Permission configuration methods, devices, storage media and equipment in blockchain

Abstract

This application discloses a method, apparatus, storage medium, and device for configuring permissions in a blockchain, belonging to the field of blockchain technology. The method includes: receiving a data identifier of privacy data, a hash value of a permission list transaction on the blockchain, and configuration content sent by a data holder. The configuration content includes a user identifier and a permission identifier of the data accessor to be modified in the permission list. The permission identifier indicates whether the data accessor has permissions for the privacy data. The method also includes: finding the permission list corresponding to the data identifier and the hash value of the permission list transaction on the blockchain; configuring the permission list according to the configuration content; generating a new hash value of the permission list transaction on the blockchain based on the configured permission list; and feeding back the data identifier and the new hash value of the permission list transaction to the data holder. This application stores the permission list in the blockchain, preventing malicious tampering and improving the security of the permission list.

Description

Technical Field

[0001] This application relates to the field of blockchain technology, and in particular to a permission configuration method, apparatus, storage medium and device in a blockchain. Background Technology

[0002] With the development of blockchain technology, we can store some private data that requires controlled access on the blockchain and require off-chain read and write operations on such private data to be verified on the blockchain. In this way, only with the authorization of the data holder and the correct on-chain verification, the data accessor's operation on this private data can be regarded as real and valid, thereby ensuring the security of this private data operation process.

[0003] In related technologies, a permission list can be created in a database on a local device. This permission list contains the user identifier and permission identifier of the data access user. The permission identifier indicates whether the data access user has permissions for privacy data. When it is necessary to modify the data access user's permissions, the permission list in the database needs to be modified.

[0004] Since the permission list is stored in the database, the database may be maliciously tampered with, which could lead to the permission being maliciously altered and affect the security of the privacy data operation process. Summary of the Invention

[0005] This application provides a method, apparatus, storage medium, and device for configuring permissions in a blockchain, addressing the risk of malicious tampering when permission lists are stored in a local database, thereby compromising the security of privacy data. The technical solution is as follows:

[0006] On the one hand, a permission configuration method in a blockchain is provided, the method comprising:

[0007] The system receives a data identifier for privacy data sent by a data holder, a hash value for on-chain transactions of the permission list, and configuration content. The hash value for on-chain transactions of the permission list is a hash value generated based on the permission list. The configuration content includes the user identifier and permission identifier of the data accessor to be modified in the permission list. The permission identifier is used to indicate whether the data accessor has permissions for the privacy data.

[0008] Find the permission list on the blockchain that corresponds to the data identifier and the on-chain transaction hash value of the permission list;

[0009] Configure the permission list according to the configuration content, and generate the latest permission list on-chain transaction hash value based on the configured permission list;

[0010] The data identifier and the latest on-chain transaction hash value of the permission list are fed back to the data holder, so that the data holder can store the data identifier and the latest on-chain transaction hash value of the permission list accordingly.

[0011] In one possible implementation, configuring the permission list according to the configuration content includes:

[0012] Obtain the user identifier and permission identifier contained in the configuration content;

[0013] If the user identifier is not found in the permission list, then the user identifier and the permission identifier are added to the permission list accordingly to obtain the configured permission list.

[0014] In one possible implementation, the method further includes:

[0015] If the user identifier exists in the found permission list, then the permission identifier in the permission list corresponding to the user identifier is replaced with the permission identifier in the configuration content to obtain the configured permission list.

[0016] In one possible implementation, before the data identifier, the on-chain transaction hash value of the permission list, and the configuration content of the privacy data sent by the receiving data holder, the method further includes:

[0017] Receive privacy data sent by the data holder, store the privacy data, and return the data identifier of the privacy data to the data holder;

[0018] Receive an initial permission list sent by the data holder, the permission list containing the data identifier of the privacy data, the user identifier of the data accessor, and the access permissions;

[0019] Generate on-chain transaction hash values ​​for the permission list based on the permission list, and store the permission list and the on-chain transaction hash values ​​for the permission list.

[0020] The on-chain transaction hash value of the permission list is fed back to the data holder so that the data holder can store the data identifier and the on-chain transaction hash value of the permission list accordingly.

[0021] In one possible implementation, storing the permission list and the on-chain transaction hashes of the permission list includes: storing the permission list and the on-chain transaction hashes of the permission list in a block in the form of a Merkle tree, and storing the Merkle root of the Merkle tree in the block header of the block;

[0022] The step of searching for the permission list on the blockchain that corresponds to the data identifier and the on-chain transaction hash value of the permission list includes: traversing the Merkle root in each block header on the blockchain; if a Merkle root matching the on-chain transaction hash value of the permission list is found, then searching for the permission list corresponding to the data identifier and the on-chain transaction hash value of the permission list in the block corresponding to the block header.

[0023] In one possible implementation, the privacy data is credentials, access control information, or sensitive information.

[0024] In one possible implementation, the method further includes:

[0025] Receive data identifiers, on-chain transaction hashes of the permission list, and user identifiers sent by data access users;

[0026] Locate the permission list stored on the blockchain that corresponds to the data identifier and the on-chain transaction hash value of the permission list;

[0027] Search the permission list for the permission identifier corresponding to the user identifier;

[0028] If the permission identifier indicates that the data accessor has permission for the privacy data, then the data accessor is fed back with authorization confirmation information for the privacy data, so that the data accessor can complete the corresponding access operation for the privacy data;

[0029] If the access identifier indicates that the data accessor does not have permission for the privacy data, then no authorization confirmation information for the privacy data will be sent to the data accessor.

[0030] In one possible implementation, the method further includes:

[0031] The system then receives the data identifier, the on-chain transaction hash value of the permission list, and the user identifier again from the data accessor.

[0032] Detect whether the time interval between the current time and the time of the last query by the data visitor is less than a predetermined duration;

[0033] If the time interval is less than or equal to the predetermined duration, the previous query result will be returned to the data visitor.

[0034] If the time interval is greater than the predetermined duration, the system searches the blockchain for the permission list corresponding to the data identifier and the on-chain transaction hash value of the permission list. It then searches the permission list for the permission identifier corresponding to the user identifier. If the permission identifier indicates that the data accessor has permission for the privacy data, the system sends authorization confirmation information for the privacy data to the data accessor, enabling the data accessor to complete the corresponding access operation for the privacy data. If the access identifier indicates that the data accessor does not have permission for the privacy data, the system does not send authorization confirmation information for the privacy data to the data accessor.

[0035] On the one hand, a permission configuration device in a blockchain is provided, the permission configuration device comprising:

[0036] The receiving module is used to receive the data identifier of the privacy data, the on-chain transaction hash value of the permission list, and the configuration content sent by the data holder. The on-chain transaction hash value of the permission list is a hash value generated based on the permission list. The configuration content includes the user identifier and permission identifier of the data accessor to be modified in the permission list. The permission identifier is used to indicate whether the data accessor has permission for the privacy data.

[0037] The lookup module is used to find the permission list on the blockchain that corresponds to the data identifier and the on-chain transaction hash value of the permission list;

[0038] The generation module is used to configure the permission list according to the configuration content, and generate the latest permission list on-chain transaction hash value based on the configured permission list;

[0039] The feedback module is used to feed back the data identifier and the latest on-chain transaction hash value of the permission list to the data holder, so that the data holder can store the data identifier and the latest on-chain transaction hash value of the permission list accordingly.

[0040] On the one hand, a computer-readable storage medium is provided, wherein at least one instruction is stored therein, the at least one instruction being loaded and executed by a processor to implement the permission configuration method in a blockchain as described above.

[0041] On one hand, a computer device is provided, the computer device including a processor and a memory, the memory storing at least one instruction, the instruction being loaded and executed by the processor to implement the permission configuration method in the blockchain as described above.

[0042] The beneficial effects of the technical solutions provided in this application include at least the following:

[0043] Because blockchain technology is secure, storing the permission list on the blockchain can prevent malicious tampering and improve its security. Furthermore, since every modification to the permission list is recorded on the blockchain, these modifications are traceable, further enhancing security.

[0044] Since the block header contains far less data than the block itself, searching for the permission list by traversing the block header can significantly save search time and improve performance compared to traversing each block. Attached Figure Description

[0045] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0046] Figure 1 This is a flowchart of a permission configuration method in a blockchain provided in one embodiment of this application;

[0047] Figure 2 This is a flowchart of a permission configuration method in a blockchain provided in one embodiment of this application;

[0048] Figure 3 This is a flowchart of a method for accessing privacy data in a blockchain according to an embodiment of this application;

[0049] Figure 4 This is a flowchart illustrating a permission configuration method provided in one embodiment of this application;

[0050] Figure 5 This is a structural block diagram of a permission configuration device in a blockchain provided in one embodiment of this application;

[0051] Figure 6 This is a structural block diagram of a permission configuration device in a blockchain provided in one embodiment of this application. Detailed Implementation

[0052] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the implementation methods of this application will be further described in detail below with reference to the accompanying drawings.

[0053] Please refer to Figure 1 This document illustrates a flowchart of a permission configuration method in a blockchain according to an embodiment of this application, which can be applied to smart contracts on a blockchain. The permission configuration method in the blockchain may include:

[0054] Step 101: Receive the data identifier of the privacy data, the on-chain transaction hash value of the permission list, and the configuration content sent by the data holder. The on-chain transaction hash value of the permission list is a hash value generated based on the permission list. The configuration content includes the user identifier and permission identifier of the data accessor to be modified in the permission list. The permission identifier is used to indicate whether the data accessor has permissions for the privacy data.

[0055] A data holder is the computer device used by the data holder, and a data accessor is the computer device used by the data accessor.

[0056] Data identifiers are used to uniquely identify private data.

[0057] The permission list contains multiple records, each with a user identifier and a permission identifier. The user identifier uniquely identifies a data accessor. The permission identifier indicates whether the data accessor has permission for privacy-related data. It can be set to two values ​​to indicate whether the user has permission for privacy-related data or not. For example, "true" can be set to indicate permission for privacy-related data, and "false" to indicate no permission; or "1" can be set to indicate permission for privacy-related data, and "0" to indicate no permission. Permissions for privacy-related data include, but are not limited to: read operation permission, write operation permission, and read-write operation permission.

[0058] The permission list can be stored in JSON format:

[0059] [{

[0060] ID:'user1',

[0061] Readable:true

[0062] },{

[0063] ID:'user2',

[0064] Readable: false

[0065] }]

[0066] The hash value of the permission list transaction is the hash value generated by the hash algorithm on the permission list when the permission list transaction is uploaded to the blockchain.

[0067] The configuration content refers to the content that needs to be configured (updated) on the permission list on the blockchain. For example, it can modify the permissions of a data access user, or add a data access user and its permissions.

[0068] Step 102: Locate the permission list on the blockchain that corresponds to the on-chain transaction hash value of the data identifier and permission list.

[0069] If the permission list and privacy data have a one-to-one relationship, the smart contract can directly find the permission list corresponding to the privacy data based on the on-chain transaction hash value of the permission list. If the permission list and privacy data have a one-to-many relationship, the smart contract can first find the corresponding permission list based on the on-chain transaction hash value of the permission list, and then find the partial permission list corresponding to the privacy data based on the data identifier.

[0070] Since the transaction hash values ​​on the permission list are in one-to-one correspondence with the permission list, the smart contract needs to regenerate the transaction hash values ​​on the permission list each time the permission list is configured and a new permission list is obtained.

[0071] Step 103: Configure the permission list according to the configuration content, and generate the latest permission list on-chain transaction hash value based on the configured permission list.

[0072] After obtaining the configured permission list, the smart contract needs to use a hash algorithm to recalculate the permission list and obtain the new permission list on-chain transaction hash value.

[0073] Step 104: Feed back the data identifier and the latest permission list on-chain transaction hash value to the data holder so that the data holder can store the data identifier and the latest permission list on-chain transaction hash value accordingly.

[0074] Among them, the on-chain transaction hash values ​​of the data identifier and permission list are stored in the data holder's database.

[0075] In summary, the permission configuration method in the blockchain provided in this application, due to the inherent security of the blockchain, can prevent malicious tampering of the permission list by storing it in the blockchain, thus improving the security of the permission list. Furthermore, since every modification to the permission list is recorded in the blockchain, modifications to the permission list are traceable, further enhancing the security of the permission list.

[0076] Please refer to Figure 2 This document illustrates a flowchart of a permission configuration method in a blockchain according to an embodiment of this application, which can be applied to smart contracts on a blockchain. The permission configuration method in the blockchain may include:

[0077] Step 201: Receive privacy data sent by the data holder, store the privacy data, and return the data identifier of the privacy data to the data holder.

[0078] A data holder is the computer device used by the data holder.

[0079] The privacy data mentioned in this embodiment may be credentials, access control information, or sensitive information.

[0080] Data identifiers are used to uniquely identify private data.

[0081] Step 202: Receive an initial permission list sent by the data holder. This permission list contains the data identifier of the privacy data, the user identifier of the data accessor, and the access permissions. The data accessor is the computer device used by the data accessing party.

[0082] The permission list contains multiple records, each with a user identifier and a permission identifier. The user identifier uniquely identifies a data accessor. The permission identifier indicates whether the data accessor has permission for privacy-related data. It can be set to two values ​​to indicate whether the user has permission for privacy-related data or not. For example, "true" can be set to indicate permission for privacy-related data, and "false" to indicate no permission; or "1" can be set to indicate permission for privacy-related data, and "0" to indicate no permission. Permissions for privacy-related data include, but are not limited to: read operation permission, write operation permission, and read-write operation permission.

[0083] Step 203: Generate the on-chain transaction hash value of the permission list based on the permission list, and store the permission list and the on-chain transaction hash value of the permission list.

[0084] The hash value of the permission list transaction is the hash value generated by the hash algorithm on the permission list when the permission list transaction is uploaded to the blockchain.

[0085] Specifically, storing the permission list and the hash value of the on-chain transactions of the permission list can include: storing the permission list and the hash value of the on-chain transactions of the permission list in the block in the form of a Merkle tree, and storing the Merkle root of the Merkle tree in the block header.

[0086] Step 204: Feed back the on-chain transaction hash value of the permission list to the data holder so that the data holder can store the data identifier and the on-chain transaction hash value of the permission list accordingly.

[0087] Smart contracts can feed back the transaction hash value of the permission list on the blockchain to the data holder. In this way, the data holder can obtain the data identifier and then store the data identifier and the transaction hash value of the permission list on the blockchain in the local database.

[0088] Step 205: Receive the data identifier of the privacy data, the on-chain transaction hash value of the permission list, and the configuration content sent by the data holder. The on-chain transaction hash value of the permission list is a hash value generated based on the permission list. The configuration content includes the user identifier and permission identifier of the data accessor to be modified in the permission list. The permission identifier is used to indicate whether the data accessor has permissions for the privacy data.

[0089] The configuration content refers to the content that needs to be configured (updated) on the permission list on the blockchain. For example, it can modify the permissions of a data access user, or add a data access user and its permissions.

[0090] Step 206: Locate the permission list on the blockchain that corresponds to the on-chain transaction hash value of the data identifier and permission list.

[0091] If the permission list and privacy data have a one-to-one relationship, the smart contract can directly find the permission list corresponding to the privacy data based on the on-chain transaction hash value of the permission list. If the permission list and privacy data have a one-to-many relationship, the smart contract can first find the corresponding permission list based on the on-chain transaction hash value of the permission list, and then find the partial permission list corresponding to the privacy data based on the data identifier.

[0092] Specifically, the process involves searching the blockchain for the permission list that corresponds to the hash value of the transaction on the data identifier and permission list. This includes traversing the Merkle root in the header of each block on the blockchain. If a Merkle root that matches the hash value of the transaction on the permission list is found, the process then searches for the permission list corresponding to the data identifier and the hash value of the transaction on the permission list in the block corresponding to the block header.

[0093] Since the block header contains far less data than the block itself, searching for the permission list by traversing the block header can significantly save search time and improve performance compared to traversing each block.

[0094] Since the transaction hash values ​​on the permission list are in one-to-one correspondence with the permission list, the smart contract needs to regenerate the transaction hash values ​​on the permission list each time the permission list is configured and a new permission list is obtained.

[0095] Step 207: Configure the permission list according to the configuration content, and generate the latest permission list on-chain transaction hash value based on the configured permission list.

[0096] Specifically, when the configuration involves adding a data access user and their permissions, the permission list is configured according to the configuration content. This may include: obtaining the user identifier and permission identifier contained in the configuration content; if the user identifier does not exist in the permission list, then the corresponding user identifier and permission identifier are added to the permission list to obtain the configured permission list.

[0097] For example, if the configuration includes "Id:'user3', Readable:true", and there is no user identified as 'user3' in the permission list, then the smart contract can add "Id:'user3', Readable:true" to the permission list.

[0098] Specifically, when the configuration involves modifying the permissions of a data access user, if a user identifier exists in the found permission list, the permission identifier in the configuration will replace the corresponding permission identifier in the permission list to obtain the configured permission list.

[0099] For example, if the configuration includes "Id:'user2', Readable:true", and "Id:'user2', Readable:false" already exists in the permission list, then the smart contract can change the value of the permission for 'user3' to true, that is, the content of the modified permission list will be "Id:'user2', Readable:true".

[0100] After obtaining the configured permission list, the smart contract needs to use a hash algorithm to recalculate the permission list and obtain the new permission list on-chain transaction hash value.

[0101] In this embodiment, the configuration of the permission list can be executed in the virtual machine through a smart contract, avoiding the security risks caused by modifying the permission list on the local device and improving the security of the permission list.

[0102] Step 208: Feed back the data identifier and the latest on-chain transaction hash value of the permission list to the data holder so that the data holder can store the data identifier and the latest on-chain transaction hash value of the permission list accordingly.

[0103] Among them, the on-chain transaction hash values ​​of the data identifier and permission list are stored in the data holder's database.

[0104] In summary, the permission configuration method in the blockchain provided in this application, due to the inherent security of the blockchain, can prevent malicious tampering of the permission list by storing it in the blockchain, thus improving the security of the permission list. Furthermore, since every modification to the permission list is recorded in the blockchain, modifications to the permission list are traceable, further enhancing the security of the permission list.

[0105] Since the block header contains far less data than the block itself, searching for the permission list by traversing the block header can significantly save search time and improve performance compared to traversing each block.

[0106] Please refer to Figure 3 When a data user needs to access private data, they can do so through the following steps:

[0107] Step 301: Receive the data identifier, the on-chain transaction hash value of the permission list, and the user identifier sent by the data accessor.

[0108] Here, the data identifier is the identifier of the private data that the data visitor needs to access, the on-chain transaction hash value of the permission list is the hash value of the permission list in which the data visitor's permissions are located, and the data identifier and the on-chain transaction hash value of the permission list can be sent by the data holder to the data visitor.

[0109] For example, when the private data is user A's advanced computer certificate, user A can send the data identifier and permission list of their advanced computer certificate to the company's HR manager B via email.

[0110] On-chain transaction hash value. During the sending process, user A can assign HR manager B the calculations for user A.

[0111] Grant read access to the advanced certificate (add HR Manager B's user ID and permissions to the permission list).

[0112] (The permission identifier of the computer advanced certificate) allows HR manager B to open the email and view user A's computer advanced certificate, which means sending a data identifier, the on-chain transaction hash value of the permission list, and HR manager B's user identifier to the smart contract.

[0113] Step 302: Locate the permission list on the blockchain that corresponds to the on-chain transaction hash value of the data identifier and permission list.

[0114] The search process is the same as that described in step 206, and will not be repeated here.

[0115] Step 303: Search for the permission identifier corresponding to the user identifier in the permission list.

[0116] Step 304: If the permission identifier indicates that the data accessor has permission for the privacy data, then the data accessor is provided with authorization confirmation information for the privacy data so that the data accessor can complete the corresponding access operation for the privacy data.

[0117] Step 305: If the access identifier indicates that the data accessor does not have permission for the privacy data, then no authorization confirmation information for the privacy data will be sent to the data accessor.

[0118] If user A leaves the company and wants to revoke read access to the advanced computer certificate previously sent to HR manager B, user A can change HR manager B's permission flag in the permission list to "does not have permission for the advanced computer certificate." HR manager B will then no longer be able to view user A's advanced computer certificate. Figure 4 As shown.

[0119] When a user needs to frequently access certain private data, the smart contract needs to perform frequent lookups, comparisons, and authorizations, thus wasting processing resources. In this embodiment, an authorization period can be set, meaning that after authorization, there is no need for re-authentication for a certain period of time, and the previous query result is returned directly, thereby saving processing resources.

[0120] Specifically, the smart contract receives the data identifier, the on-chain transaction hash value of the permission list, and the user identifier again from the data visitor; it checks whether the time interval between the current moment and the time of the data visitor's last query is less than a predetermined duration; if the time interval is less than or equal to the predetermined duration, the query result of the last query is returned to the data visitor; if the time interval is greater than the predetermined duration, the contract searches the blockchain for the permission list corresponding to the data identifier and the on-chain transaction hash value of the permission list, searches the permission list for the permission identifier corresponding to the user identifier, and if the permission identifier indicates that the data visitor has permission for the privacy data, the contract returns authorization confirmation information for the privacy data to the data visitor so that the data visitor can complete the corresponding access operation for the privacy data; if the access identifier indicates that the data visitor does not have permission for the privacy data, the contract does not return authorization confirmation information for the privacy data to the data visitor.

[0121] Taking a 5-hour reservation as an example, if a user accesses a certain private data after obtaining permission, and then accesses that private data again within 5 hours, the smart contract will directly return the previous query result to the user without having to search the permission list for authentication again.

[0122] Please refer to Figure 5 This illustration shows a structural block diagram of a permission configuration device in a blockchain according to an embodiment of this application. The permission configuration device in the blockchain may include...

[0123] The receiving module 510 is used to receive the data identifier of the privacy data sent by the data holder, the on-chain transaction hash value of the permission list, and the configuration content. The on-chain transaction hash value of the permission list is a hash value generated based on the permission list. The configuration content includes the user identifier and permission identifier of the data accessor to be modified in the permission list. The permission identifier is used to indicate whether the data accessor has permission for the privacy data.

[0124] The lookup module 520 is used to look up the permission list on the blockchain that corresponds to the data identifier and the on-chain transaction hash value of the permission list;

[0125] The generation module 530 is used to configure the permission list according to the configuration content and generate the latest permission list on-chain transaction hash value based on the configured permission list.

[0126] Feedback module 540 is used to feed back the data identifier and the latest on-chain transaction hash value of the permission list to the data holder, so that the data holder can store the data identifier and the latest on-chain transaction hash value of the permission list accordingly.

[0127] In an optional embodiment, the generation module 530 is further configured to:

[0128] Retrieve the user identifier and permission identifier contained in the configuration content;

[0129] If the user identifier is not found in the permission list, the user identifier and permission identifier will be added to the permission list accordingly to obtain the configured permission list.

[0130] In an optional embodiment, the generation module 530 is further configured to:

[0131] If a user identifier exists in the found permission list, the permission identifier in the permission list corresponding to the user identifier is replaced with the permission identifier in the configuration content to obtain the configured permission list.

[0132] In an optional embodiment, the receiving module 510 is further configured to receive the privacy data sent by the data holder before receiving the data identifier of the privacy data, the on-chain transaction hash value of the permission list and the configuration content sent by the data holder; store the privacy data; and feed back the data identifier of the privacy data to the data holder; and receive the initial permission list sent by the data holder, wherein the permission list contains the data identifier of the privacy data, the user identifier of the data accessor and the access permissions.

[0133] Please refer to Figure 6 The device also includes a storage module 550, which is used to generate on-chain transaction hash values ​​for the permission list based on the permission list, and to store the permission list and the on-chain transaction hash values ​​for the permission list.

[0134] The feedback module 540 is also used to feed back the on-chain transaction hash value of the permission list to the data holder, so that the data holder can store the data identifier and the on-chain transaction hash value of the permission list accordingly.

[0135] In an optional embodiment, the storage module 550 is further configured to: store the permission list and the on-chain transaction hash of the permission list in the block in the form of a Merkle tree, and store the Merkle root of the Merkle tree in the block header of the block;

[0136] The lookup module 520 is also used to: traverse the Merkle root in each block header on the blockchain, and if a Merkle root matching the hash value of the on-chain transaction of the permission list is found, then search for the permission list corresponding to the data identifier and the hash value of the on-chain transaction of the permission list in the block corresponding to the block header.

[0137] In one alternative embodiment, the privacy data is credentials, access control information, or sensitive information.

[0138] In an optional embodiment, the receiving module 510 is further configured to receive the data identifier, the on-chain transaction hash value of the permission list, and the user identifier sent by the data accessor.

[0139] The lookup module 520 is also used to look up the permission list on the blockchain that corresponds to the hash value of the on-chain transaction of the data identifier and permission list; and to look up the permission identifier corresponding to the user identifier in the permission list.

[0140] The feedback module 540 is further configured to, if the permission identifier indicates that the data access user has permission for the privacy data, provide the data access user with authorization confirmation information for the privacy data so that the data access user can complete the corresponding access operation for the privacy data; if the access identifier indicates that the data access user does not have permission for the privacy data, then not provide the data access user with authorization confirmation information for the privacy data.

[0141] In an optional embodiment, the receiving module 510 is further configured to receive again the data identifier, the on-chain transaction hash value of the permission list, and the user identifier sent by the data visitor;

[0142] The device also includes: a detection module 560, used to detect whether the time interval between the current time and the time of the data visitor's last query is less than a predetermined duration;

[0143] The feedback module 540 is also used to: if the time interval is less than or equal to a predetermined duration, return the previous query result to the data access user; if the time interval is greater than the predetermined duration, search the blockchain for the permission list corresponding to the data identifier and the on-chain transaction hash value of the permission list, search the permission list for the permission identifier corresponding to the user identifier, and if the permission identifier indicates that the data access user has permission for the privacy data, return the authorization confirmation information for the privacy data to the data access user so that the data access user can complete the corresponding access operation for the privacy data; if the access identifier indicates that the data access user does not have permission for the privacy data, do not return the authorization confirmation information for the privacy data to the data access user.

[0144] In summary, the permission configuration device in the blockchain provided in this application, due to the security inherent in blockchain, can prevent malicious tampering of the permission list by storing it in the blockchain, thus improving the security of the permission list. Furthermore, since every modification to the permission list is recorded in the blockchain, modifications to the permission list are traceable, further enhancing the security of the permission list.

[0145] Since the block header contains far less data than the block itself, searching for the permission list by traversing the block header can significantly save search time and improve performance compared to traversing each block.

[0146] One embodiment of this application provides a computer-readable storage medium storing at least one instruction, which is loaded and executed by a processor to implement the permission configuration method in a blockchain as described above.

[0147] One embodiment of this application provides a computer device including a processor and a memory, wherein the memory stores at least one instruction, which is loaded and executed by the processor to implement the permission configuration method in a blockchain as described above.

[0148] It should be noted that the permission configuration device in the blockchain provided in the above embodiments is only illustrated by the division of the above functional modules. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the permission configuration device in the blockchain can be divided into different functional modules to complete all or part of the functions described above. In addition, the permission configuration device in the blockchain provided in the above embodiments and the permission configuration method embodiments in the blockchain belong to the same concept, and the specific implementation process is detailed in the method embodiments, which will not be repeated here.

[0149] Those skilled in the art will understand that all or part of the steps of the above embodiments can be implemented by hardware or by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk.

[0150] The above description is not intended to limit the embodiments of this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the embodiments of this application should be included within the protection scope of the embodiments of this application.

Claims

1. A permission configuration method in a blockchain, characterized in that, The method comprises: receiving a data identifier of privacy data, a permission list on-chain transaction hash value and configuration content sent by a data holder, the permission list on-chain transaction hash value being a hash value generated according to a permission list, and the configuration content containing a user identifier and a permission identifier of a data visitor to be modified in the permission list, the permission identifier being used to indicate whether the data visitor has permission for the privacy data; finding a permission list corresponding to the data identifier and the permission list on-chain transaction hash value on a blockchain; configuring the permission list according to the configuration content, generating a latest permission list on-chain transaction hash value according to the configured permission list; feeding back the data identifier and the latest permission list on-chain transaction hash value to the data holder, so that the data holder stores the data identifier and the latest permission list on-chain transaction hash value correspondingly; Before the receiving of the data identifier of the privacy data, the permission list on-chain transaction hash value and the configuration content sent by the data holder, the method further comprises: receiving privacy data sent by the data holder, storing the privacy data, and feeding back a data identifier of the privacy data to the data holder; receiving an initial permission list sent by the data holder, the permission list containing a data identifier of the privacy data, a user identifier of a data visitor and an access permission; generating a permission list on-chain transaction hash value according to the permission list, storing the permission list and the permission list on-chain transaction hash value; and feeding back the permission list on-chain transaction hash value to the data holder, so that the data holder stores the data identifier and the permission list on-chain transaction hash value correspondingly. 2.The method of claim 1, wherein, The configuring of the permission list according to the configuration content comprises: obtaining a user identifier and a permission identifier contained in the configuration content; if the user identifier does not exist in the found permission list, correspondingly adding the user identifier and the permission identifier in the permission list to obtain a configured permission list. 3.The method of claim 1, wherein, The method further comprises: if the user identifier exists in the found permission list, replacing a permission identifier corresponding to the user identifier in the permission list with the permission identifier in the configuration content to obtain a configured permission list.

4. The permission configuration method in the blockchain according to claim 1, wherein the storing of the permission list and the permission list on-chain transaction hash value comprises: storing the permission list and the permission list on-chain transaction hash value in a block in the form of a Merkle tree, and storing a Merkle root of the Merkle tree in a block header of the block. The searching for the permission list corresponding to the data identifier and the permission list on-chain transaction hash value on the blockchain comprises: traversing a Merkle root in each block header on the blockchain, and if a Merkle root matching the permission list on-chain transaction hash value is found, searching for the permission list corresponding to the data identifier and the permission list on-chain transaction hash value in a block corresponding to the block header. 5.The method of claim 1, wherein, The privacy data is credential or access control information or sensitive information. 6.The method of claim 1 to 5, wherein, The method further comprises: receiving a data identifier, a permission list on-chain transaction hash value and a user identifier sent by a data visitor; searching for a permission list corresponding to the data identifier and the permission list on-chain transaction hash value on the blockchain; searching for a permission identifier corresponding to the user identifier in the permission list; if the permission identifier indicates that the data visitor has the permission for the privacy data, feeding back authorization confirmation information of the privacy data to the data visitor, so that the data visitor completes corresponding access operation on the privacy data; if the permission identifier indicates that the data visitor does not have the permission for the privacy data, not feeding back the authorization confirmation information of the privacy data to the data visitor. 7.The method of claim 6, wherein, The method further comprises: receiving again the data identifier, the permission list on-chain transaction hash value and the user identifier sent by the data visitor; detecting whether a time interval between a current time and a time when the data visitor last queries is less than a predetermined time length; if the time interval is less than or equal to the predetermined time length, feeding back a query result last time to the data visitor; if the time interval is greater than the predetermined time length, searching for a permission list corresponding to the data identifier and the permission list on-chain transaction hash value on the blockchain, searching for a permission identifier corresponding to the user identifier in the permission list, if the permission identifier indicates that the data visitor has the permission for the privacy data, feeding back authorization confirmation information of the privacy data to the data visitor, so that the data visitor completes corresponding access operation on the privacy data, if the permission identifier indicates that the data visitor does not have the permission for the privacy data, not feeding back the authorization confirmation information of the privacy data to the data visitor. 8.A permission configuration apparatus in a blockchain, characterized by, The permission configuration device comprises: a receiving module configured to receive a data identifier of privacy data, a permission list on-chain transaction hash value and configuration content sent by a data holder, the permission list on-chain transaction hash value is a hash value generated according to a permission list, and the configuration content contains a user identifier and a permission identifier of a data visitor to be modified in the permission list, the permission identifier is used to indicate whether the data visitor has the permission for the privacy data; a searching module configured to search for a permission list corresponding to the data identifier and the permission list on-chain transaction hash value on the blockchain; a generating module configured to configure the permission list according to the configuration content, and generate a latest permission list on-chain transaction hash value according to the configured permission list. The feedback module is configured to feed back the data identifier and the latest permission list on-chain transaction hash value to the data holder, so that the data holder stores the data identifier and the latest permission list on-chain transaction hash value correspondingly. The receiving module is further configured to receive the private data sent by the data holder before the data holder sends the data identifier, the permission list on-chain transaction hash value and the configuration content of the private data, store the private data, and feed back the data identifier of the private data to the data holder; and receive an initial permission list sent by the data holder, wherein the permission list contains the data identifier of the private data, the user identifier of the data visitor and the access permission. The device further comprises a storage module configured to generate a permission list on-chain transaction hash value according to the permission list, and store the permission list and the permission list on-chain transaction hash value. The feedback module is further configured to feed back the permission list on-chain transaction hash value to the data holder, so that the data holder stores the data identifier and the permission list on-chain transaction hash value correspondingly.

9. A computer-readable storage medium, characterized in that, The storage medium has at least one instruction stored therein, and the at least one instruction is loaded and executed by the processor to implement the permission configuration method in the block chain according to any one of claims 1 to 7.

10. A computer device, comprising: The computer device comprises a processor and a memory, and the memory has at least one instruction stored therein, and the instruction is loaded and executed by the processor to implement the permission configuration method in the block chain according to any one of claims 1 to 7.

Images