CN115577391A

CN115577391A - Block chain authority management method and device based on role access control

Info

Publication number: CN115577391A
Application number: CN202211321539.8A
Authority: CN
Inventors: 王晓亮; 夏珺
Original assignee: Hangzhou Rivtower Technology Co Ltd
Current assignee: Hangzhou Rivtower Technology Co Ltd
Priority date: 2022-10-26
Filing date: 2022-10-26
Publication date: 2023-01-06

Abstract

The embodiment of the specification discloses a block chain authority management method and a block chain authority management device based on role access control, wherein the method comprises the following steps: creating a management space for setting access control authority of the block chain; creating a block chain and starting a corresponding block chain service in the management space, wherein the management space can be at least associated and mapped to 1 block chain and the corresponding service thereof; creating an organization and associating the organization to the administrative space, and/or, creating a blockchain user and associating the blockchain user to the organization; and configuring the access authority corresponding to any block chain under the management space for the organization and/or the block chain user. The scheme of the invention provides a management space of the access control authority of the block chain, can realize that a user manages a plurality of block chains and distributes the management authority to a plurality of organizations or users when the user serves the management system based on the specific block chain, and more conveniently and reasonably controls the authority of the organizations or users.

Description

Block chain authority management method and device based on role access control

Technical Field

The present disclosure relates to the field of computer software technologies, and in particular, to a method and an apparatus for managing block chain permissions based on role access control, an electronic device, and a storage medium.

Background

In an existing BaaS system, namely, a block chain, i.e., an application of a service, in the form of registering an account, purchasing block chains or computing resources, one account may manage a plurality of block chains, or may serve as an organization administrator to add other accounts to share the block chain under the organization. However, if the method needs to be applied to a block chain management system for performing refined authority control chain group management, the existing management mode cannot refine members in the same mechanism, and different block chains are managed according to different authorities, especially for application scenarios of large enterprises. Therefore, how to accurately set user permissions and organize architecture permissions for a block chain and achieve flexible permission configuration is a technical problem to be solved urgently.

Disclosure of Invention

An object of the embodiments of the present specification is to provide a method, an apparatus, an electronic device, and a storage medium for managing block chain permissions based on role access control.

In order to solve the above technical problem, the embodiments of the present specification are implemented as follows:

in a first aspect, a method for managing block chain permissions based on role access control is provided, including:

creating a management space for setting access control authority of a block chain;

creating a block chain and starting corresponding block chain service in the management space, wherein the management space can be at least associated and mapped to 1 block chain and corresponding service thereof;

creating an organizational structure and associating the organizational structure to the administrative space, and/or, creating a blockchain user and associating the blockchain user to the organizational structure;

and configuring the access authority corresponding to any block chain under the management space for the organization and/or the block chain user.

Further, the management space is associated with at least 1 of the organizations.

Further, the organization associates at least 1 blockchain user.

Further, the organization has access to at least 1 of the blockchains under the management space; and/or the user of the block chain has access right to at least 1 block chain under the management space.

Further, the organization and/or the block chain user are configured with access rights corresponding to any block chain in the management space, including at least viewing and/or transaction operation rights for the block chain.

In a second aspect, a block chain authority management device based on role access control is provided, including:

a first module capable of creating a management space for setting a blockchain access control authority;

a second module, capable of creating a blockchain and starting a corresponding blockchain service in the management space, where the management space can be associated and mapped to at least 1 blockchain and its corresponding service;

a third module capable of creating an organizational structure and associating the organizational structure to the administrative space, and/or, creating a blockchain user and associating the blockchain user to the organizational structure;

a fourth module capable of configuring access permissions corresponding to any of the blockchains under the management space for the organizational structure and/or the blockchain user.

Further, the organization associates at least 1 blockchain user.

Further, the fourth module configures the organization and/or the blockchain user with access rights corresponding to any blockchain under the management space, including at least viewing and/or transaction operation rights for the blockchain.

In a third aspect, an electronic device is provided, which includes:

a processor; and

a memory arranged to store computer executable instructions that, when executed, cause the processor to perform the method of blockchain privilege management based on role access control of the first aspect.

In a fourth aspect, a computer-readable storage medium is provided, which is characterized in that the computer-readable storage medium stores one or more programs that, when executed by an electronic device including a plurality of application programs, cause the electronic device to execute the method for blockchain rights management based on role access control according to the first aspect.

The specification can achieve at least the following technical effects:

the scheme of the invention provides a management space of the access control authority of the block chain, can realize that a user manages a plurality of block chains and distributes the management authority to a plurality of organizations or users when the user is based on a specific block chain service management system, and more conveniently and reasonably controls the access authority of each organization or each user.

Drawings

In order to more clearly illustrate the embodiments of the present specification or the technical solutions in the prior art, the drawings needed to be used in the description of the embodiments or the prior art will be briefly introduced below, it is obvious that the drawings in the following description are only some embodiments described in the present specification, and for those skilled in the art, other drawings can be obtained according to the drawings without any creative effort.

Fig. 1 is a schematic diagram of a block chain privilege management method based on role access control according to an embodiment of the present disclosure.

Fig. 2 is a second block chain privilege management method based on role access control according to an embodiment of the present disclosure.

Fig. 3 is a third schematic diagram of a method for managing block chain permissions based on role access control according to an embodiment of the present disclosure.

Fig. 4 is a fourth schematic diagram of a block chain right management method based on role access control according to an embodiment of the present disclosure.

Fig. 5 is a fifth schematic diagram of a block chain privilege management method based on role access control according to an embodiment of the present disclosure.

Fig. 6 is a schematic diagram of a blockchain privilege management apparatus based on role access control according to an embodiment of the present disclosure.

Fig. 7 is a schematic structural diagram of an electronic device provided in an embodiment of the present specification.

Detailed Description

In order to make those skilled in the art better understand the technical solutions in the present specification, the technical solutions in the embodiments of the present specification will be clearly and completely described below with reference to the drawings in the embodiments of the present specification, and it is obvious that the described embodiments are only a part of the embodiments of the present specification, and not all of the embodiments. All other embodiments obtained by a person skilled in the art based on the embodiments in the present specification without any inventive step should fall within the scope of protection of the present specification.

Key terms

Role-based access control RBAC: permissions are associated with roles, and users gain permission to appropriate roles by becoming members of those roles. This greatly simplifies the management of rights. In an organization, roles are created to accomplish various tasks, and users are assigned corresponding roles according to their responsibilities and qualifications, and users can be easily assigned from one role to another. Roles can be given new permissions according to new requirements and system combination, and permissions can be recovered from a role according to needs. Role-to-role relationships can be established to encompass a wider range of objective situations. The RBAC model supports data abstraction principles and inheritance concepts. Since the current main program design language supports the object-oriented technology, the characteristic of RBAC is convenient for being applied and realized in a practical system. Concepts in the model correspond closely to real systems. The concepts of roles, users, permission rights and the like in the RBAC model are all entities which actually exist in an actual system, and are convenient for designers to establish the RBAC model of the existing system or a system to be established. The RBAC model still has an access control model, is essentially an extension of an access matrix model, can well solve the problem of distribution and control of access control access right of a main body to passenger air in the system, but does not provide an information flow control mechanism and cannot completely meet all safety requirements of an information system.

Namespace: also called name space, is a form of code organization used by many programming languages, and is classified by name space to distinguish different code functions, and avoid different code fragments, especially the code fragments which are usually worked together or called by different people, and conflict caused by the same variable name among different codes when in use. However, the namespace is not only used for code writing, but also has positive effects in role, authority and resource management.

A block chain authority management scheme based on role access control in the present specification is described in detail below by way of specific examples.

Example one

The invention aims to solve the problem of how to accurately set user permission and organization framework permission aiming at a block chain and realize flexible permission configuration. For large enterprise-level Blockchain applications, baaS (Blockchain as a Service) is an increasing choice. The BaaS is a block chain open platform which is used for embedding a block chain frame into a cloud computing platform, providing a convenient and high-performance block chain ecological environment and ecological matching service for developers by using the deployment and management advantages of cloud service infrastructure, and supporting the business expansion and operation support of the developers. When BaaS is actually used, a plurality of independent blockchains and a plurality of different organizations and different users or developers under the organizations are often involved to access the blockchain resources. That is, in general, a complete BaaS solution includes four main links of device access, access control, service monitoring and a block chain platform. The above-mentioned access control to the blockchain resources is a technical problem to which the present invention is focused. For example, in the form of registering an account, purchasing block chains, or calculating resources, an existing BaaS system may manage multiple block chains through one account, or may also serve as an organization administrator to add other accounts to share the block chains under the organization. However, when the application requirements are further refined, it is not possible to finely set different permissions for different users in a certain organization or even a certain organization, so as to manage different block chains.

Therefore, the essence of the scheme is that a management space for controlling the access authority of the block chain is created, after 1 or more corresponding organizational structures are bound in the management space, the block chain is created and corresponding block chain service is started, corresponding users are configured under an organizational structure, and finally corresponding block chain access authority is configured for the organizational structure or the users under the organizational structure according to the actual block chain access requirement. It should be understood, however, that the blockchain itself is decentralized, and the management space introduced in the solution of the present invention is only to implement control over access rights of the blockchain, that is, as an implementation solution for access control in the BaaS solution, and does not destroy the decentralized feature of the blockchain itself.

As shown in fig. 1, a block chain authority management method based on role access control according to an embodiment of the present invention is characterized in that the method includes:

s1: a management space for setting access control authority of the blockchain is created. It should be understood that the creation of the management space is done by an administrator who can set the block chain access permission configuration; the management space is an organization mode for realizing access control, and authority configuration and management can be carried out on an organization mechanism and/or a user using the block chain resources through the organization mode.

S2: and creating a block chain and starting a corresponding block chain service under the management space, wherein the management space can be at least associated and mapped to 1 block chain and the corresponding service thereof.

It should be noted that the blockchain and its corresponding service are the basis for implementing the blockchain, that is, the service operation mode, and the blockchain included in a general blockchain infrastructure is not limited to 1, and may include a public chain, a federation chain, or a private chain. Therefore, the management space for performing access right control is not unique to the association mapping relationship established between the block chain and its service resources. This also enables the access rights under the administrative space to configure different blockchains and their services for different organizations, different users.

S3: creating an organizational structure and associating the organizational structure to the administrative space, and/or creating a blockchain user and associating the blockchain user to the organizational structure.

It should be understood that an organization or a blockchain user may each be assigned a corresponding role, such as being a user or manager of the blockchain and its services. Different access rights can be configured for different block chains based on such roles.

Alternatively, as shown in fig. 2, for a user or manager with an organization as a block chain, after the organization is created, the organization can be associated to the management space, and such association relationship is not unique, that is, a plurality of organizations may be included in one management space.

Alternatively, as shown in fig. 3, for the user or manager of the blockchain to use the blockchain user as the blockchain, the blockchain user should be created under a certain organization structure.

S4: and configuring the access authority corresponding to any block chain under the management space for the organization and/or the block chain user.

Optionally, as shown in fig. 2, based on the creation of the organization and/or the user, the organization has access to at least 1 blockchain under the management space; and/or

Optionally, as shown in fig. 3, the blockchain user has access to at least 1 blockchain in the management space.

Optionally, the organization and/or the blockchain user are configured with access rights corresponding to any blockchain under the management space, including at least viewing and/or transaction operation rights for the blockchain.

Specifically, a blockchain X and a blockchain Y are created under the management space a, an organization structure M and an organization structure N exist in the current system, and a user M1 and a user M2 exist in the organization structure M. For an application scenario where an organization has a block chain access right, as shown in fig. 4, a block chain X right is allocated to an organization structure M, and rights of a block chain X and a block chain Y are allocated to an organization structure N, that is, the block chain right can be arbitrarily allocated according to the organization structure. For an application scenario where a user of an organization has block chain access permissions, as shown in fig. 5, a block chain X permission and a block chain Y permission are assigned to the organization M, the block chain X permission and the block chain Y permission can be assigned to an employee M1, and the block chain X permission and an employee M2 are assigned, that is, block chain permissions can be assigned arbitrarily according to employees under the current organization. It should be understood that if the organizational structures M, N, and the user M1 and the user M2 exist in the organizational structure M, the access rights to the blockchain X and the blockchain Y are configured, and the technical features of the embodiment of the present invention are also met.

Example two

Fig. 6 is a schematic structural diagram of a blockchain authority management device 600 based on role access control according to an embodiment of the present disclosure. Referring to fig. 6, in one embodiment, a block chain authority management device 600 based on role access control includes:

a first module 601 capable of creating a management space for setting a blockchain access control authority;

a second module 602, configured to create a blockchain and start a corresponding blockchain service in the management space, where the management space may be associated and mapped to at least 1 blockchain and its corresponding service;

a third module 603 capable of creating an organizational structure and associating the organizational structure to the administrative space, and/or, creating a blockchain user and associating the blockchain user to the organizational structure;

a fourth module 604 capable of configuring access permissions corresponding to any of the blockchains under the management space for the organizational structure and/or the blockchain user.

It should be understood that, in the embodiment of the present specification, the blockchain authority management device based on role access control may further perform the method performed by the blockchain authority management device (or apparatus) based on role access control in fig. 1 to 5, and implement the functions of the blockchain authority management device (or apparatus) based on role access control in the examples shown in fig. 1 to 5, which are not described herein again.

EXAMPLE III

Fig. 7 is a schematic structural diagram of an electronic device according to an embodiment of the present specification. Referring to fig. 7, at a hardware level, the electronic device includes a processor, and optionally further includes an internal bus, a network interface, and a memory. The Memory may include a Memory, such as a Random-Access Memory (RAM), and may further include a non-volatile Memory, such as at least 1 disk Memory. Of course, the electronic device may also include hardware required for other services.

The processor, the network interface, and the memory may be connected to each other by an internal bus, which may be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus, an EISA (Extended Industry Standard Architecture) bus, or the like. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, only one double-headed arrow is shown in FIG. 7, but this does not indicate only one bus or one type of bus.

And the memory is used for storing programs. In particular, the program may include program code comprising computer operating instructions. The memory may include both memory and non-volatile storage and provides instructions and data to the processor.

The processor reads the corresponding computer program from the nonvolatile memory into the memory and then runs the computer program to form the shared resource access control device on the logic level. The processor is used for executing the program stored in the memory and is specifically used for executing the following operations:

creating a management space for setting access control authority of the block chain;

creating an organization and associating the organization to the administrative space, and/or, creating a blockchain user and associating the blockchain user to the organization;

The above block chain authority management method based on role access control as disclosed in the embodiments shown in fig. 1 to fig. 5 of the present specification can be applied to a processor, or implemented by a processor. The processor may be an integrated circuit chip having signal processing capabilities. In implementation, the steps of the above method may be performed by integrated logic circuits of hardware in a processor or by instructions in the form of software. The Processor may be a general-purpose Processor, including a Central Processing Unit (CPU), a Network Processor (NP), and the like; but also Digital Signal Processors (DSPs), application Specific Integrated Circuits (ASICs), field Programmable Gate Arrays (FPGAs) or other Programmable logic devices, discrete Gate or transistor logic devices, discrete hardware components. The various methods, steps, and logic blocks disclosed in the embodiments of this specification may be implemented or performed. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like. The steps of a method disclosed in connection with the embodiments of the present specification may be embodied directly in a hardware decoding processor, or in a combination of hardware and software modules in the decoding processor. The software module may be located in ram, flash memory, rom, prom, or eprom, registers, etc. storage media as is well known in the art. The storage medium is located in a memory, and a processor reads information in the memory and completes the steps of the method in combination with hardware of the processor.

Of course, besides the software implementation, the electronic device of the embodiment of the present disclosure does not exclude other implementations, such as a logic device or a combination of software and hardware, and the like, that is, the execution subject of the following processing flow is not limited to each logic unit, and may also be hardware or a logic device.

Example four

Embodiments of the present specification also propose a computer-readable storage medium storing one or more programs, the one or more programs comprising instructions, which when executed by a portable electronic device comprising a plurality of application programs, are capable of causing the portable electronic device to perform the method of the embodiments shown in fig. 1 to 5, and in particular to perform the method of:

creating a block chain and starting a corresponding block chain service in the management space, wherein the management space can be at least associated and mapped to 1 block chain and the corresponding service thereof;

In short, the above description is only a preferred embodiment of the present disclosure, and is not intended to limit the scope of the present disclosure. Any modification, equivalent replacement, improvement and the like made within the spirit and principle of the present specification shall be included in the protection scope of the present specification.

The systems, apparatuses, modules or units described in the above embodiments may be specifically implemented by a computer chip or an entity, or implemented by a product with certain functions. One typical implementation device is a computer. In particular, the computer may be, for example, a personal computer, a laptop computer, a cellular telephone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

Computer-readable media, including both permanent and non-permanent, removable and non-removable media, may implement the information storage by any method or technology. The information may be computer readable instructions, data structures, modules of a program, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static Random Access Memory (SRAM), dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), read Only Memory (ROM), electrically Erasable Programmable Read Only Memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), digital Versatile Discs (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information that can be accessed by a computing device. As defined herein, a computer readable medium does not include a transitory computer readable medium such as a modulated data signal and a carrier wave.

It should also be noted that the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrases "comprising a," "8230," "8230," or "comprising" does not exclude the presence of other like elements in a process, method, article, or apparatus comprising the element.

The embodiments in the present specification are described in a progressive manner, and the same and similar parts among the embodiments are referred to each other, and each embodiment focuses on the differences from the other embodiments. In particular, for the system embodiment, since it is substantially similar to the method embodiment, the description is simple, and for the relevant points, reference may be made to the partial description of the method embodiment.

Claims

1. A block chain authority management method based on role access control is characterized by comprising the following steps:

2. A method for blockchain privilege management based on role access control as claimed in claim 1, wherein at least 1 said organization is associated with said management space.

3. A method for blockchain privilege management based on role access control as claimed in claim 2 wherein the organizational structure associates at least 1 blockchain user.

4. The method of claim 3, wherein the organization has access to at least 1 blockchain in the management space; and/or the blockchain user has access to at least 1 blockchain in the management space.

5. A blockchain privilege management method according to any one of claims 1 to 4, wherein the access privileges corresponding to any of the blockchains under the management space are configured for the organization and/or the blockchain user, including at least view and/or transaction operation privileges to the blockchain.

6. A blockchain privilege management apparatus based on role access control, comprising:

7. A blockchain privilege management device according to claim 6 and wherein at least 1 of said organizations are associated with said management space.

8. A blockchain privilege management apparatus according to claim 7 and wherein the organizational structure associates at least 1 blockchain user.

9. The device of claim 8, wherein the organization has access to at least 1 of the blockchains in the management space; and/or the blockchain user has access to at least 1 blockchain in the management space.

10. A blockchain privilege management apparatus according to any one of claims 6 to 9, wherein the fourth module configures the access privilege corresponding to any of the blockchains under the management space for the organization and/or the blockchain user, including at least view and/or transaction operation privilege for the blockchain.

11. An electronic device, comprising:

a processor; and

a memory arranged to store computer executable instructions that when executed cause the processor to perform the method of blockchain rights management based on role access control of any one of claims 1 to 5.

12. A computer-readable storage medium storing one or more programs which, when executed by an electronic device including a plurality of application programs, cause the electronic device to perform the method of blockchain rights management based on role access control of any one of claims 1 to 5.