is located is the same as the source blockchain node 703. The destination blockchain network where the destination blockchain node 703 is located may be homogeneous or heterogeneous.
可选的，optional,
在所述明文信息包含有原始报文对应的原始IP头部的情况下，所述IP头部基于区块链中继通信网络系统702的网络信息所创建；In the case where the plaintext information contains the original IP header corresponding to the original message, the IP header is created based on the network information of the blockchain relay communication network system 702;
在所述明文信息为去除所述原始IP头部的所述原始报文的情况下，所述IP头部为所述原始IP头部。When the plaintext information is the original message with the original IP header removed, the IP header is the original IP header.
可选的，所述加密消息基于IPsec ESP协议生成。Optionally, the encrypted message is generated based on IPsec ESP protocol.
图8是一示例性实施例提供的一种设备的示意结构图。请参考图8，在硬件层面，该设备包括处理器802、内部总线804、网络接口806、内存808以及非易失性存储器810，当然还可能包括其他功能所需要的硬件。本说明书一个或多个实施例可以基于软件方式来实现，比如由处理器802从非易失性存储器810中读取对应的计算机程序到内存808中然后运行。当然，除了软件实现方式之外，本说明书一个或多个实施例并不排除其他实现方式，比如逻辑器件抑或软硬件结合的方式等等，也就是说以下处理流程的执行主体并不限定于各个逻辑单元，也可以是硬件或逻辑器件。Figure 8 is a schematic structural diagram of a device provided by an exemplary embodiment. Please refer to Figure 8. At the hardware level, the device includes a processor 802, an internal bus 804, a network interface 806, a memory 808 and a non-volatile memory 810. Of course, it may also include hardware required for other functions. One or more embodiments of this specification may be implemented based on software. For example, the processor 802 reads the corresponding computer program from the non-volatile memory 810 into the memory 808 and then runs it. Of course, in addition to software implementation, one or more embodiments of this specification do not exclude other implementations, such as logic devices or a combination of software and hardware, etc. That is to say, the execution subject of the following processing flow is not limited to each A logic unit can also be a hardware or logic device.
如图9所示，图9是一示例性实施例提供的一种基于区块链中继通信网络系统的消息传输装置的框图，该装置可以应用于如图8所示的设备中，以实现本说明书的技术方案；所述装置应用于源区块链节点，所述区块链中继通信网络系统分别与所述源区块链节点和目的区块链节点相连，所述源区块链节点和所述目的区块链节点所属的区块链节点组中的各区块链节点均维护有相同的共享密钥，且所述区块链中继通信网络系统中的中继节点未维护有所述共享密钥；所述装置包括：As shown in Figure 9, Figure 9 is a block diagram of a message transmission device based on a blockchain relay communication network system provided by an exemplary embodiment. This device can be applied to the equipment shown in Figure 8 to implement The technical solution of this specification; the device is applied to a source blockchain node, the blockchain relay communication network system is connected to the source blockchain node and the destination blockchain node respectively, and the source blockchain Each blockchain node in the blockchain node group to which the node and the destination blockchain node belong maintains the same shared key, and the relay node in the blockchain relay communication network system does not maintain a shared key. The shared key; the device includes:
明文信息加密单元901，用于基于所述共享密钥对明文信息加密以获取加密信息。The plaintext information encryption unit 901 is configured to encrypt plaintext information based on the shared key to obtain encrypted information.
加密消息生成单元902，用于为所述加密信息封装IP头部以生成加密消息。The encrypted message generating unit 902 is configured to encapsulate an IP header for the encrypted information to generate an encrypted message.
加密消息发送单元903，用于将所述加密消息发送至所述区块链中继通信网络系统，所述区块链中 继通信网络系统用于基于所述IP头部将所述加密消息转发至所述目的区块链节点。The encrypted message sending unit 903 is used to send the encrypted message to the blockchain relay communication network system, and the blockchain relay communication network system is used to forward the encrypted message based on the IP header. to the destination blockchain node.
如图10所示，图10是一示例性实施例提供的另一种基于区块链中继通信网络系统的消息传输装置的框图，该装置可以应用于如图8所示的设备中，以实现本说明书的技术方案；所述装置应用于目的区块链节点，所述区块链中继通信网络系统分别与源区块链节点和所述目的区块链节点相连，所述源区块链节点和所述目的区块链节点所属的区块链节点组中的各区块链节点均维护有相同的共享密钥，且所述区块链中继通信网络系统中的中继节点未维护有所述共享密钥；所述装置包括：As shown in Figure 10, Figure 10 is a block diagram of another message transmission device based on the blockchain relay communication network system provided by an exemplary embodiment. This device can be applied to the equipment shown in Figure 8, to Implement the technical solution of this specification; the device is applied to a destination blockchain node, the blockchain relay communication network system is connected to the source blockchain node and the destination blockchain node respectively, and the source block Each blockchain node in the blockchain node group to which the chain node and the destination blockchain node belong maintains the same shared key, and the relay node in the blockchain relay communication network system is not maintained. There is the shared key; the device includes:
第一加密消息接收单元1001，用于接收所述区块链中继通信网络系统基于加密消息的IP头部转发至所述目的区块链节点的所述加密消息，所述加密消息由所述源区块链节点为基于所述共享密钥对明文信息加密获取的加密信息封装所述IP头部以生成。The first encrypted message receiving unit 1001 is configured to receive the encrypted message forwarded by the blockchain relay communication network system to the destination blockchain node based on the IP header of the encrypted message, where the encrypted message is forwarded by the The source blockchain node encapsulates the IP header to generate the encrypted information obtained by encrypting the plaintext information based on the shared key.
加密消息解密单元1002，用于基于所述共享密钥对所述加密消息解密以获取所述明文信息。The encrypted message decryption unit 1002 is configured to decrypt the encrypted message based on the shared key to obtain the plaintext information.
如图11所示，图11是一示例性实施例提供的又一种基于区块链中继通信网络系统的消息传输装置的框图，该装置可以应用于如图8所示的设备中，以实现本说明书的技术方案；所述装置应用于所述区块链中继通信网络系统，所述区块链中继通信网络系统分别与源区块链节点和目的区块链节点相连，所述源区块链节点和所述目的区块链节点所属的区块链节点组中的各区块链节点均维护有相同的共享密钥，且所述区块链中继通信网络系统中的中继节点未维护有所述共享密钥；所述装置包括：As shown in Figure 11, Figure 11 is a block diagram of yet another message transmission device based on a blockchain relay communication network system provided by an exemplary embodiment. This device can be applied to the equipment shown in Figure 8, to Implement the technical solution of this specification; the device is applied to the blockchain relay communication network system, and the blockchain relay communication network system is connected to the source blockchain node and the destination blockchain node respectively, and the Each blockchain node in the blockchain node group to which the source blockchain node and the destination blockchain node belong maintains the same shared key, and the relay in the blockchain relay communication network system The node does not maintain the shared key; the device includes:
第二加密消息接收单元1101，用于接收所述源区块链节点为基于所述共享密钥对明文信息加密获取的加密信息封装IP头部以生成的加密消息。The second encrypted message receiving unit 1101 is configured to receive an encrypted message generated by the source blockchain node by encapsulating the IP header of the encrypted information obtained by encrypting the plaintext information based on the shared key.
加密消息转发单元1102，用于基于所述IP头部将所述加密消息转发至所述目的区块链节点。The encrypted message forwarding unit 1102 is configured to forward the encrypted message to the destination blockchain node based on the IP header.
在20世纪90年代，对于一个技术的改进可以很明显地区分是硬件上的改进(例如，对二极管、晶体管、开关等电路结构的改进)还是软件上的改进(对于方法流程的改进)。然而，随着技术的发展，当今的很多方法流程的改进已经可以视为硬件电路结构的直接改进。设计人员几乎都通过将改进的方法流程编程到硬件电路中来得到相应的硬件电路结构。因此，不能说一个方法流程的改进就不能用硬件实体模块来实现。例如，可编程逻辑器件(Programmable Logic Device,PLD)(例如现场可编程门阵列(Field Programmable Gate Array，FPGA))就是这样一种集成电路，其逻辑功能由用户对器件编程来确定。由设计人员自行编程来把一个数字系统“集成”在一片PLD上，而不需要请芯片制造厂商来设计和制作专用的集成电路芯片。而且，如今，取代手工地制作集成电路芯片，这种编程也多半改用“逻辑编译器(logic compiler)”软件来实现，它与程序开发撰写时所用的软件编译器相类似，而要编译之前的原始代码也得用特定的编程语言来撰写，此称之为硬件描述语言(Hardware Description Language，HDL)，而HDL也并非仅有一种，而是有许多种，如ABEL(Advanced Boolean Expression Language)、AHDL(Altera Hardware Description Language)、Confluence、CUPL(Cornell University Programming Language)、HDCal、JHDL(Java Hardware Description Language)、Lava、Lola、MyHDL、PALASM、RHDL(Ruby Hardware Description Language)等，目前最普遍使用的是VHDL(Very-High-Speed Integrated Circuit Hardware Description Language)与Verilog。本领域技术人员也应该清楚，只需要将方法流程用上述几种硬件描述语言稍作逻辑编程并编程到集成电路中，就可以很容易得到实现该逻辑方法流程的硬件电路。In the 1990s, improvements in a technology could be clearly distinguished as hardware improvements (for example, improvements in circuit structures such as diodes, transistors, switches, etc.) or software improvements (improvements in method processes). However, with the development of technology, many improvements in today's method processes can be regarded as direct improvements in hardware circuit structures. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that an improvement of a method flow cannot be implemented using hardware entity modules. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic functions are determined by the user programming the device. Designers can program themselves to "integrate" a digital system on a PLD, instead of asking chip manufacturers to design and produce dedicated integrated circuit chips. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented using "logic compiler" software, which is similar to the software compiler used in program development and writing, and before compilation The original code must also be written in a specific programming language, which is called Hardware Description Language (HDL), and HDL is not just one kind, but there are many, such as ABEL (Advanced Boolean Expression Language) , AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc., are currently the most commonly used The two are VHDL (Very-High-Speed Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that by simply logically programming the method flow using the above-mentioned hardware description languages and programming it into the integrated circuit, the hardware circuit that implements the logical method flow can be easily obtained.
控制器可以按任何适当的方式实现，例如，控制器可以采取例如微处理器或处理器以及存储可由该(微)处理器执行的计算机可读程序代码(例如软件或固件)的计算机可读介质、逻辑门、开关、专用集成电路(Application Specific Integrated Circuit，ASIC)、可编程逻辑控制器和嵌入微控制器的形式，控制器的例子包括但不限于以下微控制器：ARC 625D、Atmel AT91SAM、Microchip PIC18F26K20以及Silicone Labs C8051F320，存储器控制器还可以被实现为存储器的控制逻辑的一部分。本领域技术人员也知道，除了以纯计算机可读程序代码方式实现控制器以外，完全可以通过将方法步骤进行逻辑编程来使得控制器以逻辑门、开关、专用集成电路、可编程逻辑控制器和嵌入微控制器等的形式来实现相同功能。因此这种控制器可以被认为是一种硬件部件，而对其内包括的用于实现各种功能的装置也可以视为硬件部件内的结构。或者甚至，可以将用于实现各种功能的装置视为既可以是实现方法的软件模块又 可以是硬件部件内的结构。The controller may be implemented in any suitable manner, for example, the controller may take the form of, for example, a microprocessor or processor and a computer readable medium storing computer readable program code (eg, software or firmware) executable by the (micro)processor. , logic gates, switches, Application Specific Integrated Circuit (ASIC), programmable logic controllers and embedded microcontrollers. Examples of controllers include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, For Microchip PIC18F26K20 and Silicone Labs C8051F320, the memory controller can also be implemented as part of the memory's control logic. Those skilled in the art also know that in addition to implementing the controller in the form of pure computer-readable program code, the controller can be completely programmed with logic gates, switches, application-specific integrated circuits, programmable logic controllers and embedded logic by logically programming the method steps. Microcontroller, etc. to achieve the same function. Therefore, this controller can be considered as a hardware component, and the devices included therein for implementing various functions can also be considered as structures within the hardware component. Or even, the means for implementing various functions can be considered as structures within hardware components as well as software modules implementing methods.
上述实施例阐明的系统、装置、模块或单元，具体可以由计算机芯片或实体实现，或者由具有某种功能的产品来实现。一种典型的实现设备为服务器系统。当然，本发明不排除随着未来计算机技术的发展，实现上述实施例功能的计算机例如可以为个人计算机、膝上型计算机、车载人机交互设备、蜂窝电话、相机电话、智能电话、个人数字助理、媒体播放器、导航设备、电子邮件设备、游戏控制台、平板计算机、可穿戴设备或者这些设备中的任何设备的组合。The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a server system. Of course, the present invention does not exclude that with the development of computer technology in the future, the computer that implements the functions of the above embodiments may be, for example, a personal computer, a laptop computer, a vehicle-mounted human-computer interaction device, a cellular phone, a camera phone, a smart phone, or a personal digital assistant. , media player, navigation device, email device, game console, tablet, wearable device, or a combination of any of these devices.
虽然本说明书一个或多个实施例提供了如实施例或流程图所述的方法操作步骤，但基于常规或者无创造性的手段可以包括更多或者更少的操作步骤。实施例中列举的步骤顺序仅仅为众多步骤执行顺序中的一种方式，不代表唯一的执行顺序。在实际中的装置或终端产品执行时，可以按照实施例或者附图所示的方法顺序执行或者并行执行(例如并行处理器或者多线程处理的环境，甚至为分布式数据处理环境)。术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、产品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、产品或者设备所固有的要素。在没有更多限制的情况下，并不排除在包括所述要素的过程、方法、产品或者设备中还存在另外的相同或等同要素。例如若使用到第一，第二等词语用来表示名称，而并不表示任何特定的顺序。Although one or more embodiments of this specification provide method operation steps as described in the embodiments or flow charts, more or fewer operation steps may be included based on conventional or non-inventive means. The sequence of steps listed in the embodiment is only one way of executing the sequence of many steps, and does not represent the only execution sequence. When the actual device or terminal product is executed, it may be executed sequentially or in parallel according to the methods shown in the embodiments or figures (for example, a parallel processor or a multi-thread processing environment, or even a distributed data processing environment). The terms "comprises," "comprises," or any other variation thereof are intended to cover a non-exclusive inclusion such that a process, method, product, or apparatus that includes a list of elements includes not only those elements, but also others not expressly listed elements, or elements inherent to the process, method, product or equipment. Without further limitation, it does not exclude the presence of additional identical or equivalent elements in a process, method, product or apparatus including the stated elements. For example, if the words "first" and "second" are used to express names, they do not indicate any specific order.
为了描述的方便，描述以上装置时以功能分为各种模块分别描述。当然，在实施本说明书一个或多个时可以把各模块的功能在同一个或多个软件和/或硬件中实现，也可以将实现同一功能的模块由多个子模块或子单元的组合实现等。以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。For the convenience of description, when describing the above device, the functions are divided into various modules and described separately. Of course, when implementing one or more of this specification, the functions of each module can be implemented in the same or multiple software and/or hardware, or the modules that implement the same function can be implemented by a combination of multiple sub-modules or sub-units, etc. . The device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated. to another system, or some features can be ignored, or not implemented. On the other hand, the coupling or direct coupling or communication connection between each other shown or discussed may be through some interfaces, and the indirect coupling or communication connection of the devices or units may be in electrical, mechanical or other forms.
本发明是参照根据本发明实施例的方法、装置(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each process and/or block in the flowchart illustrations and/or block diagrams, and combinations of processes and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine, such that the instructions executed by the processor of the computer or other programmable data processing device produce a use A device for realizing the functions specified in one process or multiple processes of the flowchart and/or one block or multiple blocks of the block diagram.
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。These computer program instructions may also be stored in a computer-readable memory that causes a computer or other programmable data processing apparatus to operate in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction means, the instructions The device implements the functions specified in a process or processes of the flowchart and/or a block or blocks of the block diagram.
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。These computer program instructions may also be loaded onto a computer or other programmable data processing device, causing a series of operating steps to be performed on the computer or other programmable device to produce computer-implemented processing, thereby executing on the computer or other programmable device. Instructions provide steps for implementing the functions specified in a process or processes of a flowchart diagram and/or a block or blocks of a block diagram.
在一个典型的配置中，计算设备包括一个或多个处理器(CPU)、输入/输出接口、网络接口和内存。In a typical configuration, a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.
内存可能包括计算机可读介质中的非永久性存储器，随机存取存储器(RAM)和/或非易失性内存等形式，如只读存储器(ROM)或闪存(flash RAM)。内存是计算机可读介质的示例。Memory may include non-permanent storage in computer-readable media, random access memory (RAM) and/or non-volatile memory in the form of read-only memory (ROM) or flash memory (flash RAM). Memory is an example of computer-readable media.
计算机可读介质包括永久性和非永久性、可移动和非可移动媒体可以由任何方法或技术来实现信息存储。信息可以是计算机可读指令、数据结构、程序的模块或其他数据。计算机的存储介质的例子包括，但不限于相变内存(PRAM)、静态随机存取存储器(SRAM)、动态随机存取存储器(DRAM)、其他类型的随机存取存储器(RAM)、只读存储器(ROM)、电可擦除可编程只读存储器(EEPROM)、快闪记忆体或其他内存技术、只读光盘只读存储器(CD-ROM)、数字多功能光盘(DVD)或其他光学存储、磁盒式磁带，磁带磁磁盘存储、石墨烯存储或其他磁性存储设备或任何其他非传输介质，可用于存储可以被计算设备访问的信息。按照本文中的界定，计算机可读介质不包括暂存电脑可读媒体(transitory media)，如调制的 数据信号和载波。Computer-readable media includes both persistent and non-volatile, removable and non-removable media that can be implemented by any method or technology for storage of information. Information may be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), and read-only memory. (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, Magnetic tape, magnetic tape storage, graphene storage or other magnetic storage devices or any other non-transmission medium can be used to store information that can be accessed by a computing device. As defined in this article, computer-readable media does not include transitory media, such as modulated data signals and carrier waves.
本领域技术人员应明白，本说明书一个或多个实施例可提供为方法、系统或计算机程序产品。因此，本说明书一个或多个实施例可采用完全硬件实施例、完全软件实施例或结合软件和硬件方面的实施例的形式。而且，本说明书一个或多个实施例可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。It should be understood by those skilled in the art that one or more embodiments of the present description may be provided as a method, system, or computer program product. Accordingly, one or more embodiments of the present description may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment that combines software and hardware aspects. Furthermore, one or more embodiments of the present description may employ a computer program implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein. Product form.
本说明书一个或多个实施例可以在由计算机执行的计算机可执行指令的一般上下文中描述，例如程序模块。一般地，程序模块包括执行特定任务或实现特定抽象数据类型的例程、程序、对象、组件、数据结构等等。也可以在分布式计算环境中实践本本说明书一个或多个实施例，在这些分布式计算环境中，由通过通信网络而被连接的远程处理设备来执行任务。在分布式计算环境中，程序模块可以位于包括存储设备在内的本地和远程计算机存储介质中。One or more embodiments of this specification may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. One or more embodiments of the present description may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media including storage devices.
本说明书中的各个实施例均采用递进的方式描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。尤其，对于系统实施例而言，由于其基本相似于方法实施例，所以描述的比较简单，相关之处参见方法实施例的部分说明即可。在本说明书的描述中，参考术语“一个实施例”、“一些实施例”、“示例”、“具体示例”、或“一些示例”等的描述意指结合该实施例或示例描述的具体特征、结构、材料或者特点包含于本说明书的至少一个实施例或示例中。在本说明书中，对上述术语的示意性表述不必须针对的是相同的实施例或示例。而且，描述的具体特征、结构、材料或者特点可以在任一个或多个实施例或示例中以合适的方式结合。此外，在不相互矛盾的情况下，本领域的技术人员可以将本说明书中描述的不同实施例或示例以及不同实施例或示例的特征进行结合和组合。Each embodiment in this specification is described in a progressive manner. The same and similar parts between the various embodiments can be referred to each other. Each embodiment focuses on its differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple. For relevant details, please refer to the partial description of the method embodiment. In the description of this specification, reference to the terms "one embodiment," "some embodiments," "an example," "specific examples," or "some examples" or the like means that specific features are described in connection with the embodiment or example. , structures, materials or features are included in at least one embodiment or example of this specification. In this specification, the schematic expressions of the above terms are not necessarily directed to the same embodiment or example. Furthermore, the specific features, structures, materials or characteristics described may be combined in any suitable manner in any one or more embodiments or examples. Furthermore, those skilled in the art may combine and combine different embodiments or examples and features of different embodiments or examples described in this specification unless they are inconsistent with each other.
以上所述仅为本说明书一个或多个实施例的实施例而已，并不用于限制本本说明书一个或多个实施例。对于本领域技术人员来说，本说明书一个或多个实施例可以有各种更改和变化。凡在本说明书的精神和原理之内所作的任何修改、等同替换、改进等，均应包含在权利要求范围之内。The above descriptions are only examples of one or more embodiments of this specification, and are not intended to limit one or more embodiments of this specification. To those skilled in the art, various modifications and changes may be made to one or more embodiments of this specification. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of this specification shall be included in the scope of the claims.

Claims (22)

  1. 一种基于区块链中继通信网络系统的消息传输方法，所述区块链中继通信网络系统分别与源区块链节点和目的区块链节点相连，所述源区块链节点和所述目的区块链节点所属的区块链节点组中的各区块链节点均维护有相同的共享密钥，且所述区块链中继通信网络系统中的中继节点未维护有所述共享密钥；所述方法包括：A message transmission method based on a blockchain relay communication network system. The blockchain relay communication network system is respectively connected to a source blockchain node and a destination blockchain node. The source blockchain node and the destination blockchain node are connected to each other. Each blockchain node in the blockchain node group to which the destination blockchain node belongs maintains the same shared key, and the relay node in the blockchain relay communication network system does not maintain the shared key. Key; the method includes:
    所述源区块链节点基于所述共享密钥对明文信息加密以获取加密信息，为所述加密信息封装IP头部以生成加密消息，并将所述加密消息发送至所述区块链中继通信网络系统；The source blockchain node encrypts plaintext information based on the shared key to obtain encrypted information, encapsulates an IP header for the encrypted information to generate an encrypted message, and sends the encrypted message to the blockchain relay communication network system;
    所述区块链中继通信网络系统基于所述IP头部将所述加密消息转发至所述目的区块链节点；The blockchain relay communication network system forwards the encrypted message to the destination blockchain node based on the IP header;
    所述目的区块链节点基于所述共享密钥对所述加密消息解密以获取所述明文信息。The destination blockchain node decrypts the encrypted message based on the shared key to obtain the plaintext information.
  2. 根据权利要求1所述的方法，所述区块链中继通信网络系统为一个中继节点；或者，According to the method of claim 1, the blockchain relay communication network system is a relay node; or,
    所述区块链中继通信网络系统包括源中继节点和目的中继节点，所述源中继节点与源区块链节点相连，所述目的中继节点与目的区块链节点相连，所述区块链中继通信网络系统基于所述IP头部将所述加密消息转发至所述目的区块链节点，包括：The blockchain relay communication network system includes a source relay node and a destination relay node. The source relay node is connected to the source blockchain node, and the destination relay node is connected to the destination blockchain node. The blockchain relay communication network system forwards the encrypted message to the destination blockchain node based on the IP header, including:
    所述源中继节点将从所述源区块链节点接收的所述加密消息发送至所述目的中继节点；The source relay node sends the encrypted message received from the source blockchain node to the destination relay node;
    所述目的中继节点将所述加密消息发送至所述目的区块链节点。The destination relay node sends the encrypted message to the destination blockchain node.
  3. 根据权利要求1所述的方法，所述共享密钥通过所述区块链节点组中的各区块链节点进行组密钥协商以维护于所述各区块链节点。According to the method of claim 1, the shared key is maintained at each blockchain node through group key negotiation by each blockchain node in the blockchain node group.
  4. 根据权利要求3所述的方法，所述各区块链节点分别与所述区块链中继通信网络系统中至少一个中继节点相连，所述各区块链节点在进行组密钥协商时所需交互的至少部分协商消息经由所述区块链中继通信网络系统实现转发。According to the method of claim 3, each of the blockchain nodes is connected to at least one relay node in the blockchain relay communication network system, and each blockchain node needs to perform group key negotiation. At least part of the interactive negotiation messages are forwarded via the blockchain relay communication network system.
  5. 根据权利要求3所述的方法，所述区块链节点组中的各区块链节点进行组密钥协商，包括：According to the method of claim 3, each blockchain node in the blockchain node group performs group key negotiation, including:
    所述区块链节点组中的主节点分别与所述区块链节点组中除所述主节点以外的其他区块链节点通过密钥协商以共同维护所述共享密钥。The master node in the blockchain node group jointly maintains the shared key through key negotiation with other blockchain nodes in the blockchain node group except the master node.
  6. 根据权利要求5所述的方法，所述主节点与所述其他区块链节点中的任一区块链节点进行密钥协商，包括：According to the method of claim 5, the master node performs key negotiation with any one of the other blockchain nodes, including:
    所述主节点与所述任一区块链节点通过DH密钥交换协议生成并维护所述共享密钥；或者，The master node and any blockchain node generate and maintain the shared key through a DH key exchange protocol; or,
    所述主节点与所述任一区块链节点通过DH密钥交换协议共同维护会话密钥，并将所述主节点生成的所述共享密钥基于所述会话密钥加密后发送至所述任一区块链节点，所述任一区块链节点用于将加密后的所述共享密钥基于所述会话密钥进行解密以获取所述共享密钥。The master node and any blockchain node jointly maintain a session key through the DH key exchange protocol, and encrypt the shared key generated by the master node based on the session key and send it to the Any blockchain node, the any blockchain node is configured to decrypt the encrypted shared key based on the session key to obtain the shared key.
  7. 根据权利要求6所述的方法，所述共享密钥和/或所述会话密钥记录在所述主节点与所述任一区块链节点维护的安全关联策略中。According to the method of claim 6, the shared key and/or the session key are recorded in a security association policy maintained by the master node and any blockchain node.
  8. 根据权利要求5所述的方法，所述主节点与所述其他区块链节点中的任一区块链节点进行密钥协商，包括：According to the method of claim 5, the master node performs key negotiation with any one of the other blockchain nodes, including:
    所述主节点生成所述共享密钥，并将所述共享密钥基于所述任一区块链节点的公钥加密得到的密文密钥发送至所述任一区块链节点；The master node generates the shared key and sends the ciphertext key obtained by encrypting the shared key based on the public key of any blockchain node to the any blockchain node;
    所述任一区块链节点将所述密文密钥基于所述任一区块链节点的私钥进行解密以获取所述共享密钥。The any blockchain node decrypts the ciphertext key based on the private key of any blockchain node to obtain the shared key.
  9. 根据权利要求8所述的方法，还包括：The method of claim 8, further comprising:
    所述主节点基于所述主节点的私钥为所述密文密钥生成数字签名，并将所述数字签名发送至所述任一区块链节点；The master node generates a digital signature for the ciphertext key based on the private key of the master node, and sends the digital signature to any blockchain node;
    所述任一区块链节点基于所述主节点的公钥对所述数字签名进行验签，在验签成功的情况下确定所述密文密钥来源于所述主节点。The any blockchain node verifies the digital signature based on the public key of the master node, and determines that the ciphertext key originates from the master node if the signature verification is successful.
  10. 根据权利要求1所述的方法，所述源区块链节点与所述目的区块链节点处于相同的区块链网络或不同的区块链网络。According to the method of claim 1, the source blockchain node and the destination blockchain node are in the same blockchain network or different blockchain networks.
  11. 根据权利要求10所述的方法，在所述源区块链节点与所述目的区块链节点处于不同的区块链网络的情况下，所述源区块链节点所处的源区块链网络与所述目的区块链节点所处的目的区块链网络同构或异构。According to the method of claim 10, when the source blockchain node and the destination blockchain node are in different blockchain networks, the source blockchain node where the source blockchain node is located The network is homogeneous or heterogeneous with the destination blockchain network where the destination blockchain node is located.
  12. 根据权利要求1所述的方法，The method of claim 1,
    在所述明文信息包含有原始报文对应的原始IP头部的情况下，所述IP头部基于区块链中继通信网络系统的网络信息所创建；In the case where the plaintext information contains the original IP header corresponding to the original message, the IP header is created based on the network information of the blockchain relay communication network system;
    在所述明文信息为去除所述原始IP头部的所述原始报文的情况下，所述IP头部为所述原始IP头部。When the plaintext information is the original message with the original IP header removed, the IP header is the original IP header.
  13. 根据权利要求1所述的方法，所述加密消息基于IPsec ESP协议生成。According to the method of claim 1, the encrypted message is generated based on IPsec ESP protocol.
  14. 一种基于区块链中继通信网络系统的消息传输方法，应用于源区块链节点，所述区块链中继通信网络系统分别与所述源区块链节点和目的区块链节点相连，所述源区块链节点和所述目的区块链节点所属的区块链节点组中的各区块链节点均维护有相同的共享密钥，且所述区块链中继通信网络系统中的中继节点未维护有所述共享密钥；所述方法包括：A message transmission method based on a blockchain relay communication network system, applied to a source blockchain node, and the blockchain relay communication network system is connected to the source blockchain node and the destination blockchain node respectively. , each blockchain node in the blockchain node group to which the source blockchain node and the destination blockchain node belong maintains the same shared key, and the blockchain relay communication network system The relay node does not maintain the shared key; the method includes:
    基于所述共享密钥对明文信息加密以获取加密信息；Encrypt plaintext information based on the shared key to obtain encrypted information;
    为所述加密信息封装IP头部以生成加密消息；encapsulating an IP header for the encrypted information to generate an encrypted message;
    将所述加密消息发送至所述区块链中继通信网络系统，所述区块链中继通信网络系统用于基于所述IP头部将所述加密消息转发至所述目的区块链节点。Send the encrypted message to the blockchain relay communication network system, which is used to forward the encrypted message to the destination blockchain node based on the IP header. .
  15. 一种基于区块链中继通信网络系统的消息传输方法，应用于目的区块链节点，所述区块链中继通信网络系统分别与源区块链节点和所述目的区块链节点相连，所述源区块链节点和所述目的区块链节点所属的区块链节点组中的各区块链节点均维护有相同的共享密钥，且所述区块链中继通信网络系统中的中继节点未维护有所述共享密钥；所述方法包括：A message transmission method based on a blockchain relay communication network system, applied to a destination blockchain node, and the blockchain relay communication network system is connected to the source blockchain node and the destination blockchain node respectively. , each blockchain node in the blockchain node group to which the source blockchain node and the destination blockchain node belong maintains the same shared key, and the blockchain relay communication network system The relay node does not maintain the shared key; the method includes:
    接收所述区块链中继通信网络系统基于加密消息的IP头部转发至所述目的区块链节点的所述加密消息，所述加密消息由所述源区块链节点为基于所述共享密钥对明文信息加密获取的加密信息封装所述IP头部以生成；Receive the encrypted message forwarded to the destination blockchain node based on the IP header of the encrypted message by the blockchain relay communication network system, and the encrypted message is forwarded by the source blockchain node based on the shared The encrypted information obtained by encrypting the plaintext information with the key encapsulates the IP header to generate;
    基于所述共享密钥对所述加密消息解密以获取所述明文信息。The encrypted message is decrypted based on the shared key to obtain the plaintext information.
  16. 一种基于区块链中继通信网络系统的消息传输方法，应用于所述区块链中继通信网络系统，所述区块链中继通信网络系统分别与源区块链节点和目的区块链节点相连，所述源区块链节点和所述目的 区块链节点所属的区块链节点组中的各区块链节点均维护有相同的共享密钥，且所述区块链中继通信网络系统中的中继节点未维护有所述共享密钥；所述方法包括：A message transmission method based on the blockchain relay communication network system, applied to the blockchain relay communication network system, the blockchain relay communication network system is connected to the source blockchain node and the destination block respectively Chain nodes are connected, each blockchain node in the blockchain node group to which the source blockchain node and the destination blockchain node belong maintains the same shared key, and the blockchain relay communication The relay node in the network system does not maintain the shared key; the method includes:
    接收所述源区块链节点为基于所述共享密钥对明文信息加密获取的加密信息封装IP头部以生成的加密消息；Receive the encrypted message generated by the source blockchain node encapsulating the IP header with the encrypted information obtained by encrypting the plaintext information based on the shared key;
    基于所述IP头部将所述加密消息转发至所述目的区块链节点。The encrypted message is forwarded to the destination blockchain node based on the IP header.
  17. 一种基于区块链中继通信网络系统的消息传输系统，所述区块链中继通信网络系统分别与源区块链节点和目的区块链节点相连，所述源区块链节点和所述目的区块链节点所属的区块链节点组中的各区块链节点均维护有相同的共享密钥，且所述区块链中继通信网络系统中的中继节点未维护有所述共享密钥；所述系统包括：A message transmission system based on a blockchain relay communication network system. The blockchain relay communication network system is respectively connected to a source blockchain node and a destination blockchain node. The source blockchain node and the destination blockchain node are connected to each other. Each blockchain node in the blockchain node group to which the destination blockchain node belongs maintains the same shared key, and the relay node in the blockchain relay communication network system does not maintain the shared key. Key; the system includes:
    所述源区块链节点，用于基于所述共享密钥对明文信息加密以获取加密信息，为所述加密信息封装IP头部以生成加密消息，并将所述加密消息发送至所述区块链中继通信网络系统；The source blockchain node is used to encrypt plain text information based on the shared key to obtain encrypted information, encapsulate an IP header for the encrypted information to generate an encrypted message, and send the encrypted message to the zone. Blockchain relay communication network system;
    所述区块链中继通信网络系统，用于基于所述IP头部将所述加密消息转发至所述目的区块链节点；The blockchain relay communication network system is used to forward the encrypted message to the destination blockchain node based on the IP header;
    所述目的区块链节点，用于基于所述共享密钥对所述加密消息解密以获取所述明文信息。The destination blockchain node is used to decrypt the encrypted message based on the shared key to obtain the plaintext information.
  18. 一种基于区块链中继通信网络系统的消息传输装置，应用于源区块链节点，所述区块链中继通信网络系统分别与所述源区块链节点和目的区块链节点相连，所述源区块链节点和所述目的区块链节点所属的区块链节点组中的各区块链节点均维护有相同的共享密钥，且所述区块链中继通信网络系统中的中继节点未维护有所述共享密钥；所述装置包括：A message transmission device based on a blockchain relay communication network system, applied to a source blockchain node, and the blockchain relay communication network system is connected to the source blockchain node and the destination blockchain node respectively. , each blockchain node in the blockchain node group to which the source blockchain node and the destination blockchain node belong maintains the same shared key, and the blockchain relay communication network system The relay node does not maintain the shared key; the device includes:
    明文信息加密单元，用于基于所述共享密钥对明文信息加密以获取加密信息；A plaintext information encryption unit, configured to encrypt plaintext information based on the shared key to obtain encrypted information;
    加密消息生成单元，用于为所述加密信息封装IP头部以生成加密消息；An encrypted message generating unit, configured to encapsulate an IP header for the encrypted information to generate an encrypted message;
    加密消息发送单元，用于将所述加密消息发送至所述区块链中继通信网络系统，所述区块链中继通信网络系统用于基于所述IP头部将所述加密消息转发至所述目的区块链节点。An encrypted message sending unit, configured to send the encrypted message to the blockchain relay communication network system, and the blockchain relay communication network system is configured to forward the encrypted message to the The destination blockchain node.
  19. 一种基于区块链中继通信网络系统的消息传输装置，应用于目的区块链节点，所述区块链中继通信网络系统分别与源区块链节点和所述目的区块链节点相连，所述源区块链节点和所述目的区块链节点所属的区块链节点组中的各区块链节点均维护有相同的共享密钥，且所述区块链中继通信网络系统中的中继节点未维护有所述共享密钥；所述装置包括：A message transmission device based on a blockchain relay communication network system, applied to a destination blockchain node. The blockchain relay communication network system is connected to the source blockchain node and the destination blockchain node respectively. , each blockchain node in the blockchain node group to which the source blockchain node and the destination blockchain node belong maintains the same shared key, and the blockchain relay communication network system The relay node does not maintain the shared key; the device includes:
    第一加密消息接收单元，用于接收所述区块链中继通信网络系统基于加密消息的IP头部转发至所述目的区块链节点的所述加密消息，所述加密消息由所述源区块链节点为基于所述共享密钥对明文信息加密获取的加密信息封装所述IP头部以生成；The first encrypted message receiving unit is configured to receive the encrypted message forwarded by the blockchain relay communication network system to the destination blockchain node based on the IP header of the encrypted message. The encrypted message is forwarded by the source The blockchain node encapsulates the IP header to generate the encrypted information obtained by encrypting the plaintext information based on the shared key;
    加密消息解密单元，用于基于所述共享密钥对所述加密消息解密以获取所述明文信息。An encrypted message decryption unit, configured to decrypt the encrypted message based on the shared key to obtain the plaintext information.
  20. 一种基于区块链中继通信网络系统的消息传输装置，应用于所述区块链中继通信网络系统，所述区块链中继通信网络系统分别与源区块链节点和目的区块链节点相连，所述源区块链节点和所述目的区块链节点所属的区块链节点组中的各区块链节点均维护有相同的共享密钥，且所述区块链中继通信网络系统中的中继节点未维护有所述共享密钥；所述装置包括：A message transmission device based on the blockchain relay communication network system, applied to the blockchain relay communication network system, the blockchain relay communication network system is connected to the source blockchain node and the destination block respectively. Chain nodes are connected, each blockchain node in the blockchain node group to which the source blockchain node and the destination blockchain node belong maintains the same shared key, and the blockchain relay communication The relay node in the network system does not maintain the shared key; the device includes:
    第二加密消息接收单元，用于接收所述源区块链节点为基于所述共享密钥对明文信息加密获取的加密信息封装IP头部以生成的加密消息；The second encrypted message receiving unit is configured to receive an encrypted message generated by the source blockchain node by encapsulating the IP header of the encrypted information obtained by encrypting the plaintext information based on the shared key;
    加密消息转发单元，用于基于所述IP头部将所述加密消息转发至所述目的区块链节点。An encrypted message forwarding unit, configured to forward the encrypted message to the destination blockchain node based on the IP header.
  21. 一种电子设备，包括：An electronic device including:
    处理器；processor;
    用于存储处理器可执行指令的存储器；Memory used to store instructions executable by the processor;
    其中，所述处理器通过运行所述可执行指令以实现如权利要求1-16中任一项所述的方法。Wherein, the processor implements the method according to any one of claims 1-16 by running the executable instructions.
  22. 一种计算机可读存储介质，其上存储有计算机指令，该指令被处理器执行时实现如权利要求1-16中任一项所述方法的步骤。A computer-readable storage medium having computer instructions stored thereon, which when executed by a processor, implements the steps of the method according to any one of claims 1-16.
PCT/CN2022/135553 2022-06-29 2022-11-30 Message transmission method and apparatus based on blockchain relay communication network system WO2024001035A1 (en)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210760932.0A CN115174061A (en) 2022-06-29 2022-06-29 Message transmission method and device based on block chain relay communication network system
CN202210760932.0 2022-06-29

Publications (1)

Publication Number Publication Date
WO2024001035A1 true WO2024001035A1 (en) 2024-01-04

Family

ID=83489441

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/135553 WO2024001035A1 (en) 2022-06-29 2022-11-30 Message transmission method and apparatus based on blockchain relay communication network system

Country Status (2)

Country Link
CN (1) CN115174061A (en)
WO (1) WO2024001035A1 (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117640496A (en) * 2024-01-26 2024-03-01 之江实验室 On-chip network route relay method, equipment and medium for nerve mimicry calculation

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115174061A (en) * 2022-06-29 2022-10-11 蚂蚁区块链科技(上海)有限公司 Message transmission method and device based on block chain relay communication network system
CN117579256B (en) * 2023-10-12 2024-04-23 智慧工地科技(广东)有限公司 Internet of things data management method and device

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR101763827B1 (en) * 2016-04-07 2017-08-02 주식회사 라이프시맨틱스 System, method and program for transmitting health data by block-chain
CN114142995A (en) * 2021-11-05 2022-03-04 支付宝(杭州)信息技术有限公司 Key secure distribution method and device for block chain relay communication network
CN114143038A (en) * 2021-11-05 2022-03-04 支付宝(杭州)信息技术有限公司 Key secure distribution method and device for block chain relay communication network
CN115174061A (en) * 2022-06-29 2022-10-11 蚂蚁区块链科技(上海)有限公司 Message transmission method and device based on block chain relay communication network system

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR101763827B1 (en) * 2016-04-07 2017-08-02 주식회사 라이프시맨틱스 System, method and program for transmitting health data by block-chain
CN114142995A (en) * 2021-11-05 2022-03-04 支付宝(杭州)信息技术有限公司 Key secure distribution method and device for block chain relay communication network
CN114143038A (en) * 2021-11-05 2022-03-04 支付宝(杭州)信息技术有限公司 Key secure distribution method and device for block chain relay communication network
CN115174061A (en) * 2022-06-29 2022-10-11 蚂蚁区块链科技(上海)有限公司 Message transmission method and device based on block chain relay communication network system

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117640496A (en) * 2024-01-26 2024-03-01 之江实验室 On-chip network route relay method, equipment and medium for nerve mimicry calculation
CN117640496B (en) * 2024-01-26 2024-05-17 之江实验室 On-chip network route relay method, equipment and medium for nerve mimicry calculation

Also Published As

Publication number Publication date
CN115174061A (en) 2022-10-11

Similar Documents

Publication Publication Date Title
WO2024001035A1 (en) Message transmission method and apparatus based on blockchain relay communication network system
US20210385201A1 (en) Systems and methods for secure multi-party communications using aproxy
US20220174050A1 (en) Cloud storage using encryption gateway with certificate authority identification
CN107018134B (en) Power distribution terminal safety access platform and implementation method thereof
US8788805B2 (en) Application-level service access to encrypted data streams
WO2016107203A1 (en) Identity authentication method and device
US10142119B2 (en) Communication method and apparatus using changing destination and return destination ID's
CN110581763A (en) Quantum key service block chain network system
US11736304B2 (en) Secure authentication of remote equipment
US11212265B2 (en) Perfect forward secrecy (PFS) protected media access control security (MACSEC) key distribution
CN107948676A (en) Method of transmitting video data and device
JP2013201537A (en) Key generation device and key generation method
WO2020252611A1 (en) Data interaction method and related equipments
CN115174267B (en) TLS protocol negotiation method, equipment and medium
CN112968778A (en) Block chain state encryption algorithm conversion method and system, computer equipment and application
CN114142995B (en) Key security distribution method and device for block chain relay communication network
WO2016134631A1 (en) Processing method for openflow message, and network element
WO2024001037A1 (en) Message transmission method and apparatus, electronic device and storage medium
US11368288B2 (en) Apparatus and method of lightweight communication protocols between multiple blockchains
US9083682B2 (en) Communication device and computer program product
WO2022166556A1 (en) Method and apparatus for realizing secure multicast in blockchain network
CN113422753B (en) Data processing method, device, electronic equipment and computer storage medium
WO2021208644A1 (en) Inter-node privacy communication method and network node
CN112055071B (en) Industrial control safety communication system and method based on 5G
CN109361684B (en) Dynamic encryption method and system for VXLAN tunnel

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22949114

Country of ref document: EP

Kind code of ref document: A1