A permission determination method, apparatus, device, and readable storage medium

Abstract

Embodiments of the present application disclose a permission determination method, device and equipment, and a readable storage medium, and relate to the blockchain technology. The method comprises the following steps: obtaining a transaction request sent by a first object, wherein the transaction request comprises public keys of N objects and a signature information set of the N objects, N is a positive integer; searching a resource policy corresponding to the transaction request from a blockchain; obtaining an identity information set of the N objects from the blockchain based on the public keys of the N objects; and determining a resource access permission of the first object based on the identity information set of the N objects, the signature information set of the N objects and the resource policy. By using the embodiments of the present application, the dependence on the CA service can be reduced, and the data processing efficiency can be improved.

Description

Technical Field

[0001] This application relates to the field of blockchain technology, and in particular to a method, apparatus, device and readable storage medium for determining permissions. Background Technology

[0002] Blockchain can identify objects and control and manage their permissions. Currently, most consortium blockchain scenarios employ a digital certificate-based system for identity management, combined with object roles for access control. However, this approach relies on digital certificates, typically requiring the integration of organizational information and role information for access control into the digital certificate of a node or object to facilitate identity-based and access control management on the blockchain. This also means it depends on specific certificate authorities, i.e., customized certificate authorities (CAs) issuing specific digital certificates. However, the process of issuing digital certificates using CA services is cumbersome, leading to low data processing efficiency. Summary of the Invention

[0003] This application provides a method, apparatus, device, and readable storage medium for determining permissions, which can reduce reliance on CA services and improve data processing efficiency.

[0004] Firstly, this application provides a method for determining permissions, including:

[0005] Obtain the transaction request sent by the first object, which includes the public keys of N objects and a set of signature information of the N objects, where N is a positive integer;

[0006] Find the resource strategy corresponding to the transaction request in the blockchain;

[0007] Based on the public keys of the N objects, obtain the set of identity information of the N objects from the blockchain;

[0008] Based on the set of identity information of the N objects, the set of signature information of the N objects, and the resource policy, the resource access permissions of the first object are determined.

[0009] Secondly, this application provides an authorization determination device, comprising:

[0010] The request acquisition unit is used to acquire the transaction request sent by the first object. The transaction request includes the public keys of N objects and a set of signature information of the N objects, where N is a positive integer.

[0011] The strategy lookup unit is used to find the resource strategy corresponding to the transaction request from the blockchain;

[0012] An identity acquisition unit is used to obtain a set of identity information of the N objects from the blockchain based on the public keys of the N objects;

[0013] The permission determination unit is used to determine the resource access permissions of the first object based on the set of identity information of the N objects, the set of signature information of the N objects, and the resource policy.

[0014] Thirdly, this application provides a computer device, including: a processor, a memory, and a network interface;

[0015] The processor is connected to a memory and a network interface. The network interface is used to provide data communication functions, the memory is used to store computer programs, and the processor is used to call the computer programs so that the computer device containing the processor can execute the permission determination method.

[0016] Fourthly, this application provides a computer-readable storage medium storing a computer program adapted to be loaded and executed by a processor, so that a computer device having a processor performs the above-described permission determination method.

[0017] Fifthly, this application provides a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. The processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the authorization determination method provided in the various optional embodiments of the first aspect of this application.

[0018] In this embodiment, a transaction request sent by a first object is obtained, and the resource policy corresponding to the transaction request is searched in the blockchain. Since the transaction request includes the public keys of N objects and a set of signature information for N objects, the identity information set of N objects can be obtained from the blockchain based on the public keys of the N objects. The resource access permissions of the first object are then judged based on the identity information set, the signature information set, and the resource policy, thus determining whether the first object has the right to access or not. Because the object's identity information, signature information, and the resource policy corresponding to the resource to be accessed can be combined to determine whether the first object has the right to access the resource, the accuracy of permission determination is improved, thereby enhancing data security and reducing the risk of data leakage. Furthermore, since this method does not rely on a CA service to issue specific digital certificates, it avoids the cumbersome process of issuing digital certificate systems, simplifies the steps of adding objects to the blockchain, and thus improves data processing efficiency. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1a This is a schematic diagram of the architecture of an authorization system provided in an embodiment of this application;

[0021] Figure 1b This is a schematic diagram of a blockchain node system provided in an embodiment of this application;

[0022] Figure 1c This is a schematic diagram of a blockchain provided in an embodiment of this application;

[0023] Figure 2 This is a schematic diagram illustrating an application scenario of a permission determination method provided in an embodiment of this application;

[0024] Figure 3 This is a flowchart illustrating a permission determination method provided in an embodiment of this application;

[0025] Figure 4 This is a diagram of an identity management system provided in an embodiment of this application;

[0026] Figure 5 This is a schematic diagram of a resource strategy mapping relationship provided in an embodiment of this application;

[0027] Figure 6 This is a flowchart illustrating another permission determination method provided in an embodiment of this application;

[0028] Figure 7 This is a schematic diagram of the composition structure of an authorization determination device provided in an embodiment of this application;

[0029] Figure 8 This is a schematic diagram of the composition structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0030] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0031] In this application's embodiments, all user information-related data is data authorized by the user. This application relates to blockchain technology; for example, blockchain technology can be used to store data such as an object's public key, the correspondence between the public key and the object's identity information, and resource policies in the blockchain; it can also store resource policies corresponding to resources in the blockchain. When a transaction request sent by a first object is received, the resource policy corresponding to the transaction request can be found in the blockchain, thereby obtaining the object's identity information from the blockchain based on the object's public key. Then, based on the object's identity information, signature information, and resource policy, it can be determined whether the first object has the right to access the resource or not. The technical solution of this application is applicable to verifying the object's identity information based on the object's transaction request, thereby determining the object's resource access permissions, that is, determining whether the object has the right to access the resource. Since this method does not rely on a CA service to issue specific digital certificates, it can avoid the cumbersome process of issuing digital certificate systems, simplify the steps of adding objects to the blockchain, and thus improve data processing efficiency.

[0032] Please see Figure 1a , Figure 1a This is a schematic diagram of the architecture of a permission determination system provided in an embodiment of this application, such as... Figure 1a As shown in the diagram, the architecture includes a blockchain node system 10 and a terminal device 11. The terminal device 11 can refer to a terminal held by a first object that needs to access resources. For example, the first object can send a transaction request to the blockchain node system 10 via the terminal device 11 to access the corresponding resource. The blockchain node system 10 can refer to a backend service device that verifies the resource access permissions of the first object to determine whether the first object has the right to access the resource. Specifically, it can be used to execute tasks such as finding the resource policy corresponding to the transaction request, verifying the identity information of the first object, and determining whether the first object has the necessary resource access permissions.

[0033] In addition, please see Figure 1b , Figure 1b This is a schematic diagram of a blockchain node system provided in an embodiment of this application. Figure 1b As shown, a blockchain node system can include multiple nodes. Each node, in its normal operation, receives input information and maintains the shared data within the system based on this information. To ensure interoperability within the blockchain node system, information connections can exist between each node, allowing for information transmission. For example, when any node in the blockchain node system receives input information, other nodes in the system retrieve this input information according to a consensus algorithm and store it as part of the shared data, ensuring data consistency across all nodes in the blockchain node system.

[0034] Each node in the blockchain node system has a corresponding node identifier, and each node can also store the node identifiers of other nodes in the blockchain node system. This allows the generated blocks to be broadcast to other nodes in the blockchain node system based on their node identifiers. Each node can maintain a node identifier list as shown in Table 1, where the node name and node identifier are stored.

[0035] Table 1

[0036] Node Name Node identifier Node 1 117.114.151.174 Node 2 117.116.189.145 … … Node N 119.123.789.258

[0037] The node identifier can be an IP (Internet Protocol) address or any other information that can be used to identify the node. Table 1 only uses IP address as an example.

[0038] Each node in a blockchain node system stores the same blockchain. A blockchain consists of multiple blocks; please refer to [link to relevant documentation]. Figure 1c , Figure 1c This is a schematic diagram of a blockchain provided in an embodiment of this application, such as... Figure 1c As shown, a blockchain consists of multiple blocks. The genesis block includes a block header and a block body. The block header stores input information feature values, version number, timestamp, and difficulty value, while the block body stores the input information. The next block after the genesis block takes the genesis block as its parent block. The next block also includes a block header and a block body. The block header stores the input information feature values ​​of the current block, the block header feature values ​​of the parent block, version number, timestamp, and difficulty value, and so on. This ensures that the block data stored in each block of the blockchain is related to the block data stored in the parent block, guaranteeing the security of the input information in the blocks.

[0039] This application utilizes smart contracts and the immutability of blockchain technology to process transaction request data, providing a blockchain-based permission determination method. A smart contract, a computerized protocol, executes the terms of a contract. It is implemented through code deployed on a shared ledger that executes when certain conditions are met. Based on actual business needs, the code is used to automate transactions. Of course, smart contracts are not limited to executing contracts for transactions; they can also execute contracts for processing received information. Blockchain is a new application model of computer technologies such as distributed data storage, peer-to-peer (P2P) transmission, consensus mechanisms, and encryption algorithms. Essentially, it is a decentralized database. A blockchain consists of multiple interconnected transaction records (also called blocks) linked and protected by cryptography. The distributed ledger linked by the blockchain allows multiple parties to effectively record transactions, and these transactions can be permanently verified (immutable). The consensus mechanism refers to the mathematical algorithm used in the blockchain network to establish trust and acquire rights among different nodes; that is, the consensus mechanism is a mathematical algorithm commonly recognized by all network nodes in the blockchain.

[0040] In the blockchain node system 10, a node can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms. The terminal device mentioned above can be an electronic device, including but not limited to mobile phones, tablets, desktop computers, laptops, PDAs, in-vehicle devices, augmented reality / virtual reality (AR / VR) devices, head-mounted displays, wearable devices, smart speakers, digital cameras, webcams, and other mobile internet devices (MIDs) with network access capabilities.

[0041] In practical applications, the aforementioned permission determination system can be used in scenarios where resource access permissions for any object can be determined, such as... Figure 2 As shown, Figure 2This is a schematic diagram illustrating an application scenario of an access control method provided in this application. Assuming a first object needs to access a target resource, the terminal device 21 corresponding to the first object can send a transaction request for the target resource to the blockchain node system 20. The transaction request includes public keys of multiple objects and a set of signature information for multiple objects. The number of public keys in the transaction request may be equal to or unequal to the number of signatures in the signature information set. Further, the blockchain node system 20 can search the blockchain for a resource policy corresponding to the transaction request and obtain the identity information set of the multiple objects from the blockchain based on the public keys of the multiple objects in the transaction request. Further, the blockchain node system 20 can extract the signature information set of the multiple objects from the transaction request and, based on the identity information set, the signature information set, and the resource policy, determine whether the first object has the right to access the resource or not. If the first object has the right to access the resource, then the first object can access the target resource corresponding to the resource policy and execute the corresponding transaction content based on the target resource. Resource policies can include, for example, {"rule":"MAJORITY", "org_list":[]", "role_list":[admin]}. This means that if a transaction request includes the signatures of administrators from more than half of the organizations on the blockchain, and this signature verification is successful, then the user has the right to access the target resource. By storing the object's public key and identity information in the blockchain, resource access permissions can be determined without relying on a CA service to issue specific digital certificates. This avoids the cumbersome process of issuing digital certificates, simplifies the steps of adding objects to the blockchain, and thus improves data processing efficiency.

[0042] Further, please see Figure 3 , Figure 3 This is a flowchart illustrating a permission determination method provided in an embodiment of this application; as shown... Figure 3 As shown, this permission determination method can be applied to nodes in a blockchain network, and the method includes, but is not limited to, the following steps:

[0043] S101, Obtain the transaction request sent by the first object.

[0044] The technical solution of this application can be applied to consortium blockchain scenarios or other scenarios. A consortium blockchain refers to a blockchain that is only for members of a certain group and a limited number of third parties. Internally, multiple pre-selected nodes are designated as ledger keepers. The generation of each block is jointly determined by all pre-selected nodes. Other access nodes can participate in transactions but do not interfere with the ledger process. Other third parties can perform limited queries through the application programming interface (API) developed by the blockchain.

[0045] In this embodiment, the first object can send a transaction request to the blockchain node system via a terminal device. This transaction request can be used to request access to a target resource, and the blockchain node system obtains the transaction request sent by the first object. The first object can be a user, i.e., a user who needs to access the target resource. The transaction request includes the public keys of N objects and a set of signature information for N objects, where N is a positive integer. The number of public keys in the transaction request and the number of signatures in the signature information set can be equal or unequal. For example, when the number of public keys in the transaction request is unequal to the number of signatures in the signature information set, such as when the transaction request includes the public keys of k objects and a set of signature information for j objects, i.e., the number of public keys is j and the number of signatures in the signature information set is k, where j and k are both positive integers and j and k are unequal. For example, j equals 3, meaning the transaction request includes the public key of object 1, the public key of object 2, and the public key of object 3; k equals 2, meaning the signature information set in the transaction request includes the signature information of object 2 and the signature information of object 4. In other words, a transaction request may not necessarily include the public key and signature information of each object. That is, a transaction request may include the public key of some objects but not their signature information, or a transaction request may include the signature information of some objects but not their public key.

[0046] Since determining the resource access permissions of the first object can be done by combining the identity information of N objects on the consortium blockchain where the first object is located, the transaction request can include the public keys and signature information of N objects. Thus, the identity information of N objects can be confirmed based on the public keys and signature information of N objects, thereby determining whether the first object has resource access permissions.

[0047] In this context, the public key refers to the publicly disclosed key in an asymmetric key pair, used to identify objects within the blockchain. The signature information set includes one or more signatures, obtained by signing the original transaction information using the object's private key. The private key corresponds to the public key, i.e., the unpublished key in the asymmetric key pair. The original transaction information can refer to the content of the transaction. For example, if the transaction content involves configuration, such as configuring an administrator's identity in an organization, the original transaction information could include configuration parameters; or if the transaction content involves calling a contract, the original transaction information could include the contract name, and so on. The N objects may or may not include the first object. It's understandable that, because each object has a different private key, each object signing the same original transaction information will produce a different signature. The signature information can then be verified using the object's public key to determine if the public key is correct, thereby identifying the object.

[0048] S102, find the resource strategy corresponding to the transaction request from the blockchain.

[0049] In this embodiment, when the blockchain node system receives a transaction request sent by a first object, it can search for the resource policy corresponding to the transaction request in the blockchain. Optionally, the transaction request may also include an identifier of the target resource. The blockchain node system can then search for the resource policy corresponding to the target resource identifier in the blockchain, thus obtaining the resource policy corresponding to the transaction request. Alternatively, a predefined correspondence between the format of the transaction request and the resources can be established. When a transaction request sent by the first object is received, the target resource that the first object needs to access can be determined based on the format of the transaction request and the correspondence between the format and the resources, thereby determining the resource policy corresponding to the transaction request. Alternatively, the resource policy corresponding to the application type or application identifier can be determined based on information such as the application type or application identifier on the terminal device. This embodiment does not limit this approach.

[0050] Optionally, a resource policy can specify the conditions that an object authorized to access a resource must meet, or the conditions that an object without authorization must meet. For example, conditions may include identity information, a first quantity or proportion of that identity information, a second quantity or proportion of successful signatures, and so on. Exemplarily, conditions may include, but are not limited to, one or more of a rule, an organization list (orgList), and a role list (roleList).

[0051] Here, "rules" refers to keywords describing the required number of organizations and their respective role types for resource access. The organization list is the set of valid organizations; an empty list indicates any organization on the chain is eligible. The role list is the set of valid roles; an empty list indicates any role type on the chain is eligible.

[0052] For example, rules may include, but are not limited to, the following:

[0053] ALL: Requires all organizations in the orgList to participate, and each organization must provide at least one signature that meets the role List requirements;

[0054] ANY: Require any organization in the orgList to provide signature information for a role that meets the roleList requirements;

[0055] MAJORITY: Requires more than half of the organizations in the consortium blockchain to provide their respective admin (administrator) signatures;

[0056] An integer expressed as a string (e.g., "3"): requires organizations in the orgList that are greater than or equal to the specified number to provide signatures for roles that meet the roleList requirements;

[0057] A fraction expressed as a string (e.g., "2 / 3"): requires organizations in the orgList that are greater than or equal to a specified percentage to provide signatures for roles that meet the roleList requirements;

[0058] SELF: Requires the organization to which the resource belongs to provide a signature that conforms to the role list requirements. Under this keyword, the organization list information in orgList is not effective.

[0059] FORBIDDEN: This rule prohibits access by all users. Under this keyword, orgList and roleList are not effective.

[0060] For example, the following provides a permission rule configuration table 2:

[0061] Table 2

[0062]

[0063] It is understood that the signature mentioned above can refer to signature information, and the chain mentioned above can refer to a specific chain within a consortium blockchain. For example, regarding a target resource, the corresponding resource strategy may include:

[0064] {“rule”:“MAJORITY”,“org_list”:[],“role_list”:[admin]} means that when accessing a target resource is required, the resource policy corresponding to that target resource requires the transaction request to include the signatures of the administrators of more than half of the organizations on the chain. Assuming that there are currently 4 organizations on the chain, the signatures of the administrators of 3 organizations are required to access the target resource.

[0065] S103: Obtain a set of identity information for N objects from the blockchain based on the public keys of N objects.

[0066] In this embodiment, the blockchain node system can obtain a set of identity information for N objects from the blockchain based on the public keys of the N objects included in the transaction request. If the identity information set for any of the N objects cannot be obtained from the blockchain, it indicates that the object's identity information is invalid and is ignored. If the identity information set for any of the N objects is obtained from the blockchain, the object's permissions can be verified to determine the object's resource access permissions.

[0067] Optionally, the blockchain node system can pre-upload the public keys and identity information of multiple objects onto the blockchain, that is, save the correspondence between the public keys and identity information of multiple objects in the blockchain. Subsequently, the identity information of an object can be retrieved from the blockchain based on the public key of the object in the transaction request. The blockchain can refer to a consortium blockchain. Specifically, the blockchain node system can obtain the public key and identity information of at least one object; obtain the correspondence between the public key and the identity information of at least one object, save the correspondence in the blockchain, with one public key corresponding to one piece of identity information; and obtain a set of identity information of N objects from the blockchain based on the public keys and correspondences of N objects.

[0068] Here, "at least one" can refer to one or more objects. The object's identity information includes the object's organizational information and its role information. The object's organizational information indicates which organization the object belongs to, and its role information indicates what role the object plays. Roles can include administrator roles and other roles, which can include ordinary object roles and light node object roles. An administrator can be an object that can perform chain configuration management on behalf of the organization. An ordinary object can be an object that can send or query transactions but does not have the authority to perform chain configuration management. A light node object can be an object that can query or subscribe to its own organization's block and transaction data but does not have the authority to send transactions or perform chain configuration management.

[0069] Optionally, the identity management system diagram can be as follows: Figure 4 As shown, Figure 4 This application provides an identity management system diagram, in which a chain in a consortium blockchain (such as chain A) can be composed of multiple organizations. Each organization has two types of identity identifiers: node identity and object identity. Node identities mainly include consensus node roles (consensus) and synchronization node roles (common); user identities mainly include administrator roles (admin), ordinary object roles (client), and light node object roles (light). A consensus node can refer to an on-chain node that has the right to participate in the block consensus process, while a synchronization node can refer to a node that can synchronize data on the chain but has no right to participate in the block consensus process.

[0070] Using digital certificates as identity identifiers requires deploying an accredited Certificate Authority (CA) to issue certificates to the aforementioned nodes or users (i.e., objects). To facilitate user access control, customized CA services are typically developed, incorporating the user's organizational and role information as certificate fields into the digital certificate. This inevitably leads to excessive reliance on CA services. However, using publicly available public key information from a key pair as identity identifiers is more convenient and faster. For example, OpenSSL or other software can be used to randomly generate key pairs with various cryptographic algorithms and strengths, thus obtaining the user's public key. Since the public key itself cannot carry identity information such as the user's or node's organization or role, it can be bound to the user's identity information—that is, the object's public key and the object's identity information—and stored on the blockchain.

[0071] The public keys and organization information of consensus nodes can be registered by default in the chain configuration file and can be updated via the chain configuration system contract. The public keys and organization information of administrators can also be registered by default in the chain configuration file and can be updated via the chain configuration system contract. The public keys and identity information of other nodes, such as synchronization nodes and other user roles, such as ordinary objects and light nodes, can be registered by the administrators of each organization through a defined public key management system contract. Each public key is bound to specified organization and role information, thereby establishing a mapping between the public keys and identity information of objects stored in the blockchain.

[0072] Optionally, resource policies can be designed using a combination of role-based access control (RBAC) and attribute-based access control (ABAC). For example... Figure 5 As shown, Figure 5 This is a schematic diagram of a resource policy mapping relationship provided in an embodiment of this application. By binding an object's public key to a role in an organization, and then binding on-chain resources (i.e., resources on the chain that require permission management operations) to specific lists of organizations and roles, the association between resources and objects can be completed. Finally, an access permission rule, i.e., a resource policy, is defined for the resource. When a transaction request sent by any object is received, the resource policy corresponding to the transaction request can be obtained, and based on the resource policy, it can be determined whether the object has the permission to access the resource. The specific definition rules of the resource policy can be referred to in step S102, and will not be repeated here.

[0073] S104. Based on the set of identity information of N objects, the set of signature information of N objects, and the resource policy, determine the resource access permissions of the first object.

[0074] In this embodiment, if the blockchain node system obtains a set of identity information for N objects from the blockchain, it can determine the resource access permission of the first object based on the set of identity information for N objects, the set of signature information for N objects, and the resource policy. The resource access permission can include authorized or unauthorized access. When the resource access permission is authorized, the resource can be accessed directly. When the resource access permission is unauthorized, a prompt message can be sent to the terminal device used by the first object to indicate that the first object is not authorized to access the resource. Further verification information can be sent to the terminal device used by the first object to further verify the first object and determine its resource access permission. In one possible scenario, if the identity information of any of the N objects is not obtained from the blockchain, such as when the number of identity information items in the set of identity information for the N objects is 0, then the resource access permission of the first object is determined to be unauthorized.

[0075] Optionally, the resource policy can refer to the existence of information about M objects authorized to access the resource in the transaction request, and the signature verification of all M objects authorized to access the resource passes. The identity information of the objects authorized to access the resource is the target identity information. For example, the resource policy can indicate that when the identity information of M objects in the transaction request is the target identity information, and the signature verification of all M objects passes, the resource access permission of the first object is authorized to access, where M is a positive integer. That is, assuming the first object belongs to the target chain in the consortium blockchain, by judging the transaction request sent by the first object, it is determined whether there are M objects in the transaction request belonging to the target chain whose identity information is the target identity information, and the signature verification of all M objects passes. If so, the resource access permission of the first object is determined to be authorized to access, that is, the first object can access the resource. The blockchain node system can verify the identities of N objects based on the set of identity information of N objects and the target identity information; it can also verify the signatures of the objects that have passed identity verification based on the public keys and signature information of the objects that have passed identity verification; it can obtain the number of objects that have passed signature verification, and if the number of objects that have passed signature verification is greater than or equal to M, it can determine that the resource access permission of the first object is authorized to access.

[0076] Specifically, we can verify whether the identity information of each of the N objects in the set of identity information is the same as the target identity information. If the identity information of an object is the same as the target identity information, the identity verification of that object is determined to be successful; if the identity information of an object is different from the target identity information, the identity verification of that object is determined to be unsuccessful. We then perform signature verification on the public key and signature information of the objects that have passed identity verification among the N objects. If the signature verification is successful, we count the number of objects that have passed signature verification. If the number of objects that have passed signature verification is greater than or equal to M, we determine that the resource access permission of the first object is authorized.

[0077] Optionally, the set of identity information for N objects includes organizational information and role information for the N objects, and the target identity information includes target organizational information and target role information. Then, identity verification can be performed on the N objects based on the organizational and role information of the N objects and the target organizational and role information. Specifically, organizational verification is performed on the N objects based on their organizational and target organizational information, and role verification is performed on their role information based on their target role information. If both the organizational and role verifications of the second object pass, the identity verification of the second object is determined to be successful, where the second object is any one of the N objects. If at least one of the organizational or role verifications of the second object fails, the identity verification of the second object is determined to be unsuccessful.

[0078] In its implementation, the blockchain node system can retrieve the corresponding organization and role information from the blockchain based on the public key of each of the N objects. Specifically, it can determine whether each object's public key matches any public key in the corresponding relationship by establishing a correspondence between the public key and identity information stored in the blockchain. If they match, the system retrieves the identity information (i.e., organization and role information) corresponding to that public key. If no such organization and role information is found, the object's signature is deemed invalid. If the organization and role information are found, but the organization information does not belong to the chain or the role information is not the target role information, the object's signature is deemed invalid. If both the organization and role information meet the requirements (i.e., the organization information belongs to the chain and the role information is the target role information), signature verification is performed based on the public key and signature information of the object that meets the requirements. If the signature verification passes, the signature is deemed valid. Furthermore, the blockchain node system can count the number of valid signatures collected. If the number of valid signatures reaches the number required by the resource policy, the permission verification passes, meaning the first object has the right to access the resource.

[0079] Optionally, the transaction request also includes original transaction information. The verified identity of the third object includes any one of the verified identities. The signature information set includes the signature information of the third object. Then, the blockchain node system can verify the user's signature information based on the original transaction information. Specifically, the signature information of the third object can be decrypted using the third object's public key. The decrypted information is then compared with the original transaction information. If the decrypted information matches the original transaction information, the signature verification of the third object is deemed successful; if the decrypted information does not match the original transaction information, the signature verification of the third object is deemed unsuccessful.

[0080] The signature information is obtained by signing the original transaction information using the object's private key; each object has a unique signature. Since the signature information is obtained by signing the original transaction information using the object's private key, the object's public key can be used to verify the signature information and determine the object's identity. The signature information of a third object is then decrypted using its public key. This decrypted information is compared with the original transaction information. If the decrypted information matches the original transaction information, the third object's signature verification is successful, indicating that the original transaction information has not been tampered with and the third object's identity is legitimate. If the decrypted information does not match the original transaction information, the third object's signature verification is unsuccessful, indicating that the third object's identity is illegitimate or the original transaction information has been tampered with. Because the signature information is obtained based on the object's private key, if the public key used for decryption is not the object's public key, normal decryption cannot be achieved, and the decrypted information will also be inconsistent with the original transaction information. By verifying the signature of each object that has passed identity verification, the number of objects that have passed signature verification can be determined. By verifying the signature information of an object using its public key, the authenticity of the object's identity can be determined, improving the accuracy of authorization determination.

[0081] Optionally, the resource access permissions of the first object can be determined based on the identity information set of N objects and the resource policy. For example, if the number of objects in the identity information set of N objects that have the same target identity information as required by the resource policy is less than M, then the resource access permissions of the first object are determined to be unauthorized. In other words, if the number of objects among the N objects that have passed identity verification is less than M, then the resource access permissions of the first object are determined to be unauthorized. Since the resource policy requires that the first object has resource access permissions when the signature information of M objects that meet the conditions passes verification, and identity verification needs to be performed on the N objects, and then signature verification needs to be performed on the objects that have passed identity verification. Therefore, if the number of objects among the N objects that have passed identity verification is less than M, then the resource access permissions of the first object are determined to be unauthorized.

[0082] Optionally, the resource access permissions of the first object can be determined based on the identity information set and resource policy of N objects, and the signature information set and resource policy of N objects. For example, it can be determined whether the identity information set of N objects is the same as the target identity information required in the resource policy. If the number of objects in the identity information set of N objects that are the same as the target identity information required in the resource policy is greater than M, then the resource access permissions of the first object are determined based on the signature information set of the objects with the same target identity information and the resource policy. In other words, if the number of objects that have passed identity verification among the N objects is greater than or equal to M, and the number of objects that have passed signature verification among the objects that have passed identity verification is less than M, then the resource access permissions of the first object are determined to be unauthorized. Since the resource policy requires that the first object has resource access permissions when the signature information verification of M objects meets the conditions, and identity verification needs to be performed on the N objects, and then signature verification needs to be performed on the objects that have passed identity verification. Therefore, if the number of objects that have passed identity verification among the N objects is greater than or equal to M, and the number of objects that have passed signature verification among the objects that have passed identity verification is less than M, then the resource access permissions of the first object are determined to be unauthorized.

[0083] In one possible implementation, the blockchain node system can verify the identities of any X objects out of N objects to determine the resource access permissions of the first object. Specifically, the blockchain node system can verify the identities of the X objects based on the identity information of any X objects out of N objects and the target identity information; if all X objects pass the identity verification, then the system performs signature verification on the X objects based on their public keys and signature information; if the number of successful signature verifications of the X objects is greater than or equal to M, then the resource access permissions of the first object are determined to be authorized. Here, X is a positive integer. By verifying the identities of any X objects out of N objects, and if all X objects pass the identity verification, the resource access permissions of the first object are determined to be authorized, eliminating the need to verify the identities of objects other than the X objects out of N objects, thus improving the efficiency of permission verification.

[0084] Optionally, when performing signature verification on X objects based on their public keys and signature information, if the number of successful signature verifications for the X objects is less than M, identity verification can be performed on the objects other than the X objects out of N objects. If the number of successful identity verifications for the N objects is greater than M, then signature verification is performed on the objects that have passed identity verification to determine the resource access permissions of the first object. In this way, when the number of successful signature verifications for X objects is less than M, identity verification is then performed on the objects other than the X objects out of N objects, which improves the accuracy of permission determination while enhancing permission verification.

[0085] The method described in this application embodiment can perform identity management and signature verification based on public-private key pairs, without relying on CA services. This avoids the cumbersome issuance process of digital certificate systems, making the process of users joining the blockchain network simpler and faster. Users only need to register the public key from their existing or generated public-private key pair on the blockchain and bind their identity information, such as their organization and role, to quickly access the blockchain and accept its authentication and management. Since no digital certificate issuance is required, overall data processing efficiency can be improved. Furthermore, using the public key as a user identifier can also reduce the size of transaction request data packets to some extent, thereby improving system performance. In addition, by designing resource policies using a combination of role-based and attribute-based access control, more granular management of access control for on-chain operations such as transaction sending and configuration updates can be achieved, further enhancing data processing efficiency.

[0086] In this embodiment, a transaction request sent by a first object is obtained. This transaction request includes the public keys of N objects and a set of signature information for N objects. A resource policy corresponding to the transaction request is searched in the blockchain. Based on the public keys of the N objects, the identity information set of the N objects is obtained from the blockchain. Based on the identity information set, the signature information set, and the resource policy, the resource access permissions of the first object are determined, thus determining whether the first object has authorized or unauthorized access. Since the object's identity information, signature information, and the resource policy corresponding to the resource to be accessed can be combined to determine whether the first object has resource access permissions, the accuracy of permission determination is improved, thereby enhancing data security and reducing the risk of data leakage. Furthermore, since this method does not rely on a CA service to issue specific digital certificates, it avoids the cumbersome process of issuing digital certificate systems and simplifies the steps of adding objects to the blockchain, thus improving data processing efficiency.

[0087] Further, please see Figure 6 , Figure 6 This is a flowchart illustrating another permission determination method provided in an embodiment of this application. The permission determination method can be applied to nodes in a blockchain network, and includes, but is not limited to, the following steps:

[0088] S201, Obtain the transaction request sent by the first object.

[0089] S202, determine whether a resource policy corresponding to the transaction request has been found.

[0090] In this embodiment, if the resource policy corresponding to the transaction request is found, step S203 is executed to extract the signature information set, public key, and original transaction information from the transaction request. If the resource policy corresponding to the transaction request is not found, step S207 is executed to determine that the resource access permission of the first object is unauthorized.

[0091] S203, Extract the signature information set, public key and original transaction information from the transaction request.

[0092] S204 retrieves the identity information corresponding to the public key from the blockchain based on the public key.

[0093] S205, based on resource policies, performs permission verification on identity information and signature information to determine whether the verification passes.

[0094] In this embodiment of the application, if the permission verification passes, step S206 is executed to determine that the resource access permission of the first object is authorized; if the permission verification fails, step S207 is executed to determine that the resource access permission of the first object is not authorized.

[0095] S206, Determine that the resource access permissions of the first object are valid.

[0096] S207, Determine that the resource access permission of the first object is not allowed.

[0097] To illustrate the above process, consider the following example: the resource strategy corresponding to the target resource is:

[0098] {"rule":"MAJORITY","org_list":[],"role_list":[admin]};

[0099] When the blockchain node system receives a transaction request from the first object, it can determine that the first object needs to access the target resource. It then searches the blockchain for the resource policy corresponding to the transaction request. For example, it can search for the resource policy based on the name of the target resource. This resource policy requires the transaction request from the first object to include the signatures of administrators from more than half of the organizations on the chain. Assuming there are currently 4 organizations on the chain, it needs the signatures of administrators from 3 organizations (i.e., the signatures of the administrators from 3 organizations must be verified) to access the target resource. The blockchain node system can extract a valid set of endorsement (signature) information from the transaction request and verify each signature in the set. Specifically, the blockchain node system can search the blockchain for the organization information and role information corresponding to each of the N objects included in the transaction request, based on the public key of that object. If no organization information or role information corresponding to the public key is found, the signature information of that object is determined to be invalid and ignored. If the organization information corresponding to the public key does not belong to the chain or the role information corresponding to the public key is not an administrator, the signature information of that object is determined to be invalid. If the role information corresponding to the public key belongs to this chain and the role information indicates an administrator identity, then the public key is used to verify the signature information of the object. If the signature verification passes, the signature of the object is determined to be valid. Furthermore, the number of valid signatures collected is counted. If the number of valid signatures reaches the signatures of administrators from the three organizations required by the resource policy, then the permission verification has passed, meaning the first object has the authorized access to the resource.

[0100] In this embodiment, by obtaining a transaction request sent by a first object, which includes the public keys of N objects and a set of signature information of N objects, and searching for the resource policy corresponding to the transaction request in the blockchain, the resource access permissions of the first object can be determined based on the object's public key and signature information. The identity information set of N objects is obtained from the blockchain based on the public keys of the N objects; the resource access permissions of the first object are determined based on the identity information set, the signature information set, and the resource policy. Since the object's identity information, signature information, and the resource policy corresponding to the resource to be accessed can be combined to determine whether the first object has resource access permissions, the accuracy of permission determination is improved, thereby enhancing data security and reducing the risk of data leakage. Furthermore, since this method does not rely on a CA service to issue specific digital certificates, it avoids the cumbersome process of issuing digital certificate systems, simplifies the steps of adding objects to the blockchain, and thus improves data processing efficiency.

[0101] The methods of the embodiments of this application have been described above, and the apparatus of the embodiments of this application will be described below.

[0102] See Figure 7 , Figure 7 This is a schematic diagram of the composition structure of a permission determination device provided in an embodiment of this application. The permission determination device may be a computer program (including program code) running on a terminal device; the permission determination device may be used to execute the corresponding steps in the permission determination method provided in the embodiment of this application.

[0103] For example, the authorization determination device 70 includes:

[0104] The request acquisition unit 71 is used to acquire a transaction request sent by the first object. The transaction request includes the public keys of N objects and a set of signature information of the N objects, where N is a positive integer.

[0105] The strategy lookup unit 72 is used to look up the resource strategy corresponding to the transaction request from the blockchain;

[0106] Identity acquisition unit 73 is used to obtain a set of identity information of the N objects from the blockchain based on the public keys of the N objects;

[0107] The permission determination unit 74 is used to determine the resource access permissions of the first object based on the set of identity information of the N objects, the set of signature information of the N objects, and the resource policy.

[0108] Optionally, the resource policy indicates that when the identity information of M objects in the transaction request is the target identity information, and the signature verification of the M objects is passed, the resource access permission of the first object is authorized to access, where M is a positive integer;

[0109] This permission determination unit 74 is specifically used for:

[0110] Based on the set of identity information of the N objects and the target identity information, perform identity verification on the N objects;

[0111] Based on the public key of the object whose identity has been verified among the N objects and the signature information of the object whose identity has been verified, a signature verification is performed on the object whose identity has been verified.

[0112] Get the number of objects whose signatures have passed verification. If the number of objects whose signatures have passed verification is greater than or equal to M, then determine that the resource access permission of the first object is authorized.

[0113] Optionally, the set of identity information for the N objects includes the organization information and role information of the N objects, and the target identity information includes the target organization information and the target role information;

[0114] This permission determination unit 74 is specifically used for:

[0115] Based on the organization information of the N objects and the target organization information, perform organization verification on the N objects, and perform role verification on the N objects based on the role information of the N objects and the target role information;

[0116] If both the organization verification and the role verification of the second object pass, then the identity verification of the second object is determined to be successful, and the second object is any one of the N objects;

[0117] If at least one of the organization verification or the role verification of the second object fails, then the identity verification of the second object is determined to have failed.

[0118] Optionally, the transaction request may also include original transaction information, the object whose identity has been verified includes a third object, which is any one of the objects whose identity has been verified, and the signature information set includes the signature information of the third object;

[0119] This permission determination unit 74 is specifically used for:

[0120] The signature information of the third object is decrypted based on the public key of the third object, and the decrypted information obtained is compared with the original transaction information.

[0121] If the decrypted information matches the original transaction information, then the signature verification of the third object is deemed successful.

[0122] If the decrypted information is inconsistent with the original transaction information, then the signature verification of the third object is determined to be unsuccessful.

[0123] Optionally, the permission determination unit 74 is further configured to: if the number of objects that have passed identity verification among the N objects is less than M, then determine that the resource access permission of the first object is unauthorized.

[0124] Optionally, the permission determination unit 74 is further configured to: if the number of objects that have passed identity verification among the N objects is greater than or equal to M, and the number of objects that have passed signature verification among the objects that have passed identity verification is less than M, then determine that the resource access permission of the first object is unauthorized.

[0125] Optionally, the permission determination device further includes: an information uplink unit 75, used for:

[0126] Obtain the public key and identity information of at least one object;

[0127] Obtain the correspondence between the public key of at least one object and the identity information of at least one object, and save the correspondence to the blockchain, where one public key corresponds to one identity information;

[0128] The identity acquisition unit 73 is used for:

[0129] Based on the public keys of the N objects and the corresponding relationship, obtain the set of identity information of the N objects from the blockchain.

[0130] In this embodiment, a transaction request sent by a first object is obtained. This transaction request includes the public keys of N objects and a set of signature information for N objects. A resource policy corresponding to the transaction request is searched in the blockchain. Based on the public keys of the N objects, the identity information set of the N objects is obtained from the blockchain. Based on the identity information set, the signature information set, and the resource policy, the resource access permissions of the first object are determined, thus determining whether the first object has authorized or unauthorized access. Since the object's identity information, signature information, and the resource policy corresponding to the resource to be accessed can be combined to determine whether the first object has resource access permissions, the accuracy of permission determination is improved, thereby enhancing data security and reducing the risk of data leakage. Furthermore, since this method does not rely on a CA service to issue specific digital certificates, it avoids the cumbersome process of issuing digital certificate systems and simplifies the steps of adding objects to the blockchain, thus improving data processing efficiency.

[0131] See Figure 8 , Figure 8 This is a schematic diagram of the structural composition of a computer device provided in an embodiment of this application. For example... Figure 8 As shown, the aforementioned computer device 80 may include a processor 801, a memory 802, and a network interface 803. The processor 801 is connected to the memory 802 and the network interface 803, for example, the processor 801 can be connected to the memory 802 and the network interface 803 via a bus. The computer device can be a terminal device or a blockchain node system.

[0132] Processor 801 is configured to support the data processing device in performing the corresponding functions in the above-described data processing method. Processor 801 may be a Central Processing Unit (CPU), a Network Processor (NP), a hardware chip, or any combination thereof. The aforementioned hardware chip may be an Application-Specific Integrated Circuit (ASIC), a Programmable Logic Device (PLD), or a combination thereof. The aforementioned PLD may be a Complex Programmable Logic Device (CPLD), a Field-Programmable Gate Array (FPGA), a Generic Array Logic (GAL), or any combination thereof.

[0133] Memory 802 is used to store program code, etc. Memory 802 may include volatile memory (VM), such as random access memory (RAM); memory 802 may also include non-volatile memory (NVM), such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid-state drive (SSD); memory 802 may also include combinations of the above types of memory.

[0134] Network interface 803 is used to provide network communication functions.

[0135] Processor 801 can call program code to perform the following operations:

[0136] Obtain the transaction request sent by the first object, which includes the public keys of N objects and a set of signature information of the N objects, where N is a positive integer;

[0137] Find the resource strategy corresponding to the transaction request in the blockchain;

[0138] Based on the public keys of the N objects, obtain the set of identity information of the N objects from the blockchain;

[0139] Based on the set of identity information of the N objects, the set of signature information of the N objects, and the resource policy, the resource access permissions of the first object are determined.

[0140] In this embodiment, a transaction request sent by a first object is obtained. This transaction request includes the public keys of N objects and a set of signature information for N objects. A resource policy corresponding to the transaction request is searched in the blockchain. Based on the public keys of the N objects, the identity information set of the N objects is obtained from the blockchain. Based on the identity information set, the signature information set, and the resource policy, the resource access permissions of the first object are determined, thus determining whether the first object has authorized or unauthorized access. Since the object's identity information, signature information, and the resource policy corresponding to the resource to be accessed can be combined to determine whether the first object has resource access permissions, the accuracy of permission determination is improved, thereby enhancing data security and reducing the risk of data leakage. Furthermore, since this method does not rely on a CA service to issue specific digital certificates, it avoids the cumbersome process of issuing digital certificate systems and simplifies the steps of adding objects to the blockchain, thus improving data processing efficiency.

[0141] It should be understood that the computer device 80 described in the embodiments of this application can perform the foregoing... Figure 3 and Figure 6 The description of the data processing method in the corresponding embodiments can also be performed as described above. Figure 7 The description of the data processing apparatus in the corresponding embodiments will not be repeated here. Furthermore, the beneficial effects of using the same method will also not be repeated.

[0142] This application also provides a computer-readable storage medium storing a computer program. The computer program includes program instructions, which, when executed by a computer, cause the computer to perform the methods described in the foregoing embodiments. The computer can be part of the aforementioned computer device, such as the processor 801 described above. As an example, the program instructions can be deployed and executed on a single computer device, or on multiple computer devices located in one location, or on multiple computer devices distributed across multiple locations and interconnected via a communication network. These multiple computer devices distributed across multiple locations and interconnected via a communication network can form a blockchain network.

[0143] This application also provides a computer program product or computer program, which includes computer instructions that, when executed by a processor, can implement some or all of the steps in the above-described methods. Optionally, the computer instructions may be stored in a computer-readable storage medium. For example, a processor of a computer device may read the computer instructions from the computer-readable storage medium, and the processor may execute the computer instructions to cause the computer device to perform the steps performed in the embodiments of the above-described methods.

[0144] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0145] The above-disclosed embodiments are merely preferred embodiments of this application and should not be construed as limiting the scope of this application. Therefore, any equivalent variations made in accordance with the claims of this application shall still fall within the scope of this application.

Claims

1. A method for determining permissions, characterized in that, include: Obtain the transaction request sent by the first object, wherein the transaction request includes the public keys of N objects and a set of signature information of the N objects, where N is a positive integer; Find the resource policy corresponding to the transaction request from the blockchain; the resource policy indicates that when the identity information of M objects in the transaction request are all the target identity information, and the signature verification of the M objects all passes, the resource access permission of the first object is authorized to access, where M is a positive integer; Based on the public keys of the N objects, obtain the set of identity information of the N objects from the blockchain; Based on the set of identity information of the N objects and the target identity information, the identities of the N objects are verified. Based on the public key of the object whose identity has been verified among the N objects and the signature information of the object whose identity has been verified, the signature of the object whose identity has been verified is verified. Obtain the number of objects whose signatures have passed verification. If the number of objects whose signatures have passed verification is greater than or equal to M, then determine that the resource access permission of the first object is authorized to access.

2. The method according to claim 1, characterized in that, The set of identity information for the N objects includes the organization information and role information of the N objects, and the target identity information includes the target organization information and the target role information; The step of verifying the identities of the N objects based on the set of identity information of the N objects and the target identity information includes: Based on the organization information of the N objects and the target organization information, the organization of the N objects is verified, and based on the role information of the N objects and the target role information, the role of the N objects is verified. If both the organization verification and the role verification of the second object pass, then the identity verification of the second object is determined to be successful, and the second object is any one of the N objects; If at least one of the organization verification or the role verification of the second object fails, then the identity verification of the second object is determined to have failed.

3. The method according to claim 1, characterized in that, The transaction request also includes original transaction information, the object whose identity has been verified includes a third object, the third object is any one of the objects whose identity has been verified, and the signature information set includes the signature information of the third object; The step of performing signature verification on the objects whose identities have been verified based on the public key of the objects that have passed identity verification among the N objects and the signature information of the objects that have passed identity verification includes: The signature information of the third object is decrypted based on the public key of the third object, and the decrypted information obtained from the decryption process is compared with the original transaction information. If the decrypted information is consistent with the original transaction information, then the signature verification of the third object is deemed to have passed. If the decrypted information is inconsistent with the original transaction information, then the signature verification of the third object is determined to have failed.

4. The method according to any one of claims 1-3, characterized in that, The method further includes: If the number of objects that pass identity verification among the N objects is less than M, then the resource access permission of the first object is determined to be unauthorized.

5. The method according to any one of claims 1-3, characterized in that, The method further includes: If the number of objects that pass identity verification among the N objects is greater than or equal to M, and the number of objects that pass signature verification among the objects that pass identity verification is less than M, then the resource access permission of the first object is determined to be unauthorized.

6. The method according to claim 1, characterized in that, The method further includes: Obtain the public key of at least one object and the identity information of said at least one object; Obtain the correspondence between the public key of the at least one object and the identity information of the at least one object, and save the correspondence to the blockchain, where one public key corresponds to one identity information; The step of retrieving the set of identity information of the N objects from the blockchain based on the public keys of the N objects includes: The identity information set of the N objects is obtained from the blockchain based on the public keys of the N objects and the corresponding relationship.

7. An access control device, characterized in that, include: The request acquisition unit is used to acquire a transaction request sent by a first object, wherein the transaction request includes the public keys of N objects and a set of signature information of the N objects, where N is a positive integer; The strategy lookup unit is used to look up the resource strategy corresponding to the transaction request from the blockchain; the resource strategy indicates that when the identity information of M objects in the transaction request are all target identity information, and the signature verification of the M objects all passes, the resource access permission of the first object is authorized to access, where M is a positive integer; An identity acquisition unit is used to obtain a set of identity information of the N objects from the blockchain based on the public keys of the N objects; The permission determination unit is used to perform identity verification on the N objects based on the set of identity information of the N objects and the target identity information; Based on the public key of the object whose identity has been verified among the N objects and the signature information of the object whose identity has been verified, the object whose identity has been verified is subjected to signature verification; the number of objects whose signature verification has been verified is obtained, and if the number of objects whose signature verification has been verified is greater than or equal to M, then the resource access permission of the first object is determined to be authorized.

8. A computer device, characterized in that, include: Processor, memory, and network interface; The processor is connected to the memory and the network interface, wherein the network interface is used to provide data communication functions, the memory is used to store program code, and the processor is used to call the program code so that the computer device executes the method according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program adapted to be loaded and executed by a processor, such that a computer device having the processor performs the method according to any one of claims 1-6.

10. A computer program product, characterized in that, The computer program product includes computer instructions that are executed by a processor to implement the method of any one of claims 1-6.

Images