WO2020177508A1 - 一种区块链的构建及群组划分方法与装置 - Google Patents

一种区块链的构建及群组划分方法与装置 Download PDF

Info

Publication number
WO2020177508A1
WO2020177508A1 PCT/CN2020/074750 CN2020074750W WO2020177508A1 WO 2020177508 A1 WO2020177508 A1 WO 2020177508A1 CN 2020074750 W CN2020074750 W CN 2020074750W WO 2020177508 A1 WO2020177508 A1 WO 2020177508A1
Authority
WO
WIPO (PCT)
Prior art keywords
organization
node
group
certificate
configuration file
Prior art date
Application number
PCT/CN2020/074750
Other languages
English (en)
French (fr)
Inventor
李昊轩
王�章
李辉忠
张开翔
范瑞彬
Original Assignee
深圳前海微众银行股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳前海微众银行股份有限公司 filed Critical 深圳前海微众银行股份有限公司
Publication of WO2020177508A1 publication Critical patent/WO2020177508A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network

Definitions

  • the present invention relates to the technical field of financial technology (Fintech), and in particular to a method and device for building and dividing a block chain.
  • Blockchain technology is a brand-new distributed infrastructure and computing method in the field of financial technology.
  • the blockchain can be divided into public chains, private chains and consortium chains.
  • the nodes of the public chain are a block chain structure that anyone can participate in and anyone can access;
  • the private chain is a block chain structure that is only open to individual individuals (such as companies, schools); alliances
  • the chain is currently a very widely used and very common blockchain structure.
  • the blockchain is maintained by certain organizations, is open to certain individuals, and supervisory nodes (such as bank supervisory agencies, securities supervisory agencies, central banks, etc.) can be introduced to make the block chain unchangeable At the same time meet the corresponding regulatory requirements.
  • the consortium chain when the consortium chain is initialized, it is impossible to meet the demands of equal status among multiple institutions of the consortium chain.
  • all parties need to negotiate the node information contained in the genesis block.
  • the current practice is for one of the institutions to generate its own node information, start the blockchain, and then join the nodes of other institutions.
  • the institution At this time, the institution generates certificates and private keys for the other institutions that have joined and then sends them to other institutions; or
  • the third-party organization directly generates node information in all organizations and sends the installation package to each organization.
  • the organization that generates the node installation package will have all the information of other nodes, and the security of the node's private key is low, which does not meet the peer and security requirements of all organizations in the alliance chain.
  • This application provides a block chain construction and group division method and device to solve the problem of unequal and low security among various institutions in the alliance chain.
  • An embodiment of the present invention provides a block chain construction and group division method, including:
  • the first organization generates the first certificate of the node in the first organization;
  • the first organization is any organization in the alliance chain, and the node in the first organization is any node in the nodes to which the first organization belongs;
  • the first organization broadcasts the first certificate to a second organization, and receives a second certificate of a node in the second organization, where the second organization is an organization other than the first organization in the alliance chain;
  • the first organization verifies the second certificate, and after the verification is passed, generates a configuration file of the alliance chain according to the first certificate and the second certificate;
  • the first organization sends the first certificate, the first private key of the node within the first organization, and the configuration file to the node within the first organization, so as to activate the node within the first organization.
  • the first private key of the node within the first organization, and the configuration file to the node within the first organization include:
  • the node in the first organization uses the first private key to verify the first certificate, and the node in the first organization starts after the verification is passed;
  • the node in the first organization After the node in the first organization is started, it further includes:
  • the node in the first organization After determining that the number of received second heartbeat requests is greater than a first threshold, the node in the first organization generates the genesis block of the alliance chain.
  • the method further includes:
  • the first organization determines a third certificate from the first certificate and N second certificates, the third certificate is a certificate corresponding to a third node belonging to the group, and the first organization includes Node within the first organization of the group;
  • the first organization generates the group configuration file of the group according to the third certificate and the group configuration item;
  • the node in the first organization belonging to the group restarts according to the group configuration file, so that the node in the first organization has a group attribute.
  • the method further includes:
  • the group genesis block of the group is generated.
  • the first organization generating the configuration file of the alliance chain according to the first certificate and the second certificate includes:
  • the first organization analyzes the public key information and the certificate fingerprint contained in the first certificate and the second certificate to generate the configuration file, the configuration file containing the network connection addresses of N second nodes;
  • the node in the first organization sending a first heartbeat request to N second nodes according to the configuration file includes:
  • the node in the first organization sends the first heartbeat request to the N second nodes according to the network connection addresses of the N second nodes.
  • the embodiment of the present invention also provides a method for dividing a block chain into groups, including:
  • the first organization determines a third certificate from all the certificates in the alliance chain, where the third certificate is a certificate corresponding to the third node belonging to the group; the first organization is that the alliance chain contains the certificates belonging to the group Any institution of the node within the first institution;
  • the first organization generates the group configuration file of the group according to the group configuration item and the third certificate;
  • the first organization sends the group configuration file to the node in the first organization that belongs to the group, so that the node in the first organization that belongs to the group is based on the group configuration file Restart, so that the nodes in the first organization have group attributes.
  • the method further includes:
  • the group genesis block of the group is generated.
  • the first organization generating the group configuration file of the group according to the third certificate and the group configuration item includes:
  • the first organization analyzes the public key information and the certificate fingerprint contained in the third certificate, and generates the group configuration file according to the group configuration item, and the group configuration file contains the group configuration file.
  • the sending of a third heartbeat request by the node in the first organization belonging to the group to a third node other than the node in the first organization according to the group configuration file includes:
  • the node in the first organization belonging to the group sends the first organization node to a third node other than the node in the first organization according to the group serial number and the network connection address of the third node.
  • Three heartbeat requests are possible.
  • the embodiment of the present invention also provides a block chain construction device, including:
  • a generating unit configured to generate a first certificate of a node in the first organization; the node in the first organization is any node in the node to which the first organization belongs, and the first organization is any organization in the alliance chain ;
  • the organization transceiving unit is used to broadcast the first certificate to a second organization and receive the second certificate of the node in the second organization, where the second organization is an organization other than the first organization in the alliance chain ;
  • a configuration unit configured to verify the second certificate, and after the verification is passed, generate a configuration file of the alliance chain according to the first certificate and the second certificate;
  • the institution transceiver unit is further configured to send the first certificate, the first private key of the node in the first institution, and the configuration file to the node in the first institution, so that the first institution The internal node starts.
  • it further includes:
  • the activation unit is configured to verify the first certificate by using the first private key, and activate it after the verification is passed;
  • a node transceiver unit configured to send a first heartbeat request to the node in the second organization according to the configuration file, and receive a second heartbeat request from the node in the second organization;
  • the consensus unit is used for generating the genesis block of the alliance chain after determining that the number of the received second heartbeat requests is greater than the first threshold.
  • the method further includes a determining unit configured to determine a third certificate from the first certificate and the N second certificates, where the third certificate is a certificate corresponding to a third node belonging to the group ,
  • the first organization includes nodes within the first organization that belong to the group;
  • the configuration unit is further configured to generate a group configuration item according to the third certificate, and the group configuration item is used to indicate node information of the third node;
  • the configuration unit is further configured to generate a group configuration file of the group according to the third certificate and the group configuration item;
  • the institution transceiver unit is further configured to send the group configuration file to the node in the first institution belonging to the group;
  • the activation unit is further configured to restart according to the group configuration file, so that the nodes in the first organization have group attributes.
  • the node transceiver unit is further configured to send a third heartbeat request to a third node other than the node in the first organization according to the group configuration file, and receive the first Four-heartbeat request;
  • the consensus unit is further configured to generate a group genesis block of the group after determining that the number of received fourth heartbeat requests is greater than a second threshold.
  • the embodiment of the present invention also provides a block chain group division device, including:
  • the determining unit is configured to determine a third certificate from all certificates in the consortium chain, where the third certificate is a certificate corresponding to a third node belonging to the group; the first organization to which the determining unit belongs is included in the consortium chain Any organization belonging to the node within the first organization of the group;
  • a generating unit configured to generate a group configuration item according to the third certificate, where the group configuration item is used to indicate node information of the third node;
  • the generating unit is further configured to generate a group configuration file of the group according to the group configuration item and the third certificate;
  • the organization transceiving unit is configured to send the group configuration file to the node in the first organization belonging to the group, so that the node in the first organization belonging to the group is configured according to the group
  • the file is restarted, so that the nodes in the first organization have group attributes.
  • it further includes:
  • a node transceiver unit configured to send a third heartbeat request to a third node other than the node in the first organization according to the group configuration file, and receive a fourth heartbeat request;
  • the consensus unit is configured to generate the group genesis block of the group after determining that the number of received fourth heartbeat requests is greater than a second threshold.
  • the embodiment of the present invention also provides an electronic device, including:
  • At least one processor and,
  • a memory communicatively connected with the at least one processor; wherein,
  • the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor, so that the at least one processor can execute the method described above.
  • the embodiment of the present invention also provides a non-transitory computer-readable storage medium, the non-transitory computer-readable storage medium storing computer instructions, and the computer instructions are used to make the computer execute the method described above.
  • the first organization generates the first certificate of the node in the first organization, and the first organization broadcasts the generated first certificate to the second organization, and receives the second certificate of the node in the second organization.
  • An organization is any organization in the alliance chain
  • the node in the first organization is any node in the node to which the first organization belongs
  • the second organization is an organization in the alliance chain other than the first organization.
  • the first organization verifies the received second certificate, and after the verification is passed, generates the configuration file of the consortium chain based on the first certificate and the second certificate, and combines the first certificate, the first private key of the node in the first organization and the configuration
  • the file is sent to the node in the first organization to activate the node in the first organization.
  • the private key of the node is generated and maintained by the institution itself, which ensures that the private key of the node within the institution does not exit the intranet of the institution, and ensures the security of the node between the institutions.
  • the organizations of the alliance chain each generate the certificate and private key of the corresponding node, instead of one organization generating the certificates and private keys of the other organizations, ensuring the peer relationship between organizations.
  • Figure 1 is a schematic structural diagram of a possible system architecture provided by an embodiment of the present invention.
  • FIG. 2 is a schematic flowchart of a method for constructing a blockchain according to an embodiment of the present invention
  • FIG. 3 is a schematic flowchart of a method for constructing a consortium chain according to a specific embodiment of the present invention
  • FIG. 4 is a schematic flowchart of a method for grouping a consortium chain according to a second embodiment of the present invention.
  • FIG. 5 is a schematic structural diagram of a device for constructing a blockchain according to an embodiment of the present invention.
  • FIG. 6 is a schematic structural diagram of a block chain group division device provided by an embodiment of the present invention.
  • FIG. 7 is a schematic structural diagram of an electronic device provided by an embodiment of the present invention.
  • a blockchain is a chain composed of a series of blocks. In addition to recording the data of this block, each block also records the hash value of the previous block. In this way, a chain is formed.
  • There are two core concepts of the blockchain one is cryptography and the other is decentralization. Based on these two concepts, the historical information on the blockchain cannot be tampered with.
  • the alliance chain generating all the node information within a single organization for a single organization cannot meet the needs of decentralized thinking.
  • the embodiment of the present invention provides a method for constructing a blockchain.
  • the institution is the subject that has passed the consortium chain committee and has the institution certificate agency.crt and the institution private key agency.key.
  • Organizations can generate nodes within the organization.
  • the organization can issue the node certificate node.crt of its own node and generate the node private key node.key.
  • a certificate is a digital certificate. It is a string of numbers that mark the identity information of all parties in the Internet communication. It provides a way to verify the identity of the communication entity on the Internet.
  • a digital certificate is not a digital ID, but an identity certification authority covers the digital identity.
  • CA Certificate Authority
  • nodes participate in network formation and data exchange.
  • a node refers to a participant with a unique identity.
  • the node has a complete copy of the ledger and has the ability to participate in the blockchain peer-to-peer network consensus and ledger maintenance.
  • the nodes in the organization are nodes running in the alliance chain, which belong to the corresponding organization, and the nodes may be in one or more groups.
  • the node has the node certificate node.crt and the node private key node.key. Nodes in the organization will connect to other nodes in the group and maintain the group. Data isolation between groups, each group runs its own consensus algorithm independently, and different groups can use different consensus algorithms.
  • the embodiment of the present invention supports a multi-group architecture, shares a network between groups, and realizes network message isolation between accounts through a network access module. All organizations negotiate to complete the root certificate of the alliance chain, and all organizations have the node certificate node.crt and the node private key node.key of the nodes in their respective organizations. Inter-organizations have equal status, and nodes within an organization only communicate with other nodes in the group they belong to. Nodes between institutions can negotiate certificates with each other and create new groups. An organization can correspond to one intra-organization node or multiple intra-organization nodes; the intra-organization nodes corresponding to the same institution can belong to the same group or different groups.
  • the embodiment of the present invention provides a method for constructing a blockchain. As shown in FIG. 2, the method for constructing a blockchain provided by the embodiment of the present invention includes the following steps:
  • Step 201 The first organization generates a first certificate of the node in the first organization; the first organization is any organization in the alliance chain, and the node in the first organization is any node in the nodes to which the first organization belongs.
  • Step 202 The first organization broadcasts the first certificate to the second organization, and receives the second certificate of the node in the second organization.
  • the second organization is an organization other than the first organization in the alliance chain.
  • Step 203 The first organization verifies the second certificate, and after passing the verification, generates a configuration file of the alliance chain according to the first certificate and the second certificate.
  • Step 204 The first organization sends the first certificate, the first private key of the node in the first organization, and the configuration file to the node in the first organization, so as to start the node in the first organization.
  • the first organization generates the first certificate of the node in the first organization, and the first organization broadcasts the generated first certificate to the second organization, and receives the second certificate of the node in the second organization.
  • An organization is any organization in the alliance chain
  • the node in the first organization is any node in the node to which the first organization belongs
  • the second organization is an organization in the alliance chain other than the first organization.
  • the first organization verifies the received second certificate, and after the verification is passed, generates the configuration file of the consortium chain based on the first certificate and the second certificate, and combines the first certificate, the first private key of the node in the first organization and the configuration
  • the file is sent to the node in the first organization to activate the node in the first organization.
  • the private key of the node is generated and maintained by the institution itself, which ensures that the private key of the node within the institution does not exit the intranet of the institution, and ensures the security of the node between the institutions.
  • the organizations of the alliance chain each generate the certificate and private key of the corresponding node, instead of one organization generating the certificates and private keys of the other organizations, ensuring the peer relationship between organizations.
  • each organization generates node certificates for its own corresponding intra-organization nodes, and multiple organizations use a peer-to-peer negotiation method to broadcast node certificates and perform certificate verification.
  • the organization can generate the configuration file when the alliance chain node is started based on the certificates of all nodes, and the node private key is stored locally in the organization and not sent to other organizations, so that the node private key will not be leaked and the security of the private key is guaranteed. Since the generated configuration file does not contain the node's private key, even if the generated configuration file is leaked, the organization cannot use these configuration files.
  • the node certificate can be actively sent by the first organization to the other organizations in the alliance chain, that is, the second organization, or it can be obtained from the first organization by the second organization. After each organization receives the node certificate broadcast by other organizations, it verifies the issuer, user, validity period, key usage, and public key contained in the certificate to determine whether the node certificate is legal. If the node certificates are all valid, the node certificate negotiation succeeds, and the subsequent process continues; if there is an illegal node certificate, the node certificate negotiation fails.
  • each organization in the alliance chain After the node certificate negotiation is successful, each organization in the alliance chain generates the configuration file of the node within the corresponding organization, and sends the configuration file of each node within the organization, together with the certificate and private key of the node within the organization, to the node within the organization , So that the nodes in the organization are activated.
  • the method further includes:
  • the node in the first organization uses the first private key to verify the first certificate, and the node in the first organization starts after the verification is passed;
  • the node in the first organization After the node in the first organization is started, it further includes:
  • the node in the first organization After determining that the number of received second heartbeat requests is greater than a first threshold, the node in the first organization generates the genesis block of the alliance chain.
  • each organization configures the node's private key to the installation package of the node in the corresponding organization to start the node.
  • two configuration methods are supported, namely the keycenter type private key encryption method and the method of directly loading the private key to the node folder.
  • the first heartbeat request is sent to the remaining nodes in the alliance chain, that is, the node in the second organization. Only when the nodes in the first organization have collected a sufficient number of heartbeat requests from other nodes will they reach consensus, that is, jointly create a blockchain. In this way, the success rate of blockchain creation is guaranteed.
  • the consensus algorithm is that each node in the blockchain peer-to-peer network confirms a batch of transactions through an algorithm, and ensures that all nodes have a consistent confirmation result for this batch of data. This algorithm is the consensus algorithm of the blockchain.
  • n the number of nodes in the organization is n, and operations such as certificate negotiation and node deployment have been completed.
  • each node in the alliance chain After each node in the alliance chain is started, it connects with the rest of the nodes in the alliance chain according to the configuration file of the alliance chain.
  • Different consensus methods have different first thresholds. For example, in the PBFT (Practical Byzantine Fault Tolerance) method, the nodes in the organization must collect more than 2n/3 (rounded up) heartbeat requests before they can generate the genesis block of the alliance chain to further complete the consensus.
  • PBFT Practical Byzantine Fault Tolerance
  • RAFT distributed consensus algorithm
  • the first organization generating the configuration file of the alliance chain according to the first certificate and the second certificate includes:
  • the first organization analyzes the public key information and the certificate fingerprint contained in the first certificate and the second certificate to generate the configuration file, and the configuration file contains the network connection addresses of N second nodes.
  • the node in the first organization sending a first heartbeat request to the N second nodes according to the configuration file includes:
  • the node in the first organization sends the first heartbeat request to the N second nodes according to the network connection addresses of the N second nodes.
  • the first organization generates a configuration file based on all the node certificates in the alliance chain. Specifically, it analyzes the public key information and certificate fingerprint contained in the certificate to generate the serial number of the alliance chain. When the subsequent node generates the genesis block, the serial number information is put into the genesis block. At the same time, the first organization generates configuration files such as group capacity and network connection addresses required for blockchain startup. In this way, when the node in the first organization needs to send the first heartbeat request, it can send the first heartbeat request to the second node according to the network connection address of each second node.
  • Each group contains multiple nodes.
  • the nodes belonging to the same organization can belong to different groups or belong to the same group.
  • the method further includes:
  • the first organization determines a third certificate from the first certificate and the N second certificates, where the third certificate is a certificate corresponding to a third node belonging to the group, and the first organization includes The node in the first organization of the group;
  • the first organization generates the group configuration file of the group according to the third certificate and the group configuration item;
  • the node in the first organization belonging to the group restarts according to the group configuration file, so that the node in the first organization has a group attribute.
  • the groups are divided. Since each organization has obtained all the node certificates in the alliance chain, there is no need to perform the process of obtaining node certificates and verification again, because the first organization contains the nodes belonging to the group For nodes within the first organization, the first organization can directly determine the third certificate corresponding to the third node belonging to the group from all node certificates. Generate group configuration items according to the third certificate.
  • the group configuration item can include data such as the certificate of each node in the group, the IP of the node, and the port number, and can indicate which nodes are the third nodes in the group.
  • the first organization analyzes the public key information and certificate fingerprint contained in the certificate according to the group configuration items and the node certificate in the group, and generates the group serial number when the group is started.
  • the subsequent node When the subsequent node generates the group creation block, it will put the group serial number information into the group creation block.
  • the first organization generates configuration files such as the group capacity required when dividing the group and the network connection addresses of nodes in the group.
  • each organization After each organization generates the group configuration file, it sends the group configuration file to the nodes within the organization that belong to the group, and after importing the group configuration file into the node installation package, restart the node. In this way, the nodes in the organization belonging to the group will have group attributes after restarting according to the group configuration file.
  • the method further includes:
  • the group genesis block of the group is generated.
  • the nodes in the first organization will only proceed to consensus when they have collected a sufficient number of heartbeat requests from other nodes in the group, that is, create the group genesis block. In this way, the success rate of group division is guaranteed.
  • the node also has a detection function. Specifically, when the node is started, the corresponding node certificate will be generated, and the node configuration items include information such as the node IP, port number, and group to which the node belongs to ensure that the generated node is available.
  • the embodiment of the present invention is also designed with a monitoring function.
  • You can configure the corresponding monitoring service, such as the default configuration to report the monitoring results to the user's WeChat.
  • an organization can initiate an RPC (Remote Procedure Call) request to a node in the organization to obtain relevant parameters during the operation of the node in the organization. Perform monitoring and report the monitoring results to the service configured by the user.
  • the monitoring service is configured by default, supports reporting to WeChat, personal URLs, supports dedicated service settings, and can be reported to corporate WeChat.
  • the embodiment of the present invention also provides a group division method of the alliance chain, which is used to perform peer group division in the alliance chain initialized by any method.
  • the group division method of the alliance chain in the embodiment of the present invention includes the following steps:
  • the first organization determines a third certificate from all the certificates in the alliance chain, where the third certificate is a certificate corresponding to the third node belonging to the group; the first organization is that the alliance chain contains the certificates belonging to the group Any organization of the node within the first organization.
  • the first organization generates a group configuration item according to the third certificate, and the group configuration item is used to indicate node information of the third node.
  • the first organization generates a group configuration file of the group according to the group configuration item and the third certificate.
  • the first organization sends the group configuration file to the node in the first organization that belongs to the group.
  • the node in the first organization belonging to the group restarts according to the group configuration file, so that the node in the first organization has a group attribute.
  • the node in the first organization that belongs to the group sends a third heartbeat request to a third node other than the node in the first organization according to the group configuration file, and receives a fourth heartbeat request.
  • the group genesis block of the group is generated.
  • the organization of each node belonging to the group generates a group configuration file based on all the certificates in the group and configures it to the corresponding node Install the package to maintain the equivalence of group division.
  • the first organization generating the group configuration file of the group according to the third certificate and the group configuration item includes:
  • the first organization analyzes the public key information and the certificate fingerprint contained in the third certificate, and generates the group configuration file according to the group configuration item, and the group configuration file contains the group configuration file.
  • the sending, by the node in the first organization belonging to the group, a third heartbeat request to a third node other than the node in the first organization according to the group configuration file includes:
  • the node in the first organization belonging to the group sends the first organization node to a third node other than the node in the first organization according to the group serial number and the network connection address of the third node.
  • Three heartbeat requests are possible.
  • the first organization analyzes the public key information and certificate fingerprint contained in the third certificate to generate the group serial number.
  • the node of the subsequent group When the node of the subsequent group generates the group creation block, it will put the group serial number information Enter the group genesis block.
  • the first organization generates group configuration files such as the group capacity required for blockchain startup and the network connection addresses of nodes in the group. In this way, when a node in the first organization needs to send a heartbeat request to other nodes in the group, it can send a heartbeat request to other nodes in the group according to the group network connection address of the node.
  • Embodiment 1 is the initialization process of the alliance chain.
  • the specific scenario is that the alliance chain includes nodes 11, 12, ... and 19 in total. Nodes belong to 4 organizations from Organization 1 to Organization 4. Among them, node 11 and node 15 are nodes within the organization of organization 1, node 11 belongs to the first group, and node 15 belongs to the second group. Steps of the specific embodiment As shown in Figure 3, it includes:
  • Step 301 Organization 1 generates node certificate 110 of node 11 and node certificate 150 of node 15.
  • Step 302 Organization 1 broadcasts node certificate 110 and node certificate 150, that is, sends node certificates of node 11 and node 15 to organization 2, organization 3, and organization 4, and receives node certificates sent by organization 2, organization 3, and organization 4. .
  • Step 303 Institution 1 verifies the received node certificate. If the verification is passed, step 304 is executed, otherwise, step 311 is executed.
  • Step 304 Institution 1 generates a configuration file of the alliance chain according to the node certificate 110 to the node certificate 190.
  • Step 305 The organization 1 sends the configuration file to the node 11 and the node 15, and sends the node certificate 110 and the corresponding private key to the node 11, and sends the node certificate 150 and the corresponding private key to the node 15.
  • Step 306 The node 11 uses the received private key to verify the node certificate 110, if the verification is passed, step 307 is executed, otherwise, step 311 is executed.
  • Step 307 Node 11 starts.
  • Step 308 The node 11 sends the first heartbeat request to the node 12 to the node 19 according to the configuration file, and receives the second heartbeat request.
  • Step 309 The node 11 judges the number of received second heartbeat requests, and if it is greater than the threshold value 5, then executes step 310; otherwise, executes step 309.
  • Step 310 The node 11 conducts a consensus.
  • Step 311 The initialization of the alliance chain fails.
  • the second embodiment is the group division process of the alliance chain, and the scenario in the first embodiment is still used.
  • the steps of the specific embodiment are shown in Figure 4, including:
  • Step 401 Institution 1 determines from node certificate 110 to node certificate 190, node 11 to node 14 are the first group, and node 15 to node 19 are the second group.
  • Step 402 Institution 1 generates a group configuration item of the first group according to the node certificate 110 to the node certificate 140, and further generates a group configuration file of the first group.
  • Step 403 Organization 1 sends the group configuration file of the first group to node 11.
  • Step 404 The node 11 uses the private key to verify the group configuration file. If the verification is passed, step 405 is executed, otherwise, step 401 is executed.
  • Step 405 The node 11 restarts according to the group configuration file of the first group.
  • Step 406 Node 11 sends a third heartbeat request to node 12, node 13, and node 14, and receives a fourth heartbeat request.
  • Step 407 The node 11 determines whether the number of fourth heartbeat requests is greater than 2, if yes, execute step 408, otherwise, execute step 407.
  • Step 408 Node 11 conducts a consensus.
  • the embodiment of the present invention also provides a block chain construction device, as shown in FIG. 5, including:
  • the generating unit 501 is configured to generate a first certificate of a node in a first organization; the node in the first organization is any node in the node to which the first organization belongs, and the first organization is any node in the alliance chain mechanism;
  • the organization transceiving unit 502 is configured to broadcast the first certificate to a second organization and receive a second certificate of a node in the second organization.
  • the second organization is an organization other than the first organization in the alliance chain mechanism;
  • the configuration unit 503 is configured to verify the second certificate, and after the verification passes, generate a configuration file of the alliance chain according to the first certificate and the second certificate;
  • the institution transceiver unit 502 is further configured to send the first certificate, the first private key of the node in the first institution, and the configuration file to the node in the first institution, so that the first The node within the organization is activated.
  • the activation unit 504 is configured to verify the first certificate by using the first private key, and activate it after passing the verification;
  • the node transceiver unit 505 is configured to send a first heartbeat request to the node in the second organization according to the configuration file, and receive a second heartbeat request from the node in the second organization;
  • the consensus unit 506 is configured to generate the genesis block of the alliance chain after determining that the number of received second heartbeat requests is greater than a first threshold.
  • a determining unit 507 configured to determine a third certificate from the first certificate and the N second certificates, where the third certificate is a certificate corresponding to a third node belonging to the group, and the first certificate
  • An organization includes nodes in the first organization that belong to the group;
  • the configuration unit 503 is further configured to generate a group configuration item according to the third certificate, and the group configuration item is used to indicate node information of the third node;
  • the configuration unit 503 is further configured to generate a group configuration file of the group according to the third certificate and the group configuration item;
  • the institution transceiver unit 502 is further configured to send the group configuration file to the node in the first institution belonging to the group;
  • the starting unit 504 is further configured to restart according to the group configuration file, so that the nodes in the first organization have group attributes.
  • the node transceiver unit 505 is further configured to send a third heartbeat request to a third node other than the node in the first organization according to the group configuration file, and receive a fourth heartbeat request;
  • the consensus unit 506 is further configured to generate a group genesis block of the group after determining that the number of received fourth heartbeat requests is greater than a second threshold.
  • the embodiment of the present invention also provides a block chain group division device, as shown in FIG. 6, including:
  • the determining unit 601 is configured to determine a third certificate from all certificates in the consortium chain, where the third certificate is a certificate corresponding to a third node belonging to the group; the first organization to which the determining unit belongs is in the consortium chain Contains any organization belonging to the node within the first organization of the group;
  • a generating unit 602 configured to generate a group configuration item according to the third certificate, where the group configuration item is used to indicate node information of the third node;
  • the generating unit 602 is further configured to generate a group configuration file of the group according to the group configuration item and the third certificate;
  • the organization transceiving unit 603 is configured to send the group configuration file to the node in the first organization belonging to the group, so that the node in the first organization belonging to the group is based on the group
  • the configuration file is restarted, so that the nodes in the first organization have group attributes.
  • the node transceiver unit 604 is configured to send a third heartbeat request to a third node other than the node in the first organization according to the group configuration file, and receive a fourth heartbeat request;
  • the consensus unit 605 is configured to generate a group genesis block of the group after determining that the number of received fourth heartbeat requests is greater than a second threshold.
  • the present invention also provides an electronic device, as shown in FIG. 7, including:
  • It includes a processor 701, a memory 702, a transceiver 703, and a bus interface 704, wherein the processor 701, the memory 702 and the transceiver 703 are connected through the bus interface 704;
  • the processor 701 is configured to read a program in the memory 702 and execute the following methods:
  • the first organization generates the first certificate of the node in the first organization;
  • the first organization is any organization in the alliance chain, and the node in the first organization is any node in the nodes to which the first organization belongs;
  • the first organization broadcasts the first certificate to a second organization, and receives a second certificate of a node in the second organization, where the second organization is an organization other than the first organization in the alliance chain;
  • the first institution verifies the second certificate, and after the verification is passed, generates a configuration file of the alliance chain according to the first certificate and the second certificate;
  • the first organization sends the first certificate, the first private key of the node within the first organization, and the configuration file to the node within the first organization, so as to activate the node within the first organization.
  • the present invention also provides a non-transitory computer-readable storage medium, the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to make the computer execute FIGS. 2 to 4 Any of the methods described in.
  • These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing equipment to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction device.
  • the device implements the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.
  • These computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operation steps are executed on the computer or other programmable equipment to produce computer-implemented processing, so as to execute on the computer or other programmable equipment.
  • the instructions provide steps for implementing functions specified in a flow or multiple flows in the flowchart and/or a block or multiple blocks in the block diagram.
  • These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing equipment to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction device.
  • the device implements the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.
  • These computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operation steps are executed on the computer or other programmable equipment to produce computer-implemented processing, so as to execute on the computer or other programmable equipment.
  • the instructions provide steps for implementing functions specified in a flow or multiple flows in the flowchart and/or a block or multiple blocks in the block diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明实施例涉及金融科技(Fintech)技术领域，尤其涉及一种区块链(Block chain)的构建及群组划分方法与装置，用以解决联盟链中各机构不对等、安全性低的问题。其中方法包括：第一机构生成第一机构内节点的第一证书；第一机构为联盟链中的任一机构，第一机构内节点为第一机构所属节点中的任一节点；第一机构将第一证书向第二机构广播，并接收第二机构内节点的第二证书，第二机构为联盟链中除第一机构外的机构；第一机构验证第二证书，并在验证通过后，根据第一证书以及第二证书生成联盟链的配置文件；第一机构将第一证书、第一机构内节点的第一私钥以及配置文件发送至第一机构内节点，以使第一机构内节点启动。

Description

一种区块链的构建及群组划分方法与装置
相关申请的交叉引用
本申请要求在2019年03月05日提交中国专利局、申请号为201910165256.0、申请名称为“一种区块链的构建及群组划分方法与装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及金融科技(Fintech)技术领域，尤其涉及一种区块链的构建及群组划分方法与装置。
背景技术
区块链(Block chain)技术是金融科技领域中一种全新的分布式基础架构与计算方式。在区块链技术中，根据区块链网络访问控制权限的不同，区块链可以分为公有链，私有链和联盟链。其中，公有链的节点是任何人都可以参与的，任何人都可以访问的一种区块链结构；私有链是仅仅对单独的个体开放(如公司，学校内部)的区块链结构；联盟链则是目前应用非常广泛的，非常普遍的一种区块链结构。在这种结构中，区块链由特定的某些组织维护，对某些个体开放，并且可以引入监管节点(比如银行监管机构、证券监管机构、央行等)，让区块链在不可篡改的同时满足相应的监管需求。
目前，在联盟链初始化时无法满足联盟链的多个机构间地位对等的诉求。具体来说，联盟链在初始化时，各方需要协商创世区块中包含的节点信息。现有做法为其中一个机构生成自己的节点信息，启动区块链，再加入其它机构的节点，此时，该机构为加入的其它机构生成证书和私钥再发送给其它机构；或是由权威第三方机构直接生成所有机构内的节点信息，并将安装包发送给各机构。上述方法中，生成节点安装包的机构会拥有其它节点的所有信息，节点私钥的安全性低，不满足联盟链中各机构对等，安全的要求。
发明内容
本申请提供一种区块链的构建及群组划分方法与装置，用以解决联盟链中各机构不对等，安全性低的问题。
本发明实施例提供的一种区块链的构建及群组划分方法，包括：
第一机构生成第一机构内节点的第一证书；所述第一机构为联盟链中的任一机构，所述第一机构内节点为所述第一机构所属节点中的任一节点；
所述第一机构将所述第一证书向第二机构广播，并接收第二机构内节点的第二证书，所述第二机构为所述联盟链中除所述第一机构外的机构；
所述第一机构验证所述第二证书，并在验证通过后，根据所述第一证书以及所述第二证书生成联盟链的配置文件；
所述第一机构将所述第一证书、所述第一机构内节点的第一私钥以及所述配置文件发送至所述第一机构内节点，以使所述第一机构内节点启动。
一种可选的实施例中，所述第一机构将所述第一证书、所述第一机构内节点的第一私钥以及所述配置文件发送至所述第一机构内节点之后，还包括：
所述第一机构内节点利用所述第一私钥对所述第一证书进行验证，验证通过后所述第一机构内节点启动；
所述第一机构内节点启动后，还包括：
所述第一机构内节点根据所述配置文件向所述第二机构内节点发送第一心跳请求，并接收所述第二机构内节点的第二心跳请求；
所述第一机构内节点确定接收到的所述第二心跳请求的数量大于第一阈值后，生成所述联盟链的创世区块。
一种可选的实施例中，所述第一机构内节点确定接收到的所述第二心跳请求的数量大于阈值后，生成所述联盟链的创世区块之后，还包括：
所述第一机构从所述第一证书以及N个第二证书中确定第三证书，所述第三证书为属于群组的第三节点对应的证书，所述第一机构中包含属于所述群组的第一机构内节点；
所述第一机构根据所述第三证书生成群组配置项，所述群组配置项用于 指示所述第三节点的节点信息；
所述第一机构根据所述第三证书以及所述群组配置项，生成所述群组的群组配置文件；
所述第一机构将所述群组配置文件发送至所述属于所述群组的第一机构内节点；
所述属于所述群组的第一机构内节点根据所述群组配置文件进行重启，以使所述第一机构内节点具有群组属性。
一种可选的实施例中，所述属于所述群组的第一机构内节点根据所述群组配置文件进行重启之后，还包括：
所述属于所述群组的第一机构内节点根据所述群组配置文件，向除所述第一机构内节点之外的第三节点发送第三心跳请求，并接收第四心跳请求；
所述属于所述群组的第一机构内节点确定接收到的所述第四心跳请求的数量大于第二阈值后，生成所述群组的群组创世区块。
一种可选的实施例中，所述第一机构根据所述第一证书以及所述第二证书生成联盟链的配置文件，包括：
所述第一机构分析所述第一证书以及所述第二证书中包含的公钥信息和证书指纹，生成所述配置文件，所述配置文件中包含N个第二节点的网络连接地址；
所述第一机构内节点根据所述配置文件向N个第二节点发送第一心跳请求，包括：
所述第一机构内节点根据所述N个第二节点的网络连接地址，向所述N个第二节点发送所述第一心跳请求。
本发明实施例还提供一种区块链的群组划分方法，包括：
第一机构从联盟链的所有证书中确定第三证书，所述第三证书为属于群组的第三节点对应的证书；所述第一机构为所述联盟链中包含属于所述群组的第一机构内节点的任一机构；
所述第一机构根据所述第三证书生成群组配置项，所述群组配置项用于 指示所述第三节点的节点信息；
所述第一机构根据所述群组配置项以及所述第三证书，生成所述群组的群组配置文件；
所述第一机构将所述群组配置文件发送至所述属于所述群组的第一机构内节点，以使所述属于所述群组的第一机构内节点根据所述群组配置文件进行重启，从而所述第一机构内节点具有群组属性。
一种可选的实施例中，所述属于所述群组的第一机构内节点根据所述群组配置文件进行重启之后，还包括：
所述属于所述群组的第一机构内节点根据所述群组配置文件向除所述第一机构内节点之外的第三节点发送第三心跳请求，并接收第四心跳请求；
所述属于所述群组的第一机构内节点确定接收到的所述第四心跳请求的数量大于第二阈值后，生成所述群组的群组创世区块。
一种可选的实施例中，所述第一机构根据所述第三证书以及所述群组配置项，生成所述群组的群组配置文件，包括：
所述第一机构分析所述第三证书中包含的公钥信息和证书指纹，根据所述群组配置项，生成所述群组配置文件，所述群组配置文件中包含所述群组的群组序列号，以及所述第三节点的网络连接地址；
所述属于所述群组的第一机构内节点根据所述群组配置文件向除所述第一机构内节点之外的第三节点发送第三心跳请求，包括：
所述属于所述群组的第一机构内节点根据所述群组序列号以及所述第三节点的网络连接地址，向除所述第一机构内节点之外的第三节点发送所述第三心跳请求。
本发明实施例还提供一种区块链的构建装置，包括：
生成单元，用于生成第一机构内节点的第一证书；所述第一机构内节点为第一机构所属节点中的任一节点，所述第一机构为所述联盟链中的任一机构；
机构收发单元，用于将所述第一证书向第二机构广播，并接收第二机构 内节点的第二证书，所述第二机构为所述联盟链中除所述第一机构外的机构；
配置单元，用于验证所述第二证书，并在验证通过后，根据所述第一证书以及所述第二证书生成联盟链的配置文件；
所述机构收发单元，还用于将所述第一证书、所述第一机构内节点的第一私钥以及所述配置文件发送至所述第一机构内节点，以使所述第一机构内节点启动。
一种可选的实施例中，还包括：
启动单元，用于利用所述第一私钥对所述第一证书进行验证，验证通过后启动；
节点收发单元，用于根据所述配置文件向所述第二机构内节点发送第一心跳请求，并接收所述第二机构内节点的第二心跳请求；
共识单元，用于确定接收到的所述第二心跳请求的数量大于第一阈值后，生成所述联盟链的创世区块。
一种可选的实施例中，还包括确定单元，用于从所述第一证书以及N个第二证书中确定第三证书，所述第三证书为属于群组的第三节点对应的证书，所述第一机构中包含属于所述群组的第一机构内节点；
所述配置单元，还用于根据所述第三证书生成群组配置项，所述群组配置项用于指示所述第三节点的节点信息；
所述配置单元，还用于根据所述第三证书以及所述群组配置项，生成所述群组的群组配置文件；
所述机构收发单元，还用于将所述群组配置文件发送至所述属于所述群组的第一机构内节点；
所述启动单元，还用于根据所述群组配置文件进行重启，以使所述第一机构内节点具有群组属性。
一种可选的实施例中，所述节点收发单元，还用于根据所述群组配置文件，向除所述第一机构内节点之外的第三节点发送第三心跳请求，并接收第四心跳请求；
所述共识单元，还用于确定接收到的所述第四心跳请求的数量大于第二阈值后，生成所述群组的群组创世区块。
本发明实施例还提供一种区块链的群组划分装置，包括：
确定单元，用于从联盟链的所有证书中确定第三证书，所述第三证书为属于群组的第三节点对应的证书；所述确定单元所属的第一机构为所述联盟链中包含属于所述群组的第一机构内节点的任一机构；
生成单元，用于根据所述第三证书生成群组配置项，所述群组配置项用于指示所述第三节点的节点信息；
所述生成单元，还用于根据所述群组配置项以及所述第三证书，生成所述群组的群组配置文件；
机构收发单元，用于将所述群组配置文件发送至所述属于所述群组的第一机构内节点，以使所述属于所述群组的第一机构内节点根据所述群组配置文件进行重启，从而所述第一机构内节点具有群组属性。
一种可选的实施例中，还包括：
节点收发单元，用于根据所述群组配置文件向除所述第一机构内节点之外的第三节点发送第三心跳请求，并接收第四心跳请求；
共识单元，用于确定接收到的所述第四心跳请求的数量大于第二阈值后，生成所述群组的群组创世区块。
本发明实施例还提供一种电子设备，包括：
至少一个处理器；以及，
与所述至少一个处理器通信连接的存储器；其中，
所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器能够执行如上所述的方法。
本发明实施例还提供一种非暂态计算机可读存储介质，所述非暂态计算机可读存储介质存储计算机指令，所述计算机指令用于使所述计算机执行如上所述的方法。
本发明实施例中，第一机构生成第一机构内节点的第一证书，第一机构 将生成的第一证书向第二机构广播，并接收第二机构内节点的第二证书，其中，第一机构为联盟链中的任一机构，第一机构内节点为第一机构所属节点中的任一节点，第二机构为联盟链中除第一机构外的机构。第一机构验证接收到的第二证书，并在验证通过后，根据第一证书以及第二证书生成联盟链的配置文件，并将第一证书、第一机构内节点的第一私钥以及配置文件发送至第一机构内节点，以使第一机构内节点启动。本发明实施例中，机构间只需广播证书，节点的私钥由机构自己生成和维护，保证了机构内节点的私钥不出机构内网，确保了机构间节点的安全性。同时，联盟链的机构各自生成对应节点的证书和私钥，而不是由一个机构生成其余机构的证书和私钥，保证了机构间的对等关系。
附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简要介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域的普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1为本发明实施例提供的一种可能的***构架的结构示意图；
图2为本发明实施例提供的一种区块链的构建方法的流程示意图；
图3为本发明具体实施例一提供的一种联盟链构建方法的流程示意图；
图4为本发明具体实施例二提供的一种联盟链的群组划分方法的流程示意图；
图5为本发明实施例提供的一种区块链的构建装置的结构示意图；
图6为本发明实施例提供的一种区块链的群组划分装置的结构示意图；
图7为本发明实施例提供的电子设备的结构示意图。
具体实施方式
为了使本发明的目的、技术方案和优点更加清楚，下面将结合附图对本 发明作进一步地详细描述，显然，所描述的实施例仅仅是本发明一部份实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其它实施例，都属于本发明保护的范围。
区块链是由一系列区块组成的一条链，每个块上除了记录本块的数据还会记录上一块的哈希值，通过这种方式组成一条链。区块链的核心理念有两个，一个是密码学技术，另一个是去中心化思想，基于这两个理念做到区块链上的历史信息无法被篡改。然而在联盟链中，为单个机构生成所有机构内节点信息，无法满足去中心化思想的需求。
为了解决上述问题，本发明实施例提供了一种区块链的构建方法。该方法所适用的一种可能的***构架，如图1所示，包括机构和节点。
其中，机构为通过联盟链委员会准入的主体，拥有机构证书agency.crt和机构私钥agency.key。机构可以生成机构内节点。机构可以签发所属节点的节点证书node.crt并生成节点私钥node.key。证书即数字证书，是互联网通讯中标志通讯各方身份信息的一串数字，提供了一种在互联网上验证通信实体身份的方式，数字证书不是数字身份证，而是身份认证机构盖在数字身份证上的一个章或印(或者说加在数字身份证上的一个签名)。它是由权威机构——证书授权(Certificate Authority，CA)机构中心发行的，人们可以在网上用它来识别对方的身份。
在区块链对等网络中，节点参与网络组建和数据交换。一个节点是指一个具有唯一身份的参与者，该节点具有一份完整的账本拷贝，具有参与区块链对等网络共识和账本维护的能力。本发明实施例中，机构内节点即为联盟链中运行的节点，属于对应的机构，节点可能会处于一个或多个群组中。节点拥有节点证书node.crt和节点私钥node.key。机构内节点会与所属群组的其他节点进行网络链接，并维护该群组。群组间数据隔离，每个群组独立运行各自的共识算法，不同群组可使用不同的共识算法。
本发明实施例支持多群组架构，群组间共享网络，通过网络准入模块实 现各账本间网络消息隔离。所有机构协商完成联盟链根证书，所有机构拥有各自对应机构内节点的节点证书node.crt和节点私钥node.key。机构间地位对等，机构内节点只与所属群组的其他节点通信。机构间节点可以互相协商证书并新建群组。一个机构可以对应一个机构内节点，也可以对应多个机构内节点；同一个机构对应的机构内节点，可以属于同一个群组，也可以属于不同群组。
基于上述架构，本发明实施例提供了一种区块链的构建方法，如图2所示，本发明实施例提供的区块链的构建方法，包括以下步骤：
步骤201、第一机构生成第一机构内节点的第一证书；第一机构为联盟链中的任一机构，第一机构内节点为第一机构所属节点中的任一节点。
步骤202、第一机构将第一证书向第二机构广播，并接收第二机构内节点的第二证书，第二机构为联盟链中除第一机构外的机构。
步骤203、第一机构验证第二证书，并在验证通过后，根据第一证书以及第二证书生成联盟链的配置文件。
步骤204、第一机构将第一证书、第一机构内节点的第一私钥以及配置文件发送至第一机构内节点，以使第一机构内节点启动。
本发明实施例中，第一机构生成第一机构内节点的第一证书，第一机构将生成的第一证书向第二机构广播，并接收第二机构内节点的第二证书，其中，第一机构为联盟链中的任一机构，第一机构内节点为第一机构所属节点中的任一节点，第二机构为联盟链中除第一机构外的机构。第一机构验证接收到的第二证书，并在验证通过后，根据第一证书以及第二证书生成联盟链的配置文件，并将第一证书、第一机构内节点的第一私钥以及配置文件发送至第一机构内节点，以使第一机构内节点启动。本发明实施例中，机构间只需广播证书，节点的私钥由机构自己生成和维护，保证了机构内节点的私钥不出机构内网，确保了机构间节点的安全性。同时，联盟链的机构各自生成对应节点的证书和私钥，而不是由一个机构生成其余机构的证书和私钥，保证了机构间的对等关系。
具体来说，本发明实施例的联盟链中，各个机构分别为自身对应的机构内节点生成节点证书，多个机构之间采用对等协商的方法广播节点证书，并进行证书验证。机构可以根据所有节点的证书，生成联盟链节点启动时的配置文件，而节点私钥则存储在机构本地，不发送至其它机构，从而不会泄露节点私钥，保证了私钥的安全性。由于生成的配置文件不包含节点私钥，即使生成的配置文件泄露，非本机构也无法使用这些配置文件。
节点证书既可以由第一机构主动发送至联盟链中的其余机构，即第二机构；也可以由第二机构从第一机构中获取。各个机构收到其余机构广播的节点证书后，对证书的颁发者、使用者、有效期、密钥用法、证书中包含的公钥等信息进行验证，从而判断节点证书是否合法。若节点证书均合法，则节点证书协商成功，继续执行后续流程；若存在不合法的节点证书，则节点证书协商失败。
在节点证书协商成功后，联盟链中的每个机构生成对应机构内节点的配置文件，并将每个机构内节点的配置文件，连同该机构内节点的证书和私钥，发送给机构内节点，以使机构内节点启动。
相应地，所述第一机构将所述第一证书、所述第一机构内节点的第一私钥以及所述配置文件发送至所述第一机构内节点之后，还包括：
所述第一机构内节点利用所述第一私钥对所述第一证书进行验证，验证通过后所述第一机构内节点启动；
所述第一机构内节点启动后，还包括：
所述第一机构内节点根据所述配置文件向所述第二机构内节点发送第一心跳请求，并接收所述第二机构内节点的第二心跳请求；
所述第一机构内节点确定接收到的所述第二心跳请求的数量大于第一阈值后，生成所述联盟链的创世区块。
具体实施过程中，各机构将节点私钥配置至对应机构内节点的安装包，启动节点。目前支持两种配置方式，分别为keycenter类型的私钥加密方式和直接加载私钥至节点文件夹的方式。第一机构内节点接收到机构发送来的第 一证书、第一私钥和配置文件之后，可以利用第一私钥对第一证书进行验证，判断第一私钥与第一证书是否匹配，验证通过后第一机构内节点启动，否则，则结束联盟链的初始化过程。第一机构内节点启动后，根据接收到的配置文件，向联盟链中的其余节点，即第二机构内节点，发送第一心跳请求。第一机构内节点只有收集到足够数量的其他节点的心跳请求才会进行共识，即共同创建区块链。这样，保证了区块链创建的成功率。共识算法为区块链对等网络中的各个节点通过一种算法对一批交易进行确认，并确保所有节点对这批数据具有一致的确认结果，这种算法就是区块链的共识算法。
举例来说，若协商的节点证书的数量为n个，则说明机构内节点的数量为n个，且已经完成证书协商、节点部署等操作。联盟链中各节点启动后，根据联盟链的配置文件与联盟链中其余的节点进行连接。不同共识方法中的第一阈值不同。如PBFT(Practical Byzantine Fault Tolerance，实用拜占庭容错算法)方式中机构内节点只有收集到数量大于2n/3(向上取整)的心跳请求后，才能生成联盟链的创世区块，进一步完成共识。RAFT(一种分布式一致性算法)方式中只有收集到数量大于n/2(向上取整)的心跳请求后，联盟链群组才能进行共识，完成部署。为了保证联盟链的共识效率，PBFT中节点证书的数量n不建议超过40，RAFT中节点证书的数量n不建议超过100。
进一步地，所述第一机构根据所述第一证书以及所述第二证书生成联盟链的配置文件，包括：
所述第一机构分析所述第一证书以及所述第二证书中包含的公钥信息和证书指纹，生成所述配置文件，所述配置文件中包含N个第二节点的网络连接地址。
所述第一机构内节点根据所述配置文件向所述N个第二节点发送第一心跳请求，包括：
所述第一机构内节点根据所述N个第二节点的网络连接地址，向所述N个第二节点发送所述第一心跳请求。
具体实施过程中，第一机构根据联盟链中所有的节点证书生成配置文件。 具体为分析证书中包含的公钥信息和证书指纹，生成联盟链的序列号，后续节点生成创世区块时，会将序列号信息放入创世区块中。同时，第一机构生成区块链启动所需的群组容量与网络连接地址等配置文件。这样，第一机构内节点需要发送第一心跳请求时，可以根据每个第二节点的网络连接地址，向第二节点发送第一心跳请求。
联盟链初始化完成后，机构间需要根据不同业务划分不同群组。每个群组中含有多个节点，同一个机构所属的节点可以分属于不同的群组，也可以属于同一个群组。
所述第一机构内节点确定接收到的所述第二心跳请求的数量大于阈值后，生成所述联盟链的创世区块之后，还包括：
所述第一机构从所述第一证书以及所述N个第二证书中确定第三证书，所述第三证书为属于群组的第三节点对应的证书，所述第一机构中包含属于所述群组的第一机构内节点；
所述第一机构根据所述第三证书生成群组配置项，所述群组配置项用于指示所述第三节点的节点信息；
所述第一机构根据所述第三证书以及所述群组配置项，生成所述群组的群组配置文件；
所述第一机构将所述群组配置文件发送至所述属于所述群组的第一机构内节点；
所述属于所述群组的第一机构内节点根据所述群组配置文件进行重启，以使所述第一机构内节点具有群组属性。
具体来说，联盟链初始化后划分群组，由于各机构已获得联盟链中的所有节点证书，因此，无需再次执行获取节点证书和验证的过程，由于第一机构中包含属于所述群组的第一机构内节点，第一机构可以直接从所有节点证书中确定出属于群组的第三节点对应的第三证书。根据第三证书生成群组配置项。群组配置项中可以包含群组中每个节点的证书、节点的IP、端口号等数据，可以指示群组中的第三节点具体为哪些节点。第一机构根据群组配置 项以及该群组中的节点证书，分析证书包含的公钥信息和证书指纹，生成该群组启动时的群组序列号。后续节点生成群组创世区块时，会将群组序列号信息放入群组创世区块中。同时，第一机构生成划分群组时所需的群组容量与群组内节点的网络连接地址等配置文件。各机构生成群组配置文件后，将群组配置文件发送至属于该群组的机构内节点中，将群组配置文件导入节点安装包后，重启节点。这样，属于该群组的机构内节点根据群组配置文件进行重启后，会具有群组属性。
与联盟链初始化时类似，所述属于所述群组的第一机构内节点根据所述群组配置文件进行重启之后，还包括：
所述属于所述群组的第一机构内节点根据所述群组配置文件，向除所述第一机构内节点之外的第三节点发送第三心跳请求，并接收第四心跳请求；
所述属于所述群组的第一机构内节点确定接收到的所述第四心跳请求的数量大于第二阈值后，生成所述群组的群组创世区块。
也就是说，第一机构内节点只有收集到群组内足够数量的其他节点的心跳请求才会进行共识，即创建群组创世区块。这样，保证了群组划分的成功率。
进一步，本发明实施例中，节点还具有检测功能。具体为节点启动时，会生成对应的节点证书，节点配置项中包含节点IP、端口号、节点所属群组等信息，确保生成节点可用。
进一步，本发明实施例还设计有监控功能。可以配置相应的监控服务，如默认配置将监控结果上报至使用者微信。本发明实施例可以通过机构向机构内节点发起RPC(Remote Procedure Call，远程过程调用)请求，得到机构内节点运行时的相关参数，同时通过分析机构内节点运行时的log信息，对机构内节点进行监控，并将监控结果上报至用户配置的服务中。例如，默认配置监控服务，支持上报至微信、个人网址，支持专用服务设置，可上报至企业微信等。
此外，本发明实施例还提供一种联盟链的群组划分方法，用于无论利用 任何方式初始化的联盟链中，进行对等的群组划分。本发明实施例中联盟链的群组划分方法包括以下步骤：
第一机构从联盟链的所有证书中确定第三证书，所述第三证书为属于群组的第三节点对应的证书；所述第一机构为所述联盟链中包含属于所述群组的第一机构内节点的任一机构。
所述第一机构根据所述第三证书生成群组配置项，所述群组配置项用于指示所述第三节点的节点信息。
所述第一机构根据所述群组配置项以及所述第三证书，生成所述群组的群组配置文件。
所述第一机构将所述群组配置文件发送至所述属于所述群组的第一机构内节点。
所述属于所述群组的第一机构内节点根据所述群组配置文件进行重启，以使所述第一机构内节点具有群组属性。
所述属于所述群组的第一机构内节点根据所述群组配置文件向除所述第一机构内节点之外的第三节点发送第三心跳请求，并接收第四心跳请求。
所述属于所述群组的第一机构内节点确定接收到的所述第四心跳请求的数量大于第二阈值后，生成所述群组的群组创世区块。
本发明实施例中，无论联盟链的初始化方式如何，对于节点的群组划分，每个属于群组的节点所属机构均根据群组内的所有证书生成群组配置文件，并配置至对应的节点安装包，从而维护了群组划分的对等性。同时，无需在机构间传输节点私钥，保证了私钥的安全性。
进一步地，所述第一机构根据所述第三证书以及所述群组配置项，生成所述群组的群组配置文件，包括：
所述第一机构分析所述第三证书中包含的公钥信息和证书指纹，根据所述群组配置项，生成所述群组配置文件，所述群组配置文件中包含所述群组的群组序列号，以及所述第三节点的网络连接地址；
所述属于所述群组的第一机构内节点根据所述群组配置文件向除所述第 一机构内节点之外的第三节点发送第三心跳请求，包括：
所述属于所述群组的第一机构内节点根据所述群组序列号以及所述第三节点的网络连接地址，向除所述第一机构内节点之外的第三节点发送所述第三心跳请求。
具体实施过程中，第一机构分析第三证书中包含的公钥信息和证书指纹，生成群组序列号，后续群组的节点生成群组创世区块时，会将群组序列号信息放入群组创世区块中。同时，第一机构生成区块链启动所需的群组容量与群组内节点的网络连接地址等群组配置文件。这样，第一机构内节点需要向群组内其它节点发送心跳请求时，可以根据节点的群组网络连接地址，向群组内其它节点发送心跳请求。
为了更清楚地理解本发明，下面以具体实施例对上述流程进行详细描述，实施例一为联盟链的初始化过程，具体场景为，联盟链中包含节点11、节点12、……节点19共9个节点，属于机构1至机构4共4个机构，其中，节点11与节点15为机构1的机构内节点，节点11属于第一群组，节点15属于第二群组，具体实施例的步骤如图3所示，包括：
步骤301：机构1生成节点11的节点证书110和节点15的节点证书150。
步骤302：机构1将节点证书110和节点证书150进行广播，即向机构2、机构3、机构4发送节点11与节点15的节点证书，并接收机构2、机构3、机构4发送的节点证书。
步骤303：机构1对接收到的节点证书进行验证，若验证通过，则执行步骤304，否则执行步骤311。
步骤304：机构1根据节点证书110至节点证书190，生成联盟链的配置文件。
步骤305：机构1将配置文件发送至节点11与节点15，并将节点证书110与对应的私钥发送至节点11，将节点证书150与对应的私钥发送至节点15。
步骤306：节点11利用接收到的私钥对节点证书110进行验证，若验证通过，则执行步骤307，否则执行步骤311。
步骤307：节点11启动。
步骤308：节点11根据配置文件，向节点12至节点19发送第一心跳请求，并接收第二心跳请求。
步骤309：节点11判断接收到的第二心跳请求的数量，若大于阈值5，则执行步骤310，否则执行步骤309。
步骤310：节点11进行共识。
步骤311：联盟链初始化失败。
具体实施例二为联盟链的群组划分过程，仍沿用实施例一中的场景，具体实施例的步骤如图4所示，包括：
步骤401：机构1从节点证书110至节点证书190中确定，节点11至节点14为第一群组，节点15至节点19为第二群组。
步骤402：机构1根据节点证书110至节点证书140，生成第一群组的群组配置项，进一步生成第一群组的群组配置文件。
步骤403：机构1将第一群组的群组配置文件向节点11发送。
步骤404：节点11利用私钥对群组配置文件进行验证，若验证通过，则执行步骤405，否则执行步骤401。
步骤405：节点11根据第一群组的群组配置文件进行重启。
步骤406：节点11向节点12、节点13和节点14发送第三心跳请求，并接收第四心跳请求。
步骤407：节点11确定第四心跳请求的数量是否大于2，若是，则执行步骤408，否则执行步骤407。
步骤408：节点11进行共识。
本发明实施例还提供了一种区块链的构建装置，如图5所示，包括：
生成单元501，用于生成第一机构内节点的第一证书；所述第一机构内节点为第一机构所属节点中的任一节点，所述第一机构为所述联盟链中的任一机构；
机构收发单元502，用于将所述第一证书向第二机构广播，并接收第二机 构内节点的第二证书，所述第二机构为所述联盟链中除所述第一机构外的机构；
配置单元503，用于验证所述第二证书，并在验证通过后，根据所述第一证书以及所述第二证书生成联盟链的配置文件；
所述机构收发单元502，还用于将所述第一证书、所述第一机构内节点的第一私钥以及所述配置文件发送至所述第一机构内节点，以使所述第一机构内节点启动。
进一步，还包括：
启动单元504，用于利用所述第一私钥对所述第一证书进行验证，验证通过后启动；
节点收发单元505，用于根据所述配置文件向所述第二机构内节点发送第一心跳请求，并接收所述第二机构内节点的第二心跳请求；
共识单元506，用于确定接收到的所述第二心跳请求的数量大于第一阈值后，生成所述联盟链的创世区块。
进一步，还包括确定单元507，用于从所述第一证书以及所述N个第二证书中确定第三证书，所述第三证书为属于群组的第三节点对应的证书，所述第一机构中包含属于所述群组的第一机构内节点；
所述配置单元503，还用于根据所述第三证书生成群组配置项，所述群组配置项用于指示所述第三节点的节点信息；
所述配置单元503，还用于根据所述第三证书以及所述群组配置项，生成所述群组的群组配置文件；
所述机构收发单元502，还用于将所述群组配置文件发送至所述属于所述群组的第一机构内节点；
所述启动单元504，还用于根据所述群组配置文件进行重启，以使所述第一机构内节点具有群组属性。
进一步，所述节点收发单元505，还用于根据所述群组配置文件，向除所述第一机构内节点之外的第三节点发送第三心跳请求，并接收第四心跳请求；
所述共识单元506，还用于确定接收到的所述第四心跳请求的数量大于第二阈值后，生成所述群组的群组创世区块。
本发明实施例还提供一种区块链的群组划分装置，如图6所示，包括：
确定单元601，用于从联盟链的所有证书中确定第三证书，所述第三证书为属于群组的第三节点对应的证书；所述确定单元所属的第一机构为所述联盟链中包含属于所述群组的第一机构内节点的任一机构；
生成单元602，用于根据所述第三证书生成群组配置项，所述群组配置项用于指示所述第三节点的节点信息；
所述生成单元602，还用于根据所述群组配置项以及所述第三证书，生成所述群组的群组配置文件；
机构收发单元603，用于将所述群组配置文件发送至所述属于所述群组的第一机构内节点，以使所述属于所述群组的第一机构内节点根据所述群组配置文件进行重启，从而所述第一机构内节点具有群组属性。
进一步，还包括：
节点收发单元604，用于根据所述群组配置文件向除所述第一机构内节点之外的第三节点发送第三心跳请求，并接收第四心跳请求；
共识单元605，用于确定接收到的所述第四心跳请求的数量大于第二阈值后，生成所述群组的群组创世区块。
基于相同的原理，本发明还提供一种电子设备，如图7所示，包括：
包括处理器701、存储器702、收发机703、总线接口704，其中处理器701、存储器702与收发机703之间通过总线接口704连接；
所述处理器701，用于读取所述存储器702中的程序，执行下列方法：
第一机构生成第一机构内节点的第一证书；所述第一机构为联盟链中的任一机构，所述第一机构内节点为所述第一机构所属节点中的任一节点；
所述第一机构将所述第一证书向第二机构广播，并接收第二机构内节点的第二证书，所述第二机构为所述联盟链中除所述第一机构外的机构；
所述第一机构验证所述第二证书，并在验证通过后，根据所述第一证书 以及所述第二证书生成联盟链的配置文件；
所述第一机构将所述第一证书、所述第一机构内节点的第一私钥以及所述配置文件发送至所述第一机构内节点，以使所述第一机构内节点启动。
基于相同的原理，本发明还提供一种非暂态计算机可读存储介质，所述非暂态计算机可读存储介质存储计算机指令，所述计算机指令用于使所述计算机执行图2至图4中任一所述的方法。
本发明是参照根据本发明实施例的方法、设备(***)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
尽管已描述了本发明的优选实施例，但本领域内的技术人员一旦得知了基本创造性概念，则可对这些实施例作出另外的变更和修改。所以，所附权利要求意欲解释为包括优选实施例以及落入本发明范围的所有变更和修改。
显然，本领域的技术人员可以对本发明进行各种改动和变型而不脱离本 发明的精神和范围。这样，倘若本发明的这些修改和变型属于本发明权利要求及其等同技术的范围之内，则本发明也意图包括这些改动和变型在内。
本发明是参照根据本发明实施例的方法、设备(***)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
尽管已描述了本发明的优选实施例，但本领域内的技术人员一旦得知了基本创造性概念，则可对这些实施例作出另外的变更和修改。所以，所附权利要求意欲解释为包括优选实施例以及落入本发明范围的所有变更和修改。
显然，本领域的技术人员可以对本发明进行各种改动和变型而不脱离本发明的精神和范围。这样，倘若本发明的这些修改和变型属于本发明权利要求及其等同技术的范围之内，则本发明也意图包括这些改动和变型在内。

Claims (16)

  1. 一种区块链的构建方法，其特征在于，包括：
    第一机构生成第一机构内节点的第一证书；所述第一机构为联盟链中的任一机构，所述第一机构内节点为所述第一机构所属节点中的任一节点；
    所述第一机构将所述第一证书向第二机构广播，并接收第二机构内节点的第二证书，所述第二机构为所述联盟链中除所述第一机构外的机构；
    所述第一机构验证所述第二证书，并在验证通过后，根据所述第一证书以及所述第二证书生成所述联盟链的配置文件；
    所述第一机构将所述第一证书、所述第一机构内节点的第一私钥以及所述配置文件发送至所述第一机构内节点，以使所述第一机构内节点启动。
  2. 如权利要求1所述的方法，其特征在于，所述第一机构将所述第一证书、所述第一机构内节点的第一私钥以及所述配置文件发送至所述第一机构内节点之后，还包括：
    所述第一机构内节点利用所述第一私钥对所述第一证书进行验证，验证通过后所述第一机构内节点启动；
    所述第一机构内节点启动后，还包括：
    所述第一机构内节点根据所述配置文件向所述第二机构内节点发送第一心跳请求，并接收所述第二机构内节点的第二心跳请求；
    所述第一机构内节点确定接收到的所述第二心跳请求的数量大于第一阈值后，生成所述联盟链的创世区块。
  3. 如权利要求2所述的方法，其特征在于，所述第一机构内节点确定接收到的所述第二心跳请求的数量大于阈值后，生成所述联盟链的创世区块之后，还包括：
    所述第一机构从所述第一证书以及N个第二证书中确定第三证书，所述第三证书为属于群组的第三节点对应的证书，所述第一机构中包含属于所述群组的第一机构内节点；
    所述第一机构根据所述第三证书生成群组配置项，所述群组配置项用于指示所述第三节点的节点信息；
    所述第一机构根据所述第三证书以及所述群组配置项，生成所述群组的群组配置文件；
    所述第一机构将所述群组配置文件发送至所述属于所述群组的第一机构内节点；
    所述属于所述群组的第一机构内节点根据所述群组配置文件进行重启，以使所述第一机构内节点具有群组属性。
  4. 如权利要求3所述的方法，其特征在于，所述属于所述群组的第一机构内节点根据所述群组配置文件进行重启之后，还包括：
    所述属于所述群组的第一机构内节点根据所述群组配置文件，向除所述第一机构内节点之外的第三节点发送第三心跳请求，并接收第四心跳请求；
    所述属于所述群组的第一机构内节点确定接收到的所述第四心跳请求的数量大于第二阈值后，生成所述群组的群组创世区块。
  5. 如权利要求2所述的方法，其特征在于，所述第一机构根据所述第一证书以及所述第二证书生成联盟链的配置文件，包括：
    所述第一机构分析所述第一证书以及所述第二证书中包含的公钥信息和证书指纹，生成所述配置文件，所述配置文件中包含N个第二节点的网络连接地址；
    所述第一机构内节点根据所述配置文件向N个第二节点发送第一心跳请求，包括：
    所述第一机构内节点根据所述N个第二节点的网络连接地址，向所述N个第二节点发送所述第一心跳请求。
  6. 一种区块链的群组划分方法，其特征在于，包括：
    第一机构从联盟链的所有证书中确定第三证书，所述第三证书为属于群组的第三节点对应的证书；所述第一机构为所述联盟链中包含属于所述群组的第一机构内节点的任一机构；
    所述第一机构根据所述第三证书生成群组配置项，所述群组配置项用于指示所述第三节点的节点信息；
    所述第一机构根据所述群组配置项以及所述第三证书，生成所述群组的群组配置文件；
    所述第一机构将所述群组配置文件发送至所述属于所述群组的第一机构内节点，以使所述属于所述群组的第一机构内节点根据所述群组配置文件进行重启，从而所述第一机构内节点具有群组属性。
  7. 如权利要求6所述的方法，其特征在于，所述属于所述群组的第一机构内节点根据所述群组配置文件进行重启之后，还包括：
    所述属于所述群组的第一机构内节点根据所述群组配置文件向除所述第一机构内节点之外的第三节点发送第三心跳请求，并接收第四心跳请求；
    所述属于所述群组的第一机构内节点确定接收到的所述第四心跳请求的数量大于第二阈值后，生成所述群组的群组创世区块。
  8. 如权利要求7所述的方法，其特征在于，所述第一机构根据所述第三证书以及所述群组配置项，生成所述群组的群组配置文件，包括：
    所述第一机构分析所述第三证书中包含的公钥信息和证书指纹，根据所述群组配置项，生成所述群组配置文件，所述群组配置文件中包含所述群组的群组序列号，以及所述第三节点的网络连接地址；
    所述属于所述群组的第一机构内节点根据所述群组配置文件向除所述第一机构内节点之外的第三节点发送第三心跳请求，包括：
    所述属于所述群组的第一机构内节点根据所述群组序列号以及所述第三节点的网络连接地址，向除所述第一机构内节点之外的第三节点发送所述第三心跳请求。
  9. 一种区块链的构建装置，其特征在于，包括：
    生成单元，用于生成第一机构内节点的第一证书；所述第一机构内节点为第一机构所属节点中的任一节点，所述第一机构为所述联盟链中的任一机构；
    机构收发单元，用于将所述第一证书向第二机构广播，并接收第二机构内节点的第二证书，所述第二机构为所述联盟链中除所述第一机构外的机构；
    配置单元，用于验证所述第二证书，并在验证通过后，根据所述第一证书以及所述第二证书生成联盟链的配置文件；
    所述机构收发单元，还用于将所述第一证书、所述第一机构内节点的第一私钥以及所述配置文件发送至所述第一机构内节点，以使所述第一机构内节点启动。
  10. 如权利要求9所述的装置，其特征在于，还包括：
    启动单元，用于利用所述第一私钥对所述第一证书进行验证，验证通过后启动；
    节点收发单元，用于根据所述配置文件向所述第二机构内节点发送第一心跳请求，并接收所述第二机构内节点的第二心跳请求；
    共识单元，用于确定接收到的所述第二心跳请求的数量大于第一阈值后，生成所述联盟链的创世区块。
  11. 如权利要求10所述的装置，其特征在于，
    还包括确定单元，用于从所述第一证书以及N个第二证书中确定第三证书，所述第三证书为属于群组的第三节点对应的证书，所述第一机构中包含属于所述群组的第一机构内节点；
    所述配置单元，还用于根据所述第三证书生成群组配置项，所述群组配置项用于指示所述第三节点的节点信息；
    所述配置单元，还用于根据所述第三证书以及所述群组配置项，生成所述群组的群组配置文件；
    所述机构收发单元，还用于将所述群组配置文件发送至所述属于所述群组的第一机构内节点；
    所述启动单元，还用于根据所述群组配置文件进行重启，以使所述第一机构内节点具有群组属性。
  12. 如权利要求11所述的装置，其特征在于，
    所述节点收发单元，还用于根据所述群组配置文件，向除所述第一机构内节点之外的第三节点发送第三心跳请求，并接收第四心跳请求；
    所述共识单元，还用于确定接收到的所述第四心跳请求的数量大于第二阈值后，生成所述群组的群组创世区块。
  13. 一种区块链的群组划分装置，其特征在于，包括：
    确定单元，用于从联盟链的所有证书中确定第三证书，所述第三证书为属于群组的第三节点对应的证书；所述确定单元所属的第一机构为所述联盟链中包含属于所述群组的第一机构内节点的任一机构；
    生成单元，用于根据所述第三证书生成群组配置项，所述群组配置项用于指示所述第三节点的节点信息；
    所述生成单元，还用于根据所述群组配置项以及所述第三证书，生成所述群组的群组配置文件；
    机构收发单元，用于将所述群组配置文件发送至所述属于所述群组的第一机构内节点，以使所述属于所述群组的第一机构内节点根据所述群组配置文件进行重启，从而所述第一机构内节点具有群组属性。
  14. 如权利要求13所述的装置，其特征在于，还包括：
    节点收发单元，用于根据所述群组配置文件向除所述第一机构内节点之外的第三节点发送第三心跳请求，并接收第四心跳请求；
    共识单元，用于确定接收到的所述第四心跳请求的数量大于第二阈值后，生成所述群组的群组创世区块。
  15. 一种电子设备，其特征在于，包括：
    至少一个处理器；以及，
    与所述至少一个处理器通信连接的存储器；其中，
    所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器能够执行权利要求1-5任一所述的方法。
  16. 一种非暂态计算机可读存储介质，其特征在于，所述非暂态计算机 可读存储介质存储计算机指令，所述计算机指令用于使所述计算机执行权利要求1～5任一所述的方法。
PCT/CN2020/074750 2019-03-05 2020-02-11 一种区块链的构建及群组划分方法与装置 WO2020177508A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910165256.0 2019-03-05
CN201910165256.0A CN110035059B (zh) 2019-03-05 2019-03-05 一种区块链的构建方法与装置

Publications (1)

Publication Number Publication Date
WO2020177508A1 true WO2020177508A1 (zh) 2020-09-10

Family

ID=67235767

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/074750 WO2020177508A1 (zh) 2019-03-05 2020-02-11 一种区块链的构建及群组划分方法与装置

Country Status (2)

Country Link
CN (2) CN113098907B (zh)
WO (1) WO2020177508A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112435024A (zh) * 2020-11-17 2021-03-02 浙江大学 基于群签名和ca多方认证的联盟链跨链隐私保护方法
CN112564895A (zh) * 2020-11-26 2021-03-26 中国船舶工业***工程研究院 基于区块链的无人艇集群可信组网方法、***及存储介质
CN112583858A (zh) * 2021-01-05 2021-03-30 广州华资软件技术有限公司 一种基于区块链pbft算法的统一身份鉴权方法
CN114465714A (zh) * 2021-12-23 2022-05-10 杭州溪塔科技有限公司 联盟链中的节点配置方法及***

Families Citing this family (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113098907B (zh) * 2019-03-05 2023-07-11 深圳前海微众银行股份有限公司 一种区块链的群组划分方法与装置
CN112884562B (zh) * 2019-11-30 2024-03-19 腾讯科技（深圳）有限公司 基于区块链的抵押处理方法、装置及可读存储介质
CN111586102B (zh) * 2020-04-07 2021-05-18 浙商银行股份有限公司 一种基于bft共识的联盟链组网方法
CN112200575B (zh) * 2020-05-28 2022-05-31 支付宝(杭州)信息技术有限公司 在联盟链网络中创建节点组、基于节点组的交易方法
CN111541552B (zh) 2020-07-08 2021-06-22 支付宝(杭州)信息技术有限公司 区块链一体机及其节点自动加入方法、装置
CN112491847B (zh) * 2020-07-08 2022-02-22 支付宝(杭州)信息技术有限公司 区块链一体机及其自动建链方法、装置
CN111541724B (zh) 2020-07-08 2021-06-29 支付宝(杭州)信息技术有限公司 区块链一体机及其节点自动加入方法、装置
CN112419060B (zh) * 2020-11-20 2024-03-22 上海树图区块链研究院 资产托管***、资产管理方法、节点及介质
CN114745189B (zh) * 2022-04-20 2023-10-13 中国工商银行股份有限公司 一种用于集群通信的方法及其相关装置

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2017127564A1 (en) * 2016-01-19 2017-07-27 Priv8Pay, Inc. Network node authentication
CN108683630A (zh) * 2018-04-03 2018-10-19 阿里巴巴集团控股有限公司 跨区块链的认证方法及装置、电子设备
CN109040279A (zh) * 2018-08-21 2018-12-18 北京京东金融科技控股有限公司 区块链网络组网方法、装置、设备及可读存储介质
CN109167771A (zh) * 2018-08-21 2019-01-08 北京京东金融科技控股有限公司 基于联盟链的鉴权方法、装置、设备及可读存储介质
CN109242467A (zh) * 2018-09-17 2019-01-18 金蝶软件（中国）有限公司 基于区块链的组网方法、装置、计算机设备和存储介质
CN110035059A (zh) * 2019-03-05 2019-07-19 深圳前海微众银行股份有限公司 一种区块链的构建及群组划分方法与装置

Family Cites Families (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101484904A (zh) * 2006-07-07 2009-07-15 桑迪士克股份有限公司 使用多用途控制结构的内容控制***和方法
JP6648555B2 (ja) * 2016-02-29 2020-02-14 富士ゼロックス株式会社 情報処理装置及びプログラム
US10856122B2 (en) * 2016-05-31 2020-12-01 Intel Corporation System, apparatus and method for scalable internet of things (IoT) device on-boarding with quarantine capabilities
CN107079059B (zh) * 2016-12-21 2019-12-10 深圳前海达闼云端智能科技有限公司 区块链存储方法、装置及节点设备
CN107171806B (zh) * 2017-05-18 2020-04-10 北京航空航天大学 基于区块链的移动终端网络密钥协商方法
CN108052530B (zh) * 2017-11-10 2020-12-11 杭州云象网络技术有限公司 一种基于联盟链的去中心化ca构建方法及其***
US10505920B2 (en) * 2017-11-30 2019-12-10 Mocana Corporation System and method of device identification for enrollment and registration of a connected endpoint device, and blockchain service
CN108011885B (zh) * 2017-12-07 2020-12-15 北京科技大学 一种基于群组密码体制的电子邮件加密方法与***
CN108256864B (zh) * 2018-02-13 2019-06-07 中链科技有限公司 一种区块链之间的跨链联盟的建立及通信方法、***
CN108416589A (zh) * 2018-03-08 2018-08-17 深圳前海微众银行股份有限公司 区块链节点的连接方法、***及计算机可读存储介质
CN108881290B (zh) * 2018-07-17 2021-04-23 深圳前海微众银行股份有限公司 基于区块链的数字证书使用方法、***及存储介质
CN109104311B (zh) * 2018-08-06 2021-08-31 腾讯科技（深圳）有限公司 基于区块链的设备管理方法、装置、介质及电子设备
CN109189962B (zh) * 2018-08-17 2021-12-21 福建南威软件有限公司 一种基于区块链的证照服务实现***
CN109067553B (zh) * 2018-10-17 2021-06-25 杭州趣链科技有限公司 一种基于智能合约的区块链分布式证书的管理方法

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2017127564A1 (en) * 2016-01-19 2017-07-27 Priv8Pay, Inc. Network node authentication
CN108683630A (zh) * 2018-04-03 2018-10-19 阿里巴巴集团控股有限公司 跨区块链的认证方法及装置、电子设备
CN109040279A (zh) * 2018-08-21 2018-12-18 北京京东金融科技控股有限公司 区块链网络组网方法、装置、设备及可读存储介质
CN109167771A (zh) * 2018-08-21 2019-01-08 北京京东金融科技控股有限公司 基于联盟链的鉴权方法、装置、设备及可读存储介质
CN109242467A (zh) * 2018-09-17 2019-01-18 金蝶软件（中国）有限公司 基于区块链的组网方法、装置、计算机设备和存储介质
CN110035059A (zh) * 2019-03-05 2019-07-19 深圳前海微众银行股份有限公司 一种区块链的构建及群组划分方法与装置

Cited By (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112435024A (zh) * 2020-11-17 2021-03-02 浙江大学 基于群签名和ca多方认证的联盟链跨链隐私保护方法
CN112435024B (zh) * 2020-11-17 2022-06-10 浙江大学 基于群签名和ca多方认证的联盟链跨链隐私保护方法
CN112564895A (zh) * 2020-11-26 2021-03-26 中国船舶工业***工程研究院 基于区块链的无人艇集群可信组网方法、***及存储介质
CN112564895B (zh) * 2020-11-26 2022-10-21 中国船舶工业***工程研究院 基于区块链的无人艇集群可信组网方法、***及存储介质
CN112583858A (zh) * 2021-01-05 2021-03-30 广州华资软件技术有限公司 一种基于区块链pbft算法的统一身份鉴权方法
CN112583858B (zh) * 2021-01-05 2023-04-18 广州华资软件技术有限公司 一种基于区块链pbft算法的统一身份鉴权方法
CN114465714A (zh) * 2021-12-23 2022-05-10 杭州溪塔科技有限公司 联盟链中的节点配置方法及***
CN114465714B (zh) * 2021-12-23 2023-06-20 杭州溪塔科技有限公司 联盟链中的节点配置方法及***

Also Published As

Publication number Publication date
CN113098907A (zh) 2021-07-09
CN110035059B (zh) 2021-09-28
CN113098907B (zh) 2023-07-11
CN110035059A (zh) 2019-07-19

Similar Documents

Publication Publication Date Title
WO2020177508A1 (zh) 一种区块链的构建及群组划分方法与装置
US11895242B2 (en) Data processing method and apparatus in blockchain network, storage medium, and computer device
US11533164B2 (en) System and method for blockchain-based cross-entity authentication
JP6830552B2 (ja) アンチリプレー攻撃認証プロトコル
JP7289298B2 (ja) 低エントロピーパスワードを用いてブロックチェーントランザクションを許可するためのコンピュータ実装されたシステム及び方法
US20210097538A1 (en) Systems and methods for managing data generation, storage, and verification in a distributed system having a committee of validator nodes
JP2023051935A (ja) ブロックチェーン・ネットワークに関する方法
CN110288480B (zh) 一种区块链的私密交易方法及装置
WO2021018088A1 (zh) 可信认证方法，网络设备、***及存储介质
US20180308091A1 (en) Fairness preserving byzantine agreements
CN110572262A (zh) 区块链联盟链构建方法、装置及***
CN110494875A (zh) 用于动态节点群组的私钥的安全再使用
CN110999204A (zh) 区块链实施的事件锁加密的方法和***
CN115001706A (zh) 基于安全区块链的共识
CN109741068B (zh) 网银跨行签约方法、装置及***
US11849052B2 (en) Certificate in blockchain network, storage medium, and computer device
CN111770201A (zh) 一种数据验证方法、装置及设备
CN110069918A (zh) 一种基于区块链技术的高效双因子跨域认证方法
CN113850599B (zh) 一种应用于联盟链的跨链交易方法及***
CN114240433A (zh) 基于区块链的数据处理方法及***
CN110008739B (zh) 一种基于群组的区块链***、群组管理方法及装置
US11611435B2 (en) Automatic key exchange
WO2023082903A1 (zh) 一种区块链中恶意节点的检测方法及区块链
CN112926983A (zh) 一种基于区块链的存证交易加密***及方法
CN112671541A (zh) 一种区块链网络中节点管理的方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20766890

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 21/01/2022)

122 Ep: pct application non-entry in european phase

Ref document number: 20766890

Country of ref document: EP

Kind code of ref document: A1