WO2019127278A1 - 安全访问区块链的方法、装置、***、存储介质及电子设备 - Google Patents

安全访问区块链的方法、装置、***、存储介质及电子设备 Download PDF

Info

Publication number
WO2019127278A1
WO2019127278A1 PCT/CN2017/119575 CN2017119575W WO2019127278A1 WO 2019127278 A1 WO2019127278 A1 WO 2019127278A1 CN 2017119575 W CN2017119575 W CN 2017119575W WO 2019127278 A1 WO2019127278 A1 WO 2019127278A1
Authority
WO
WIPO (PCT)
Prior art keywords
node
endorsement
target node
target
trusted
Prior art date
Application number
PCT/CN2017/119575
Other languages
English (en)
French (fr)
Inventor
谢辉
陈敏
张跃洋
庞洪福
Original Assignee
深圳达闼科技控股有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳达闼科技控股有限公司 filed Critical 深圳达闼科技控股有限公司
Priority to CN201780002593.7A priority Critical patent/CN108235806B/zh
Priority to PCT/CN2017/119575 priority patent/WO2019127278A1/zh
Publication of WO2019127278A1 publication Critical patent/WO2019127278A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures

Definitions

  • the present disclosure relates to the field of computers, and in particular, to a method, an apparatus, a storage medium, and an electronic device for securely accessing a blockchain.
  • Blockchain is a technical solution for collectively maintaining a reliable database through decentralization.
  • nodes are connected to each other through a P2P (Peer-to-Peer) network.
  • P2P Peer-to-Peer
  • a node for example, a new node, including various terminals, a blockchain light node, a blockchain full node, etc.
  • the legitimacy of the target node the target node will not verify the legitimacy of the node.
  • this type of access may lead to the disclosure of critical information.
  • multiple organizations, such as banks and enterprises participate in a blockchain at the same time to complete the business. Different organizations participating in the same blockchain may acquire key information that they do not want the other party to obtain. Therefore, it is imperative that inter-node access in the blockchain network complete mutual authentication.
  • the traditional identity authentication method is generally implemented by mutual transfer of digital certificates issued by third parties. This traditional identity authentication method is over-centralized, and the problem of high complexity of digital certificate is not applicable to decentralized. Blockchain network.
  • the present disclosure provides a method, apparatus, system, storage medium, and electronic device for securely accessing a blockchain for implementing secure access in a blockchain network.
  • a method for securely accessing a blockchain is provided, which is applied to prepare a new node for accessing a target node in a blockchain network, the method comprising: determining whether a need is needed The trusted node preset in the blockchain network endorses the target node; if the trusted node is required to endorse the target node, acquiring the trusted node to use the private key to the target An endorsement data obtained by signing a node public key; and providing a public key of the new node to the target node, wherein a public key of the new node is used to make the target node in the blockchain network Querying, in the preset permission permission, the permission permission of the account address corresponding to the public key of the new node, determining whether the identity authentication of the new node is successful according to the queried permission, and performing signature verification on the endorsement data; If the signature verification is passed, it is determined that the identity authentication of the target node is successful.
  • an apparatus for securely accessing a blockchain configured to prepare to access or access a new node of a target node in a blockchain network.
  • the apparatus includes a determination module configured to determine whether a trusted node preset in the blockchain network is required to endorse the target node.
  • the endorsement obtaining module is configured to acquire, when the trusted node is required to endorse the target node, the endorsement data obtained by the trusted node using the private key to sign the target node public key.
  • a public key providing module configured to provide a public key of the new node to the target node, wherein a public key of the new node is used to enable a license of the target node to be preset in the blockchain network Querying the permission permission of the account address corresponding to the public key of the new node, and determining whether the identity authentication of the new node is successful according to the queried permission.
  • the target identity authentication module is configured to perform signature verification on the endorsement data, and if the signature verification is passed, determine that the identity authentication of the target node is successful.
  • a method of securely accessing a blockchain applied to a target node in a blockchain network.
  • the method includes: acquiring a public key of the new node in response to receiving an access or access request issued by a new node; querying a public key corresponding to the new node in a permission permission preset by the blockchain network The license right owned by the account address; determining whether the identity authentication of the new node is successful according to the queried permission.
  • an apparatus for securely accessing a blockchain configured in a target node in a blockchain network.
  • the apparatus includes a new node public key acquisition module configured to acquire a public key of the new node in response to receiving an access or access request issued by the new node.
  • the new node permission query module is configured to query, in the license rights preset by the blockchain network, the permission rights owned by the account address corresponding to the public key of the new node.
  • the new node identity authentication module is configured to determine whether the identity authentication of the new node is successful according to the queried permission.
  • a method of securely accessing a blockchain the method being applied to a trusted node preset in a blockchain network.
  • the method includes: in response to preparing a new node accessing a target node in a blockchain network, requiring a trusted node to endorse the target node, obtaining a public key of the target node; using the trusted node's own private key to the target The node's public key is signed to obtain endorsement data; the endorsement data is provided to the new node, so that the new node determines whether the identity authentication of the target node is successful by performing signature verification on the endorsement data.
  • an apparatus for securely accessing a blockchain the apparatus being configured with a trusted node preset in a blockchain network.
  • the apparatus includes a target public key acquisition module configured to acquire a public key of the target node in response to a new node that is ready to access a target node in the blockchain network, requiring the trusted node to endorse the target node.
  • the signature module is configured to use the trusted node's own private key to sign the public key of the target node to obtain endorsement data.
  • An endorsement providing module configured to provide the endorsement data to the new node to cause the new node to perform signature verification on the endorsement data, and if the new node signature verification passes, the new node determines a location The identity authentication of the target node is successful.
  • a computer readable storage medium comprising one or more programs for performing the first embodiment of the present disclosure The method described on the one hand.
  • an electronic device comprising: the computer readable storage medium of the seventh aspect of the embodiments of the present disclosure; and one or more processors for executing the computer Read the program in the storage medium.
  • a computer readable storage medium comprising one or more programs for performing the first embodiment of the present disclosure The method described in three aspects.
  • an electronic device comprising: the computer readable storage medium of the ninth aspect of the embodiments of the present disclosure; and one or more processors for executing the computer Read the program in the storage medium.
  • a computer readable storage medium comprising one or more programs for performing the embodiments of the present disclosure The method of the fifth aspect.
  • an electronic device comprising: the computer readable storage medium of the eleventh aspect of the embodiments of the present disclosure; and one or more processors for executing A program in a computer readable storage medium.
  • a system for securely accessing a blockchain includes: a new node implemented by the electronic device according to the eighth aspect of the present disclosure; a target node implemented by the electronic device according to the tenth aspect of the embodiment of the present disclosure; The trusted node implemented by the electronic device of the second aspect; wherein the new node, the target node, and the trusted node belong to the same blockchain network.
  • a new node preparing to access the blockchain network acquires endorsement data obtained by the trusted node preset in the blockchain network using the private key to sign the target node public key, and performs signature verification on the endorsement data. If the signature verification is passed, it is determined that the identity authentication of the target node is successful, and the target node queries the permission permission of the account address corresponding to the public key of the new node in the permission permission preset by the blockchain network, according to the permission of the query.
  • the authority determines whether the identity authentication of the new node is successful, and the trusted node responds to the new node that is ready to access the target node in the blockchain network, and the trusted node needs to endorse the target node, obtain the public key of the target node, and use the
  • the private key of the target node is signed by the private key of the target node to obtain endorsement data; the endorsement data is provided to the new node, and therefore, the mutual authentication of the new node and the target node of the disclosure directly utilizes the blockchain network.
  • the public and private keys of the node account do not require a centralized third party to participate in the digital certificate, avoiding the digital certificate award Brought about by high complexity, inter-block chain to achieve a secure access network node.
  • FIG. 1 is a schematic structural diagram of a blockchain network according to an exemplary embodiment of the present disclosure.
  • FIG. 2 is a flow chart of a method of securely accessing a blockchain, according to an exemplary embodiment of the first aspect of the present disclosure.
  • FIG. 3 is a schematic diagram of signaling interaction of a method for securely accessing a blockchain according to another exemplary embodiment of the first aspect of the present disclosure.
  • FIG. 4 is a block diagram of an apparatus for securely accessing a blockchain, according to an exemplary embodiment of the second aspect of the present disclosure.
  • FIG. 5 is a block diagram of an apparatus for securely accessing a blockchain, according to another exemplary embodiment of the second aspect of the present disclosure.
  • FIG. 6 is a block diagram of an apparatus for securely accessing a blockchain, according to still another exemplary embodiment of the second aspect of the present disclosure.
  • FIG. 7 is a flowchart of a method for securely accessing a blockchain according to an exemplary embodiment of the third aspect of the present disclosure.
  • FIG. 8 is a block diagram of an apparatus for securely accessing a blockchain, according to an exemplary embodiment of the fourth aspect of the present disclosure.
  • FIG. 9 is a block diagram of an apparatus for securely accessing a blockchain, according to another exemplary embodiment of the fourth aspect of the present disclosure.
  • FIG. 10 is a block diagram of an apparatus for securely accessing a blockchain, according to still another exemplary embodiment of the fourth aspect of the present disclosure.
  • FIG. 11 is a flowchart of a method for securely accessing a blockchain according to an exemplary embodiment of the fifth aspect of the present disclosure.
  • FIG. 12 is a block diagram of an apparatus for securely accessing a blockchain, according to an exemplary embodiment of the sixth aspect of the present disclosure.
  • FIG. 13 is a block diagram of an apparatus for securely accessing a blockchain, according to another exemplary embodiment of the sixth aspect of the present disclosure.
  • FIG. 14 is a block diagram of an electronic device, according to an exemplary embodiment.
  • the blockchain network shown in Figure 1 is a P2P-based peer-to-peer network composed of several nodes. Each node in the blockchain network maintains a string of blockchains generated using cryptographic methods. The latest blocks are obtained by broadcasting between the nodes, so that the blocks between the nodes are maintained synchronously. Each node has an account that describes its identity. This account consists of public and private key pairs. The hash coded value of the public key is the address of the "account”. The private key is kept by the account owner and cannot be made public.
  • FIG. 1 is a schematic diagram of a blockchain network structure according to an exemplary embodiment.
  • the blockchain network may include a new node 110, a target node 120, a trusted node 130, a management node 140, and a participating node 150. among them:
  • the new node 110 may include, but is not limited to, various terminals, a blockchain light node, a blockchain full node, etc., and needs to generate its own blockchain account, but may not synchronize any block data of the target blockchain network. .
  • the target node 120 may include, but is not limited to, various terminals, and may be any node in the blockchain network, and block the block data of the blockchain network.
  • the trusted node 130 may include, but is not limited to, various terminals, and is a default trusted node that the management node 140 presets into the blockchain network, and may have multiple.
  • the management node 140 may include, but is not limited to, various terminals, management nodes in the blockchain network, and may configure the permission rights of other blockchain node accounts.
  • the participating nodes 150 may include, but are not limited to, various terminals, and any number of nodes other than the default trusted nodes in the blockchain network are not limited.
  • each node can generate its own blockchain node account by running a blockchain program on the corresponding node server.
  • the management node 140 can configure the permission rights of each node through the node control platform, for example, access permission rights, and the rights configuration is sent to the blockchain network by means of transaction, and is written into the blockchain after being verified by the blockchain network node. And finally through the P2P network to all nodes in the blockchain network.
  • FIG. 2 is a flow chart of a method of securely accessing a blockchain, according to an exemplary embodiment of the first aspect of the present disclosure.
  • the method is applied to a new node that is ready to access a target node in a blockchain network.
  • the method may include:
  • step 210 the new node determines whether a trusted node preset in the blockchain network is required to endorse the target node.
  • Endorsement in the present disclosure, refers to a process in which a node uses a blockchain account private key of a node itself to sign endorean data (such as public key, communication encrypted data) of a blockchain node that needs to be endorsed.
  • target node that is not trusted in the present disclosure needs to be endorsed.
  • a target node that is preset as a trusted node or endorsed (endorsed is not expired) can be regarded as a trusted node for the new node, and does not need to endorse, but is not preset as a target node of the trusted node or expires without endorsement or endorsement.
  • the target node is an untrusted node and needs to be endorsed.
  • the trusted node of the new node requesting endorsement can be preset by the new node after the new node generates its own node account.
  • the node information of the preset trusted node may include an IP or a domain name and an account public key of the trusted node.
  • the manner in which the new node presets the default trusted node may include: the client accessing the blockchain by the new node presets the default trusted node information internally, or the client accessing the blockchain by the new node prompts the user to input the default. Information about the node. If the new node does not have other node information in the chain, it can also obtain other node information from the trusted node, and refresh the local trusted node information list, such as adding/removing trusted nodes and refreshing the trusted node validity period.
  • the new node can issue a connection request to the target node.
  • the new node may also receive a random challenge code from the target node, sign the random challenge code using the new node's own private key, and send the signed random challenge code. Give the target node.
  • step 220 if the trusted node is required to endorse the target node, the endorsement data obtained by the trusted node using the private key to sign the target node public key is obtained.
  • the new node sends the IP or domain name of the trusted node and the endorsement determination indication to the target node.
  • the list of trusted nodes and the validity period can be locally updated and maintained at the new node.
  • the endorsement determination indication may be used to cause the target node to pre-store from the local query according to the IP or domain name of the trusted node, and the trusted node performs the target node public key by using its own private key.
  • the endorsement data obtained by the signature transmits the endorsement data to the new node if the endorsement data has not expired.
  • the corresponding endorsement request may be sent to the trusted node, the endorsement data is obtained from the trusted node, and the endorsement data is sent to the new node. Since the embodiment obtains the endorsement data locally from the target node, it is not necessary to obtain the endorsement data from the trusted node every time, thereby effectively reducing the burden on the trusted node.
  • the endorsement determination indication may be used to cause the target node to issue a corresponding endorsement request to the trusted node, obtain endorsement data from the trusted node, and send the endorsement data to the new node.
  • the new node receives the endorsement data sent by the target node for the endorsement determination indication.
  • the random challenge code can also be used to prevent replay attacks.
  • the trusted node may query the account address corresponding to the public key of the target node in the permission permission preset by the blockchain network. Permission authority, determining whether to endorse the target node according to the queried permission, and in the case of determining endorsement of the target node, using the private key to sign the public key of the target node and the communication encrypted data Get endorsed data.
  • the new node may send the endorsement determination indication to the target node along with the signed random challenge code.
  • the communication encrypted data generated by the new node can also be sent to the target node together with the endorsement determination indication.
  • the communication encrypted data is used by the new node and the target node to perform encrypted communication with each other using the communication encrypted data after the identity authentication is passed.
  • the communication encrypted data may include: a communication encrypted symmetric key, or a communication encrypted random number.
  • the new node encrypts the communication encrypted data.
  • the target node may send the random challenge code and its own public key to the new node after receiving the connection request of the new node.
  • the new node can encrypt the communication encrypted data by using the target node public key, and send the encrypted communication encrypted data, the endorsement determination indication, and the signed random challenge code to the target node.
  • the communication encrypted data for encrypted communication is generated by the new node client and transmitted to the other party in the two-way authentication process, thereby reducing the number of interactions and improving the authentication efficiency.
  • the new node may send an endorsement request to the trusted node. Receiving endorsement data that the trusted node requests feedback for the endorsement.
  • the new node directly obtains the endorsement data from the trusted node, and the endorsement data does not pass through the target node, and the security is higher.
  • step 230 the public key of the new node is provided to the target node.
  • the public key of the new node is used to enable the target node to query the permission rights of the account address corresponding to the public key of the new node in the permission permission preset by the blockchain network, according to the query.
  • the permission determines whether the identity authentication for the new node is successful. For example, here, corresponding to the access or access request of the new node, the target node checks the access permission of the new node account on the current blockchain, that is, checks whether the account of the new node has its corresponding in the current blockchain network. Access permission, if any, determines that the identity authentication for the new node was successful.
  • step 240 signature verification is performed on the endorsement data.
  • step 250 if the signature verification is passed, it is determined that the identity authentication for the target node is successful.
  • a new node that is ready to access the blockchain network acquires endorsement data obtained by the trusted node preset in the blockchain network using the private key to sign the target node public key, and performs endorsement data on the endorsement data.
  • Signature verification if the signature verification is passed, it determines that the identity authentication of the target node is successful.
  • the identity authentication directly utilizes the public and private keys of the blockchain network node account, and does not require a centralized third party to participate in the digital certificate, thereby avoiding the digital certificate issuing office.
  • the high complexity brings about secure access between nodes in the blockchain network.
  • FIG. 3 is a schematic diagram of signaling interaction of a method for securely accessing a blockchain according to another exemplary embodiment of the first aspect of the present disclosure.
  • the new node may first generate a node account and preset the trusted node public key.
  • the new node such as the local no-chain intra-node information, can obtain the intra-chain node information from the trusted node and refresh the trusted node information list.
  • the trusted node presets the trusted node information in the blockchain network and adds the new node account to the blockchain. Understandably, these preset operations need only be completed in advance, and do not need to be performed before each authentication.
  • step 310 the new node issues a connection request to the target node.
  • step 311 the new node receives the random challenge code and the target node public key from the target node.
  • step 312 the new node signs the random challenge code using its own private key.
  • step 313 the new node generates a communication encryption symmetric key and encrypts the communication encryption symmetric key using the target node public key.
  • a communication encrypted random number may be used instead of the encrypted symmetric key.
  • step 314 the new node determines whether the target node is trusted, that is, determines whether the trusted node preset in the blockchain network needs to endorse the target node.
  • step 315 if the new node determines that the target node is trusted, the signed random challenge code, the encrypted communication encryption symmetric key, and the endorsement negative indication are carried together in the access or access request and sent to the target node. .
  • step 316 when the new node determines that the target node is not trusted, that is, if the trusted node is required to endorse the target node, the IP address of the trusted node or the domain name and the signed random challenge code are encrypted.
  • the communication encrypts the symmetric key, and the endorsement determination indication is carried along with the access or access request to the target node.
  • step 320 the target node performs signature verification on the random challenge code carried in response to receiving the access or access request, and obtains the public key of the new node according to the signature.
  • step 321 the target node queries the permission rights of the account address corresponding to the public key of the new node in the permission permission preset by the blockchain network.
  • step 322 the target node determines whether the identity authentication of the new node is successful according to the queried permission.
  • the account authority corresponding to the account address of the new node of the new node may include multiple types, where the target node checks the access of the new node account on the current blockchain, corresponding to the access or access request of the new node. Permission, that is, checking whether the account of the new node has its corresponding access permission in the current blockchain network.
  • step 323 the target node determines whether the endorsement determination indication or the endorsement negative indication is received in the case that it is determined that the identity authentication of the new node is successful.
  • step 324 if the target node determines that the endorsement determination indication is received, the target node carries the communication encryption symmetric key in the endorsement request according to the IP or domain name of the trusted node carried in the access or access request. Send to the corresponding trusted node.
  • the target node may locally maintain the endorsement of the trusted node, including end-of-life management of the endorsement. Within the validity period of the endorsement, the target node may not need to endorse the trusted node again, which reduces the burden on the trusted node. Specifically, the target node may locally query, according to the IP address or the domain name of the trusted node, the previously stored endorsement data obtained by the trusted node using the private key to sign the target node public key, in the endorsement data. If not expired, the endorsement data is sent to the new node. It can be understood that if there is no endorsement of the trusted node that has not expired locally, the endorsement data can be obtained by sending an endorsement request to the trusted node.
  • the target node determines that the endorsement negative indication is received, it means that the new node determines that the target node is trusted, and the target node can decrypt the communication encryption symmetric key by using its own private key, and use its own private key.
  • the decrypted communication encryption symmetric key is signed, and the signed communication encryption symmetric key is sent to the new node, and the new node performs signature verification on the received communication encryption symmetric key. After the verification is passed, the new node is The target nodes can communicate with each other.
  • step 325 the target node receives a random challenge code from the trusted node.
  • step 326 the target node signs the random challenge code using its own private key.
  • step 327 the target node sends the signed random challenge code to the trusted node.
  • step 330 the trusted node performs signature verification on the received random challenge code, and obtains the public key of the target node after the verification is passed.
  • step 331 the trusted node queries the permission rights of the target node's public key corresponding account address in the license rights preset by the blockchain network.
  • step 332 the trusted node determines whether to endorse the target node according to the queried permission.
  • the public key of the target node may have multiple license rights corresponding to the account address, where the trusted node may check the access permission of the target node account on the current blockchain corresponding to the endorsement request of the target node. That is, it checks whether the account of the target node has its corresponding access permission right in the current blockchain network. If the inspection is passed, the target node can be endorsed. If it is not passed, it will not be endorsed.
  • the trusted node when determining to endorse the target node, uses the private key to sign the public key of the target node and the communication encryption symmetric key to obtain endorsement data.
  • step 334 the trusted node sends the endorsement data to the target node.
  • step 340 the target node decrypts the communication encryption symmetric key using its own private key and signs the communication encryption symmetric key using its own private key.
  • step 341 the target node transmits the signed communication encryption symmetric key and the endorsement data to the new node. That is, the trusted node provides the endorsement data to the new node through the target node.
  • step 342 the new node determines whether the identity authentication of the target node is successful by performing signature verification on the received endorsement data.
  • step 343 the new node performs signature verification on the signed communication encrypted symmetric key to obtain the public key of the target node. If the signature verification passes, the new node determines that the identity authentication of the target node is successful, and the new node will target the node. The public key is added to the list of trusted nodes of the new node and configured for its validity period. Thereafter, the new node can communicate with the target node with each other.
  • the new node and the target node need to calculate the encryption key according to the communication encrypted random number before the communication, and use the encryption key to perform the encrypted communication.
  • the communication encrypted random number may be a true random number segment generated by the new node and having the same length as the plaintext byte number.
  • the encryption key can be generated by adding or XORing the plaintext one-to-one. Decryption is the inverse of encryption.
  • the two-way authentication of the new node and the target node directly utilizes the public and private keys of the node of the blockchain network node, and does not require a centralized third party to participate in the digital certificate, thereby avoiding the digital certificate issuance.
  • High complexity enables secure access between nodes in the blockchain network.
  • the target node adopts a challenge response manner to prevent replay attacks, and the encryption key of the subsequent encrypted communication is generated by the new node client, and is transmitted to the other party in the two-way authentication process, which reduces the number of interactions, and the identity authentication efficiency is higher.
  • FIG. 4 is a block diagram of an apparatus 400 for securely accessing a blockchain, according to an exemplary embodiment of the second aspect of the present disclosure.
  • the device is configured to a new node that is ready to access a target node in the blockchain network.
  • the apparatus may include: a determining module 410, an endorsement obtaining module 420, a public key providing module 430, and a target identity authentication module 440.
  • the determining module 410 may be configured to determine whether a trusted node preset in the blockchain network is required to endorse the target node.
  • the endorsement obtaining module 420 may be configured to acquire, when the trusted node is required to endorse the target node, the endorsement data obtained by the trusted node using the private key to sign the target node public key. .
  • the public key providing module 430 may be configured to provide the public key of the new node to the target node, wherein a public key of the new node is used to pre-stage the target node in the blockchain network
  • the permission permission of the account address corresponding to the public key of the new node is queried, and the identity authentication of the new node is determined according to the privileged permission.
  • the target identity authentication module 440 can be configured to perform signature verification on the endorsement data, and if the signature verification is passed, determine that the identity authentication of the target node is successful.
  • a new node that is ready to access the blockchain network acquires endorsement data obtained by the trusted node preset in the blockchain network using the private key to sign the target node public key, and performs endorsement data on the endorsement data.
  • Signature verification if the signature verification is passed, it is determined that the identity authentication of the target node is successful, and the identity authentication directly utilizes the public and private keys of the blockchain network node account, and does not require a centralized third party to participate in the digital certificate, thereby avoiding the digital certificate issuance.
  • the high complexity has resulted in secure access between nodes in the blockchain network.
  • FIG. 5 is a block diagram of an apparatus 500 for securely accessing a blockchain, according to another exemplary embodiment of the second aspect of the present disclosure.
  • the endorsement obtaining module 420 may include: a first request sending submodule 421, and may be configured to: if the trusted node is required to endorse the target node, The IP or domain name and endorsement determination indication of the trusted node is sent to the target node.
  • the first endorsement receiving sub-module 422 may be configured to receive endorsement data sent by the target node for the endorsement determination indication.
  • the endorsement determination indication may be used to enable the target node to locally query, according to the IP address or the domain name of the trusted node, the pre-stored, trusted node to use its own private key pair.
  • the endorsement data obtained by signing the target node public key is sent to the new node if the endorsement data has not expired.
  • the corresponding endorsement request may be sent to the trusted node, the endorsement data is obtained from the trusted node, and the endorsement data is sent to the Describe the new node. Since the embodiment obtains the endorsement data locally from the target node, it is not necessary to obtain the endorsement data from the trusted node every time, thereby effectively reducing the burden on the trusted node.
  • the endorsement determination indication may be used to enable the target node to issue a corresponding endorsement request directly to the trusted node, obtain endorsement data from the trusted node, and use the endorsement data Sent to the new node.
  • FIG. 6 is a block diagram of an apparatus 600 for securely accessing a blockchain, according to yet another exemplary embodiment of the second aspect of the present disclosure.
  • the endorsement obtaining module 420 may include: a second request sending submodule 423, which may be configured to request an endorsement if the trusted node is required to endorse the target node Sent to the trusted node.
  • the second endorsement receiving sub-module 424 can be configured to receive endorsement data that the trusted node requests feedback for the endorsement.
  • the new node directly obtains the endorsement data from the trusted node, and the endorsement data does not pass through the target node, and the security is higher.
  • the apparatus may further include: a communication encrypted data generating module 450, which may be configured to generate communication encrypted data.
  • the communication encrypted data is used by the new node and the target node to perform encrypted communication with each other using the communication encrypted data after the identity authentication is passed.
  • the communication encrypted data encryption module 451 can be configured to encrypt the communication encrypted data.
  • the communication encrypted data transmitting module 452 may be configured to, when transmitting the endorsement determination indication to the target node, transmit the encrypted communication encrypted data together with the endorsement determination indication to the target node.
  • the communication encrypted data may include: a communication encryption symmetric key, or a communication encryption random number.
  • the apparatus may further include: a challenge code receiving module 460, configured to receive a random challenge code from the target node.
  • the challenge code signature module 461 can be configured to sign the random challenge code using the new node's own private key.
  • the challenge code sending module 462 can be configured to send the signed random challenge code to the target node.
  • FIG. 7 is a flowchart of a method for securely accessing a blockchain according to an exemplary embodiment of the third aspect of the present disclosure. The method is applied to a target node in a blockchain network. As shown in FIG. 7, the method may include:
  • the target node acquires the public key of the new node in response to receiving an access or access request issued by the new node.
  • the target node may further receive an IP address or a domain name and an endorsement determination indication of the trusted node sent by the new node, and according to the receiving the endorsement determination indication, locally query the corresponding IP or domain name.
  • Pre-stored endorsement data wherein the endorsement data is obtained by the trusted node using the private key to sign the target node public key, and if the endorsement data has not expired, the endorsement is performed Data is sent to the new node.
  • the IP or domain name and endorsement determination indication of the trusted node sent by the new node may be carried in an access or access request sent by the new node, and the target node obtains the trusted from the access or access request.
  • the IP or domain name of the node and the endorsement determine the indication.
  • the target node may further receive an IP or a domain name and an endorsement determination indication of the trusted node sent by the new node, and according to the receiving the endorsement determination indication, may correspond to the IP or the domain name.
  • the letter node sends an endorsement request, wherein the endorsement request is used to enable the trusted node to acquire the public key of the target node, and use the trusted node's own private key to sign the public key of the target node to obtain an endorsement Data, the target node obtains the endorsement data from the trusted node, and the target node sends the endorsement data to the new node.
  • step 720 the license authority owned by the account address corresponding to the public key of the new node is queried in the license authority preset by the blockchain network.
  • step 730 it is determined whether the identity authentication of the new node is successful according to the queried permission.
  • the target node determines the license right of the account address corresponding to the public key of the new node in the permission permission preset by the blockchain network, and determines the identity authentication of the new node according to the checked permission. Whether it is successful, therefore, the identity authentication directly utilizes the public and private keys of the blockchain network node account, and does not require a centralized third party to participate in the digital certificate, thereby avoiding the high complexity brought by the digital certificate issuance and realizing the blockchain network. Secure access between nodes.
  • FIG. 8 is a block diagram of an apparatus 800 for securely accessing a blockchain, according to an exemplary embodiment of the fourth aspect of the present disclosure.
  • the device is configured at a target node in a blockchain network.
  • the apparatus may include: a new node public key obtaining module 810, a new node authority querying module 820, and a new node identity authentication module 830.
  • the new node public key obtaining module 810 can be configured to acquire the public key of the new node in response to receiving an access or access request issued by the new node.
  • the new node permission query module 820 can be configured to query the license rights owned by the account address corresponding to the public key of the new node in the license rights preset by the blockchain network.
  • the new node identity authentication module 830 can be configured to determine whether the identity authentication of the new node is successful according to the queried permission.
  • FIG. 9 is a block diagram of an apparatus 900 for securely accessing a blockchain, according to another exemplary embodiment of the fourth aspect of the present disclosure.
  • the apparatus may further include: an endorsement indication obtaining module 840, configured to receive an IP or domain name and an endorsement determination indication of the trusted node sent by the new node.
  • the endorsement data query module 841 may be configured to, according to the receipt of the endorsement determination indication, locally query the pre-stored endorsement data corresponding to the IP or the domain name, wherein the endorsement data is used by the trusted node.
  • the private key of the target node is signed by the private key.
  • the endorsement sending first module 842 can be configured to send the endorsement data to the new node if the endorsement data has not expired.
  • FIG. 10 is a block diagram of an apparatus 1000 for securely accessing a blockchain, according to yet another exemplary embodiment of the fourth aspect of the present disclosure.
  • the apparatus may further include: an endorsement indication obtaining module 1010, configured to receive an IP or domain name and an endorsement determination indication of the trusted node sent by the new node.
  • the endorsement request sending module 1011 may be configured to issue an endorsement request to the trusted node corresponding to the IP or the domain name according to the received endorsement determination indication, where the endorsement request is used to obtain the trusted node Describe the public key of the target node, and use the trusted node's own private key to sign the public key of the target node to obtain endorsement data.
  • the endorsement data receiving module 1012 can be configured to obtain the endorsement data from the trusted node.
  • the endorsement sending second module 1013 can be configured to send the endorsement data to the new node.
  • the target node queries the permission permission of the account address corresponding to the public key of the new node in the permission permission preset by the blockchain network, and determines the identity of the new node according to the obtained permission permission. Whether the authentication is successful, therefore, the identity authentication directly utilizes the public and private keys of the blockchain network node account, and does not require a centralized third party to participate in the digital certificate, thereby avoiding the high complexity brought by the digital certificate issuance and realizing the blockchain. Secure access between network nodes.
  • FIG. 11 is a flowchart of a method for securely accessing a blockchain according to an exemplary embodiment of the fifth aspect of the present disclosure.
  • the method is applied to a trusted node preset in a blockchain network.
  • the method may include:
  • the trusted node responds to the new node that is ready to access the target node in the blockchain network, and the trusted node needs to endorse the target node to obtain the public key of the target node.
  • the trusted node may acquire the public key of the target node in response to receiving the endorsement request sent by the target node, where the endorsement request is received by the target node according to the The IP or domain name of the trusted node sent by the new node and the endorsement determination indication are correspondingly issued.
  • the trusted node may acquire the public key of the target node in response to receiving an endorsement request for the target node from the new node.
  • step 1120 the public key of the target node is signed using the trusted node's own private key to obtain endorsement data.
  • the trusted node may further query, in the permission permission preset by the blockchain network, the permission permission of the account address corresponding to the public key of the target node, according to the query.
  • the permission authority determines whether to endorse the target node, and if it is determined to endorse the target node, re-enter the signature of the public key of the target node by using the private key of the trusted node itself The step of endorsing data.
  • step 1130 the endorsement data is provided to the new node, so that the new node performs signature verification on the endorsement data, and if the new node signature verification passes, the new node determines the target The identity authentication of the node is successful.
  • the endorsement data may be sent to the target node, and the endorsement data is sent to the new node via the target node.
  • the endorsement data can be sent directly to the new node.
  • the trusted node since the trusted node uses the private key to sign the public key of the target node to obtain endorsement data, the endorsement data is provided to the new node, and therefore, the new node and the target node of the present disclosure
  • the two-way authentication directly utilizes the public and private keys of the blockchain network node account, and does not require a centralized third party to participate in the digital certificate, thereby avoiding the high complexity brought by the digital certificate issuance and realizing the secure access between the nodes of the blockchain network. .
  • FIG. 12 is a block diagram of an apparatus 1200 for securely accessing a blockchain, according to an exemplary embodiment of the sixth aspect of the present disclosure.
  • the device is configured on a trusted node in a blockchain network.
  • the apparatus may include: a target public key obtaining module 1210, a signature module 1220, and an endorsement providing module 1230.
  • the target public key obtaining module 1210 may be configured to acquire a public key of the target node in response to preparing a new node of the target node in the blockchain network to require the trusted node to endorse the target node.
  • the signature module 1220 can be configured to use the trusted node's own private key to sign the public key of the target node to obtain endorsement data.
  • the endorsement providing module 1230 may be configured to provide the endorsement data to the new node, so that the new node performs signature verification on the endorsement data, and if the new node signature verification passes, the new node Determining that the identity authentication of the target node is successful.
  • the target public key obtaining module 1210 may be configured to acquire a public key of the target node in response to receiving an endorsement request sent by the target node, where the endorsement request is The target node is correspondingly sent according to the IP or domain name of the trusted node sent by the new node and the endorsement determination indication.
  • the endorsement providing module 1230 may be configured to send the endorsement data to the target node, and the endorsement data is sent to the new node via the target node.
  • the target public key obtaining module 1210 may be configured to acquire the public key of the target node in response to receiving an endorsement request to the target node from the new node.
  • the endorsement providing module 1230 can be configured to send the endorsement data directly to the new node.
  • FIG. 13 is a block diagram of an apparatus 1300 for securely accessing a blockchain, according to another exemplary embodiment of the sixth aspect of the present disclosure.
  • the apparatus may further include: a target authority querying module 1240, configured to query, in the permission permission preset by the blockchain network, after receiving the endorsement request sent by the target node
  • the license authority owned by the account address corresponding to the public key of the target node.
  • the endorsement determination module 1241 may be configured to determine whether to endorse the target node according to the queried permission.
  • the signing module 1220 may be configured to execute the signing of the public key of the target node by using the trusted node's private key to obtain endorsement data if the endorsement determining module determines to endorse the target node. A step of.
  • the trusted node since the trusted node uses the private key to sign the public key of the target node to obtain endorsement data, the endorsement data is provided to the new node, and therefore, the new node and the target node of the present disclosure
  • the two-way authentication directly utilizes the public and private keys of the blockchain network node account, and does not require a centralized third party to participate in the digital certificate, thereby avoiding the high complexity brought by the digital certificate issuance and realizing the secure access between the nodes of the blockchain network. .
  • FIG. 14 is a block diagram of an electronic device 1400, according to an exemplary embodiment.
  • the electronic device 1400 can include a processor 1401, a memory 1402, a multimedia component 1403, an input/output (I/O) interface 1404, and a communication component 1405.
  • a processor 1401 a memory 1402
  • multimedia component 1403 a multimedia component 1403
  • I/O input/output
  • the processor 1401 is configured to control the overall operation of the electronic device 1400 to complete all or part of the steps of the method for securely accessing the blockchain.
  • the memory 1402 is configured to store various types of data to support operations at the electronic device 1400, such as may include instructions for any application or method operating on the electronic device 1400, and application related data, For example, contact data, sent and received messages, pictures, audio, video, and so on.
  • the memory 1402 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as a static random access memory (SRAM), an electrically erasable programmable read only memory ( Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (Erasable) Programmable Read-Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic memory, flash memory, disk or optical disk.
  • the multimedia component 1403 can include a screen and an audio component.
  • the screen may be, for example, a touch screen, and the audio component is used to output and/or input an audio signal.
  • the audio component can include a microphone for receiving an external audio signal.
  • the received audio signal may be further stored in memory 1402 or transmitted via communication component 1405.
  • the audio component also includes at least one speaker for outputting an audio signal.
  • the I/O interface 1404 provides an interface between the processor 1401 and other interface modules, such as a keyboard, a mouse, a button, and the like. These buttons can be virtual buttons or physical buttons.
  • the communication component 1405 is used for wired or wireless communication between the electronic device 1400 and other devices. Wireless communication, such as Wi-Fi, Bluetooth, Near Field Communication (NFC), 2G, 3G or 4G, or a combination of one or more of them, so the corresponding communication component 1405 can include: Wi-Fi module, Bluetooth module, NFC module.
  • the electronic device 1400 may be configured by one or more application specific integrated circuits (Application Specific) Integrated Circuit (ASIC), Digital Signal Processor (DSP), Digital Signal Processing Device (DSPD), Programmable Logic Device (PLD), field programmable A Field Programmable Gate Array (FPGA), controller, microcontroller, microprocessor or other electronic component implementation for performing the above method of securely accessing a blockchain.
  • ASIC Application Specific
  • DSP Digital Signal Processor
  • DSPD Digital Signal Processing Device
  • PLD Programmable Logic Device
  • FPGA field programmable A Field Programmable Gate Array
  • controller microcontroller, microprocessor or other electronic component implementation for performing the above method of securely accessing a blockchain.
  • a computer readable storage medium comprising program instructions, such as a memory 1402 comprising program instructions executable by processor 1401 of electronic device 1400 to perform the secure access described above Blockchain approach.
  • the present disclosure also provides a system for securely accessing a blockchain.
  • the system may include at least one new node implemented by the electronic device as described in the above embodiments, at least one new node implemented by the electronic device as described in the above embodiment, at least one electronic device as described in the above embodiment
  • the target node implemented by the device at least one trusted node implemented by the electronic device as described in the above embodiments.
  • the trusted node implemented by the electronic device as described in the foregoing embodiment, the target node implemented by the electronic device as described in the foregoing embodiment, and the electronic device as described in the foregoing embodiment belong to the same area.
  • Blockchain network may include at least one new node implemented by the electronic device as described in the above embodiments, at least one new node implemented by the electronic device as described in the above embodiment, at least one electronic device as described in the above embodiment
  • the target node implemented by the device at least one trusted node implemented by the electronic device as described in the above embodiments.
  • the two-way authentication of the new node and the target node of the present disclosure directly utilizes the public and private keys of the blockchain network node account, and does not require a centralized third party to participate in the digital certificate, thereby avoiding the high complexity brought by the digital certificate issuance. Degrees, achieve secure access between nodes in the blockchain network.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本公开提出一种安全访问区块链的方法、装置、***、存储介质及电子设备。该方法包括：准备访问区块链网络的新节点获取区块链网络中预置的可信节点使用自身私钥对目标节点公钥进行签名得到的背书数据，对背书数据进行签名验证，如果签名验证通过，确定对目标节点的身份认证成功，而目标节点在区块链网络预置的许可权限中查询出新节点的公钥对应账户地址拥有的许可权限，根据查询出的许可权限确定对新节点的身份认证是否成功。因此，本公开新节点与目标节点的双向认证直接利用了区块链网络节点账户的公私钥，不需要中心化的第三方参与数字证书，避免了数字证书颁发所带来的高复杂度，实现了区块链网络节点间安全访问。

Description

安全访问区块链的方法、装置、***、存储介质及电子设备 技术领域
本公开涉及计算机领域，尤其涉及一种安全访问区块链的方法、装置、存储介质及电子设备。
 背景技术
区块链是通过去中心化的方式集体维护一个可靠数据库的技术方案。区块链中，节点间通过P2P（Peer-to-Peer，点对点）网络建立相互连接。
目前的区块链技术中，某节点（例如，新节点，包括各种终端、区块链轻节点、区块链全节点等等）访问区块链网络上的目标节点时，不会去验证目标节点的合法性，目标节点也不会去验证该节点的合法性。然而，在某些对信息安全性要求较高的场景中，这种访问方式可能会导致关键信息的泄露。例如，银行、企业等多个组织同时参与一条区块链来完成业务，参与同一条区块链的不同组织彼此可能会获取到不想让对方获取到的关键信息。因此，区块链网络中节点间访问完成彼此身份认证是势在必行的。而传统的身份认证方式一般通过双方互传第三方机构颁发的数字证书来实现，这种传统的身份认证方式又存在过度中心化，数字证书颁发复杂度高的问题，不适用于去中心化的区块链网络。
因此，如何在区块链网络中实现节点间安全互访成为了令人苦恼的问题。
发明内容
有鉴于此，本公开提供一种安全访问区块链的方法、装置、***、存储介质及电子设备，用以在区块链网络中实现安全访问。
为了实现上述目的，根据本公开实施例的第一方面，提供一种安全访问区块链的方法，应用于准备访问区块链网络中目标节点的新节点，所述方法包括：判断是否需要所述区块链网络中预置的可信节点对所述目标节点背书；在需要所述可信节点对所述目标节点背书的情况下，获取所述可信节点使用自身私钥对所述目标节点公钥进行签名得到的背书数据；以及，将所述新节点的公钥提供给所述目标节点，其中，所述新节点的公钥用于使所述目标节点在所述区块链网络预置的许可权限中查询所述新节点的公钥对应的账户地址拥有的许可权限，根据查询出的许可权限确定对所述新节点的身份认证是否成功；对所述背书数据进行签名验证；如果签名验证通过，确定对所述目标节点的身份认证成功。
根据本公开实施例的第二方面，提供一种安全访问区块链的装置，配置于准备接入或访问区块链网络中目标节点的新节点。该装置包括：判断模块，被配置为判断是否需要所述区块链网络中预置的可信节点对所述目标节点背书。背书获取模块，被配置为在需要所述可信节点对所述目标节点背书的情况下，获取所述可信节点使用自身私钥对所述目标节点公钥进行签名得到的背书数据。公钥提供模块，被配置为将所述新节点的公钥提供给所述目标节点，其中，所述新节点的公钥用于使所述目标节点在所述区块链网络预置的许可权限中查询所述新节点的公钥对应的账户地址拥有的许可权限，根据查询出的许可权限确定对所述新节点的身份认证是否成功。目标身份认证模块，被配置为对所述背书数据进行签名验证，如果签名验证通过，确定对所述目标节点的身份认证成功。
根据本公开实施例的第三方面，提供一种安全访问区块链的方法，应用于区块链网络中的目标节点。所述方法包括：响应于接收到新节点发出的访问或接入请求，获取所述新节点的公钥；在所述区块链网络预置的许可权限中查询所述新节点的公钥对应的账户地址拥有的许可权限；根据查询出的许可权限确定对所述新节点的身份认证是否成功。
根据本公开实施例的第四方面，提供一种安全访问区块链的装置，配置于区块链网络中的目标节点。所述装置包括：新节点公钥获取模块，被配置为响应于接收到新节点发出的访问或接入请求，获取所述新节点的公钥。新节点权限查询模块，被配置为在所述区块链网络预置的许可权限中查询所述新节点的公钥对应的账户地址拥有的许可权限。新节点身份认证模块，被配置为根据查询出的许可权限确定对所述新节点的身份认证是否成功。
根据本公开实施例的第五方面，提供一种安全访问区块链的方法，所述方法应用于区块链网络中预置的可信节点。所述方法包括：响应于准备访问区块链网络中目标节点的新节点需要可信节点对目标节点背书，获取所述目标节点的公钥；使用所述可信节点自身私钥对所述目标节点的公钥进行签名得到背书数据；将所述背书数据提供给所述新节点，以便使所述新节点通过对所述背书数据进行签名验证确定对所述目标节点的身份认证是否成功。
根据本公开实施例的第六方面，提供一种安全访问区块链的装置，所述装置配置于区块链网络中预置的可信节点。所述装置包括：目标公钥获取模块，被配置为响应于准备访问区块链网络中目标节点的新节点需要可信节点对目标节点背书，获取所述目标节点的公钥。签名模块，被配置为使用所述可信节点自身私钥对所述目标节点的公钥进行签名得到背书数据。背书提供模块，被配置为将所述背书数据提供给所述新节点，以便使所述新节点对所述背书数据进行签名验证，如果所述新节点签名验证通过，所述新节点确定对所述目标节点的身份认证成功。
根据本公开实施例的第七方面，提供一种计算机可读存储介质，所述计算机可读存储介质中包括一个或多个程序，所述一个或多个程序用于执行本公开实施例的第一方面所述的方法。
根据本公开实施例的第八方面，提供一种电子设备，包括：本公开实施例的第七方面所述的计算机可读存储介质；以及，一个或者多个处理器，用于执行所述计算机可读存储介质中的程序。
根据本公开实施例的第九方面，提供一种计算机可读存储介质，所述计算机可读存储介质中包括一个或多个程序，所述一个或多个程序用于执行本公开实施例的第三方面所述的方法。
根据本公开实施例的第十方面，提供一种电子设备，包括：本公开实施例的第九方面所述的计算机可读存储介质；以及，一个或者多个处理器，用于执行所述计算机可读存储介质中的程序。
根据本公开实施例的第十一方面，提供一种计算机可读存储介质，所述计算机可读存储介质中包括一个或多个程序，所述一个或多个程序用于执行本公开实施例的第五方面所述的方法。
根据本公开实施例的第十二方面，提供一种电子设备，包括：本公开实施例的第十一方面所述的计算机可读存储介质；以及，一个或者多个处理器，用于执行所述计算机可读存储介质中的程序。
根据本公开实施例的第十三方面，提供一种安全访问区块链的***。所述***包括：本公开实施例的第八方面所述的电子设备所实现的新节点；本公开实施例的第十方面所述的电子设备所实现的目标节点；本公开实施例的第十二方面所述的电子设备所实现的可信节点；其中，所述新节点、目标节点、可信节点属于同一区块链网络。
通过本公开上述技术方案，准备访问区块链网络的新节点获取区块链网络中预置的可信节点使用自身私钥对目标节点公钥进行签名得到的背书数据，对背书数据进行签名验证，如果签名验证通过，确定对目标节点的身份认证成功，而目标节点在区块链网络预置的许可权限中查询出新节点的公钥对应的账户地址拥有的许可权限，根据查询出的许可权限确定对新节点的身份认证是否成功，可信节点响应于准备访问区块链网络中目标节点的新节点需要可信节点对目标节点背书，获取所述目标节点的公钥，使用所述可信节点自身私钥对所述目标节点的公钥进行签名得到背书数据；将所述背书数据提供给所述新节点，因此，本公开新节点与目标节点的双向认证直接利用了区块链网络节点账户的公私钥，不需要中心化的第三方参与数字证书，避免了数字证书颁发所带来的高复杂度，实现了区块链网络节点间安全访问。
应当理解的是，以上的一般描述和后文的细节描述仅是示例性和解释性的，并不能限制本公开。
 附图说明
图1是根据本公开一示例性实施例示出的区块链网络的结构示意图。
图2是根据本公开第一方面一示例性实施例提供的一种安全访问区块链的方法的流程图。
图3是根据本公开第一方面另一示例性实施例提供的一种安全访问区块链的方法的信令交互示意图。
图4是根据本公开第二方面一示例性实施例提供的一种安全访问区块链的装置的框图。
图5是根据本公开第二方面另一示例性实施例提供的一种安全访问区块链的装置的框图。
图6是根据本公开第二方面又一示例性实施例提供的一种安全访问区块链的装置的框图。
图7是根据本公开第三方面一示例性实施例提供的一种安全访问区块链的方法的流程图。
图8是根据本公开第四方面一示例性实施例提供的一种安全访问区块链的装置的框图。
图9是根据本公开第四方面另一示例性实施例提供的一种安全访问区块链的装置的框图。
图10是根据本公开第四方面又一示例性实施例提供的一种安全访问区块链的装置的框图。
图11是根据本公开第五方面一示例性实施例提供的一种安全访问区块链的方法的流程图。
图12是根据本公开第六方面一示例性实施例提供的一种安全访问区块链的装置的框图。
图13是根据本公开第六方面另一示例性实施例提供的一种安全访问区块链的装置的框图。
图14是根据一示例性实施例示出的一种电子设备的框图。
具体实施方式
这里将详细地对示例性实施例进行说明，其示例表示在附图中。下面的描述涉及附图时，除非另有表示，不同附图中的相同数字表示相同或相似的要素。以下示例性实施例中所描述的实施方式并不代表与本公开相一致的所有实施方式。相反，它们仅是与如所附权利要求书中所详述的、本公开的一些方面相一致的装置和方法的例子。
在介绍本公开提供的安全访问区块链的方法、装置、***、存储介质及电子设备之前，首先对区块链网络进行简单介绍。如图1所示的区块链网络，是由若干节点所组成的基于P2P的对等网络。区块链网络中的每个节点都维护着一串使用密码学方法相关联产生的区块链。各个节点之间通过广播来获取最新的区块，从而保证各个节点之间的区块是同步维护的。每个节点都有一个描述其身份的账户，这个账户由公私钥对组成。公钥的哈希编码值即为该“账户”的地址。私钥由账户所有人保管，不可公开。
为了使公开技术方案更加易于理解，再对本公开各个实施例所涉及的可能的区块链网络结构进行介绍。例如，图1是根据一示例性实施例示出的一种区块链网络结构示意图。如图1所示，该区块链网络可以包括：新节点110、目标节点120、可信节点130、管理节点140、参与节点150。其中：
新节点110，可以包括但不限于各种终端、区块链轻节点、区块链全节点等等，需要产生自己的区块链账户，但可以不同步目标区块链网络的任何区块数据。
目标节点120，可以包括但不限于各种终端，可以是区块链网络中的任意节点，同步区块链网络的区块数据。
可信节点130，可以包括但不限于各种终端，是管理节点140预置到区块链网络中的的默认可信节点，可以有多个。
管理节点140，可以包括但不限于各种终端，区块链网络中的管理节点，可以配置其它区块链节点账户的许可权限。
参与节点150，可以包括但不限于各种终端，区块链网络中除默认可信节点外的任意节点，数量不限。
在区块链网络中，各个节点可以通过在对应的节点服务器上运行区块链程序产生自己的区块链节点账户。管理节点140可以通过节点控制平台配置各个节点的许可权限，例如接入许可权限，权限配置以交易的方式发送到区块链网络上，经区块链网络节点的验证后写入区块链，并最终通过P2P网络同步到区块链网络的所有节点中。
图2是根据本公开第一方面一示例性实施例提供的一种安全访问区块链的方法的流程图。该方法应用于准备访问区块链网络中目标节点的新节点。如图2所示，该方法可以包括：
在步骤210中，新节点判断是否需要所述区块链网络中预置的可信节点对所述目标节点背书。
背书，在本公开中是指节点用节点自身的区块链账户私钥对需要背书的区块链节点的需要背书的数据（如公钥、通信加密数据）进行签名的过程。
可以理解的是，在本公开中不可信的目标节点即需要被背书。预置为可信节点或经过背书（背书未过期）的目标节点对新节点来说可视为可信节点，无需背书，而未预置为可信节点的目标节点或者未经背书或者背书过期的目标节点即为不可信节点，需要背书。
本公开中新节点要求背书的可信节点可以在新节点产生自己的节点账户后，由新节点预置。预置的可信节点的节点信息可以包括IP或域名及可信节点的账户公钥。例如，新节点预置默认可信节点的方式可以包括：新节点访问区块链的客户端在内部预置默认可信节点信息，或者，新节点访问区块链的客户端提示用户输入默认可信节点的信息。如果新节点本地没有链内其他节点信息，还可以从可信节点获取其他节点信息，并刷新本地可信节点信息列表，如增/删可信节点及刷新可信节点有效期。
新节点在完成以上预置后，可以向目标节点发出连接请求。为了防止重放攻击，在新节点对目标节点发出连接请求之后，新节点还可以从目标节点接收随机挑战码，使用新节点自身私钥对随机挑战码进行签名，将签名后的随机挑战码发送给目标节点。
在步骤220中，在需要所述可信节点对所述目标节点背书的情况下，获取所述可信节点使用自身私钥对所述目标节点公钥进行签名得到的背书数据。
一种可能的实施方式中，新节点将可信节点的IP或域名及背书确定指示发送给目标节点。所述可信节点的列表及有效期可以在所述新节点本地更新维护。
例如，所述背书确定指示可以用于使所述目标节点根据所述可信节点的IP或域名从本地查询出预先存储的、所述可信节点使用自身私钥对所述目标节点公钥进行签名得到的背书数据，在所述背书数据未过期的情况下，将所述背书数据发送给所述新节点。在目标节点本地不存在未过期的背书数据的情况下，则可以向可信节点发出相应背书请求，从所述可信节点获得背书数据，将所述背书数据发送给所述新节点。由于该实施方式从目标节点本地获取背书数据，不必每次都从可信节点获取背书数据，有效减轻了可信节点的负担。
再例如，所述背书确定指示可以用于使所述目标节点向所述可信节点发出相应的背书请求，从所述可信节点获得背书数据，将所述背书数据发送给所述新节点。新节点接收所述目标节点针对所述背书确定指示发送的背书数据。在目标节点与可信节点交互的过程中，也可以采用随机挑战码的方式防止重放攻击。另外，为了确保背书数据的安全性，可信节点在接收到目标节点的背书请求后，可以在所述区块链网络预置的许可权限中查询所述目标节点的公钥对应的账户地址拥有的许可权限，根据查询出的许可权限确定是否对所述目标节点进行背书，在确定对所述目标节点进行背书的情况下，再使用自身私钥对目标节点的公钥及通信加密数据进行签名得到背书数据。
可选地，新节点可以将背书确定指示与签名后的随机挑战码一同发送给目标节点。为了减少交互次数，提高认证效率，新节点所产生的通信加密数据同样可以同背书确定指示一同发送给目标节点。所述通信加密数据用于所述新节点与所述目标节点在身份认证通过后使用所述通信加密数据彼此进行加密通信。例如，通信加密数据可以包括：通信加密对称密钥，或者，通信加密随机数。新节点对所述通信加密数据进行加密。例如，一种可能的实施方式中，目标节点可以在接收到新节点的连接请求后，将随机挑战码及自身公钥发送给新节点。这样，新节点就可以使用目标节点公钥对通信加密数据进行加密，将加密后的通信加密数据、背书确定指示及签名后的随机挑战码一同发送给目标节点。在该实施方式中，加密通信用的通信加密数据由新节点客户端产生，并在双向认证过程中传递给对方，从而减少交互次数，提高了认证效率。
另一种可能的实施方式中，在需要所述可信节点对所述目标节点背书的情况下，新节点可以将背书请求发送给所述可信节点。接收所述可信节点针对所述背书请求反馈的背书数据。在该实施方式中，新节点直接从可信节点获取背书数据，背书数据不经过目标节点，安全性更高。
在步骤230中，将所述新节点的公钥提供给所述目标节点。
其中，所述新节点的公钥用于使所述目标节点在所述区块链网络预置的许可权限中查询所述新节点的公钥对应的账户地址拥有的许可权限，根据查询出的许可权限确定对所述新节点的身份认证是否成功。例如，此处对应新节点的接入或访问请求，目标节点检查新节点账户在当前区块链上的接入许可权限，即检查新节点的账户在当前区块链网络中是否拥有其对应的接入许可权，如果有，则确定对新节点的身份认证成功。
在步骤240中，对所述背书数据进行签名验证。
在步骤250中，如果签名验证通过，确定对所述目标节点的身份认证成功。
另外，如果签名验证未通过，则可以确定身份认证失败。
在新节点与目标节点双方身份认证成功后即可进行通信。
可见，通过本公开上述技术方案，准备访问区块链网络的新节点获取区块链网络中预置的可信节点使用自身私钥对目标节点公钥进行签名得到的背书数据，对背书数据进行签名验证，如果签名验证通过，则确定对目标节点的身份认证成功，身份认证直接利用了区块链网络节点账户的公私钥，不需要中心化的第三方参与数字证书，避免了数字证书颁发所带来的高复杂度，实现了区块链网络节点间安全访问。
为了使本公开技术方案更加易于理解，下面再通过以下可能的实施方式的信令交互示意图对本公开技术方案进行详细说明。
图3是根据本公开第一方面另一示例性实施例提供的一种安全访问区块链的方法的信令交互示意图。需要说明的是，在新节点与目标节点相互认证之前，新节点可以先产生节点账户，预置可信节点公钥。新节点如本地无链内节点信息，可以从可信节点获取链内节点信息，刷新可信节点信息列表。可信节点则在区块链网络预置可信节点信息，将新节点账户加入区块链。可以理解的是，这些预置操作只需提前完成即可，无需在每次认证之前进行。
在步骤310中，新节点向目标节点发出连接请求。
在步骤311中，新节点从目标节点接收随机挑战码及目标节点公钥。
在步骤312中，新节点使用自身私钥对随机挑战码进行签名。
在步骤313中，新节点产生通信加密对称密钥，并使用目标节点公钥加密通信加密对称密钥。
在另一种可能的实施方式中，为了加强安全性，可以用通信加密随机数来代替加密对称密钥。
在步骤314中，新节点判断目标节点是否可信，也即判断是否需要区块链网络中预置的可信节点对目标节点背书。
在步骤315中，在新节点判定目标节点可信的情况下，将签名后的随机挑战码，加密后的通信加密对称密钥，背书否定指示一同携带在访问或接入请求中发送给目标节点。
在步骤316中，在新节点判定目标节点不可信的情况下，也即在需要可信节点对目标节点背书的情况下，将可信节点的IP或域名、签名后的随机挑战码，加密后的通信加密对称密钥，背书确定指示一同携带在访问或接入请求中发送给目标节点。
在步骤320中，目标节点响应于接收到访问或接入请求，对其中携带的随机挑战码进行签名验证，并根据签名获得新节点的公钥。
在步骤321中，目标节点在所述区块链网络预置的许可权限中查询所述新节点的公钥对应的账户地址拥有的许可权限。
在步骤322中，目标节点根据查询出的许可权限确定对所述新节点的身份认证是否成功。
可以理解的是，新节点的公钥对应的账户地址拥有的许可权限可以包括多种，此处对应新节点的接入或访问请求，目标节点检查新节点账户在当前区块链上的接入许可权限，即检查新节点的账户在当前区块链网络中是否拥有其对应的接入许可权。
在步骤323中，目标节点在确定对新节点的身份认证成功的情况下，判断接收到的是背书确定指示还是背书否定指示。
在步骤324中，目标节点在判定接收到的是背书确定指示的情况下，根据所述访问或接入请求中携带的可信节点的IP或域名，将通信加密对称密钥携带在背书请求中发送给相应的可信节点。
在另一种可能的实施方式中，为了减轻可信节点的负担，目标节点可以在本地维护可信节点对其的背书，包括背书的有效期限管理。在背书有效期限内，目标节点可以不用再次向可信节点索要背书，减轻了可信节点的负担。具体地，目标节点可以根据可信节点的IP或域名从本地查询出预先存储的、所述可信节点使用自身私钥对所述目标节点公钥进行签名得到的背书数据，在所述背书数据未过期的情况下，将所述背书数据发送给所述新节点。可以理解的是，如果本地不存在该可信节点未过期的背书的情况下，则可以通过向该可信节点发送背书请求来获得背书数据。
可以理解的是，目标节点在判定接收到的是背书否定指示的情况下，也就意味着新节点判定目标节点可信，目标节点可以使用自身私钥解密通信加密对称密钥，使用自身私钥对解密后的通信加密对称密钥进行签名，并将签名后的通信加密对称密钥发送给新节点，新节点即对接收到的通信加密对称密钥进行签名验证，验证通过后，新节点就可以与目标节点彼此进行通信。
在步骤325中，目标节点从可信节点接收随机挑战码。
在步骤326中，目标节点使用自身私钥对随机挑战码进行签名。
在步骤327中，目标节点将签名后的随机挑战码发送给可信节点。
在步骤330中，可信节点对接收到的随机挑战码进行签名验证，验证通过后获取目标节点的公钥。
在步骤331中，可信节点在所述区块链网络预置的许可权限中查询所述目标节点的公钥对应账户地址拥有的许可权限。
在步骤332中，可信节点根据查询出的许可权限确定是否对所述目标节点进行背书。
可以理解的是，目标节点的公钥对应账户地址拥有的许可权限可以包括多种，此处对应目标节点的背书请求，可信节点可以检查目标节点账户在当前区块链上的接入许可权限，即检查目标节点的账户在当前区块链网络中是否拥有其对应的接入许可权限。检查通过则可以为目标节点背书，未通过则不予背书。
在步骤333中，可信节点在确定对所述目标节点进行背书的情况下，使用自身私钥对目标节点的公钥及通信加密对称密钥进行签名，得到背书数据。
在步骤334中，可信节点将背书数据发送给目标节点。
在步骤340中，目标节点使用自身私钥解密通信加密对称密钥，使用自身私钥对通信加密对称密钥进行签名。
在步骤341中，目标节点将签名后的通信加密对称密钥以及背书数据发送给新节点。也即，可信节点通过目标节点将背书数据提供给新节点。
在步骤342中，新节点通过对接收到的背书数据进行签名验证确定对所述目标节点的身份认证是否成功。
可以理解的是，签名验证通过则身份认证成功，签名验证未通过则身份认证失败。
在步骤343中，新节点对签名后的通信加密对称密钥进行签名验证，得到目标节点的公钥，如果签名验证通过，新节点确定对所述目标节点的身份认证成功，新节点将目标节点的公钥加入新节点的可信节点列表，并配置其有效期。此后，新节点可以与目标节点彼此进行通信。
在用通信加密随机数来代替通信加密对称密钥的情况下，新节点及目标节点在通信之前需根据通信加密随机数来计算加密密钥，使用加密密钥来进行加密通信。其中，通信加密随机数可以是由新节点产生的与明文字节数一样长度的真随机数字节。再进行加密密钥生成时，可以通过与明文一对一的顺序相加或者异或起来生成加密密钥。解密则是做加密的逆运算。
可见，通过本公开上述技术方案，新节点与目标节点的双向认证直接利用了区块链网络节点账户的公私钥，不需要中心化的第三方参与数字证书，避免了数字证书颁发所带来的高复杂度，实现了区块链网络节点间安全访问。而且，目标节点采用挑战应答的方式以防重放攻击，后续加密通信的加密密钥由新节点客户端产生，并在双向认证过程中传递给对方，减少了交互次数，身份认证效率更高。
图4是根据本公开第二方面一示例性实施例提供的一种安全访问区块链的装置400的框图。该装置配置于准备访问区块链网络中目标节点的新节点。如图4所示，该装置可以包括：判断模块410、背书获取模块420、公钥提供模块430、目标身份认证模块440。
该判断模块410，可以被配置为判断是否需要所述区块链网络中预置的可信节点对所述目标节点背书。
该背书获取模块420，可以被配置为在需要所述可信节点对所述目标节点背书的情况下，获取所述可信节点使用自身私钥对所述目标节点公钥进行签名得到的背书数据。
该公钥提供模块430，可以被配置为将所述新节点的公钥提供给所述目标节点，其中，所述新节点的公钥用于使所述目标节点在所述区块链网络预置的许可权限中查询所述新节点的公钥对应的账户地址拥有的许可权限，根据查询出的许可权限确定对所述新节点的身份认证是否成功。
该目标身份认证模块440，可以被配置为对所述背书数据进行签名验证，如果签名验证通过，确定对所述目标节点的身份认证成功。
可见，通过本公开上述技术方案，准备访问区块链网络的新节点获取区块链网络中预置的可信节点使用自身私钥对目标节点公钥进行签名得到的背书数据，对背书数据进行签名验证，如果签名验证通过，确定对目标节点的身份认证成功，身份认证直接利用了区块链网络节点账户的公私钥，不需要中心化的第三方参与数字证书，避免了数字证书颁发所带来的高复杂度，实现了区块链网络节点间安全访问。
图5是根据本公开第二方面另一示例性实施例提供的一种安全访问区块链的装置500的框图。如图5所示，在该装置中，背书获取模块420可以包括：第一请求发送子模块421，可以被配置为在需要所述可信节点对所述目标节点背书的情况下，将所述可信节点的IP或域名及背书确定指示发送给所述目标节点。第一背书接收子模块422，可以被配置为接收所述目标节点针对所述背书确定指示发送的背书数据。
一种可能的实施方式中，所述背书确定指示可以用于使所述目标节点根据所述可信节点的IP或域名从本地查询出预先存储的、所述可信节点使用自身私钥对所述目标节点公钥进行签名得到的背书数据，在所述背书数据未过期的情况下，将所述背书数据发送给所述新节点。在该实施方式中，在目标节点本地不存在未过期的背书数据的情况下，则可以向可信节点发出相应背书请求，从所述可信节点获得背书数据，将所述背书数据发送给所述新节点。由于该实施方式从目标节点本地获取背书数据，不必每次都从可信节点获取背书数据，有效减轻了可信节点的负担。
另一种可能的实施方式中，所述背书确定指示可以用于使所述目标节点直接向所述可信节点发出相应的背书请求，从所述可信节点获得背书数据，将所述背书数据发送给所述新节点。
图6是根据本公开第二方面又一示例性实施例提供的一种安全访问区块链的装置600的框图。如图6所示，在该装置中，背书获取模块420可以包括：第二请求发送子模块423，可以被配置为在需要所述可信节点对所述目标节点背书的情况下，将背书请求发送给所述可信节点。第二背书接收子模块424，可以被配置为接收所述可信节点针对所述背书请求反馈的背书数据。
在该实施方式中，新节点直接从可信节点获取背书数据，背书数据不经过目标节点，安全性更高。
一可能的实施方式中，如图5及图6所示，该装置还可以包括：通信加密数据产生模块450，可以被配置为产生通信加密数据。其中，所述通信加密数据用于所述新节点与所述目标节点在身份认证通过后使用所述通信加密数据彼此进行加密通信。通信加密数据加密模块451，可以被配置为对所述通信加密数据进行加密。通信加密数据发送模块452，可以被配置为在将所述背书确定指示发送给所述目标节点时，将加密后的所述通信加密数据与所述背书确定指示一同发送给所述目标节点。其中，所述通信加密数据可以包括：通信加密对称密钥，或者，通信加密随机数。
通过该实施方式，减少了新节点与目标节点交互次数，提高了认证效率。
又一可能的实施方式中，如图5及图6所示，该装置还可以包括：挑战码接收模块460，可以被配置为从所述目标节点接收随机挑战码。挑战码签名模块461，可以被配置为使用所述新节点自身私钥对所述随机挑战码进行签名。挑战码发送模块462，可以被配置为将签名后的所述随机挑战码发送给所述目标节点。
通过该实施方式，可以防止重放攻击，提高节点间交互的安全性。
图7是根据本公开第三方面一示例性实施例提供的一种安全访问区块链的方法的流程图。该方法应用于区块链网络中的目标节点。如图7所示，该方法可以包括：
在步骤710中，目标节点响应于接收到新节点发出的访问或接入请求，获取所述新节点的公钥。
一种可能的实施方式中，目标节点还可以接收所述新节点发送的可信节点的IP或域名及背书确定指示，根据接收到所述背书确定指示，从本地查询出该IP或域名所对应的预先存储的背书数据，其中，所述背书数据是由所述可信节点使用自身私钥对所述目标节点公钥进行签名得到，在所述背书数据未过期的情况下，将所述背书数据发送给所述新节点。例如，在该实施方式中，新节点发送的可信节点的IP或域名及背书确定指示可以携带在新节点发出的访问或接入请求中，目标节点从该访问或接入请求中获得可信节点的IP或域名及背书确定指示。
另一种可能的实施方式中，目标节点还可以接收所述新节点发送的可信节点的IP或域名及背书确定指示，根据接收到所述背书确定指示，向所述IP或域名对应的可信节点发出背书请求，其中，所述背书请求用于使所述可信节点获取所述目标节点的公钥，使用所述可信节点自身私钥对所述目标节点的公钥进行签名得到背书数据，目标节点从所述可信节点获得所述背书数据，目标节点将所述背书数据发送给所述新节点。
在步骤720中，在所述区块链网络预置的许可权限中查询所述新节点的公钥对应的账户地址拥有的许可权限。
在步骤730中，根据查询出的许可权限确定对所述新节点的身份认证是否成功。
通过本公开上述技术方案，由于目标节点在区块链网络预置的许可权限中查询出新节点的公钥对应的账户地址拥有的许可权限，根据查询出的许可权限确定对新节点的身份认证是否成功，因此，身份认证直接利用了区块链网络节点账户的公私钥，不需要中心化的第三方参与数字证书，避免了数字证书颁发所带来的高复杂度，实现了区块链网络节点间安全访问。
另外，还可以参考图3所示信令交互示意图来进一步详细了解本公开提供的应用于目标节点的安全访问区块链的方法，在此不再赘述。
图8是根据本公开第四方面一示例性实施例提供的一种安全访问区块链的装置800的框图。该装置配置于区块链网络中的目标节点。如图8所示，该装置可以包括：新节点公钥获取模块810、新节点权限查询模块820、新节点身份认证模块830。
该新节点公钥获取模块810，可以被配置为响应于接收到新节点发出的访问或接入请求，获取所述新节点的公钥。
该新节点权限查询模块820，可以被配置为在所述区块链网络预置的许可权限中查询所述新节点的公钥对应的账户地址拥有的许可权限。
该新节点身份认证模块830，可以被配置为根据查询出的许可权限确定对所述新节点的身份认证是否成功。
图9是根据本公开第四方面另一示例性实施例提供的一种安全访问区块链的装置900的框图。如图9所示，该装置还可以包括：背书指示获取模块840，可以被配置为接收所述新节点发送的可信节点的IP或域名及背书确定指示。背书数据查询模块841，可以被配置为根据接收到所述背书确定指示，从本地查询出该IP或域名所对应的预先存储的背书数据，其中，所述背书数据是由所述可信节点使用自身私钥对所述目标节点公钥进行签名得到。背书发送第一模块842，可以被配置为在所述背书数据未过期的情况下，将所述背书数据发送给所述新节点。
图10是根据本公开第四方面又一示例性实施例提供的一种安全访问区块链的装置1000的框图。如图10所示，该装置还可以包括：背书指示获取模块1010，可以被配置为接收所述新节点发送的可信节点的IP或域名及背书确定指示。背书请求发送模块1011，可以被配置为根据接收到所述背书确定指示，向所述IP或域名对应的可信节点发出背书请求，其中，所述背书请求用于使所述可信节点获取所述目标节点的公钥，使用所述可信节点自身私钥对所述目标节点的公钥进行签名得到背书数据。背书数据接收模块1012，可以被配置为从所述可信节点获得所述背书数据。背书发送第二模块1013，可以被配置为将所述背书数据发送给所述新节点。
可见，由于本公开上述技术方案中目标节点在区块链网络预置的许可权限中查询出新节点的公钥对应的账户地址拥有的许可权限，根据查询出的许可权限确定对新节点的身份认证是否成功，因此，身份认证直接利用了区块链网络节点账户的公私钥，不需要中心化的第三方参与数字证书，避免了数字证书颁发所带来的高复杂度，实现了区块链网络节点间安全访问。
图11是根据本公开第五方面一示例性实施例提供的一种安全访问区块链的方法的流程图。该方法应用于区块链网络中预置的可信节点。如图11所示，该方法可以包括：
在步骤1110中，可信节点响应于准备访问区块链网络中目标节点的新节点需要可信节点对目标节点背书，获取所述目标节点的公钥。
一种可能的实施方式中，可信节点可以响应于接收到所述目标节点发送的背书请求，获取所述目标节点的公钥，其中，所述背书请求是由所述目标节点根据接收到所述新节点发送的可信节点的IP或域名及背书确定指示相应发出的。
另一种可能的实施方式中，可信节点可以响应于从新节点接收到对所述目标节点的背书请求，获取所述目标节点的公钥。
在步骤1120中，使用所述可信节点自身私钥对所述目标节点的公钥进行签名得到背书数据。
在从目标节点接收背书请求的实施方式中，可信节点还可以在所述区块链网络预置的许可权限中查询所述目标节点的公钥对应的账户地址拥有的许可权限，根据查询出的许可权限确定是否对所述目标节点进行背书，在确定对所述目标节点进行背书的情况下，再进入所述使用所述可信节点自身私钥对所述目标节点的公钥进行签名得到背书数据的步骤。
在步骤1130中，将所述背书数据提供给所述新节点，以便使所述新节点对所述背书数据进行签名验证，如果所述新节点签名验证通过，所述新节点确定对所述目标节点的身份认证成功。
例如，在从目标节点接收背书请求的实施方式中，可以将所述背书数据发送给所述目标节点，所述背书数据经过所述目标节点发送给所述新节点。
再例如，在从新节点接收背书请求的实施方式中，可以将所述背书数据直接发送给所述新节点。
通过本公开上述技术方案，由于可信节点使用自身私钥对所述目标节点的公钥进行签名得到背书数据，将所述背书数据提供给所述新节点，因此，本公开新节点与目标节点的双向认证直接利用了区块链网络节点账户的公私钥，不需要中心化的第三方参与数字证书，避免了数字证书颁发所带来的高复杂度，实现了区块链网络节点间安全访问。
另外，还可以参考图3所示信令交互示意图来进一步详细了解本公开提供的应用于可信节点的安全访问区块链的方法，在此不再赘述。
图12是根据本公开第六方面一示例性实施例提供的一种安全访问区块链的装置1200的框图。该装置配置于区块链网络中的可信节点。如图12所示，该装置可以包括：目标公钥获取模块1210、签名模块1220、背书提供模块1230。
该目标公钥获取模块1210，可以被配置为响应于准备访问区块链网络中目标节点的新节点需要可信节点对目标节点背书，获取所述目标节点的公钥。
该签名模块1220，可以被配置为使用所述可信节点自身私钥对所述目标节点的公钥进行签名得到背书数据。
该背书提供模块1230，可以被配置为将所述背书数据提供给所述新节点，以便使所述新节点对所述背书数据进行签名验证，如果所述新节点签名验证通过，所述新节点确定对所述目标节点的身份认证成功。
一种可能的实施方式中，所述目标公钥获取模块1210可以被配置为响应于接收到所述目标节点发送的背书请求，获取所述目标节点的公钥，其中，所述背书请求是由所述目标节点根据接收到所述新节点发送的可信节点的IP或域名及背书确定指示相应发出的。所述背书提供模块1230可以被配置为将所述背书数据发送给所述目标节点，所述背书数据经过所述目标节点发送给所述新节点。
另一种可能的实施方式中，所述目标公钥获取模块1210可以被配置为响应于从新节点接收到对所述目标节点的背书请求，获取所述目标节点的公钥。所述背书提供模块1230可以被配置为将所述背书数据直接发送给所述新节点。
图13是根据本公开第六方面另一示例性实施例提供的一种安全访问区块链的装置1300的框图。如图13所示，该装置还可以包括：目标权限查询模块1240，可以被配置为在接收到所述目标节点发送的背书请求之后，在所述区块链网络预置的许可权限中查询所述目标节点的公钥对应的账户地址拥有的许可权限。背书确定模块1241，可以被配置为根据查询出的许可权限确定是否对所述目标节点进行背书。所述签名模块1220可以被配置为在所述背书确定模块确定对所述目标节点进行背书的情况下，执行所述使用可信节点自身私钥对所述目标节点的公钥进行签名得到背书数据的步骤。
通过本公开上述技术方案，由于可信节点使用自身私钥对所述目标节点的公钥进行签名得到背书数据，将所述背书数据提供给所述新节点，因此，本公开新节点与目标节点的双向认证直接利用了区块链网络节点账户的公私钥，不需要中心化的第三方参与数字证书，避免了数字证书颁发所带来的高复杂度，实现了区块链网络节点间安全访问。
图14是根据一示例性实施例示出的一种电子设备1400的框图。如图14所示，该电子设备1400可以包括：处理器1401，存储器1402，多媒体组件1403，输入/输出（I/O）接口1404，以及通信组件1405。
其中，处理器1401用于控制该电子设备1400的整体操作，以完成上述的安全访问区块链的方法中的全部或部分步骤。存储器1402用于存储各种类型的数据以支持在该电子设备1400的操作，这些数据例如可以包括用于在该电子设备1400上操作的任何应用程序或方法的指令，以及应用程序相关的数据，例如联系人数据、收发的消息、图片、音频、视频等等。该存储器1402可以由任何类型的易失性或非易失性存储设备或者它们的组合实现，例如静态随机存取存储器（Static Random Access Memory，简称SRAM），电可擦除可编程只读存储器（Electrically Erasable Programmable Read-Only Memory，简称EEPROM），可擦除可编程只读存储器（Erasable Programmable Read-Only Memory，简称EPROM），可编程只读存储器（Programmable Read-Only Memory，简称PROM），只读存储器（Read-Only Memory，简称ROM），磁存储器，快闪存储器，磁盘或光盘。多媒体组件1403可以包括屏幕和音频组件。其中屏幕例如可以是触摸屏，音频组件用于输出和/或输入音频信号。例如，音频组件可以包括一个麦克风，麦克风用于接收外部音频信号。所接收的音频信号可以被进一步存储在存储器1402或通过通信组件1405发送。音频组件还包括至少一个扬声器，用于输出音频信号。I/O接口1404为处理器1401和其他接口模块之间提供接口，上述其他接口模块可以是键盘，鼠标，按钮等。这些按钮可以是虚拟按钮或者实体按钮。通信组件1405用于该电子设备1400与其他设备之间进行有线或无线通信。无线通信，例如Wi-Fi，蓝牙，近场通信（Near Field Communication，简称NFC），2G、3G或4G，或它们中的一种或几种的组合，因此相应的该通信组件1405可以包括：Wi-Fi模块，蓝牙模块，NFC模块。
在一示例性实施例中，电子设备1400可以被一个或多个应用专用集成电路（Application Specific Integrated Circuit，简称ASIC）、数字信号处理器（Digital Signal Processor，简称DSP）、数字信号处理设备（Digital Signal Processing Device，简称DSPD）、可编程逻辑器件（Programmable Logic Device，简称PLD）、现场可编程门阵列（Field Programmable Gate Array，简称FPGA）、控制器、微控制器、微处理器或其他电子元件实现，用于执行上述的安全访问区块链的方法。
在另一示例性实施例中，还提供了一种包括程序指令的计算机可读存储介质，例如包括程序指令的存储器1402，上述程序指令可由电子设备1400的处理器1401执行以完成上述的安全访问区块链的方法。
另外，本公开还提供了一种安全访问区块链的***。在该***中可以包括至少一个如上述实施例所述的电子设备所实现的新节点，至少一个如上述实施例所述的电子设备所实现的新节点，至少一个如上述实施例所述的电子设备所实现的目标节点，至少一个如上述实施例所述的电子设备所实现的可信节点。其中，如上述实施例所述的电子设备所实现的新节点、如上述实施例所述的电子设备所实现的目标节点、如上述实施例所述的电子设备所实现的可信节点属于同一区块链网络。
综上所述，本公开新节点与目标节点的双向认证直接利用了区块链网络节点账户的公私钥，不需要中心化的第三方参与数字证书，避免了数字证书颁发所带来的高复杂度，实现了区块链网络节点间安全访问。
以上结合附图详细描述了本公开的优选实施方式，但是，本公开并不限于上述实施方式中的具体细节，在本公开的技术构思范围内，可以对本公开的技术方案进行多种简单变型，这些简单变型均属于本公开的保护范围。
另外需要说明的是，在上述具体实施方式中所描述的各个具体技术特征，在不矛盾的情况下，可以通过任何合适的方式进行组合，为了避免不必要的重复，本公开对各种可能的组合方式不再另行说明。
此外，本公开的各种不同的实施方式之间也可以进行任意组合，只要其不违背本公开的思想，其同样应当视为本公开所公开的内容。

Claims (31)

  1. 一种安全访问区块链的方法，其特征在于，所述方法应用于准备接入或访问区块链网络中目标节点的新节点，所述方法包括：
    判断是否需要所述区块链网络中预置的可信节点对所述目标节点背书；
    在需要所述可信节点对所述目标节点背书的情况下，获取所述可信节点使用自身私钥对所述目标节点公钥进行签名得到的背书数据；
    以及，将所述新节点的公钥提供给所述目标节点，其中，所述新节点的公钥用于使所述目标节点在所述区块链网络预置的许可权限中查询所述新节点的公钥对应的账户地址拥有的许可权限，根据查询出的许可权限确定对所述新节点的身份认证是否成功；
    对所述背书数据进行签名验证；
    如果签名验证通过，确定对所述目标节点的身份认证成功。
  2. 根据权利要求1所述的方法，其特征在于，所述在需要所述可信节点对所述目标节点背书的情况下，获取所述可信节点使用自身私钥对所述目标节点公钥进行签名得到的背书数据包括：
    在需要所述可信节点对所述目标节点背书的情况下，将所述可信节点的IP或域名及背书确定指示发送给所述目标节点，所述背书确定指示用于使所述目标节点根据所述可信节点的IP或域名从本地查询出预先存储的、所述可信节点使用自身私钥对所述目标节点公钥进行签名得到的背书数据，在所述背书数据未过期的情况下，将所述背书数据发送给所述新节点，或者，所述背书确定指示用于使所述目标节点向所述可信节点发出相应的背书请求，从所述可信节点获得背书数据，将所述背书数据发送给所述新节点；
    接收所述目标节点针对所述背书确定指示发送的背书数据；
    或者，
    在需要所述可信节点对所述目标节点背书的情况下，将背书请求发送给所述可信节点；
    接收所述可信节点针对所述背书请求反馈的背书数据。
  3. 根据权利要求2所述的方法，其特征在于，所述方法还包括：
    产生通信加密数据，其中，所述通信加密数据用于所述新节点与所述目标节点在身份认证通过后使用所述通信加密数据彼此进行加密通信；
    对所述通信加密数据进行加密；
    在将所述背书确定指示发送给所述目标节点时，将加密后的所述通信加密数据与所述背书确定指示一同发送给所述目标节点。
  4. 根据权利要求3所述的方法，其特征在于，所述通信加密数据包括：通信加密对称密钥，或者，通信加密随机数。
  5. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    从所述目标节点接收随机挑战码；
    使用所述新节点自身私钥对所述随机挑战码进行签名；
    将签名后的所述随机挑战码发送给所述目标节点。
  6. 一种安全访问区块链的装置，其特征在于，所述装置配置于准备接入或访问区块链网络中目标节点的新节点，所述装置包括：
    判断模块，被配置为判断是否需要所述区块链网络中预置的可信节点对所述目标节点背书；
    背书获取模块，被配置为在需要所述可信节点对所述目标节点背书的情况下，获取所述可信节点使用自身私钥对所述目标节点公钥进行签名得到的背书数据；
    公钥提供模块，被配置为将所述新节点的公钥提供给所述目标节点，其中，所述新节点的公钥用于使所述目标节点在所述区块链网络预置的许可权限中查询所述新节点的公钥对应的账户地址拥有的许可权限，根据查询出的许可权限确定对所述新节点的身份认证是否成功；
    目标身份认证模块，被配置为对所述背书数据进行签名验证，如果签名验证通过，确定对所述目标节点的身份认证成功。
  7. 根据权利要求6所述的装置，其特征在于，所述背书获取模块包括：
    第一请求发送子模块，被配置为在需要所述可信节点对所述目标节点背书的情况下，将所述可信节点的IP或域名及背书确定指示发送给所述目标节点，所述背书确定指示用于使所述目标节点根据所述可信节点的IP或域名从本地查询出预先存储的、所述可信节点使用自身私钥对所述目标节点公钥进行签名得到的背书数据，在所述背书数据未过期的情况下，将所述背书数据发送给所述新节点，或者，所述背书确定指示用于使所述目标节点向所述可信节点发出相应的背书请求，从所述可信节点获得背书数据，将所述背书数据发送给所述新节点；
    第一背书接收子模块，被配置为接收所述目标节点针对所述背书确定指示发送的背书数据；
    或者，
    所述背书获取模块包括：
    第二请求发送子模块，被配置为在需要所述可信节点对所述目标节点背书的情况下，将背书请求发送给所述可信节点；
    第二背书接收子模块，被配置为接收所述可信节点针对所述背书请求反馈的背书数据。
  8. 根据权利要求7所述的装置，其特征在于，所述装置还包括：
    通信加密数据产生模块，被配置为产生通信加密数据，其中，所述通信加密数据用于所述新节点与所述目标节点在身份认证通过后使用所述通信加密数据彼此进行加密通信；
    通信加密数据加密模块，被配置为对所述通信加密数据进行加密；
    通信加密数据发送模块，被配置为在将所述背书确定指示发送给所述目标节点时，将加密后的所述通信加密数据与所述背书确定指示一同发送给所述目标节点。
  9. 根据权利要求8所述的装置，其特征在于，所述通信加密数据包括：通信加密对称密钥，或者，通信加密随机数。
  10. 根据权利要求6所述的装置，其特征在于，所述装置还包括：
    挑战码接收模块，被配置为从所述目标节点接收随机挑战码；
    挑战码签名模块，被配置为使用所述新节点自身私钥对所述随机挑战码进行签名；
    挑战码发送模块，被配置为将签名后的所述随机挑战码发送给所述目标节点。
  11. 一种安全访问区块链的方法，其特征在于，所述方法应用于区块链网络中的目标节点，所述方法包括：
    响应于接收到新节点发出的访问或接入请求，获取所述新节点的公钥；
    在所述区块链网络预置的许可权限中查询所述新节点的公钥对应的账户地址拥有的许可权限；
    根据查询出的许可权限确定对所述新节点的身份认证是否成功。
  12. 根据权利要求11所述的方法，其特征在于，所述方法还包括：
    接收所述新节点发送的可信节点的IP或域名及背书确定指示；
    根据接收到所述背书确定指示，从本地查询出该IP或域名所对应的预先存储的背书数据，其中，所述背书数据是由所述可信节点使用自身私钥对所述目标节点公钥进行签名得到；
    在所述背书数据未过期的情况下，将所述背书数据发送给所述新节点。
  13. 根据权利要求11所述的方法，其特征在于，所述方法还包括：
    接收所述新节点发送的可信节点的IP或域名及背书确定指示；
    根据接收到所述背书确定指示，向所述IP或域名对应的可信节点发出背书请求，其中，所述背书请求用于使所述可信节点获取所述目标节点的公钥，使用所述可信节点自身私钥对所述目标节点的公钥进行签名得到背书数据；
    从所述可信节点获得所述背书数据；
    将所述背书数据发送给所述新节点。
  14. 一种安全访问区块链的装置，其特征在于，所述装置配置于区块链网络中的目标节点，所述装置包括：
    新节点公钥获取模块，被配置为响应于接收到新节点发出的访问或接入请求，获取所述新节点的公钥；
    新节点权限查询模块，被配置为在所述区块链网络预置的许可权限中查询所述新节点的公钥对应的账户地址拥有的许可权限；
    新节点身份认证模块，被配置为根据查询出的许可权限确定对所述新节点的身份认证是否成功。
  15. 根据权利要求14所述的装置，其特征在于，所述装置还包括：
    背书指示获取模块，被配置为接收所述新节点发送的可信节点的IP或域名及背书确定指示；
    背书数据查询模块，被配置为根据接收到所述背书确定指示，从本地查询出该IP或域名所对应的预先存储的背书数据，其中，所述背书数据是由所述可信节点使用自身私钥对所述目标节点公钥进行签名得到；
    背书发送第一模块，被配置为在所述背书数据未过期的情况下，将所述背书数据发送给所述新节点。
  16. 根据权利要求14所述的装置，其特征在于，所述装置还包括：
    背书指示获取模块，被配置为接收所述新节点发送的可信节点的IP或域名及背书确定指示；
    背书请求发送模块，被配置为根据接收到所述背书确定指示，向所述IP或域名对应的可信节点发出背书请求，其中，所述背书请求用于使所述可信节点获取所述目标节点的公钥，使用所述可信节点自身私钥对所述目标节点的公钥进行签名得到背书数据；
    背书数据接收模块，被配置为从所述可信节点获得所述背书数据；
    背书发送第二模块，被配置为将所述背书数据发送给所述新节点。
  17. 一种安全访问区块链的方法，其特征在于，所述方法应用于区块链网络中预置的可信节点，所述方法包括：
    响应于准备访问区块链网络中目标节点的新节点需要可信节点对目标节点背书，获取所述目标节点的公钥；
    使用所述可信节点自身私钥对所述目标节点的公钥进行签名得到背书数据；
    将所述背书数据提供给所述新节点，以便使所述新节点对所述背书数据进行签名验证，如果所述新节点签名验证通过，所述新节点确定对所述目标节点的身份认证成功。
  18. 根据权利要求17所述的方法，其特征在于，所述响应于准备访问区块链网络中目标节点的新节点需要可信节点对目标节点背书，获取所述目标节点的公钥包括：
    响应于接收到所述目标节点发送的背书请求，获取所述目标节点的公钥，其中，所述背书请求是由所述目标节点根据接收到所述新节点发送的可信节点的IP或域名及背书确定指示相应发出的；
    所述将背书数据提供给所述新节点包括：
    将所述背书数据发送给所述目标节点，所述背书数据经过所述目标节点发送给所述新节点。
  19. 根据权利要求17所述的方法，其特征在于，所述响应于准备访问区块链网络中目标节点的新节点需要可信节点对目标节点背书，获取所述目标节点的公钥包括：
    响应于从新节点接收到对所述目标节点的背书请求，获取所述目标节点的公钥；
    所述将背书数据提供给所述新节点包括：
    将所述背书数据直接发送给所述新节点。
  20. 根据权利要求18所述的方法，其特征在于，在所述接收到所述目标节点发送的背书请求之后，所述方法还包括：
    在所述区块链网络预置的许可权限中查询所述目标节点的公钥对应的账户地址拥有的许可权限；
    根据查询出的许可权限确定是否对所述目标节点进行背书；
    在确定对所述目标节点进行背书的情况下，进入所述使用所述可信节点自身私钥对所述目标节点的公钥进行签名得到背书数据的步骤。
  21. 一种安全访问区块链的装置，其特征在于，所述装置配置于区块链网络中预置的可信节点，所述装置包括：
    目标公钥获取模块，被配置为响应于准备访问区块链网络中目标节点的新节点需要可信节点对目标节点背书，获取所述目标节点的公钥；
    签名模块，被配置为使用所述可信节点自身私钥对所述目标节点的公钥进行签名得到背书数据；
    背书提供模块，被配置为将所述背书数据提供给所述新节点，以便使所述新节点对所述背书数据进行签名验证，如果所述新节点签名验证通过，确定对所述目标节点的身份认证成功。
  22. 根据权利要求21所述的装置，其特征在于，所述目标公钥获取模块被配置为响应于接收到所述目标节点发送的背书请求，获取所述目标节点的公钥，其中，所述背书请求是由所述目标节点根据接收到所述新节点发送的可信节点的IP或域名及背书确定指示相应发出的；
    所述背书提供模块被配置为将所述背书数据发送给所述目标节点，所述背书数据经过所述目标节点发送给所述新节点。
  23. 根据权利要求21所述的装置，其特征在于，所述目标公钥获取模块被配置为响应于从新节点接收到对所述目标节点的背书请求，获取所述目标节点的公钥；
    所述背书提供模块被配置为将所述背书数据直接发送给所述新节点。
  24. 根据权利要求22所述的装置，其特征在于，所述装置还包括：
    目标权限查询模块，被配置为在接收到所述目标节点发送的背书请求之后，在所述区块链网络预置的许可权限中查询所述目标节点的公钥对应的账户地址拥有的许可权限；
    背书确定模块，被配置为根据查询出的许可权限确定是否对所述目标节点进行背书；
    所述签名模块被配置为在所述背书确定模块确定对所述目标节点进行背书的情况下，执行所述使用可信节点自身私钥对所述目标节点的公钥进行签名得到背书数据的步骤。
  25. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中包括一个或多个程序，所述一个或多个程序用于执行权利要求1至5中任一项所述的方法。
  26. 一种电子设备，其特征在于，包括：
    权利要求25中所述的计算机可读存储介质；以及
    一个或者多个处理器，用于执行所述计算机可读存储介质中的程序。
  27. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中包括一个或多个程序，所述一个或多个程序用于执行权利要求11到13中任一项所述的方法。
  28. 一种电子设备，其特征在于，包括：
    权利要求27中所述的计算机可读存储介质；以及
    一个或者多个处理器，用于执行所述计算机可读存储介质中的程序。
  29. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中包括一个或多个程序，所述一个或多个程序用于执行权利要求17至20中任一项所述的方法。
  30. 一种电子设备，其特征在于，包括：
    权利要求29中所述的计算机可读存储介质；以及
    一个或者多个处理器，用于执行所述计算机可读存储介质中的程序。
  31. 一种安全访问区块链的***，其特征在于，所述***包括：
    至少一个如权利要求26所述的电子设备所实现的新节点；
    至少一个如权利要求28所述的电子设备所实现的目标节点；
    至少一个如权利要求30所述的电子设备所实现的可信节点；
    其中，所述权利要求26所述的电子设备所实现的新节点、权利要求28所述的电子设备所实现的目标节点、权利要求30所述的电子设备所实现的可信节点属于同一区块链网络。
PCT/CN2017/119575 2017-12-28 2017-12-28 安全访问区块链的方法、装置、***、存储介质及电子设备 WO2019127278A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN201780002593.7A CN108235806B (zh) 2017-12-28 2017-12-28 安全访问区块链的方法、装置、***、存储介质及电子设备
PCT/CN2017/119575 WO2019127278A1 (zh) 2017-12-28 2017-12-28 安全访问区块链的方法、装置、***、存储介质及电子设备

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2017/119575 WO2019127278A1 (zh) 2017-12-28 2017-12-28 安全访问区块链的方法、装置、***、存储介质及电子设备

Publications (1)

Publication Number Publication Date
WO2019127278A1 true WO2019127278A1 (zh) 2019-07-04

Family

ID=62643269

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/119575 WO2019127278A1 (zh) 2017-12-28 2017-12-28 安全访问区块链的方法、装置、***、存储介质及电子设备

Country Status (2)

Country Link
CN (1) CN108235806B (zh)
WO (1) WO2019127278A1 (zh)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108989468A (zh) * 2018-08-31 2018-12-11 北京八分量信息科技有限公司 一种信任网络构建方法及装置
CN110933108A (zh) * 2019-09-26 2020-03-27 腾讯科技（深圳）有限公司 基于区块链网络的数据处理方法、装置、电子设备及存储介质
CN111478769A (zh) * 2020-03-18 2020-07-31 西安电子科技大学 一种分布式可信身份认证方法、***、存储介质、终端
CN114221824A (zh) * 2022-02-22 2022-03-22 北京悦游信息技术有限公司 一种私域网络的安全访问控制方法、***和可读存储介质
US11405364B1 (en) 2021-03-04 2022-08-02 International Business Machines Corporation Privacy-preserving endorsements in blockchain transactions

Families Citing this family (32)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110677376B (zh) * 2018-07-03 2022-03-22 中国电信股份有限公司 认证方法、相关设备和***及计算机可读存储介质
CN109146683A (zh) * 2018-08-01 2019-01-04 江苏恒宝智能***技术有限公司 一种利用区块链的信息管理和认证***
CN110839002B (zh) * 2018-08-15 2022-05-17 华为云计算技术有限公司 云的开户、认证及访问方法和设备
CN109344628B (zh) * 2018-08-23 2022-07-08 达闼机器人股份有限公司 区块链网络中可信节点的管理方法，节点及存储介质
CN109117674A (zh) * 2018-09-25 2019-01-01 深圳市元征科技股份有限公司 一种客户端验证加密方法、***、设备及计算机介质
BR112019008000B1 (pt) * 2018-11-16 2022-03-15 Advanced New Technologies Co., Ltd Método implementado por computador para a autenticação de um nome de domínio, método implementado por computador, meio não transitório legível por computador e sistema para a implementação de um método
CN109740370A (zh) * 2018-12-12 2019-05-10 北京世纪互联宽带数据中心有限公司 数据访问方法及其装置、电子设备、计算机可读介质
CN109886036B (zh) * 2019-01-02 2020-12-01 广州大学 基于区块链的域名分布式认证方法、装置及区块链网络
CN109905388B (zh) * 2019-02-20 2021-12-07 中国互联网络信息中心 一种基于区块链的域名信用的处理方法及***
CN109996229B (zh) * 2019-02-28 2022-06-24 达闼机器人股份有限公司 基于dht网络的数据传输方法、装置、电子设备和存储介质
CN110611647A (zh) * 2019-03-06 2019-12-24 张超 一种区块链***上的节点加入方法和装置
CN109961292B (zh) * 2019-03-22 2022-04-01 杭州复杂美科技有限公司 区块链验证码应用方法、设备和存储介质
CN110046521B (zh) * 2019-04-24 2023-04-18 成都派沃特科技股份有限公司 去中心化隐私保护方法
CN110213264A (zh) * 2019-05-30 2019-09-06 全链通有限公司 基于联盟区块链的身份验证方法、设备及存储介质
CN110266659B (zh) * 2019-05-31 2020-09-25 联想(北京)有限公司 一种数据处理方法和设备
CN110210209A (zh) * 2019-06-06 2019-09-06 中星技术股份有限公司 管理摄像设备的方法和装置
CN112311735B (zh) * 2019-07-30 2021-11-19 华为技术有限公司 可信认证方法，网络设备、***及存储介质
CN110381167B (zh) * 2019-08-09 2022-02-08 中国工商银行股份有限公司 基于云的区块链节点主动发现***及方法
CN110851857B (zh) * 2019-10-14 2022-07-01 上海唯链信息科技有限公司 一种在区块链上实现身份背书的方法及装置
CN110851813B (zh) * 2019-11-11 2021-01-26 北京海益同展信息科技有限公司 身份验证方法、区块链***的节点装置和区块链***
CN111222885B (zh) * 2019-11-13 2021-04-16 腾讯科技（深圳）有限公司 数据处理请求背书方法、装置、计算机设备及存储介质
CN111010372A (zh) * 2019-11-20 2020-04-14 国家信息中心 区块链网络身份认证***、数据处理方法及网关设备
CN111092958B (zh) * 2019-12-27 2022-10-21 深圳市迅雷网络技术有限公司 一种节点接入方法、装置、***及存储介质
CN111294205A (zh) * 2020-02-24 2020-06-16 联想(北京)有限公司 密钥管理方法及装置、计算机***以及可读存储介质
CN111447070B (zh) * 2020-03-26 2023-04-07 丁莉萍 区块链签名验证方法、装置及存储介质
CN111935075A (zh) * 2020-06-23 2020-11-13 浪潮云信息技术股份公司 一种基于区块链的数字身份签发方法、设备及介质
CN111711646B (zh) * 2020-08-20 2020-11-24 飞天诚信科技股份有限公司 一种确保区块链p2p网络节点通信安全性的方法和设备
CN112311556B (zh) * 2020-11-05 2024-05-24 北京领主科技有限公司 设备认证的方法、设备控制的方法、节点、设备、区块链
CN112543098B (zh) * 2020-11-12 2021-10-01 西安交通大学 基于挑战应答机制的智能楼宇移动设备认证***、方法
CN112512048B (zh) * 2020-11-27 2022-07-12 达闼机器人股份有限公司 移动网络接入***、方法、存储介质及电子设备
WO2022150961A1 (zh) * 2021-01-12 2022-07-21 深圳大学 一种区块链安全监测方法、装置、电子设备及存储介质
CN113364583B (zh) * 2021-05-31 2024-05-21 山东中科好靓基础软件技术有限公司 一种基于去中心化网络的远程验证方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106453636A (zh) * 2016-11-22 2017-02-22 深圳银链科技有限公司 可信区块生成方法及***
CN106796685A (zh) * 2016-12-30 2017-05-31 深圳前海达闼云端智能科技有限公司 区块链权限控制方法、装置及节点设备
CN107070667A (zh) * 2017-06-07 2017-08-18 国民认证科技（北京）有限公司 身份认证方法、用户设备和服务器
CN107077674A (zh) * 2016-12-29 2017-08-18 深圳前海达闼云端智能科技有限公司 交易验证处理方法、装置及节点设备

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2015142765A1 (en) * 2014-03-17 2015-09-24 Coinbase, Inc Bitcoin host computer system
US9876646B2 (en) * 2015-05-05 2018-01-23 ShoCard, Inc. User identification management system and method
CN105488675B (zh) * 2015-11-25 2019-12-24 布比（北京）网络技术有限公司 一种区块链的分布式共享总账构建方法
US11115418B2 (en) * 2016-12-23 2021-09-07 Cloudminds (Shanghai) Robotics Co., Ltd. Registration and authorization method device and system
CN107171806B (zh) * 2017-05-18 2020-04-10 北京航空航天大学 基于区块链的移动终端网络密钥协商方法
CN107392608B (zh) * 2017-07-11 2020-07-07 北京博晨技术有限公司 基于区块链***的数字资产交易方法及区块链***
CN107451874A (zh) * 2017-07-27 2017-12-08 武汉天喻信息产业股份有限公司 基于区块链的电子***综合处理方法及***
CN107403379B (zh) * 2017-08-07 2021-02-26 成都质数斯达克科技有限公司 一种数据处理方法、装置和区块链核心分布式***

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106453636A (zh) * 2016-11-22 2017-02-22 深圳银链科技有限公司 可信区块生成方法及***
CN107077674A (zh) * 2016-12-29 2017-08-18 深圳前海达闼云端智能科技有限公司 交易验证处理方法、装置及节点设备
CN106796685A (zh) * 2016-12-30 2017-05-31 深圳前海达闼云端智能科技有限公司 区块链权限控制方法、装置及节点设备
CN107070667A (zh) * 2017-06-07 2017-08-18 国民认证科技（北京）有限公司 身份认证方法、用户设备和服务器

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108989468A (zh) * 2018-08-31 2018-12-11 北京八分量信息科技有限公司 一种信任网络构建方法及装置
CN108989468B (zh) * 2018-08-31 2021-03-30 北京八分量信息科技有限公司 一种信任网络构建方法及装置
CN110933108A (zh) * 2019-09-26 2020-03-27 腾讯科技（深圳）有限公司 基于区块链网络的数据处理方法、装置、电子设备及存储介质
CN111478769A (zh) * 2020-03-18 2020-07-31 西安电子科技大学 一种分布式可信身份认证方法、***、存储介质、终端
US11405364B1 (en) 2021-03-04 2022-08-02 International Business Machines Corporation Privacy-preserving endorsements in blockchain transactions
CN114221824A (zh) * 2022-02-22 2022-03-22 北京悦游信息技术有限公司 一种私域网络的安全访问控制方法、***和可读存储介质
CN114221824B (zh) * 2022-02-22 2022-05-17 北京悦游信息技术有限公司 一种私域网络的安全访问控制方法、***和可读存储介质

Also Published As

Publication number Publication date
CN108235806B (zh) 2020-10-02
CN108235806A (zh) 2018-06-29

Similar Documents

Publication Publication Date Title
WO2019127278A1 (zh) 安全访问区块链的方法、装置、***、存储介质及电子设备
US11606352B2 (en) Time-based one time password (TOTP) for network authentication
TWI737240B (zh) 提高區塊鏈網路與外部資料源之間的通信的完整性
CN107231351B (zh) 电子证件的管理方法及相关设备
TWI715338B (zh) 用於配置用於區塊鏈網路的基於現場可程式化閘陣列的可信執行環境的方法、系統和裝置
US10284378B2 (en) Certificate authority master key tracking on distributed ledger
US11159307B2 (en) Ad-hoc trusted groups on a blockchain
US11483298B2 (en) Information masking using certificate authority
US9912485B2 (en) Method and apparatus for embedding secret information in digital certificates
US9467430B2 (en) Device, method, and system for secure trust anchor provisioning and protection using tamper-resistant hardware
WO2021073170A1 (zh) 数据提供和融合的方法及装置
JP2020528224A (ja) 信頼できる実行環境におけるスマート契約動作のセキュアな実行
US9680827B2 (en) Geo-fencing cryptographic key material
US9654922B2 (en) Geo-fencing cryptographic key material
KR102266206B1 (ko) 합의 노드와 클라이언트 노드 간의 통신을 관리하는 방법
WO2019110018A1 (zh) 通信网络***的消息验证方法、通信方法和通信网络***
WO2022252992A1 (zh) 用户数据授权方法及用户数据授权***
CN115242471A (zh) 信息传输方法、装置、电子设备及计算机可读存储介质
JP2024513521A (ja) 組み込みデバイスの安全な信頼の起点登録及び識別管理
TW201935357A (zh) 電子交易方法及系統
JP2018148293A (ja) クレデンシャル生成システム及び方法、クライアント端末、サーバ装置、発行依頼装置、クレデンシャル発行装置並びにプログラム
Masud Kerberos-based authentication for OpenStack cloud infrastructure as a service
KR20180059076A (ko) 암호화된 트래픽 분석을 통한 내부 정보 유출 모니터링 시스템 및 방법

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17936643

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 16/11/2020)

122 Ep: pct application non-entry in european phase

Ref document number: 17936643

Country of ref document: EP

Kind code of ref document: A1