Node management method and apparatus, terminal device, and storage medium

Abstract

The embodiment of the application is suitable for the field of computer technology, and provides a node management method and device, terminal equipment and storage medium, the method comprises the following steps: when receiving a node application initiated by a user terminal for a node, generating an audit result about the node application based on a client credential associated with the user terminal; the client credential is generated when the client program installed in the user terminal is identified as legal by the blockchain; if the audit result is passed, the node is identified as a permitted node, and a permission file about the permitted node is generated; the permission file comprises node permission; the node permission is sent to the permitted node, and the node permission is used for authorizing the permitted node to run in the blockchain. Through the method, the client can locally authenticate the node permission, and the consumption of blockchain network resources can be reduced.

Description

TECHNICAL FIELD

[0001] The embodiment of the present application belongs to the technical field of computers, and particularly relates to a node management method and device, a terminal device and a storage medium. BACKGROUND

[0002] In the prior art, before the nodes of a blockchain are managed, a corresponding permission node list needs to be defined in advance and written into each node of the blockchain. When the nodes in the blockchain need to be authenticated or maintained, the node list in the nodes needs to be obtained through network communication, and the nodes of the blockchain are authenticated or maintained according to the node list. Since the node list needs to be obtained through network communication when the nodes are authenticated or maintained in the prior art, when a large number of nodes are added in a short period of time, the node authentication through the prior art is likely to affect the normal operation of the blockchain service. In addition, in the prior art, since the node list only contains information such as public keys and IP addresses, when the node management rules of the blockchain are updated, the entire blockchain network needs to be stopped, and after the management rule update is completed, the node permissions of each node in the blockchain need to be manually replaced, which is not conducive to the management of the nodes. SUMMARY

[0003] Therefore, the embodiment of the present application provides a node management method to solve the problem that the node permission needs to be obtained through network communication in the prior art and the problem that the blockchain needs to be stopped when the nodes are managed.

[0004] The first aspect of the embodiment of the present application provides a node management method applied to a blockchain system, comprising:

[0005] When receiving a node application initiated by a user terminal, an audit result about the node application is generated based on a client credential associated with the user terminal; the client credential is generated when a client program installed on the user terminal is identified as legal by the blockchain;

[0006] If the audit result is passed, the node is identified as a permitted node, and a permission file about the permitted node is generated; the permission file includes node permission;

[0007] The node permission is sent to the permitted node, and the node permission is used to authorize the permitted node to run in the blockchain.

[0008] The second aspect of the embodiment of the present application provides a node management device applied to a blockchain, comprising:

[0009] An auditing module is configured to generate an auditing result of the node application based on a client credential associated with the user terminal when receiving the node application initiated by the user terminal; the client credential is generated when the client program installed on the user terminal is identified as legal by the blockchain;

[0010] A licensing module is configured to identify the node as a licensed node and generate a license file of the licensed node if the auditing result is passed; the license file includes node license;

[0011] An authorization module is configured to send the node license to the licensed node, and the node license is used to authorize the licensed node to run in the blockchain.

[0012] A third aspect of the embodiments of the present application provides a terminal device, which comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the node management method of the first aspect.

[0013] A fourth aspect of the embodiments of the present application provides a computer readable storage medium, which stores a computer program, and the computer program is executable by a processor to implement the node management method of the first aspect.

[0014] A fifth aspect of the embodiments of the present application provides a computer program product, which, when executed on a computer, causes the computer to execute the node management method of the first aspect.

[0015] Compared with the prior art, the embodiments of the present application have the following advantages:

[0016] In the embodiments of the present application, the concept of credential is introduced in the blockchain system to reduce the interaction between each to-be-deployed node and the license management platform. Since the license management platform can grant the client credential corresponding to the client program installed on the user terminal that is identified as passed, the task of node authentication of the blockchain can be assigned to the client program installed on the user terminal to complete, that is, the process of node authentication does not need to pass through the license management platform, but is handed over to the client program installed on the user terminal to license the node application that needs to be chained, so that the authentication of the node license in the blockchain can be performed locally on the client side of the user terminal, without occupying the blockchain network resources. The authentication of the blockchain node and the blockchain network business are isolated from each other, which can reduce the consumption of the blockchain network resources and is helpful for the efficient operation of the blockchain business. BRIEF DESCRIPTION OF DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed to be used in the embodiments or prior art description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without any creative effort based on these drawings.

[0018] Figure 1 is a networking topology diagram of a node management system provided by an embodiment of the present application;

[0019] Figure 2 is a relationship diagram of each participant of a node management system provided by an embodiment of the present application;

[0020] Figure 3 is a schematic diagram of a node management method provided by an embodiment of the present application;

[0021] Figure 4 is a flowchart of a client initialization provided by an embodiment of the present application;

[0022] Figure 5 is a schematic diagram of another node management method provided by an embodiment of the present application;

[0023] Figure 6 is a flowchart of a node issuance provided by an embodiment of the present application;

[0024] Figure 7 is a flowchart of a node revocation provided by an embodiment of the present application;

[0025] Figure 8 is a flowchart of a node update provided by an embodiment of the present application;

[0026] Figure 9 is a flowchart of a node validity check provided by an embodiment of the present application;

[0027] Figure 10 is a schematic diagram of a node management apparatus provided by an embodiment of the present application;

[0028] Figure 11 is a schematic diagram of a terminal device for node management provided by an embodiment of the present application; DETAILED DESCRIPTION

[0029] In the following description, for purposes of explanation and not limitation, specific details are set forth such as particular architectures, techniques, etc. in order to provide a thorough understanding of the embodiments of the present application. However, it will be apparent to those skilled in the art that the present application can be practiced in other embodiments that depart from these specific details. In other instances, detailed descriptions of well-known methods, devices, circuits, and

[0030] In the prior art, before the nodes in the blockchain are permitted, the administrator needs to pre-set a plurality of public keys and a plurality of IP addresses. The administrator can write the pre-defined public keys and IP addresses into a permitted node list, and write the pre-created permitted node list into each node of the blockchain when permitting and authenticating the nodes. When authenticating the nodes of the blockchain, the node list in each node needs to be sent to the permission management platform through network communication, and then the permission management platform authenticates the identity of the node. Subsequently, when maintaining the permitted node list in the node, the super administrator in the system needs to insert or delete data in the permitted node list in each node. In the prior art, the following three defects exist.

[0031] Firstly, the business operation of the blockchain is affected. In the prior art, when authenticating the nodes of the blockchain, the permitted node list needs to be sent to the permission management platform through network communication. Therefore, the blockchain needs to consume certain network resources for transmitting data generated in the node authentication process. When the blockchain needs to permit and authenticate a large number of nodes in a short time, the permission authentication through this way easily occupies a large amount of network resources of the blockchain, thereby affecting the normal operation of other businesses in the blockchain network.

[0032] Secondly, only limited node permission information can be updated and maintained. In the prior art, although the identity of the super administrator is set to update and maintain the node list of the permitted nodes, the node list only contains information such as IP address and public key. Therefore, the super administrator can only change the number of nodes or the public key in the node list. When further definition operations such as changing the expiration time of the node are needed, the entire blockchain network needs to be shut down, and the node permission of each node needs to be manually changed.

[0033] Thirdly, the prior art is only applicable to a single blockchain. When a user who has a plurality of blockchains needs to manage the nodes according to the prior art, the node permission of each blockchain needs to be separately maintained and updated.

[0034] To address the aforementioned technical issues, this solution provides a node management system. Through this system, clients can perform node authorization and authentication locally. Furthermore, by incorporating the concept of credentials, clients and nodes can be managed in diverse ways using these credentials. In the embodiments provided in this application, the node sending the node request to the client program can be a blockchain node awaiting deployment. After obtaining node authorization issued by the client program, the node awaiting deployment can become a licensed node.

[0035] The technical solution of this application will be described below through specific embodiments.

[0036] like Figure 1 The diagram shown illustrates a network topology for a node management system according to an embodiment of this application. It should be noted that the node management system provided in this embodiment can be applied to blockchain systems. Through the node management system provided in this embodiment, various node management functions, such as node licensing, node updates, and node revocation, can be performed on each node in the blockchain system. When managing nodes in a single blockchain system using the node management system provided in this embodiment, the licensing management platform, client, and nodes in the node management system can all be devices within the blockchain system. The node management system provided in this embodiment can also simultaneously manage nodes in multiple different blockchains. In scenarios where the node management system manages multiple blockchain systems, the node management platform and client in the node management system can exist independently of any single blockchain system.

[0037] In this embodiment, the node management system may include a license management platform, clients, and blockchain nodes. The license management platform can store various license information such as client license conditions, client credentials, and node credentials. The license management platform can also issue client credentials and node credentials according to credential standards issued by regulators.

[0038] In this embodiment, the regulator can be a user, a regulatory platform, or a terminal that accesses the license management platform as a third party. The regulator can formulate credential standards and write them into the license management platform. The regulator can also formulate various node credential templates according to the type of blockchain, and the license management platform can issue credentials according to the credential standards.

[0039] In the embodiments of the present application, the node management system can further include a plurality of clients, and each client can constitute an independent blockchain management platform. The client can receive a node application initiated by a user terminal about a to-be-deployed node, and based on a client credential associated with the user terminal, the client program can perform permission authentication on the node application. Meanwhile, the client can also perform node management, node update, node revocation, and application node credential on the permitted node.

[0040] In the embodiments of the present application, the user terminal can perform node authentication by sending a node application about a to-be-deployed node to the client program. The node permitted by the client can become a permitted node and start various node services. In the node management system, the execution subject of the permission management platform, the client and each node can be a computer device, and the computer device can be a desktop computer, a cloud server and the like.

[0041] As shown in FIG. 1, Figure 2 FIG. 1 is a schematic diagram of the relationship between each participant in the node management system. In the node management system, the supervisor can define the permission management platform of the blockchain by formulating various credential standards and credential templates. The client can send the permission conditions and permission information of the client to the permission management platform, and receive the client credential and node credential fed back by the permission management platform. Meanwhile, the client can also download the permission information from the permission management platform for permission verification at regular intervals, so as to ensure the validity of the issued node permission. The permission management platform can issue the client credential for the client according to the permission conditions uploaded by the client, and issue the node credential for the node according to the permission information uploaded by the client. The permission conditions uploaded by the client can include but are not limited to the client expiration time, the IP address of the client, the type of node that can be issued by the client, the total number of nodes that can be issued by the client, the IP address range of the node that can be permitted by the client, and various blockchain business information. The business information contained in the permission conditions is determined by the blockchain business content associated with the client. The client can perform various node management such as permission, revocation and update on the node.

[0042] Referring to Figure 3 FIG. 2 shows a schematic diagram of a node management method provided by the embodiments of the present application. It should be noted that the method can be applied to the blockchain, and the execution subject of the embodiments of the present application can be a computer device, and the computer device can be a desktop computer, a cloud server and the like. The specific type of the computer device is not limited in the embodiments of the present application.

[0043] The node management method can specifically include the following steps:

[0044] S301, when receiving a node application initiated by a user terminal for a to-be-deployed node, generating an audit result about the node application based on a client credential associated with the user terminal; the client credential is generated when the client program installed on the user terminal is identified by the blockchain as legal;

[0045] In the embodiments of the present application, the client program installed on the user terminal can first perform legal authentication of the client program through the permission management platform before performing authentication of the node permission. After the legal authentication of the client program is passed, the permission management platform can send a client credential to the client program that passes the authentication. The client program installed on the user terminal can receive and store the client credential sent by the permission management platform, and the client carrying the client credential can become a legal client in the blockchain. The client program installed on the user terminal and carrying the client credential can generate an audit result about the node application through the client program when receiving a node application initiated by the user terminal for a to-be-deployed node. The generated audit result can include audit pass and audit fail.

[0046] In a possible implementation of the embodiments of the present application, before the node management system performs node permission authentication through the client program installed on the user terminal, the user can first provide the user terminal with initial settings for the client program. The user can perform initial settings of the client program by configuring client permission conditions in the client program. The configured client permission conditions can include, but are not limited to, the number of nodes permitted by the client, the expiration time of the permitted nodes, the IP address range of the nodes that can be permitted, and various blockchain business information. The business information contained in the permission conditions is determined by the blockchain business content associated with the client. After the permission conditions are configured, the user can send the configured permission conditions to the permission management platform through the client program installed on the user terminal. The permission management platform can store the received client permission conditions on the chain, and form client permission information based on the received permission conditions. After storing the client permission conditions on the chain, the permission management platform can generate a client credential based on the client permission conditions, and feed back the generated client credential to the client program on the corresponding user terminal. The client credential can include the client permission conditions and the client identifier. The client identifier can include a client credential unique identifier and a client permission unique identifier. The client permission can be a permission file that ensures the normal operation of the client, for example, a file starting with XLicense Copyright (C) 2020, where X can be the client name. The client credential is a verifiable credential generated by the permission management platform after storing the received permission conditions on the chain and generating a decentralized unique client identifier based on the permission conditions. The node credential can encapsulate the node permission information and the unique client identifier. The node permission information can include the expiration time of the node, the IP address of the node, and the node type of the node, and various blockchain business information. After receiving the client credential fed back by the permission management platform based on the permission conditions, the client program installed on the user terminal can have the permission authority corresponding to the permission conditions. The client program installed on the user terminal can perform node permission authentication on the received node application according to the permission conditions in the client credential.

[0047] As Figure 4As shown, a flowchart of the client initialization process is shown. In S41, when the user first uses the client program on the user terminal, the user can configure the permission conditions of the client program, such as the number of nodes permitted by the client, the expiration time of the permitted nodes, the IP address range of the permitted nodes, and other permission conditions. After the user configures the permission conditions of the client program, the user can enter S42, and the client program installed on the user terminal can generate a client license according to the permission conditions configured by the user, and send the client license to the blockchain permission management platform for on-chain storage. After receiving the client license, the permission management platform can enter S42, that is, the permission management platform can issue a client credential to the client program that submits the client license. The client program installed on the user terminal can receive and store the client credential issued by the permission management platform, and can enter S42, that is, the client program installed on the user terminal can be initialized and set again according to the received client credential, and thus the initialization and setting of the first use of the client program is completed.

[0048] In another possible implementation manner of the embodiment of the application, the client credential can include the permission conditions of the client, such as the maximum number of licenses of the client program, the expiration time, the IP address range of the nodes, and the like. The client program can locally match the node information in the received node application with the permission conditions in the client credential. If the node information in the node application matches the node permission conditions, the client program can generate an audit result of passing the audit for the node. If the node information in the node application does not match the node permission conditions, the client program can generate an audit result of failing the audit for the node.

[0049] S302, if the audit result is passing the audit, the node is identified as a permitted node, and a permission file about the permitted node is generated; the permission file includes node permission;

[0050] In the embodiment of the application, if the audit result generated by the client program installed on the user terminal based on the node information in the node application is passing the audit, the client program installed on the user terminal can identify the to-be-deployed node as a permitted node, and automatically generate a permission file based on the node application. The generated permission file can include node permission. The node permission can be a permission file that guarantees the normal operation of the node, for example, a file starting with X License Copyright (C) 2020, where X can be the node name.

[0051] In a possible implementation of the embodiments of the present application, when the client program receives the node application initiated by the user terminal, the client program can match the node information contained in the node application with the permission conditions associated with the client credential. For example, the client program can determine whether the node IP address contained in the node application is within the IP address range contained in the permission conditions of the client program. Alternatively, the client program can determine whether the node type contained in the node application is within the node type contained in the permission conditions of the client program. When the node information contained in the node application matches the permission conditions associated with the client credential, the client program can generate an audit result of passing the audit. For example, when the node IP address contained in a node application is within the IP address range contained in the permission conditions of the client program, the node type is within the node type contained in the permission conditions of the client program, and the number of nodes permitted by the client program does not reach the maximum number of nodes permitted by the client program, the client program can consider that the node information of the node matches the permission conditions of the client program, and the client program can generate an audit result of passing the audit.

[0052] In another possible implementation of the embodiments of the present application, when the node information contained in the node application of the node to be deployed does not satisfy the permission conditions of the client or the number of nodes permitted by the client program has reached the maximum number of nodes permitted by the client program, the client program can consider that the node application does not pass the audit, and the client program installed on the user terminal can generate an audit result of failing the audit and reject the node application of the node. For example, if the IP address of a node is outside the IP address range of the permission conditions of the client, the client program can consider that the node information contained in the node application does not match the permission conditions of the node, that is, the node information contained in the node application does not satisfy the permission conditions of the client. Therefore, the client program can generate an audit result of failing the audit and reject the node application of the node.

[0053] S303, sending the node permission to the permitted node, the node permission being used to authorize the permitted node to run in the blockchain.

[0054] The node permission is used to authorize the permitted node to perform node services, and the node permission can include basic information that allows the permitted node to normally run in the blockchain network. After the client program installed on the user terminal generates the node permission, the client program can send the generated node permission to the corresponding permitted node. After receiving the node permission, the permitted node can start running and perform various node services.

[0055] In this embodiment, the client program installed on the user terminal can perform client legitimacy authentication by sending license conditions to the license management platform. The license management platform can then legitimize the client program based on the received license conditions. After legitimacy authentication, the license management platform can issue client credentials to the client program according to the license conditions and grant the client the authority to issue node license information. Upon receiving the client credentials, the client program installed on the user terminal can locally perform node license authentication on the received node application for the node to be deployed. Through the method described in this embodiment, localized node license authentication can be achieved. The client program installed on the user terminal can perform node license authentication locally based on the client credentials, meaning the blockchain node license authentication process does not consume blockchain network resources, and blockchain node authentication is isolated from blockchain business. This scheme isolates blockchain node license authentication from blockchain business, reducing the consumption of blockchain network resources and performance. Since the client performs node authentication locally using client credentials, even when authenticating a large number of nodes, the blockchain business can continue to operate normally without being affected by node authentication, contributing to the stability of blockchain business operation.

[0056] Reference Figure 5 The diagram illustrates another node management method provided in this application embodiment, which may specifically include the following steps:

[0057] S501. Upon receiving a node application for a node to be deployed initiated by a user terminal, an audit result for the node application is generated based on the client credentials associated with the user terminal; the client credentials are generated when the blockchain identifies that the client program installed on the user terminal is legitimate.

[0058] S502. If the audit result is "approved", then the node is identified as a licensed node, and a license file for the licensed node is generated; the license file includes a node license.

[0059] S503. Send the node permission to the authorized node, the node permission being used to authorize the authorized node to operate in the blockchain;

[0060] Since S501-S503 in this embodiment is similar to S301-S303 in the previous embodiment, they can be referred to each other, and will not be described again in this embodiment.

[0061] S503. Send the license file to the license management platform corresponding to the blockchain to bind the client credential to the licensed node;

[0062] In the embodiments of the present application, after the client program installed on the user terminal generates the license file, the generated license file can also be sent to the license management platform for on-chain storage. After receiving the license file uploaded by the client program installed on the user terminal, the license management platform can write the received license file into the blockchain network for storage, and can also bind the client credential of the user terminal sending the license file and the licensed node according to the license file. The license file can include node license and license information. The license information can include node license information and license conditions of the client. That is, the license information can include expiration time of the node, IP address of the node, node type of the node, maximum number of licenses of the client program, expiration time, IP address range of the node, and various blockchain business information. Among them, the node license information can include but is not limited to expiration time of the node, IP address of the node, and node type of the node, and various blockchain business information. The license conditions of the client can include maximum number of licenses of the client program, expiration time, IP address range of the node, and business information.

[0063] S504, receiving the node credential fed back by the license management platform based on the node license information;

[0064] In the embodiments of the present application, if the audit result generated by the client program installed on the user terminal based on the node information in the node application is audit passed, the client program installed on the user terminal can send the node license information generated based on the node information to the license management platform for on-chain storage. After receiving the license file uploaded by the client program installed on the user terminal, the license management platform can generate corresponding node credential according to the received license file. The node credential can include node license information, node license identifier and client identifier. The node credential is a verifiable credential generated by the license management platform after on-chain storage of the received node license information and generation of a decentralized unique node license identifier based on the node license information. Among them, the node license information can include but is not limited to expiration time of the node, IP address of the node, and node type of the node, and various blockchain business information. The license management platform can bind the client credential and the licensed node by writing the client identifier in the node credential. In subsequent operations, the user or the license management platform can query the client program that has licensed the node by checking the client identifier in the node credential. After generating the node credential, the license management platform can feed back the node credential to the client program uploading the node license information. The client program installed on the user terminal can receive the node credential fed back by the license management platform based on the node license information.

[0065] S505, generating a configuration file based on the node credential and the node permission, and sending the configuration file to the permitted node.

[0066] In the embodiments of the present application, after receiving the node credential fed back by the permission management platform based on the permission file, the client program installed on the user terminal can generate the configuration file directly on the client program based on the node permission and the node credential. After the client program generates the configuration file, the client program can send the configuration file to the to-be-deployed node. After receiving the configuration file fed back by the client program, the to-be-deployed node can become a permitted node.

[0067] In another possible implementation manner of the embodiments of the present application, the client program can also send the received node credential and node permission information to the corresponding to-be-deployed node. After receiving the node credential and node permission information sent by the client program, the to-be-deployed node can become a permitted node. The node that becomes a permitted node can start running and perform various node services, such as storing blockchain data, accounting, providing wallet services, and the like. After receiving the node permission information and the node credential, the to-be-deployed node can generate a configuration file of the node according to the received node permission information and the node credential, and store the configuration file.

[0068] As Figure 6As shown, a node permission issuing flowchart provided by an embodiment of the present application is shown. In S61, when a node needs to be served, a user can initiate a node application through a client program installed on a user terminal, and submit the node application to a super administrator of a client program installed on a manager terminal for auditing. The node application can include node information such as an IP address of a node to be deployed. The super administrator can determine whether to allow the user to deploy the node through the client program installed on the user terminal according to the node information in the node application on the client program installed on the manager terminal. If the super administrator does not allow the user to deploy the node through the client program installed on the user terminal, the super administrator can reject the node application through the client program installed on the manager terminal. If the super administrator allows the user to deploy the node through the client program installed on the user terminal, S62 can be entered, and the client program installed on the user terminal can audit whether the node application meets the permission conditions of the client. For example, a user wants to deploy a blockchain for financial business, and the blockchain can include four nodes. The user can generate a node application for the financial blockchain on the client program, and submit the node application to the super administrator of the client program. If the super administrator allows the user to deploy the financial blockchain on the client program, the node application of the user can be rejected. If the super administrator allows the user to deploy the financial blockchain on the client program, the client program can audit whether the node application meets the permission conditions of the client.

[0069] If the node information in the node application does not meet the permission conditions of the client program installed on the user terminal, such as the node IP address of the to-be-deployed node is outside the IP address range of the client permission conditions, the client program installed on the user terminal considers that the node application audit is failed. The client program installed on the user terminal can reject the node application of the node. If the node information in the node application meets the permission conditions of the client program installed on the user terminal, such as the node IP address of the node is within the IP address range of the client permission conditions, the client program installed on the user terminal can consider that the node application audit is passed. The client program installed on the user terminal can issue a permission file to the to-be-deployed node according to the node application and the permission conditions of the client program. The permission file issued by the client program can include node permission and permission information, and the client program installed on the user terminal can send the node permission to the to-be-deployed node that submits the node application for authorizing the normal operation of the node, and send the issued permission file to the blockchain permission management platform for on-chain storage. In S63, after receiving the permission file sent by the client program installed on the user terminal, the permission management platform can store the permission file in the blockchain. The permission management platform can issue a node credential according to the permission file, and feed back the issued node credential to the client program that uploads the permission file. In S64, after receiving the node credential fed back by the permission management platform based on the permission file, the client program installed on the user terminal can send the node permission and the node credential to the to-be-deployed node that applies for the node. After receiving the node permission and the node credential fed back by the client program, the to-be-deployed node can become a permitted node, and write the node permission information and the node credential into the configuration file of the node. In another possible implementation manner, after receiving the node credential fed back by the permission management platform based on the permission file, the client program installed on the user terminal can also generate a configuration file on the client program based on the node permission and the node credential. After the client program generates the configuration file, the client program can send the configuration file to the to-be-deployed node, and after receiving the configuration file fed back by the client program, the to-be-deployed node can become a permitted node.

[0070] In another possible implementation manner of the embodiment of the application, the client program installed on the user terminal can also automatically revoke the node permission that has been issued based on the node credential after completing the node permission authentication, when deleting the permitted node or deleting the blockchain network. When receiving the instruction of deleting the node or deleting the blockchain network, the permission management platform can determine the issuing client program of the node according to the client identifier in the node credential, and form the node revocation instruction about the node. The permission management platform can send the node revocation instruction to the client program installed on the user terminal through network communication. The user can also directly generate the node revocation instruction about a permitted node on the client program through the user terminal. After receiving the node revocation instruction, the client program installed on the user terminal can generate corresponding node revocation information according to the node revocation instruction. The node revocation information can include the client identifier of the client program and the node identifier of the node to be revoked. The client program installed on the user terminal can send the generated node revocation information to the permission management platform for on-chain storage. After receiving the node revocation information sent by the client program, the permission management platform can store the received node revocation information in the blockchain network for evidence storage. The permission management platform can generate corresponding node revocation credentials based on the received node revocation information. The generated node revocation credentials can include the unique identifier of the node to be revoked and the client identifier. The permission management platform can feed back the node revocation credentials to the client program installed on the user terminal. After receiving the node revocation credentials, the client program installed on the user terminal can delete the configuration file in the permitted node by sending a deletion instruction to the server of the node to be revoked. The specific manner of deleting the node configuration file by the client program is determined by the type of the blockchain where the permitted node is located. Since the configuration file of the node stores the node permission information and the node credential of the permitted node, after the configuration file of the permitted node is deleted, the permitted node cannot provide node service any more, and the permitted node becomes a revoked node, that is, the node revocation is completed.

[0071] As Figure 7As shown, in S71, when a user needs to delete a node or a blockchain network, the user can apply for revoking the node permission through the user terminal to the client program. When the client program installed on the user terminal receives the application for revoking the node permission, the client program can generate revocation information according to the received application, and send the generated revocation information to the permission management platform to update the permission information stored in the permission management platform. After receiving the revocation information sent by the client program installed on the user terminal, the permission management platform can enter S72, that is, the permission management platform can generate a revocation node credential based on the revocation information sent by the client program, and feed back the generated revocation node credential to the client program sending the revocation node permission. After receiving the revocation node credential fed back by the permission management platform, the client program installed on the user terminal can enter S73, that is, the client program can delete the configuration file in the node to be revoked.

[0072] In another possible implementation manner of the embodiment of the present application, after completing the node permission authentication, the client program installed on the user terminal can also update the client and the node based on the client credential and the node credential. In the node management system provided in the present application, the client program can also include a permission update interface, and the super administrator can update the client credential and the node credential through the permission update interface. The specific implementation process of the client credential of the client program and the node credential of the node is as follows:

[0073] Before updating the client program, the user can initiate an update application to the client program through the user terminal, and the update application can include a number of node permissions that can be issued, a permission expiration time and a plurality of permission information. The user can also pre-set a plurality of client update conditions in the client program, such as the number of node permissions that can be issued in the new permission condition needs to be greater than or equal to the limit number of the current node, the expiration time of the node permission in the new permission condition needs to be later than the expiration time of the node permission in the current permission condition, and the like. After receiving the update application initiated by the user, the client program installed on the user terminal can determine whether the client can be updated according to the update application according to the pre-set client update conditions.

[0074] If the update application meets the preset client update condition, the client program installed on the user terminal can send the update application to the license management platform. After receiving the update application sent by the client, the license management platform can store the update application on the chain and form an update instruction according to the update application. The update instruction can include new client credentials and license credentials. The license management platform can feed back the update instruction to the client program sending the update application. After receiving the update instruction fed back by the license management platform, the client program installed on the user terminal can update the license conditions and client identifier of the client based on the new client credentials in the update instruction.

[0075] After the client program installed on the user terminal is updated, the configuration files of the licensed nodes authorized by the client program can also be obtained, and the existing node credentials in the node configuration files can be updated according to the new node credentials in the update instruction. Alternatively, since the client program installed on the user terminal may fail to update the nodes due to server network failure of the client program or server network failure of the nodes, etc. Therefore, after updating the licensed nodes, the client program can obtain the configuration files of the licensed nodes again to determine the client identifier in the existing node credentials of the licensed nodes. By judging whether the client identifier in the node credentials is consistent with the existing client identifier of the client, the client program can confirm whether the node has been updated. If the client identifier in the node credentials is consistent with the existing client identifier of the client, the client program can consider that the node has been updated, and the client program does not need to perform subsequent operations on the node. If the client identifier in the node credentials is inconsistent with the existing client identifier of the client, the client program can consider that the node update has failed, and the client program updates the node credentials of the node again.

[0076] As Figure 8As shown, the client program and the node update flow diagram provided by the embodiment of the present application. In S81, when the user needs to update the client permission condition, the client program can check the user identity, that is, the client can check whether the user is a super administrator. If the check fails, that is, the user is not a super administrator of the client program, the client program can reject the user's update application. If the check is successful, the node management system can enter S82, that is, the user is a super administrator of the client program installed on the user terminal, the client checks whether the new client permission condition in the update application submitted by the super administrator meets the current permission limit of the client program. If the check fails, that is, the new client permission condition in the update application does not meet the current permission limit of the client program, the client program can reject the update application. If the check is successful, the node management system can enter S83, that is, the new client permission condition in the update application meets the current permission limit of the client program, the client program can generate an update application according to the update information, and send the update application to the permission management platform. After receiving the new client credential feedback by the permission management platform based on the update application, the client program can update the client permission condition according to the new client credential. The client program can update the existing client credential according to the received new client credential, and update the permitted nodes of the client according to the new node credential. Since the client credential and the node credential are updated at the same time, the permission conditions and the client identifier in the client credential and the node credential are updated, therefore, after the client credential is updated, the client program installed on the user terminal can judge whether the permitted node is updated successfully by judging whether the client identifier in the node credential of the permitted node is consistent with the existing client identifier of the client. If the client identifier in the node credential is consistent with the existing client identifier of the client, the node update is successful. If the client identifier in the node credential is not consistent with the existing client identifier of the client, the node update fails, and the client program installed on the user terminal can update the failed node again.

[0077] In the embodiments of the present application, since the node permission information and the node credential are included in the configuration file of the node, and the node credential includes the node identifier and the client identifier, the issuing client of the node can be determined by querying the node credential, that is, the node credential and the client credential are bound. Therefore, when the client and the node are updated, only the node credential needs to be updated, and the node permission information does not need to be replaced. Since the node permission information does not need to be replaced when the node is updated in the embodiments of the present application, the node management method provided by the embodiments of the present application can complete the node update under the condition that the node is normally running. That is, the embodiments of the present application can avoid the problem that the node permission information needs to be replaced when the node is updated, thereby causing the node to be out of service and affecting the normal operation of the blockchain business.

[0078] In another possible implementation manner of the embodiments of the present application, the client program installed on the user terminal can further perform validity verification on the client and the node based on the permission information stored on the permission management platform after completing the node permission authentication. In order to ensure the validity of the issued node permission information, the client program installed on the user terminal can periodically perform validity verification on the client credential and the node credential. The client program installed on the user terminal can periodically acquire the permission information stored in the permission management platform, and the permission information stored on the permission management platform can include the client credential information and the node credential information. The client program installed on the user terminal can perform validity verification on the client program and the node by judging whether the client credential and the node credential of the permitted node are consistent with the permission information. If it is found by verification that the client credential is inconsistent with the permission information stored on the permission management platform, it can be considered that the client credential of the client program is invalid, that is, the node permission authentication function of the client is invalid. The client program installed on the user terminal can disable the node permission function in the program and stop the permission authentication for the node. Meanwhile, the client program installed on the user terminal can also stop the node service of the permitted node by sending a stop instruction to the permitted node, for example, the client can send a stop() instruction to the server deployed by the node to stop the node process.

[0079] If the client program installed on the user terminal finds by verification that the client credential is consistent with the permission information stored on the permission management platform, it can be considered that the client credential of the client program is valid, and the client program installed on the user terminal can further perform validity verification on any permitted node permitted by the client program. The client program installed on the user terminal can judge whether the permitted node is valid by judging whether the node credential in the configuration file of the permitted node is consistent with the permission information in the permission management platform.

[0080] If the client program installed on the user terminal verifies that the node credentials of a licensed node are inconsistent with the license information, the client program can consider the node invalid and send a warning message to the invalid node to remind the user and administrator that the node credentials are inconsistent with the license information stored on the license management platform. The client program installed on the user terminal can also stop the node service of a licensed node by sending a stop command to the licensed node; for example, the client can issue a stop() command to the server where the node is deployed to stop the node process. If the client program installed on the user terminal verifies that the information in the node credentials of a licensed node is consistent with the license information stored on the blockchain license management platform, the client program installed on the user terminal can consider both the current client and the licensed node to be valid and can continue to run blockchain services.

[0081] like Figure 9 The diagram illustrates the process of a client program installed on a user terminal verifying the validity of licensed nodes. To ensure the validity of issued nodes, the client program on the user terminal can perform periodic credential verification on licensed nodes. The client credential verification checks whether the client credential and node credential are consistent with the license information stored on the license management platform. Therefore, when verifying the validity of licensed nodes in S91, the client program on the user terminal first retrieves the license information stored on the license management platform. After receiving the license information from the license management platform, the client program on the user terminal proceeds to S92, which verifies whether the information in the client credential is consistent with the license information stored on the blockchain license management platform. If the information in the client credential is inconsistent with the license information stored on the blockchain license management platform, the client program on the user terminal can stop the node issuance function within the program and stop the node service of all nodes under the client by sending a stop command. If the information in the client credentials installed on the user terminal matches the license information stored on the blockchain license management platform, then proceed to S92. This allows the client program to further verify the validity of the node credentials; specifically, the client program can verify whether the information in the licensed node's credentials matches the license information stored on the blockchain license management platform. If the information in the licensed node's credentials does not match the license information stored on the blockchain license management platform, the client program installed on the user terminal can stop the node's service. If the information in the licensed node's credentials matches the license information stored on the blockchain license management platform, the client program installed on the user terminal can consider both the current client and the licensed node to be valid, and the blockchain business can continue to operate.

[0082] In the embodiments of the present application, the client program installed on the user terminal can periodically check the validity of the nodes and the client. Since the license information on the license management platform is stored on the blockchain network, the license information stored on the license management platform is tamper-proof. The client credentials and node credentials stored on the client program and the nodes are stored on the server device, so the node configuration file may be replaced by human. By checking the consistency of the tamper-proof license information and the client credentials and node credentials stored on the client program and the nodes, the consistency of the data stored on the client and the nodes and the data recorded on the license management platform can be effectively ensured. Even if someone replaces the node license locally, the validity check can timely discover it, which can further ensure the security of the blockchain network.

[0083] In another possible implementation manner of the embodiments of the present application, in order to further meet the requirements of the blockchain network for further supervision of the nodes and special customization requirements, the node management system in the embodiments of the present application can further include a supervisor. In the embodiments of the present application, the supervisor can be a user, and can also be a supervision platform or a terminal accessing the license management platform in the manner of a third party. The supervisor can formulate credential standards based on the restrictions of different blockchain types on node licenses, and write the formulated credential standards into the license management platform. The license management platform can issue credentials according to the credential standards. The supervisor can also formulate a plurality of node credential templates according to the types of blockchains. The license management platform can match different node credential templates according to the node license information, and generate corresponding node credentials based on the matched node credential templates. In addition, the supervisor can query the license information and update records stored on the license management platform. The supervisor can also query the issuance of credentials and licenses on the license management platform. The supervisor can supervise and review the client and the blockchain node according to the queried data.

[0084] In the embodiments of the present application, since the supervisor can formulate standardized templates of node credentials, and customize node restriction data in the credential templates for different blockchain types, and then the license management platform issues a plurality of node credentials according to the credential templates. Therefore, in the node management method provided in the present application, the supervisor can realize the customization operation of the node license restriction. The user can customize a plurality of node license restrictions according to the own requirements, and apply them to different blockchains.

[0085] In the embodiments of the present application, since the concept of credentials is introduced in the node management of the blockchain, the permission management platform can generate corresponding client credentials and node credentials according to the permission conditions submitted by the client program installed on the user terminal and the node permission information. Therefore, when the client program and the permitted node need to be updated, the user can write the updated permission data into the new client credentials and node credentials through the permission management platform, so that when the permission data of the blockchain network is updated, only the client credentials and the node credentials need to be updated, without replacing the node permission information. Compared with the prior art, when the user updates the permission data, the user needs to stop the blockchain network first, and then manually replace the node list of each node to update the node. Obviously, the node management method provided in the embodiments of the present application can improve the node management efficiency while ensuring the normal operation of the blockchain service, and is helpful for the user to manage the blockchain nodes in time. In the embodiments of the present application, since the client program installed on the user terminal is limited by the client permission conditions when performing permission authentication on the node, and the permission management platform writes the client identifier into the node credentials when generating the node credentials, the user can update the client identifier in the client credentials synchronously when updating the blockchain network. Subsequently, when updating the node, the client program installed on the user terminal can quickly determine the node that needs to be updated by judging whether the client identifier in the node credentials is consistent with the client identifier in the new client credentials, thereby realizing automatic batch updating of the node credentials. Therefore, by using the node management method provided in the embodiments of the present application, the node credentials can be updated in batches, the node management efficiency can be improved, and the large number of blockchain nodes can be effectively managed. In addition, in the embodiments of the present application, the permission, update, revocation and other node management operations of the node and the client can be performed by the client program installed on the user terminal, which sends the corresponding node management information such as node permission information, client permission conditions and other node management information to the permission management platform, and then the permission management platform stores these node management information on the chain. Since the blockchain has the characteristics of non-tamperability, storing various node management information on the chain by the permission management platform can preserve the record of node changes and prevent tampering by others.

[0086] It should be noted that the size of the serial number of each step in the above embodiments does not mean the execution order, and the execution order of each process should be determined according to its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0087] Referring to Figure 10 , a schematic diagram of a node management device provided by an embodiment of the present application is shown, which can specifically include an auditing module 1001, a permission module 1002 and an authorization module 1003, wherein:

[0088] An audit module 1001 is configured to generate an audit result of a node application initiated by a user terminal when receiving the node application, based on a client credential associated with the user terminal; the client program carries the client credential; the client credential is generated when the blockchain identifies that the client program installed on the user terminal is legal;

[0089] A permission module 1002 is configured to identify the node as a permitted node and generate a permission file of the permitted node if the audit result is passed; the permission file includes node permission; and the permitted node is to be deployed

[0090] An authorization module 1003 is configured to send the node permission to the permitted node, and the node permission is used to authorize the permitted node to run in the blockchain.

[0091] The audit module 1001 can also be configured to conditionally match node information of the node in the node application according to a node permission condition associated with the client credential; and generate the audit result of the audit pass if the node information matches the node permission condition.

[0092] The audit module 1001 can also be configured to generate the permission condition in the client program, send the permission condition to the permission management platform, receive the client credential fed back by the permission management platform based on the permission condition, and store the client credential; the client credential is generated when it is detected that the client program has a permission authority corresponding to the permission condition.

[0093] The permission module 1002 can also be configured to receive a node credential fed back by the permission management platform based on the node permission information; send the node credential and the node permission information to the permitted node, so that the permitted node generates a configuration file based on the node credential and the node permission information; and the permitted node is any node permitted by the client program.

[0094] The permission module 1002 can also be configured to send an update application to the permission management platform through the client program if any client credential satisfies an update condition corresponding to the client credential; update the permission condition and the client identifier of the client credential in response to an update instruction fed back by the permission management platform based on the update application; and update the node credential in each configuration file issued by the any client credential according to the update instruction.

[0095] The license module 1002 can also be configured to, in response to a node revocation instruction about any of the licensed nodes, generate node revocation information of the any licensed node, and send the node revocation information to the license management platform; receive a node revocation credential fed back by the license management platform based on the node revocation information, and delete the node credential of the any licensed node according to the node revocation credential.

[0096] The license module 1002 can also be configured to obtain license information in the license management platform; if the client credential is inconsistent with the license information, prohibit the user terminal from licensing nodes through the client program, and send a stop instruction to a licensed node; the stop instruction is used to stop the node service of the licensed node; the licensed node is any node licensed through the client program.

[0097] The license module 1002 can also be configured to, if the client credential is consistent with the license information, determine whether the node credential is consistent with the license information; if the node credential is inconsistent with the license information, send a warning information to the licensed node, and send a stop instruction to the licensed node.

[0098] Optionally, the client credential and the node credential are generated by the license management platform based on a credential standard and a credential template corresponding to the blockchain.

[0099] Optionally, the credential standard and the credential template are generated by a regulatory party and sent to the license management platform; the regulatory party is used to supervise and manage the license information stored in the license management platform.

[0100] For the device embodiment, it is basically similar to the method embodiment, so it is described more simply, and the related parts refer to the description in the method embodiment part.

[0101] Referring to Figure 11 , a schematic diagram of a terminal device provided by an embodiment of the present application is shown. As shown in Figure 11 , the terminal device 1100 in the embodiment of the present application includes a processor 1110, a memory 1120, and a computer program 1121 stored in the memory 1120 and executable on the processor 1110. The processor 1110 implements the steps in the above node management method embodiments when executing the computer program 1121, for example Figure 3 , steps S301 to S302. Alternatively, the processor 1110 implements the functions of each module / unit in the above device embodiments when executing the computer program 1121, for example Figure 10 , the functions of the modules 1001 to 1002.

[0102] For example, the computer program 1121 can be divided into one or more modules / units, which are stored in the memory 1120 and executed by the processor 1110 to complete the present application. The one or more modules / units can be a series of computer program instruction segments capable of completing a specific function, which can be used to describe the execution process of the computer program 1121 in the terminal device 1100. For example, the computer program 1121 can be divided into an audit module and a license module, and the specific functions of each module are as follows:

[0103] The audit module is configured to generate an audit result about the node application when receiving the node application sent by any node in the blockchain through a client program; the client program carries a client credential; the client credential is generated when the client program is identified as legal by the blockchain;

[0104] The license module is configured to generate node license information about the any node if the audit result is passed, and send the node license information to the any node and the corresponding license management platform of the blockchain to bind the client program and the any node; the node license information includes license information allowing the any node to run in the blockchain.

[0105] The terminal device 1100 can be a server device in the foregoing embodiments, which can be a desktop computer, a cloud server, or the like. The terminal device 1100 can include, but is not limited to, a processor 1110 and a memory 1120. Those skilled in the art can understand that, Figure 11 The terminal device 1100 is only an example and does not constitute a limitation on the terminal device 1100, and can include more or fewer components than those shown, or combine certain components, or different components, for example, the terminal device 1100 can also include an input / output device, a network access device, a bus, and the like.

[0106] The processor 1110 can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic components, discrete hardware components, etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor.

[0107] The memory 1120 can be an internal storage unit of the terminal device 1100, for example, a hard disk or a memory of the terminal device 1100. The memory 1120 can also be an external storage device of the terminal device 1100, for example, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. Further, the memory 1120 can include both an internal storage unit and an external storage device of the terminal device 1100. The memory 1120 is used to store the computer program 1121 and other programs and data required by the terminal device 1100. The memory 1120 can also be used to temporarily store data that has been output or will be output.

[0108] The embodiments of the present application also disclose a terminal device, which comprises a memory, a processor and a computer program stored in the memory and executable on the processor, and the processor implements the node management method according to the foregoing embodiments when executing the computer program.

[0109] The embodiments of the present application also disclose a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the node management method according to the foregoing embodiments.

[0110] The embodiments of the present application also disclose a computer program product, which, when running on a computer, enables the computer to execute the node management method according to the foregoing embodiments.

[0111] The above-described embodiments are merely used to illustrate the technical solutions of the present application, but not to limit the same. Although the present application is described in detail with reference to the foregoing embodiments, it should be understood by those skilled in the art that the technical solutions recorded in the foregoing embodiments can be modified, or some of the technical features can be replaced equivalently, and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application.

Claims

1. A node management method applied to a blockchain system, characterized in that, The method comprises: Upon receiving a node application initiated by a user terminal for a node, generating an audit result of the node application based on a client credential associated with the user terminal; The client credential is generated when the client program installed on the user terminal is identified as legitimate by the blockchain; If the audit result is an audit pass, the node is identified as a permitted node, and a permission file of the permitted node is generated; the permission file comprises node permission; The node permission is sent to the permitted node; the node permission is used to authorize the permitted node to run in the blockchain; The method comprises: According to the permission condition associated with the client credential, conditionally matching node information of the node in the node application; the permission condition comprises an IP address range of a node that can be permitted; the node information comprises an IP address of the node; If the node information matches the permission condition, the audit result of the audit pass is generated.

2. The method of claim 1, wherein, The method comprises: The permission file is sent to a permission management platform corresponding to the blockchain to bind the client credential and the permitted node; Receiving a node credential fed back by the permission management platform based on the permission file; Generating a configuration file based on the node credential and the node permission, and sending the configuration file to the permitted node.

3. The method of claim 2, wherein, The node credential and the client credential comprise a client identifier; after the configuration file is generated based on the node credential and the node permission, and the configuration file is sent to the permitted node, the method further comprises: If any update condition corresponding to the client credential is met, an update application is sent to the permission management platform; In response to an update instruction fed back by the permission management platform based on the update application, updating the permission condition and the client identifier of the client credential; Obtaining the configuration file of the permitted node, and updating the node credential in each configuration file issued by the client credential according to the update instruction.

4. The method of claim 2, wherein, After the configuration file is generated based on the node credential and the node permission, and the configuration file is sent to the permitted node, the method further comprises: In response to a node revocation instruction of any permitted node, generating node revocation information of the any permitted node, and sending the node revocation information to the permission management platform; Receiving a node revocation credential fed back by the permission management platform based on the node revocation information, and deleting the node credential of the any permitted node according to the node revocation credential.

5. The method of claim 2, wherein, The client credential and the node credential are generated by the permission management platform based on a credential standard and a credential template corresponding to the blockchain.

6. The method of claim 5, wherein The credential standard and the credential template are generated by a supervisor and sent to the permission management platform; the supervisor is used to supervise and manage the permission information stored in the permission management platform.

7. The method of claim 1, wherein, The permission file further includes permission information, and after the node permission is sent to the permitted node, the following steps are further included: Obtaining the permission information in the permission management platform; If the client credential is inconsistent with the permission information, the user terminal is prohibited from obtaining node permission through the client program, and a stop instruction is sent to the permitted node; the stop instruction is used to stop the node service of the permitted node; the permitted node is any node permitted through the client program.

8. The method of claim 7, wherein, The node credential is generated by the permission management platform based on the permission file, and after the permission information in the permission management platform is obtained, the following steps are further included: If the client credential is consistent with the permission information, it is determined whether the node credential is consistent with the permission information; If the node credential is inconsistent with the permission information, an alert information is sent to the permitted node, and a stop instruction is sent to the permitted node.

9. The method according to any one of claims 1 to 8, characterized in that, Before receiving the node application initiated by the user and generating the audit result of the node application through the client program, the following steps are included: Generating the permission condition in the client program and sending the permission condition to the permission management platform; Receiving the client credential fed back by the permission management platform based on the permission condition, and storing the client credential; the client credential is generated when it is detected that the client program has the permission authority corresponding to the permission condition. 10.A node management apparatus applied to a blockchain, characterized in that, It includes: An audit module is used to generate an audit result of the node application based on the client credential associated with the user terminal when the user terminal initiates the node application; the client credential is generated when the client program installed on the user terminal is identified by the blockchain to be legal; when the user terminal initiates the node application, the audit result of the node application is generated based on the client credential associated with the user terminal, including: the node information of the node in the node application is conditionally matched according to the permission condition associated with the client credential; the permission condition includes the IP address range of the node that can be permitted; the node information includes the IP address of the node; if the node information matches the permission condition, an audit pass audit result is generated; A permission module is used to identify the node as a permitted node if the audit result is an audit pass, and generate a permission file about the permitted node; the permission file includes node permission; An authorization module is used to send the node permission to the permitted node, and the node permission is used to authorize the permitted node to run in the blockchain to be deployed. The processor executes the computer program to realize the node management method of any one of claims 1-9.

11. A terminal device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, The computer program is executed by the processor to realize the node management method of any one of claims 1-9.

12. A computer-readable storage medium, the computer-readable storage medium storing a computer program, characterized in that, ​

Images