Subject authority management method in bond issuance alliance chain and bond issuance alliance chain system

Abstract

The present application discloses a method for managing subject rights in a bond issuance alliance chain and a bond issuance alliance chain, the method comprising: pre-saving the identity data of each subject, and when the target subject calls a smart contract, querying the target subject's institutional information and tender document serial number through the smart contract call request sent by it, and then querying the target subject's identity data, and extracting the subject role of the target subject from it. According to the mapping relationship between the subject role and the authority, it can be determined whether the target subject has the authority to call the smart contract, and the smart contract is executed when it is determined that there is authority. In addition, the business data is protected by an attribute encryption algorithm based on a ciphertext strategy to ensure that different business data is only disclosed to the corresponding subject role. In the above manner, different permissions to call smart contracts and data access rights can be assigned to different subjects, thereby realizing the management of the subject's authority to operate the bond issuance alliance chain.

Description

Technical Field

[0001] The present application relates to the technical field of alliance chains, and specifically to a method for managing subject authority in a bond issuance alliance chain and a bond issuance alliance chain. Background Art

[0002] In the alliance chain, operations such as node joining and bookkeeping require authorization and certification, which can naturally solve the problem of external node intrusion attacks in the existing blockchain bond system. At the same time, the consensus mechanism of the alliance chain enables it to have efficient information processing capabilities, which is suitable for the implementation of large-scale financial services. Issuance is the starting point of the entire life cycle of bonds. Bonds are put on the chain during the issuance process, which can provide a basis for blockchain support in the transaction, custody, settlement, information disclosure, and payment. Therefore, banks and financial infrastructure institutions at home and abroad are actively exploring the development of blockchain bond issuance systems, and piloting the issuance of digital bonds through blockchain, which is of great significance to all parties. Therefore, choosing the alliance chain as the underlying platform for bond issuance has irreplaceable advantages over the public chain.

[0003] However, the user permissions in the alliance chain are single, and it does not support granting different business operation permissions to different issuers. For example, bookkeepers can only publish offer information on the alliance chain, investors can only record bond subscription data on the alliance chain, and administrators can only create the above two types of entities on the alliance chain. Therefore, how to assign different business operation permissions to each issuer is an urgent problem to be solved. Summary of the invention

[0004] In view of this, an embodiment of the present application provides a method for managing subject authority in a bond issuance alliance chain and a bond issuance alliance chain to solve the problem of unauthorized subjects calling smart contract interfaces to disrupt the bond issuance process and the problem of unauthorized subjects obtaining business data of other subjects by accessing shared ledgers.

[0005] To solve the above problems, the technical solutions provided in the embodiments of the present application are as follows:

[0006] A method for managing subject rights in a bond issuance alliance chain, the method being applied to a bond issuance alliance chain, the method comprising:

[0007] Obtaining a smart contract call request of a target entity; the smart contract call request includes the customer number of the target entity, the smart contract to be called, and the parameters passed in by the user; the target entity is any entity in the bond issuance alliance chain;

[0008] Query the certificate information of the target subject through the customer number of the target subject, extract the institution information of the target subject from the certificate information, and obtain the bidding document serial number through the user input parameters;

[0009] The identity data of the target subject corresponding to the query keyword is extracted from the identity data of the target subject; the keyword is the organization information of the target subject and the bidding document serial number;

[0010] Query the mapping relationship between subject roles and permissions to determine whether the subject role of the target subject has the permission to call the smart contract to be called;

[0011] If yes, the smart contract to be called is executed according to the parameters passed in by the user.

[0012] In a possible implementation, the method further includes:

[0013] The identity data of the subject is saved, wherein the identity data of the subject includes the subject's institutional information, the bidding document serial number, the subject name and the subject role, wherein the subject role includes the bookkeeper, investor or administrator.

[0014] In a possible implementation, the method further includes:

[0015] The mapping relationship between the subject role and the authority is saved, and the authority includes the callable smart contract corresponding to the subject role; wherein the callable smart contract corresponding to the bookkeeper includes the offer smart contract, the subscription smart contract and the placement smart contract; the callable smart contract corresponding to the investor includes the subscription smart contract and the placement query smart contract; the callable smart contract corresponding to the administrator includes the subject smart contract.

[0016] In one possible implementation, the subject-type smart contracts include a subject creation smart contract, a subject deletion smart contract, a subject modification smart contract, and a subject query smart contract; the offer-type smart contracts include an offer creation smart contract, an offer modification smart contract, an offer deletion smart contract, and an offer query smart contract; the subscription-type smart contracts include a subscription creation smart contract, a subscription modification smart contract, a subscription deletion smart contract, and a subscription query smart contract; the allocation-type smart contracts include an allocation calculation smart contract, an allocation confirmation smart contract, an allocation modification smart contract, an allocation deletion smart contract, and an allocation query smart contract.

[0017] In a possible implementation, the bond issuance alliance chain includes a subject node used by the subject and an administrator node used by the administrator; the identity data of the subject is stored, including:

[0018] The subject node submits a creation request to the administrator node; the creation request includes the subject's organization information, tender document serial number, subject name and subject role;

[0019] The administrator node calls the subject query smart contract through the subject's organization information and tender document serial number to check whether the subject exists;

[0020] If not, the administrator node calls the subject to create a smart contract and saves the identity data of the subject in the bond issuance alliance chain.

[0021] In a possible implementation, the bond issuance alliance chain includes a subject node used by a subject, the subject node includes an investor node and a bookkeeper node, and the method further includes:

[0022] Distribute a corresponding private key to the subject according to the subject role and the bidding document serial number of the subject;

[0023] The investor node uses the access structure tree corresponding to the subscription data to encrypt the subscription data by attributes, and generates a ciphertext of the subscription data;

[0024] The investor node records the ciphertext of the subscription data on the bond issuance alliance chain;

[0025] The bookkeeper node obtains the ciphertext of the subscription data corresponding to each of the investor nodes from the bond issuance consortium chain;

[0026] The bookkeeper node uses its own private key to decrypt the ciphertext of the subscription data corresponding to each of the investor nodes. If the bookkeeper node meets the attributes of the access structure tree corresponding to the subscription data, the subscription data corresponding to each of the investor nodes is obtained by decryption;

[0027] The bookkeeper node completes the placement calculation according to the subscription data corresponding to each of the investor nodes and generates a placement result;

[0028] The bookkeeper node uses the access structure tree corresponding to the placement result to encrypt the placement result by attributes, and generates a ciphertext of the placement result;

[0029] The bookkeeper node records the encrypted version of the placement result on the bond issuance alliance chain.

[0030] In a possible implementation, the investor node records the ciphertext of the subscription data on the bond issuance alliance chain, including:

[0031] The investor node calls the subscription creation smart contract and records the encrypted subscription data on the bond issuance alliance chain;

[0032] The bookkeeper node obtains the ciphertext of the subscription data corresponding to each of the investor nodes from the bond issuance alliance chain, including:

[0033] The bookkeeper node calls the subscription query smart contract to obtain the ciphertext of the subscription data corresponding to each of the investor nodes from the bond issuance consortium chain;

[0034] The bookkeeper node completes the placement calculation according to the subscription data corresponding to each of the investor nodes and generates a placement result, including:

[0035] The bookkeeper node calls the placement calculation smart contract to complete the placement calculation according to the subscription data corresponding to each of the investor nodes and generate the placement result;

[0036] The bookkeeper node records the ciphertext of the placement result on the bond issuance alliance chain, including:

[0037] The bookkeeper node calls the placement confirmation smart contract and records the ciphertext of the placement result on the bond issuance alliance chain.

[0038] In a possible implementation, the method further includes:

[0039] The investor node obtains the ciphertext of the allocation result from the bond issuance consortium chain;

[0040] The investor node uses its own private key to decrypt the ciphertext of the allocation result. If the investor node meets the attributes of the access structure tree corresponding to the allocation result, the allocation result is obtained by decryption.

[0041] In a possible implementation, the investor node obtains the ciphertext of the placement result from the bond issuance consortium chain, including:

[0042] The investor node allocation query smart contract obtains the ciphertext of the allocation result from the bond issuance alliance chain.

[0043] A bond issuance consortium chain, the bond issuance consortium chain is used for:

[0044] Obtaining a smart contract call request of a target entity; the smart contract call request includes the customer number of the target entity, the smart contract to be called, and the parameters passed in by the user; the target entity is any entity in the bond issuance alliance chain;

[0045] Query the certificate information of the target subject through the user number of the target subject, extract the organization information of the target subject from the certificate information, and obtain the bidding document serial number through the user input parameters;

[0046] The identity data of the target subject corresponding to the query keyword is extracted from the identity data of the target subject; the keyword is the organization information of the target subject and the bidding document serial number;

[0047] Query the mapping relationship between subject roles and permissions to determine whether the subject role of the target subject has the permission to call the smart contract to be called;

[0048] If yes, the smart contract to be called is executed according to the parameters passed in by the user.

[0049] It can be seen that the embodiments of the present application have the following beneficial effects:

[0050] The embodiment of the present application pre-stores the identity data of each subject. When a target subject calls a smart contract, the target subject's institutional information and tender document serial number can be queried through its customer number, thereby determining its subject role. According to the mapping relationship between subject roles and permissions, it can be determined whether the target subject has the authority to call the smart contract, and the smart contract is executed when it is determined that it has the authority. At the same time, the business data is protected by an attribute encryption algorithm based on a ciphertext strategy, and a decryption key is generated for the subject using the subject role and tender document serial number to ensure that different business data is only disclosed to the corresponding subject role. In the above manner, different permissions to call smart contracts and shared account data access rights can be assigned to different subjects, thereby realizing the management of the subject's authority to operate the bond issuance alliance chain. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 A schematic diagram of an exemplary scenario provided for an embodiment of the present application;

[0052] Figure 2 A flowchart of a method for managing subject rights in a bond issuance alliance chain provided in an embodiment of the present application;

[0053] Figure 3 A subscription data access structure tree provided for the embodiment of the present application;

[0054] Figure 4 A distribution data access structure tree provided in an embodiment of the present application. DETAILED DESCRIPTION

[0055] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the embodiments of the present application are further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0056] In order to facilitate understanding and explanation of the technical solutions provided by the embodiments of the present application, the background technology of the embodiments of the present application is first introduced below.

[0057] In the existing technology, the user permissions in the alliance chain are single, and it does not support granting different business operation permissions to different issuers. For example, the bookkeeper can only publish offer information on the alliance chain, investors can only record bond subscription data on the alliance chain, and administrators can only create the above two types of entities on the alliance chain. At the same time, it does not support granting different bond issuance data access rights to different accounting nodes. For example, investors can act as accounting nodes, but the existing alliance chain cannot set permissions to prevent them from seeing other investors' subscription data.

[0058] Therefore, on the one hand, how to assign different business operation permissions to each issuing entity, and on the other hand, how to encrypt the issuance business data, and then grant different accounting nodes decryption permissions for different data, so as to prevent the full node entity from bypassing the contract to obtain sensitive bond issuance data, is an urgent problem to be solved.

[0059] Based on this, the embodiment of the present application provides a method for managing the subject rights in a bond issuance alliance chain and a bond issuance alliance chain. The embodiment of the present application can allocate different alliance chain operation rights and ciphertext decryption rights to different subjects according to the specific bond tender document serial number, respectively solving the problem that unauthorized subjects call smart contract interfaces to disrupt the bond issuance process and the problem that unauthorized node subjects bypass smart contracts to obtain sensitive bond data. It includes: (1) designing the identity data structure of the subject on the alliance chain, managing the subject identity through smart contracts, and using the mapping relationship between subject roles and rights to complete the process of granting and identifying the subject's rights to operate the bond issuance alliance chain, completing the storage of the subject's identity information on the alliance chain ledger, and supporting the subject to use a certificate to switch different roles in different issued bonds, thereby realizing the management of the subject's rights to operate the bond issuance alliance chain. (2) By designing a reasonable access tree structure, the sensitive data in the ledger is attribute-encrypted based on the ciphertext strategy, and the decryption rights of the corresponding ciphertext ledger data are allocated to the subject according to the subject role, thereby realizing fine-grained on-chain data access control. That is, permissions are set according to the subject's business role to control the subject's business operations and access to data. The subject is granted business operation permissions through smart contract calls, and the subject is granted corresponding data access permissions through encryption.

[0060] In order to facilitate understanding of the subject authority management method in the bond issuance alliance chain provided in the embodiment of the present application, combined with Figure 1 The exemplary application scenarios are described below. Figure 1 A schematic diagram of an exemplary scenario provided for an embodiment of the present application.

[0061] The subject (or the subject role of the subject) in the bond issuance alliance chain can include bookkeepers, investors or administrators. Each subject can serve as a bookkeeping node in the bond issuance alliance chain, and there are bookkeeper nodes, investor nodes and administrator nodes in the bond issuance alliance chain. The bookkeeper node, investor node and administrator node can all call the smart contract in the bond issuance alliance chain according to the authority. The bond issuance alliance chain has the function of subject authority management, which can specifically control the subject's business operations and data access. The account book data of the bond issuance alliance chain is stored on their respective nodes.

[0062] It should be noted that Figure 1 The block diagram shown is only used as an example for explanation, and the subject authority management method in the bond issuance alliance chain provided in the embodiment of the present application is not limited to the above example.

[0063] Based on the above description, the embodiment of the present application provides a specific implementation method of a subject authority management method in a bond issuance alliance chain.

[0064] In a method for managing subject authority in a bond issuance alliance chain provided in an embodiment of the present application, the subject's identity data can be saved in the alliance chain. The subject's identity data includes the subject's institutional information, tender document serial number, subject name and subject role. The subject role includes bookkeeper, investor or administrator.

[0065] The subject's identity data structure includes its institutional information, tender document serial number (i.e., bond issuance number), subject name, subject role, etc. Specifically, the subject roles of the subject in the bond issuance alliance chain can be divided into three types according to the business: bookkeeper, investor, and administrator. The subject can have different subject roles in different issued bonds, and there is only one subject role in each issued bond, that is, one subject can correspond to multiple tender document serial numbers, where each tender document serial number corresponds to one subject role.

[0066] In a possible implementation, the mapping relationship between subject roles and permissions can also be saved in the alliance chain. Permissions include callable smart contracts corresponding to subject roles; among them, the callable smart contracts corresponding to bookkeepers include offer smart contracts, subscription smart contracts, and allocation smart contracts; the callable smart contracts corresponding to investors include subscription smart contracts and allocation query smart contracts; the callable smart contracts corresponding to administrators include subject smart contracts.

[0067] The subject-type smart contracts include the subject creation smart contract, the subject deletion smart contract, the subject modification smart contract and the subject query smart contract; the offer-type smart contracts include the offer creation smart contract, the offer modification smart contract, the offer deletion smart contract and the offer query smart contract; the subscription-type smart contracts include the subscription creation smart contract, the subscription modification smart contract, the subscription deletion smart contract and the subscription query smart contract; the allocation-type smart contracts include the allocation calculation smart contract, the allocation confirmation smart contract, the allocation modification smart contract, the allocation deletion smart contract and the allocation query smart contract.

[0068] That is, when the bond issuance alliance chain is initialized, the subject of the administrator role has been created. The subject-class smart contracts that manage the subject identity include: subject creation, subject deletion, subject modification, and subject query. These four subject-class smart contracts complete the addition, deletion, modification, and query of the subject identity respectively. The operation of the bond issuance alliance chain is completed through business smart contracts, including the following 13: offer creation, offer modification, offer deletion, offer query, subscription creation, subscription modification, subscription deletion, subscription query, allocation calculation, allocation confirmation, allocation modification, allocation deletion, and allocation query. Among them, offer creation, offer modification, offer deletion, and offer query belong to offer-class smart contracts, subscription creation, subscription modification, subscription deletion, and subscription query belong to subscription-class smart contracts, and allocation calculation, allocation confirmation, allocation modification, allocation deletion, and allocation query belong to allocation-class smart contracts.

[0069] The mapping relationship between subject roles and permissions is as follows: the bookkeeper has the permission to call offer smart contracts, subscription smart contracts, and placement smart contracts; the investor has the permission to call subscription smart contracts and placement query smart contracts; the administrator has the permission to call subject smart contracts.

[0070] See also Figure 2 , Figure 2 This is a flowchart of a method for managing subject rights in a bond issuance alliance chain provided in an embodiment of the present application, and the method is applied to a bond issuance alliance chain. Figure 2 As shown, the method includes S201-S205:

[0071] S201: Obtain the smart contract call request of the target entity; the smart contract call request includes the customer number of the target entity, the smart contract to be called, and the parameters passed in by the user; the target entity is any entity in the bond issuance alliance chain.

[0072] The target subject that needs to call the smart contract submits a smart contract call request to the bond issuance consortium chain through the subject node, and the bond issuance consortium chain can obtain the smart contract call request of the target subject. Among them, the target subject is any subject in the bond issuance consortium chain. The smart contract call request includes the customer number of the target subject, the smart contract to be called, and the user-input parameter args. The customer number of the target subject can uniquely identify the target subject, such as the certificate number of the target subject. The smart contract to be called can be represented by the stub chain code name and the function business smart contract name.

[0073] S202: query the target subject's certificate information through the target subject's customer number, extract the target subject's organization information from the certificate information, and obtain the bidding document serial number through the user-input parameters.

[0074] In actual applications, the bond issuance consortium chain obtains the target entity's certificate information from the target entity's customer number through the system's GetInvoker function, and extracts the institution information ORG from the certificate information; at the same time, the bond issuance consortium chain obtains the corresponding tender document serial number Zbsxh through the user-input parameter args.

[0075] S203: Query the identity data of the target subject corresponding to the keyword, and extract the subject role of the target subject from the identity data of the target subject; the keywords are the organization information of the target subject and the bidding document serial number.

[0076] The identity data of all subjects are recorded on the bond issuance alliance chain, and the subject's authority can be determined by querying the identity data of the subject on the chain. The bond issuance alliance chain obtains the identity data of the target subject through the organization information ORG and the bidding document serial number Zbsxh, and extracts the subject role from the identity data of the target subject.

[0077] S204: Query the mapping relationship between subject roles and permissions to determine whether the subject role of the target subject has the permission to call the smart contract to be called.

[0078] S205: If yes, the smart contract to be called is executed according to the parameters input by the user.

[0079] The mapping relationship between subject roles and permissions is used to determine whether the target subject can call the smart contract to be called. If not, an error message is returned. Otherwise, the user-input parameter args is passed in and the smart contract to be called is executed.

[0080] In view of the problem that the current alliance chain has a single authority management and cannot provide access rights management at the chain code level for different bond issuers, the embodiment of the present application proposes a method for managing the authority of the alliance chain for subject operation of bond issuance. In the embodiment of the present application, the identity data of each subject is pre-saved. When a target subject calls a smart contract, the target subject's institutional information and tender document serial number can be queried through the smart contract call request sent by it. The identity data of the target subject can be queried through the target subject's institutional information and tender document serial number, and the subject role of the target subject can be extracted from it. According to the mapping relationship between the subject role and the authority, it can be determined whether the target subject has the authority to call the smart contract, and the smart contract will be executed when it is determined that it has the authority. In the above manner, different permissions to call smart contracts can be assigned to different subjects, thereby realizing the management of the subject's authority to operate the bond issuance alliance chain.

[0081] In one possible implementation, the bond issuance consortium chain includes a subject node used by the subject and an administrator node used by the administrator; the administrator subject is created when the consortium chain bond issuance system is started, and only the administrator has the ability to create other types of subjects. Therefore, the identity data of the subject can be created through the administrator node. The specific implementation of saving the identity data of the subject can include A1-A4:

[0082] A1: The subject node submits a creation request to the administrator node; the creation request includes the subject's organization information, tender document serial number, subject name, and subject role.

[0083] The subject node submits a creation request. In actual applications, the content of the creation request is Value = {organization information: ORG, bidding document serial number: Zbsxh, subject name: CustName, subject role: Role}.

[0084] A2: The administrator node calls the subject query smart contract through the subject's organizational information and tender document serial number to check whether the subject exists.

[0085] The administrator constructs a composite keyword key=ORG+Zbsxh, calls the subject to query the smart contract, and retrieves whether the subject on the chain exists through the key. If it exists, it returns an error that the subject exists and the subject cannot be created. Otherwise, continue to execute A3.

[0086] A3: If not, the administrator node calls the subject to create a smart contract and saves the subject's identity data in the bond issuance consortium chain.

[0087] The administrator node calls the subject to create a smart contract, takes the subject's organization information and tender document serial number as the composite keyword key, and stores the subject's identity data as the value on the alliance chain, so that the subject's role can be uniquely retrieved by the key; where key = ORG + Zbsxh, Value = {organization information: ORG, tender document serial number: Zbsxh, subject name: CustName, subject role: Role, creation time: CreateTime, modification time: UpdateTime, operation time: OperateTime}.

[0088] In the process of creating the subject identity, only the administrator can call the subject class smart contract, so the subject needs to send an identity creation request to the administrator node through the subject node. The administrator node first queries whether the subject has created an identity related to this bond issuance on the alliance chain. If the subject's identity data exists on the chain, the identity creation application will be rejected. Otherwise, the subject's identity will be created on the chain according to its real identity in this bond issuance. In this way, the subject's identity data is saved on the chain to facilitate the subject's authority management.

[0089] In the prior art, each accounting node stores the same bond issuance subject data and business data. If these data are stored in plain text, it will cause unfair bond issuance. Therefore, the embodiment of the present application further proposes a fine-grained access control method for encrypted ledger data. In some possible implementations, the bond issuance alliance chain includes a subject node used by the subject, and the subject node includes an investor node and a bookkeeping manager node. Based on the above embodiment, it can also include B1-B8:

[0090] B1: Distribute the corresponding private key to the subject according to the subject's subject role and tender document serial number.

[0091] The administrator selects the bilinear map e(·,·) on the group G0 according to the input security parameters, the member of G0 is g, the order is a prime number p, and randomly selects elements α, β∈Z in the finite field p , the system public key is calculated as pk = G0, g, h = g β ,f=g 1 / β ,e(g,g) α , and then calculate the master key as mk = (β, g α ) to complete the initialization.

[0092] Randomly select r,r1,r2←Z p , the hash function H:{0,1}*→G0 that maps the attribute value to the element on the group G0, uses the master key mk to calculate the attribute private key for the user whose main role (investor, bookkeeper) attribute is y1 and whose bidding document serial number attribute is y2 The corresponding private keys are then distributed to the principals.

[0093] B2: The investor node uses the access structure tree corresponding to the subscription data to encrypt the attributes of the subscription data and generate the ciphertext of the subscription data.

[0094] Designed as Figure 3 , Figure 4 The access structure tree, Figure 3 The access structure tree corresponding to the purchase data. Figure 3 For the access structure tree corresponding to the placement data, construct the polynomial q starting from the root node R, R' x , randomly select s,s′∈Z p , set the degree of the polynomial to d x =k x -1, where k x is the decryption threshold, satisfying q R (0) = s, q R′ (0) = s′, q x (0) = q parent(x) (index(x)), where index(x) is the position of the node in its parent node.

[0095] Assume that T is Figure 3 Access the leaf node set of the tree τ, and then calculate and generate the ciphertext of the subscription data Pur

[0096] B3: The investor node records the encrypted subscription data on the bond issuance alliance chain.

[0097] The investor node calls the subscription creation smart contract and records the encrypted subscription data on the bond issuance alliance chain.

[0098] B4: The bookkeeper node obtains the ciphertext of the subscription data corresponding to each investor node from the bond issuance alliance chain.

[0099] The bookkeeper node calls the subscription query smart contract to obtain the ciphertext CT of the subscription data corresponding to each investor node from the bond issuance alliance chain. Pur .

[0100] B5: The bookkeeper node uses its own private key to decrypt the ciphertext of the subscription data corresponding to each investor node. If the bookkeeper node meets the attributes of the access structure tree corresponding to the subscription data, the subscription data corresponding to each investor node is decrypted.

[0101] Enter the private key SK and purchase the ciphertext CT Pur , select the attribute y in the bookkeeper attribute set Y one by one i ∈Y, if yi The same is to access the attributes in the leaf set T of the tree τ, then recursively calculate Otherwise, calculate DecryptNode(CT Pur ,SK,y i )=⊥. If the attributes of the bookkeeper satisfy the access policy, then the following equation holds true: So that the subscription plaintext can be decrypted

[0102] The subscription data of an investor can only be decrypted by the bookkeeper corresponding to the bond and the investor. If the bookkeeper node meets the attributes of the access structure tree corresponding to the subscription data, the subscription data corresponding to the corresponding investor node can be decrypted.

[0103] B6: The bookkeeper node completes the allocation calculation based on the subscription data corresponding to each investor node and generates the allocation result.

[0104] The bookkeeper node calls the allocation calculation smart contract, completes the allocation calculation according to the subscription data corresponding to each investor node, and generates the allocation result.

[0105] B7: The bookkeeper node uses the access structure tree corresponding to the allocation result to encrypt the attributes of the allocation result and generate the ciphertext of the allocation result.

[0106] Assume that T' is Figure 4 Visit the leaf node set of the tree τ′, and calculate the ciphertext of the placement result Rat

[0107]

[0108] B8: The bookkeeper node records the ciphertext of the allocation results on the bond issuance alliance chain.

[0109] The bookkeeper node calls the placement confirmation smart contract and records the encrypted placement results on the bond issuance alliance chain.

[0110] Then the investor node can obtain the ciphertext of the placement result from the bond issuance alliance chain. If the placement is obtained, the investor node can decrypt the ciphertext of the placement result. Based on the above embodiment, C1-C2 may also be included:

[0111] C1: The investor node obtains the ciphertext of the allocation results from the bond issuance consortium chain.

[0112] The investor node allocation query smart contract obtains the ciphertext of the allocation result from the bond issuance consortium chain.

[0113] C2: The investor node uses its own private key to decrypt the ciphertext of the allocation result. If the investor node meets the attributes of the access structure tree corresponding to the allocation result, the allocation result is decrypted.

[0114] Enter the private key SK and purchase the ciphertext CT Rat , select the attribute y in the investor attribute set Y one by one i ∈Y, if y i To access the attributes in the leaf set T' of the tree τ', we can recursively calculate Otherwise, calculate DecryptNode(CT Rat ,SK,y i )=⊥. If the attributes of the bookkeeper satisfy the access policy, then recursively calculating to the root node yields the following equation: So that the allocation results can be decrypted That is, if the investor node meets the attributes of the access structure tree corresponding to the allocation result, the allocation result is obtained by decryption.

[0115] By designing a reasonable access tree structure, sensitive data in the ledger is encrypted based on the ciphertext policy, and decryption permissions for corresponding ciphertext ledger data are assigned to the subject according to the subject role, thereby achieving fine-grained on-chain data access control.

[0116] Based on the method for managing subject rights in a bond issuance alliance chain provided in the above embodiment, the embodiment of the present application further provides a bond issuance alliance chain, wherein the bond issuance alliance chain is used to:

[0117] Obtaining a smart contract call request of a target entity; the smart contract call request includes the customer number of the target entity, the smart contract to be called, and the parameters passed in by the user; the target entity is any entity in the bond issuance alliance chain;

[0118] Query the certificate information of the target subject through the customer number of the target subject, extract the institution information of the target subject from the certificate information, and obtain the bidding document serial number through the user input parameters;

[0119] The identity data of the target subject corresponding to the query keyword is extracted from the identity data of the target subject; the keyword is the organization information of the target subject and the bidding document serial number;

[0120] Query the mapping relationship between subject roles and permissions to determine whether the subject role of the target subject has the permission to call the smart contract to be called;

[0121] If yes, the smart contract to be called is executed according to the parameters passed in by the user.

[0122] In a possible implementation, the bond issuance consortium chain is also used to:

[0123] The identity data of the subject is saved, wherein the identity data of the subject includes the subject's institutional information, the bidding document serial number, the subject name and the subject role, wherein the subject role includes the bookkeeper, investor or administrator.

[0124] In one possible implementation, the bond issuance consortium chain is also used to:

[0125] The mapping relationship between the subject role and the authority is saved, and the authority includes the callable smart contract corresponding to the subject role; wherein the callable smart contract corresponding to the bookkeeper includes the offer smart contract, the subscription smart contract and the placement smart contract; the callable smart contract corresponding to the investor includes the subscription smart contract and the placement query smart contract; the callable smart contract corresponding to the administrator includes the subject smart contract.

[0126] In one possible implementation, the subject-type smart contracts include a subject creation smart contract, a subject deletion smart contract, a subject modification smart contract, and a subject query smart contract; the offer-type smart contracts include an offer creation smart contract, an offer modification smart contract, an offer deletion smart contract, and an offer query smart contract; the subscription-type smart contracts include a subscription creation smart contract, a subscription modification smart contract, a subscription deletion smart contract, and a subscription query smart contract; the allocation-type smart contracts include an allocation calculation smart contract, an allocation confirmation smart contract, an allocation modification smart contract, an allocation deletion smart contract, and an allocation query smart contract.

[0127] In a possible implementation, the bond issuance alliance chain includes a subject node used by the subject and an administrator node used by the administrator;

[0128] The subject node is used to submit a creation request to the administrator node; the creation request includes the subject's organization information, tender document serial number, subject name and subject role;

[0129] The administrator node is used to call the subject query smart contract through the subject's organization information and the bidding document serial number to query whether the subject exists;

[0130] The administrator node is also used to call the subject to create a smart contract if the subject does not exist, and save the identity data of the subject in the bond issuance alliance chain.

[0131] In a possible implementation, the bond issuance alliance chain includes a subject node used by the subject, and the subject node includes an investor node and a bookkeeper node;

[0132] The bond issuance consortium chain is also used to distribute corresponding private keys to the subject according to the subject role and the bidding document serial number of the subject;

[0133] The investor node is used to encrypt the subscription data by using the access structure tree corresponding to the subscription data to generate a ciphertext of the subscription data;

[0134] The investor node is also used to record the ciphertext of the subscription data on the bond issuance alliance chain;

[0135] The bookkeeper node is used to obtain the ciphertext of the subscription data corresponding to each of the investor nodes from the bond issuance alliance chain;

[0136] The bookkeeper node is further used to decrypt the ciphertext of the subscription data corresponding to each of the investor nodes using its own private key. If the bookkeeper node meets the attributes of the access structure tree corresponding to the subscription data, the subscription data corresponding to each of the investor nodes is obtained by decryption;

[0137] The bookkeeper node is also used to complete the placement calculation according to the subscription data corresponding to each of the investor nodes and generate the placement result;

[0138] The bookkeeper node is further used to encrypt the attributes of the placement result using the access structure tree corresponding to the placement result to generate a ciphertext of the placement result;

[0139] The bookkeeper node is also used to record the encrypted version of the placement result on the bond issuance alliance chain.

[0140] In a possible implementation, the investor node is specifically used to call the subscription creation smart contract and record the ciphertext of the subscription data on the bond issuance alliance chain;

[0141] The bookkeeper node is specifically used to call the subscription query smart contract to obtain the ciphertext of the subscription data corresponding to each of the investor nodes from the bond issuance alliance chain;

[0142] The bookkeeper node is specifically used to call the placement calculation smart contract, complete the placement calculation according to the subscription data corresponding to each of the investor nodes, and generate the placement result;

[0143] The bookkeeper node is specifically used to call the placement confirmation smart contract and record the ciphertext of the placement result on the bond issuance alliance chain.

[0144] In a possible implementation, the investor node is further used to obtain the ciphertext of the placement result from the bond issuance consortium chain;

[0145] The investor node is also used to decrypt the ciphertext of the allocation result using its own private key. If the investor node meets the attributes of the access structure tree corresponding to the allocation result, the allocation result is obtained by decryption.

[0146] In a possible implementation, the investor node is specifically used for the allocation query smart contract to obtain the ciphertext of the allocation result from the bond issuance consortium chain.

[0147] It should be noted that the technical details of the bond issuance alliance chain provided in the embodiment of the present application can be found in the relevant embodiments of the subject authority management method in the above-mentioned bond issuance alliance chain, which will not be repeated here.

[0148] The embodiment of the present application pre-stores the identity data of each subject. When a target subject calls a smart contract, the target subject's institutional information and tender document serial number can be queried through the smart contract call request sent by it. The identity data of the target subject can be queried through the target subject's institutional information and tender document serial number, and the subject role of the target subject can be extracted from it. According to the mapping relationship between the subject role and the authority, it can be determined whether the target subject has the authority to call the smart contract, and the smart contract is executed when it is determined that there is authority. Through the above method, different permissions to call smart contracts can be assigned to different subjects, thereby realizing the management of the subject's authority to operate the bond issuance alliance chain. In addition, by designing a reasonable access tree structure, the sensitive data in the ledger is encrypted based on the ciphertext strategy, and the decryption authority of the corresponding ciphertext ledger data is assigned to the subject according to the subject role, thereby realizing fine-grained on-chain data access control.

[0149] It should be noted that the various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments can be referred to each other. For the system or device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.

[0150] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0151] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0152] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0153] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for managing subject rights in a bond issuance alliance chain, characterized in that: The method is applied to a bond issuance alliance chain, the bond issuance alliance chain includes a main node used by a subject, the main node includes an investor node and a bookkeeper node, and the method includes: Obtaining a smart contract call request of a target entity; the smart contract call request includes the customer number of the target entity, the smart contract to be called, and the parameters passed in by the user; the target entity is any entity in the bond issuance alliance chain; Query the certificate information of the target subject through the customer number of the target subject, extract the institution information of the target subject from the certificate information, and obtain the bidding document serial number through the user input parameters; The identity data of the target subject corresponding to the query keyword is extracted from the identity data of the target subject; the keyword is the organization information of the target subject and the bidding document serial number; Query the mapping relationship between subject roles and permissions to determine whether the subject role of the target subject has the permission to call the smart contract to be called; If yes, execute the smart contract to be called according to the parameters passed in by the user; Distribute a corresponding private key to the subject according to the subject role and the bidding document serial number of the subject; The investor node uses the access structure tree corresponding to the subscription data to encrypt the subscription data by attributes, and generates a ciphertext of the subscription data; The investor node records the ciphertext of the subscription data on the bond issuance alliance chain; The bookkeeper node obtains the ciphertext of the subscription data corresponding to each of the investor nodes from the bond issuance consortium chain; The bookkeeper node uses its own private key to decrypt the ciphertext of the subscription data corresponding to each of the investor nodes. If the bookkeeper node meets the attributes of the access structure tree corresponding to the subscription data, the subscription data corresponding to each of the investor nodes is obtained by decryption; The bookkeeper node completes the placement calculation according to the subscription data corresponding to each of the investor nodes and generates a placement result; The bookkeeper node uses the access structure tree corresponding to the placement result to encrypt the placement result by attributes, and generates a ciphertext of the placement result; The bookkeeper node records the encrypted version of the placement result on the bond issuance alliance chain.

2. The method according to claim 1, characterized in that The method further comprises: The identity data of the subject is saved, wherein the identity data of the subject includes the subject's institutional information, the bidding document serial number, the subject name and the subject role, wherein the subject role includes the bookkeeper, investor or administrator.

3. The method according to claim 2, characterized in that The method further comprises: The mapping relationship between the subject role and the authority is saved, and the authority includes the callable smart contract corresponding to the subject role; wherein the callable smart contract corresponding to the bookkeeper includes the offer smart contract, the subscription smart contract and the placement smart contract; the callable smart contract corresponding to the investor includes the subscription smart contract and the placement query smart contract; the callable smart contract corresponding to the administrator includes the subject smart contract.

4. The method according to claim 3, characterized in that The subject-type smart contracts include subject creation smart contracts, subject deletion smart contracts, subject modification smart contracts and subject query smart contracts; the offer-type smart contracts include offer creation smart contracts, offer modification smart contracts, offer deletion smart contracts and offer query smart contracts; the subscription-type smart contracts include subscription creation smart contracts, subscription modification smart contracts, subscription deletion smart contracts and subscription query smart contracts; the allocation-type smart contracts include allocation calculation smart contracts, allocation confirmation smart contracts, allocation modification smart contracts, allocation deletion smart contracts and allocation query smart contracts.

5. The method according to claim 2, characterized in that: The bond issuance alliance chain includes a subject node used by the subject and an administrator node used by the administrator; the identity data of the stored subject includes: The subject node submits a creation request to the administrator node; the creation request includes the subject's organization information, tender document serial number, subject name and subject role; The administrator node calls the subject query smart contract through the subject's organization information and tender document serial number to check whether the subject exists; If not, the administrator node calls the subject to create a smart contract and saves the identity data of the subject in the bond issuance alliance chain.

6. The method according to claim 1, characterized in that The investor node records the ciphertext of the subscription data on the bond issuance alliance chain, including: The investor node calls the subscription creation smart contract and records the encrypted subscription data on the bond issuance alliance chain; The bookkeeper node obtains the ciphertext of the subscription data corresponding to each of the investor nodes from the bond issuance alliance chain, including: The bookkeeper node calls the subscription query smart contract to obtain the ciphertext of the subscription data corresponding to each of the investor nodes from the bond issuance consortium chain; The bookkeeper node completes the placement calculation according to the subscription data corresponding to each of the investor nodes and generates a placement result, including: The bookkeeper node calls the placement calculation smart contract to complete the placement calculation according to the subscription data corresponding to each of the investor nodes and generate the placement result; The bookkeeper node records the ciphertext of the placement result on the bond issuance alliance chain, including: The bookkeeper node calls the placement confirmation smart contract and records the ciphertext of the placement result on the bond issuance alliance chain.

7. The method according to claim 1, characterized in that The method further comprises: The investor node obtains the ciphertext of the allocation result from the bond issuance consortium chain; The investor node uses its own private key to decrypt the ciphertext of the allocation result. If the investor node meets the attributes of the access structure tree corresponding to the allocation result, the allocation result is obtained by decryption.

8. The method according to claim 7, characterized in that The investor node obtains the ciphertext of the placement result from the bond issuance alliance chain, including: The investor node allocation query smart contract obtains the ciphertext of the allocation result from the bond issuance alliance chain.

9. A bond issuance alliance chain system, characterized in that: The bond issuance alliance chain system includes a subject node used by the subject, and the subject node includes an investor node and a bookkeeper node. The bond issuance alliance chain system is used to: Obtain the target subject's smart contract call request; the smart contract call request includes the target subject's customer number, the smart contract to be called, and the user input parameters; the target subject is any subject in the bond issuance alliance chain; Query the certificate information of the target subject through the user number of the target subject, extract the organization information of the target subject from the certificate information, and obtain the bidding document serial number through the user input parameters; The identity data of the target subject corresponding to the query keyword is extracted from the identity data of the target subject; the keyword is the organization information of the target subject and the bidding document serial number; Query the mapping relationship between subject roles and permissions to determine whether the subject role of the target subject has the permission to call the smart contract to be called; If yes, execute the smart contract to be called according to the parameters passed in by the user; Distribute a corresponding private key to the subject according to the subject role and the bidding document serial number of the subject; The investor node uses the access structure tree corresponding to the subscription data to encrypt the subscription data by attributes, and generates a ciphertext of the subscription data; The investor node records the ciphertext of the subscription data on the bond issuance alliance chain; The bookkeeper node obtains the ciphertext of the subscription data corresponding to each of the investor nodes from the bond issuance consortium chain; The bookkeeper node uses its own private key to decrypt the ciphertext of the subscription data corresponding to each of the investor nodes. If the bookkeeper node meets the attributes of the access structure tree corresponding to the subscription data, the subscription data corresponding to each of the investor nodes is obtained by decryption; The bookkeeper node completes the placement calculation according to the subscription data corresponding to each of the investor nodes and generates a placement result; The bookkeeper node uses the access structure tree corresponding to the placement result to encrypt the placement result by attributes, and generates a ciphertext of the placement result; The bookkeeper node records the encrypted version of the placement result on the bond issuance alliance chain.

Images