Authorization methods, systems, computing devices, and readable storage media

Abstract

The application discloses an authorization method, a system, a computing device and a readable storage medium, which are executed in a node server in a blockchain, and the method comprises the following steps: receiving in-chain information sent by a device, wherein the in-chain information comprises a device unique identifier of the device; signing the device unique identifier to obtain an in-chain permission certificate; and sending the in-chain permission certificate to the device, so that the device joins the blockchain based on the in-chain permission certificate and obtains the permission authorized by the node server. The technical scheme of the application improves the security of the authorization scheme.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of blockchain, and in particular to an authorization method, an authorization system, a computing device and a readable storage medium. BACKGROUND

[0002] At present, the batch authorization scheme of the site (in the local area network) device usually has the problem of being unable to safely guarantee high availability when issuing authorization. In the existing scheme, the user can purchase a batch of serial numbers through the official channel, and manually activate each device in the local area network. Although this scheme can achieve the purpose of authorization, it has low flexibility. Since one serial number can only correspond to one device, the authorization needs to be bound with the device, and therefore the authorization usage time is calculated from the moment of device activation, and the permission cannot be reused, resulting in high billing.

[0003] In another scheme, the user can manage authorization by purchasing an official local area network authorization manager, but since the authorization manager uses a traditional database, according to the CAP theorem, the scheme cannot simultaneously satisfy the three elements of consistency, availability and partition tolerance. In the local area network scenario, the availability needs to be sacrificed to guarantee data security, and the availability is not met. When the authorization manager appears, for example, the situation of downtime, the overall local area network authorization will appear the situation of paralysis.

[0004] Therefore, there is an urgent need for an authorization scheme to solve the problems in the prior art. SUMMARY

[0005] Therefore, the present application provides an authorization method, an authorization system, a computing device and a readable storage medium to solve or at least alleviate the above problems.

[0006] According to a first aspect of the present application, an authorization method is provided, which is executed in a node server in a blockchain, and the method comprises: receiving in-chain information sent by a device, the in-chain information comprising a device unique identifier of the device; signing the device unique identifier to obtain an in-chain permission credential; and sending the in-chain permission credential to the device, so that the device joins the blockchain based on the in-chain permission credential and obtains the permission authorized by the node server.

[0007] Optionally, in the authorization method according to the present application, the node server is in communication connection with an authorization server, and the method further comprises: receiving in-chain permission data sent by the authorization server, the in-chain permission data comprising a signature key, a signature algorithm and a quantity control permission for controlling the number of authorizations; and wherein the step of signing the device unique identifier comprises: if the number of nodes in the blockchain does not exceed the number of authorizations, signing the device unique identifier based on the signature key and the signature algorithm.

[0008] Optionally, in the authorization method according to the present application, the step of joining the blockchain based on the in-chain permission credential comprises: obtaining a public key in the signature key from the node server; verifying the in-chain permission credential based on the public key; if the verification is successful, verifying the legality of the in-chain and out-chain information included in the blockchain; if the verification is successful, performing a hash operation on the in-chain timestamp of the device, the in-chain permission credential, the unique identification of the device, and the in-chain hash value of the previous device to obtain the in-chain hash value of the device.

[0009] Optionally, in the authorization method according to the present application, it further comprises: generating an in-chain record based on the in-chain hash value of the device, the in-chain timestamp, the unique identification of the device, the Internet protocol address of the device at the time of in-chain, the in-chain permission credential, and the in-chain and out-chain type; and synchronizing the in-chain record to each node in the blockchain.

[0010] Optionally, in the authorization method according to the present application, the device maintains a heartbeat connection with the node server, and the method further comprises: if a heartbeat packet sent by the device is not received within a predetermined time, the authority is withdrawn, the current time is taken as an out-chain timestamp, and an out-chain transaction of the device is initiated based on the out-chain timestamp and the in-chain permission credential to obtain a first out-chain record; and the first out-chain record is stored in a block of the blockchain and broadcast to each node in the blockchain.

[0011] Optionally, in the authorization method according to the present application, it further comprises: receiving and storing a second out-chain record sent by the device, and withdrawing the authority, the second out-chain record comprising an out-chain timestamp and an out-chain permission credential of the device.

[0012] Optionally, in the authorization method according to the present application, it further comprises: obtaining an authorization duration of the device, the authorization duration being a time interval between the in-chain timestamp and the out-chain timestamp.

[0013] Optionally, in the authorization method according to the present application, it further comprises: if the verification fails or the verification fails, the authorization fails.

[0014] Optionally, in the authorization method according to the present application, the in-chain permission data further comprises authorization information for authorizing the node server, and the method further comprises: obtaining authorization authority based on the authorization information to authorize the device.

[0015] According to a second aspect of the present application, an authorization method is provided, which is executed in a device, and the method comprises: sending in-chain information of the device to a node server in a blockchain, so that the node server signs an in-chain permission credential based on a unique identification of the device included in the in-chain information; receiving the in-chain permission credential sent by the node server; and joining the blockchain based on the in-chain permission credential and obtaining the authority.

[0016] Optionally, in the authorization method according to the present application, the step of joining the blockchain based on the in-chain permission certificate comprises: obtaining a public key in the signature key from the node server; verifying the in-chain permission certificate based on the search public key; if the verification is successful, verifying the legality of the in-chain and out-chain information included in the blockchain; if the verification is successful, performing a hash operation on the in-chain timestamp of the device, the in-chain permission certificate, and the in-chain hash value of the previous device to obtain the in-chain hash value of the device.

[0017] Optionally, in the authorization method according to the present application, it further comprises: generating an in-chain record based on the in-chain hash value of the device, the in-chain timestamp, the unique identification of the device, the Internet protocol address of the device when entering the chain, and the in-chain and out-chain type; and synchronizing the in-chain record to each node in the blockchain.

[0018] Optionally, in the authorization method according to the present application, it further comprises: in response to the device initiating an out-chain transaction when exiting the blockchain, generating an out-chain record, the out-chain record comprising the out-chain timestamp of the device and the out-chain certificate information; and broadcasting the out-chain record to each node in the blockchain.

[0019] According to a third aspect of the present application, an authorization system is provided, comprising: a node server adapted to execute the authorization method as described above; an authorization server adapted to send in-chain permission data, authorization quantity, and authorization information to the node server, and further adapted to disconnect the communication connection between the node server connected later in response to more than one node server being in communication connection with the authorization server; and a device adapted to execute the authorization method as described above.

[0020] According to a fourth aspect of the present application, a computing device is provided, comprising: at least one processor; a memory storing program instructions, wherein the program instructions are configured to be executed by the at least one processor, and the program instructions comprise instructions for executing the method as described above.

[0021] According to a fifth aspect of the present application, a readable storage medium storing program instructions is provided, when the program instructions are read and executed by a computing device, the computing device executes the method as described above.

[0022] According to the technical scheme of the present application, the node server receives the in-chain information sent by the device, signs the in-chain information to generate an in-chain permission certificate, and sends the in-chain permission certificate to the device. The device can join the blockchain based on the in-chain permission certificate and obtain the authorization permission of the node server. The node server manages the devices on each node through the blockchain. Since each node has the blockchain ledger data in the blockchain, the ledger data records the authorization history information of each device, which facilitates the query of the authorization record of the device. Moreover, only addition and query operations can be performed on the blockchain, and the data is difficult to tamper with, which facilitates the management of the device and improves the security of the authorization scheme.

[0023] The above description is only a summary of the technical scheme of the present application. In order to more clearly understand the technical means of the present application, the content of the specification can be implemented, and in order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific embodiments of the present application are described below. BRIEF DESCRIPTION OF DRAWINGS

[0024] In order to achieve the above and related purposes, certain illustrative aspects will be described herein in connection with the following description and drawings, which indicate various ways in which the principles disclosed herein can be practiced, and all aspects and their equivalents are intended to fall within the scope of the claimed subject matter. The above and other objects, features and advantages of the present disclosure will become more apparent from the following detailed description, taken in conjunction with the accompanying drawings. Throughout the disclosure, like reference numerals generally refer to like parts or elements throughout the disclosure.

[0025] Figure 1 An authorization scenario in the prior art is shown;

[0026] Figure 2 A block diagram showing the physical components of a computing device 200 according to one embodiment of the present application is shown;

[0027] Figure 3 A flowchart showing an authorization method 300 according to one embodiment of the present application is shown;

[0028] Figure 4 A schematic diagram showing the connection of a node server and an authorization server according to one embodiment of the present application is shown;

[0029] Figure 5 A schematic diagram showing node in-chain according to one embodiment of the present application is shown;

[0030] Figure 6 A schematic diagram showing node out-chain according to one embodiment of the present application is shown;

[0031] Figure 7 A schematic diagram showing authorization duration according to one embodiment of the present application is shown;

[0032] Figure 8 A schematic diagram of an authorization system 800 according to an embodiment of the present application is shown. DETAILED DESCRIPTION

[0033] Exemplary embodiments of the present disclosure will be described more fully hereinafter with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it is to be understood that the present disclosure can be embodied in various forms without being limited by the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the present disclosure to those skilled in the art.

[0034] In an existing solution, a user can manage authorization by purchasing an official local network authorization manager, but since the authorization manager uses a traditional database, according to the CAP theorem, the solution cannot simultaneously satisfy the three elements of consistency, availability, and partition tolerance. In a local network scenario, the solution usually needs to sacrifice availability to ensure data security, and does not satisfy availability. When the authorization manager is down, the overall local network authorization will be paralyzed. Figure 1 An authorization scenario in the existing solution is shown. As shown in Figure 1 In a normal case, the existing solution has two main and standby authorization managers connected with an authorization database, and the authorization database also has two main and standby databases. In an abnormal case, isolation of the database can achieve multiple issuance of one authorization, thereby causing the spread of authorization. The system availability usually needs to be sacrificed to ensure data security and avoid the occurrence of the above scenario, which leads to the problem of low system availability. Therefore, the present application proposes an authorization solution to solve the problems in the prior art.

[0035] Figure 2 A block diagram of the physical components (i.e., hardware) of a computing device 200 is shown. In a basic configuration, the computing device 200 includes at least one processing unit 202 and a system memory 204. According to an aspect, depending on the configuration and type of computing device, the processing unit 202 can be implemented as a processor. The system memory 204 includes, but is not limited to, volatile (e.g., random access memory (RAM)), non-volatile (e.g., read-only memory (ROM)), flash memory, or any combination thereof. According to an aspect, the system memory 204 includes an operating system 205 and program modules 206, which include the authorization system 800 of the present application, in the program modules 206.

[0036] According to an aspect, the operating system 205 is suitable for controlling the operation of the computing device 200, for example. In addition, the example is practiced in conjunction with a graphics library, other operating systems, or any other application programs, and is not limited to any particular application or system. In this regard, the computing device 200 can implement any suitable operating system.Figure 2 The basic configuration is shown in FIG. 2 by those components within the dashed line 208. According to an aspect, the computing device 200 has additional features or functionality. For example, according to an aspect, the computing device 200 includes additional data storage devices (removable and / or non-removable) such as, for example, magnetic disks, optical disks, or tape. Such additional storage is illustrated in FIG. 2 by the removable storage 209 and the non-removable storage 210. Figure 2

[0037] As stated above, according to an aspect, program module 206 is stored in the system memory 204. According to an aspect, the program modules 206 can include one or more applications. The application is not limited by the types of applications it implements, for example, the applications can include an email and contacts application, a word processing application, a spreadsheet application, a database application, a slide presentation application, a painting or computer-aided application, a web browser application, etc.

[0038] According to an aspect, the examples can be practiced with circuitry integrated on a single integrated circuit chip, with discrete electronic components, with application specific integrated circuits, with microprocessors, or within a personal computer, a mobile telephone, a portable music player, or other networked device. For example, the examples can be practiced via a system-on-a-chip (SOC) that integrates, on a single integrated circuit package, one or more of the components shown in FIG. 2. According to an aspect, such an SOC device can include one or more processing units, graphics units, communications units, system virtualization units, and various application functionality all as integrated (or "burned") onto the chip substrate as a single integrated circuit. When operating via an SOC, the functionality described herein can be operated via application-specific logic integrated with other components of the computing device 200 on the single integrated circuit (chip). Embodiments of the application can also be practiced using other technologies capable of performing logical operations such as, for example, AND, OR, and NOT, including but not limited to mechanical, optical, fluidic, and quantum technologies. In addition, embodiments of the application can be practiced within a general computer system or in any other circuits or systems. Figure 2

[0039] ​​According to an aspect, the computing device 200 can also have one or more input device(s) 212 such as a keyboard, mouse, pen, voice input device, touch input device, etc. Output device(s) 214 such as a display, speakers, a printer, etc. can also be included. The aforementioned devices are examples and others can be used. The computing device 200 can include one or more communication connections 216 allowing communications with other computing devices 218. Examples of suitable communication connections 216 include, but are not limited to, an RF transmitter, receiver, and / or transceiver circuitry; universal serial bus (USB), parallel, and / or serial ports.

[0040] The term computer readable media as used herein includes computer storage media. Computer storage media can include volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, or program modules. The system memory 204, the removable storage device 209, and the non-removable storage device 210 are all computer storage media examples (i.e., memory storage.) Computer storage media can include Random Access Memory (RAM), Read-Only Memory (ROM), Electronically Erasable Programmable Read-Only Memory (EEPROM), flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store information and which can be accessed by the computer device 200. According to an aspect, any such computer storage media can be part of the computer device 200. Computer storage media does not include a modulated data signal or other propagated data signal.

[0041] According to an aspect, communication media typically embodies computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism and includes any information delivery media. According to an aspect, the term "modulated data signal" describes a signal that has one or more characteristics set or changed in such a manner as to encode information in the signal. By way of example, and not limitation, communication media includes wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, radio frequency (RF), infrared, and other wireless media.

[0042] In one embodiment of the application, the computing device 200 includes one or more processors and one or more readable storage media storing program instructions. When the program instructions are configured to be executed by the one or more processors, the computing device performs the authorization method in the embodiments of the application.

[0043] Figure 3A flow chart of the authorization method 300 according to an embodiment of the present application is shown.

[0044] In step 310, a node server in the blockchain receives the in-chain permission data sent by the authorization server, wherein the in-chain permission data comprises a signature key, a signature algorithm and a quantity control permission for controlling the number of authorizations. Optionally, the blockchain is a private chain, which is one of several categories of blockchains and is usually open to individual individuals or entities. Using a private chain can ensure the security of information and protect the privacy of user data. The node server is in communication connection with the authorization server.

[0045] According to an embodiment of the present application, the node server is in communication connection with the authorization server, the node server sends a request for obtaining permission to the authorization server, and the authorization server sends the in-chain permission data and the number of authorizations to the node server after receiving the request, so that the node server manages the blockchain using the in-chain permission data and the number of authorizations, for example, manages the joining or exiting of other nodes to the blockchain. Optionally, the authorization server can be a license center or an authorization cloud server, which can be responsible for authorizing the node server. Optionally, the node server elects a master node, which is in communication connection with the authorization server, the master node sends a request for obtaining permission to the authorization server, and receives the in-chain permission data and the number of authorizations sent by the authorization server. Only the master node communicates with the authorization server can ensure that no other node communicates with the authorization server, so as to avoid the unlimited spread of authorization. Optionally, the communication connection is a heartbeat communication.

[0046] Optionally, the in-chain permission data further comprises authorization information for authorizing the node server, i.e. the authorization information of the node server itself, based on which the node server can obtain authorization permission, and the node server has the permission to authorize other nodes in the blockchain.

[0047] According to an embodiment of the present application, to prevent unlimited spread of authorization, if more than one node server (or more than one master node) is in communication connection with the authorization server at the same time, it is determined that there is a risk of unlimited spread of authorization, and the authorization server cancels the newly registered node server (or master node), i.e. disconnects the communication connection between the node server connected later. Figure 4 A schematic diagram of the connection between the node server and the authorization server according to an embodiment of the present application is shown. As shown in FIG. 4, the node server is in communication connection with the authorization server. Figure 4As shown, after the node server A has been communicatively connected with the authorization server, the node server A keeps a heartbeat connection with the authorization server, and after this, if the node server B establishes a communication connection with the authorization server, the authorization server will disconnect the connection with the node server B, and the authorization server will not issue the in-chain permission data to the node server B connected later, thereby avoiding the risk of unlimited authorization caused by multiple node servers accessing the authorization server. Alternatively, if the authorization server has issued the in-chain permission data to the node server connected later, the authorization server disconnects the connection between the node server connected later, and cancels the issued in-chain permission data.

[0048] According to the technical scheme of the present application, the authorization of the device is managed in the blockchain, and due to the characteristics of the blockchain technology, the technical scheme of the present application has partition tolerance, and the system using the authorization method of the present application also has natural partition tolerance.

[0049] In step 320, the node server receives the in-chain information sent by the device, and the in-chain information includes the device unique identifier of the device. Alternatively, the device can be any computing device.

[0050] According to the embodiment of the present application, the device applies for in-chain to the node server when it needs to obtain permission. Alternatively, the situation of needing to obtain permission can be, for example, when it needs to join a local area network, when it needs to obtain software permission, and the like. The device applies for in-chain to the node server and sends in-chain information. According to the embodiment of the present application, the in-chain information includes the device unique identifier of the device. Alternatively, the device unique identifier of the device can be the hardware combination information of the device or other identifiers that can identify the uniqueness of the device. Alternatively, the in-chain information further includes a signature value.

[0051] In step 330, the node server signs the device unique identifier to obtain an in-chain permission credential.

[0052] According to the embodiment of the present application, after receiving the in-chain information, the node server signs the device unique identifier of the received device to generate an in-chain permission credential. Only the device that has obtained the in-chain permission credential sent by the node server can join the blockchain as a node, which ensures the security of the authorization and facilitates the management of the authorization, and ensures that the device that has not joined the blockchain cannot obtain the authorization.

[0053] According to one embodiment of the present application, in the node server, it is judged whether the number of nodes joining the blockchain exceeds the authorized number, and the authorized number can be the authorized number for authorization to other nodes limited by the number control authority obtained by the node server, for example, the authorized number of the number control authority obtained by the node server is 5, and the node server can authorize 5 nodes joining the blockchain. If the number of nodes joining the blockchain exceeds the authorized number, the node server will not perform the operation of signing the device unique identifier, the operation of sending the chain entry permission certificate, and the operation of authorizing the device. If the number of nodes joining the blockchain does not exceed the authorized number, the device unique identifier is signed based on the signature key and the signature algorithm in the chain entry permission data, and the chain entry permission certificate is issued to the device to authorize the device. By limiting the authorized number, the node server can only authorize the node device within the authorized number, avoiding unlimited spread of authorization and ensuring the security of authorization.

[0054] In step 340, the node server sends the chain entry permission certificate to the device so that the device joins the blockchain based on the chain entry permission certificate and obtains the authorization permission of the node server.

[0055] According to an embodiment of the present application, after obtaining the entry chain permission certificate sent by the node server, the device acquires the public key in the signature key from the node server, so that the device verifies the legality of the received entry chain permission certificate by using the public key to determine that the entry chain permission certificate is issued by the node server, and if the verification is successful, the device joins the blockchain. Specifically, the device verifies the entry chain permission certificate based on the public key. If the verification is successful, the legality of the entry chain and exit chain information included in the blockchain is verified. If the verification fails, the device does not perform subsequent operations of joining the blockchain, and the authorization process ends. If the legality verification is successful, the entry chain timestamp of the device, the entry chain permission certificate, the unique identifier of the device, and the entry chain hash value of the previous device are hashed to obtain the entry chain hash value of the device. The previous device can be the previous device that joins the blockchain, i.e., the device that joins the blockchain before the current device. If the legality verification fails, the device does not perform subsequent operations of joining the blockchain, and the authorization process ends. The purpose of verifying the legality of the entire blockchain is to prevent the node-authorized information (such as the device unique identifier, the entry / exit timestamp, etc.) from being tampered with. If the verification fails, it indicates that there may be malicious tampering of the authorization-related information, and the device cannot join the blockchain, i.e., cannot obtain authorization. Alternatively, the hash operation can be SHA-256 operation, or other hash algorithms such as MD5, SHA-1, SHA-2, SHA-384, RIPEMD-160, etc. According to an embodiment of the present application, for performance and security considerations, the hash operation selects two SHA-256 operations, which can guarantee the generation of a unique hash result and are difficult to be cracked. The operation mode of the two SHA-256 operations on the entry chain timestamp of the device, the entry chain permission certificate, the unique identifier of the device, and the entry chain hash value of the previous device is as follows: SHA-256(SHA-256(entry chain hash value of the previous device + entry chain timestamp + entry chain permission certificate + unique identifier of the device)), i.e., after performing the hash operation on the entry chain timestamp of the device, the entry chain permission certificate, the unique identifier of the device, and the entry chain hash value of the previous device, the operation result is executed again.

[0056] Then, based on the entry chain hash value of the device, the entry chain timestamp, the unique identifier of the device, the Internet protocol address when the device enters the chain, and the entry / exit chain type, an entry chain record is generated, and the entry chain record is synchronized to each node in the blockchain.

[0057] According to an embodiment of the present application, the entry chain record includes the entry chain hash value of the device, the entry chain timestamp, the unique identifier of the device, the Internet protocol address when the device enters the chain, the entry chain permission certificate, and the entry / exit chain type. The following is an exemplary entry chain record of a device:

[0058] {

[0059] history:[{...},{...}]

[0060] pre_log:{

[0061] head:"764317283e1b1e299d93c520104668846afaee2758441b933046e40b5ea759a5",

[0062] type:1, / / Record type: 1:Inbound, 2:Outbound

[0063] time:1615446658, / / Ingress time

[0064] signature:"b011a267afd58468", / / Inbound certificate

[0065] hw_id:"83d461b2e011425180f7dadd77c7331b", / / Hardware identifier

[0066] IP: "10.7.13.76" / / IP address when the device joins the network

[0067] }

[0068] }

[0069] In this exemplary device's on-chain record, the 64-bit hash value corresponding to `head` is the device's on-chain hash value, the value corresponding to `type` indicates the type of on-chain entry / exit, including on-chain or off-chain, the value corresponding to `time` represents the timestamp; in this example, the device is joining the blockchain, so this timestamp is the on-chain timestamp. If the device is leaving the blockchain, the timestamp corresponds to the off-chain timestamp. The value corresponding to `signature` represents the on-chain permission credential, the value corresponding to `hw_id` represents the device's unique identifier, and the value corresponding to `ip` represents the device's Internet Protocol address when it joined the blockchain. Based on these contents, the device's on-chain record is generated and synchronized to each node in the blockchain, making the blockchain a ledger that guarantees the records of all devices. The blockchain stores multiple copies of the on-chain and off-chain records of each node. Since each node in the blockchain has data backup, the high availability of the entire system can be guaranteed.

[0070] Figure 5 A schematic diagram illustrating node joining the chain according to an embodiment of the present invention is shown. Figure 5As shown, each device needs to obtain a chain entry permission certificate from the node server when it joins the blockchain as a node, the node server stores the chain entry length threshold of the blockchain, which represents the carrying capacity of the blockchain, i.e., the authorized number. If the number of nodes in the blockchain does not reach the authorized number, i.e., the blockchain still has carrying capacity for authorization for devices, if the threshold is reached, a node needs to exit the blockchain to release the authorization capacity of the node server for authorization for devices that join the blockchain. If the authorized number is not reached, the chain entry permission certificate is issued to the chain entry device and the chain entry configuration is allocated. Figure 5 In the embodiment, the device D applies for chain entry as a node, initiates a chain entry transaction after chain entry, records the chain entry time of the node D, the chain entry permission certificate and other information, and broadcasts to each node for verification and storage by each node.

[0071] According to the embodiment of the application, the device chain exit, i.e., the exit of the blockchain, can be divided into two cases, one is the normal exit of the node, and the other is the abnormal exit of the node. Regarding the abnormal exit of the node, each node in the blockchain maintains a heartbeat interactive connection with the node server. When the node server does not sense the node heartbeat for more than a predetermined time, i.e., does not receive the heartbeat packet sent by the device within the predetermined time, the recovery mechanism is started, the current time is taken as the chain exit timestamp, and the chain exit transaction of the device is initiated based on the chain exit timestamp and the chain entry permission certificate to obtain a first chain exit record. The first chain exit record is stored in the block of the blockchain and broadcast to each node of the blockchain, so that each node verifies and stores the received first chain exit record.

[0072] Regarding the normal exit of the node, when the device exits the blockchain, the device initiates a chain exit transaction to the node server, the process of chain exit is similar to that of chain entry, the device sends chain exit information to the node server, the node server generates a chain exit permission certificate, sends the chain exit permission certificate to the device, the device exits the blockchain based on the chain exit permission certificate, generates a second chain exit record, the node server receives and stores the second chain exit record sent by the device, and recovers the authority. The generation rules of the chain exit permission certificate and the chain entry permission certificate are the same, the difference between the chain exit record and the chain entry record is that the type of chain entry and chain exit is different, the type is chain exit, and the other parts are the same. The second chain exit record includes the chain exit timestamp of the device and the chain exit permission certificate. Figure 6 A schematic diagram of node chain exit according to an embodiment of the application is shown. As shown, Figure 6 After joining the blockchain, the node D maintains a heartbeat connection with the node server. When the node D needs to exit the blockchain, it actively reports the chain exit, initiates a chain exit transaction, generates a second chain exit record, and broadcasts to other nodes, so that each node verifies and stores the second chain exit record.

[0073] According to one embodiment of the present application, the authorization duration of the device corresponding to each node in the blockchain can be managed. The account information recorded in the block of the blockchain is obtained, and the account information includes the in-chain and out-chain records of each node. Since each node of the blockchain has a backup of the account information, the authorization duration of each node can be analyzed by obtaining the account information in the block of any node. The in-chain timestamp and the out-chain timestamp of a device are obtained, and the time interval between the in-chain timestamp and the out-chain timestamp is determined, which is the authorization duration obtained by the device. If the out-chain timestamp of the device does not exist in the account information, it means that the device has not out-chained and still holds the right, and the time interval between the in-chain timestamp and the current time is determined, which is the authorization duration obtained by the device. Figure 7 A schematic diagram of the authorization duration according to one embodiment of the present application is shown. As shown in Figure 7 The in-chain and / or out-chain records of each device are recorded in a block, and if the authorization duration of the device corresponding to node B is analyzed, the in-chain timestamp and the out-chain timestamp of node B can be obtained to determine the time interval therebetween, thereby obtaining the authorization duration of the device corresponding to node B.

[0074] The present application also provides an authorization system, Figure 8 A schematic diagram of the authorization system 800 according to one embodiment of the present application is shown. As shown in Figure 8 The authorization system 800 includes a node server 810, an authorization server 820 and a device 830.

[0075] The authorization server 820 is adapted to send in-chain permission data, authorization quantity and authorization information to the node server, and to disconnect the communication connection between the node server and the authorization server in response to more than one node server being in communication connection with the authorization server.

[0076] It should be noted that the working principles and specific execution logic of the node server 810, the authorization server 820 and the device 830 included in the authorization system 800 are described in the foregoing method 300, and specific reference can be made to the specific description in the authorization method 300, which will not be repeated here.

[0077] According to the technical scheme of the present application, by receiving the in-chain information sent by the device in the node server, and signing the in-chain information to generate an in-chain permission certificate, and sending the in-chain permission certificate to the device, the device can join the blockchain based on the in-chain permission certificate and obtain the permission authorized by the node server, realizing that the node server manages the devices on each node through the blockchain. Since each node has the blockchain ledger data in the blockchain, the authorization history information of each device is recorded, which is convenient for querying the authorization record of the device. Moreover, only addition and query operations can be performed on the blockchain, and the data is difficult to tamper with, which is convenient for managing the device and improves the security of the authorization scheme.

[0078] Further, the node server limits the number of devices that join the blockchain and obtain authorization through the number control permission in the in-chain permission data for controlling the number of authorizations, which improves the security of the authorization scheme and avoids unlimited spread of authorization. In addition, the authorization duration of the device can be managed through the in-chain timestamp and out-chain timestamp of the device, which is convenient for grasping the information of the authorization duration of each device.

[0079] Moreover, the in-chain record of the device is synchronized to each node in the blockchain, so each node of the blockchain stores a backup of the data, realizing the high availability of the scheme. At the same time, since the blockchain has partition tolerance, the authorization scheme of the present application can realize the characteristics of high security, high availability and partition tolerance.

[0080] A6. The method of any one of A2 to A4, further comprising receiving and storing a second out-link record sent by the device, the second out-link record comprising an out-link timestamp and an out-link permission credential of the device, and retrieving the permission. A7. The method of A5 or A6, further comprising obtaining an authorized duration of the device, the authorized duration being a time interval between the in-link timestamp and the out-link timestamp. A8. The method of A3 or A4, further comprising authorizing failure if the signature verification fails or the verification fails. A9. The method of any one of A2 to A8, wherein the in-link permission data further comprises authorization information for authorizing the node server, the method further comprising obtaining an authorization permission based on the authorization information to authorize the device. A12. The method of A11, further comprising generating an in-link record based on the in-link hash value of the device, the in-link timestamp, the device unique identifier, an Internet Protocol address of the device at the in-link time, and an in-link and out-link type, and synchronizing the in-link record to each node in the blockchain. A13. The method of any one of A10 to A12, further comprising generating an out-link record in response to the device initiating an out-link transaction when exiting the blockchain, the out-link record comprising an out-link timestamp and out-link credential information of the device, and broadcasting the out-link record to each node in the blockchain.

[0081] The various techniques described herein can be implemented in connection with hardware or software or, where appropriate, with a combination of both. Thus, the methods and apparatus of the present application, or certain aspects or portions thereof, can take the form of program code (i.e., instructions) embodied in tangible media, such as removable hard disks, USB flash drives, floppy diskettes, CD-ROMs, ROMs, or any other machine-readable storage medium, wherein, when the program code is loaded into and executed by a machine, such as a computer, the machine becomes an apparatus for practicing the subject application.

[0082] Where a program code is executed on a programmable computer, the mobile terminal generally includes a processor, a memory that is readable by the processor (including volatile and non-volatile memory and / or storage elements), at least one input device, and at least one output device. The memory is configured to store program code; the processor is configured to execute instructions in the program code stored in the memory to perform the authorization method of the present application.

[0083] By way of example, and not limitation, a readable medium includes a readable storage medium and a communication medium. A readable storage medium stores information such as computer readable instructions, data structures, program modules or other data. A communication medium conveys information such as computer readable instructions, data structures, program modules or other data in a modulated data signal, such as a carrier wave or other transport mechanism, and includes any information delivery media. Combinations of the any of the above are also included within the scope of readable media.

[0084] In the description provided herein, numerous specific details are set forth. However, it is understood that embodiments of the application can be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been described in detail in order to not obscure the understanding of this description.

[0085] In the description provided herein, numerous specific details are set forth. However, it is understood that embodiments of the application can be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been described in detail in order to not obscure the understanding of this description.

[0086] Similarly, it is to be understood that the above description is one example of inventive aspects of the present application and that many modifications, changes, and substitutions can be made by one skilled in the art without departing from the inventive spirit thereof. It is intended that the application be construed as including all such modifications, changes, and substitutions as fall within the true spirit and scope of the present application. Accordingly, the application is not to be taken as limited to the specific illustrative embodiments as described above. Rather, the inventive aspects are to be understood to include all alternatives, modifications, and equivalents falling within the true spirit and scope of the present application.

[0087] Those skilled in the art will understand that the modules, or units, or components of the devices in the examples disclosed herein can be arranged in a device as described in the examples, or alternatively can be located in one or more devices different from the devices in the examples. The modules in the foregoing examples can be combined as a module or further divided into multiple sub-modules.

[0088] Those skilled in the art will appreciate that the modules in the apparatuses in the embodiments can be adapted and placed in one or more apparatuses other than the embodiments. The modules or units or components in the embodiments can be combined into one module or unit or component, and further can be split into multiple sub-modules or sub-units or sub-components. Any combination of all the features disclosed in the specification (including the accompanying claims, abstract and drawings), and any method or process or steps of any such methods or processes disclosed in the specification (including the accompanying claims, abstract and drawings) can be made, except that at least some of such features and / or processes or units are mutually exclusive, unless explicitly stated otherwise. Each feature disclosed in the specification (including the accompanying claims, abstract and drawings) can be replaced by alternative features serving the same, equivalent or similar purpose, unless explicitly stated otherwise.

[0089] Furthermore, those skilled in the art will appreciate that the features of the various embodiments described herein are not mutually exclusive and can be combined in different embodiments. For example, in the following claims, any of the embodiments claimed can be used in any combination.

[0090] Furthermore, some of the embodiments described herein are described as a method or combination of elements of a method implementable by a processor of a computer system or by other means of carrying out the function. Accordingly, a processor with the necessary instructions for carrying out such a method or element of a method forms a means for carrying out the method or element of a method. Furthermore, an element of a method described herein that is implemented as a means for carrying out a particular function performs that function whether or not recited as a means for carrying out that function.

[0091] As used herein, unless otherwise indicated, the use of the ordinal adjectives "first", "second", "third" and so on, in no way limits the number of objects to which it refers, which can be only one.

[0092] While the application has been described in accordance with the various embodiments shown and described, it is to be understood that the application is not limited to those precise embodiments, and that various modifications and changes can be made by those skilled in the art without departing from the scope of the present application. It is intended that the scope of the application should only be limited as recited in the appended claims.

Claims

1. An authorization method, executed in a node server in a blockchain, the method comprising: The receiving device sends inbound information, which includes the device's unique identifier; The unique identifier of the device is signed to obtain an access permission certificate for the blockchain. The blockchain access permission certificate is sent to the device so that the device can join the blockchain and obtain the authorization from the node server based on the blockchain access permission certificate; The node server communicates with the authorization server, and the method further includes: Receive the chain entry permission data sent by the authorization server, the chain entry permission data including the signature key, signature algorithm and quantity control permission for controlling the number of authorizations; The step of signing the unique identifier of the device includes: If the number of nodes in the blockchain does not exceed the authorized number, the unique identifier of the device is signed based on the signing key and the signing algorithm.

2. The method according to claim 1, wherein, The step of the device joining the blockchain based on the blockchain access permission certificate includes: Obtain the public key from the signature key from the node server; Verify the signature of the blockchain access permission credential based on the public key; If the signature verification is successful, the legality of the incoming and outgoing information included in the blockchain will be verified. If the verification is successful, the device's inbound timestamp, the inbound permission certificate, the device's unique identifier, and the previous device's inbound hash value are hashed to obtain the device's inbound hash value.

3. The method according to claim 2, further comprising: An inbound record is generated based on the device's inbound hash value, inbound timestamp, device unique identifier, Internet Protocol address of the device when it joins the chain, inbound permission credential, and inbound / outbound type. The incoming records are synchronized to each node in the blockchain.

4. The method according to any one of claims 1 to 3, wherein, The device maintains a heartbeat connection with the node server, and the method further includes: If no heartbeat packet is received from the device within the predetermined time, the permission is revoked, the current time is used as the outgoing chain timestamp, and an outgoing chain transaction is initiated for the device based on the outgoing chain timestamp and the incoming chain permission certificate to obtain the first outgoing chain record. The first outgoing record is stored in a block of the blockchain and broadcast to each node of the blockchain.

5. An authorization method, executed in a device, the method comprising: The device’s on-chain information is sent to the node server in the blockchain so that the node server can sign the device’s unique identifier included in the on-chain information to generate an on-chain permission certificate. Receive the chain entry permission certificate sent by the node server; Join the blockchain and obtain permissions based on the blockchain access permission certificate; The step of joining the blockchain based on the blockchain access permission certificate includes: Obtain the public key from the signature key from the node server; Verify the signature of the blockchain access permission credential based on the public key; If the signature verification is successful, the legality of the incoming and outgoing information included in the blockchain will be verified. If the verification is successful, the device's inbound timestamp, the inbound permission certificate, the device's unique identifier, and the previous device's inbound hash value are hashed to obtain the device's inbound hash value.

6. An authorization system, comprising: Node server, adapted to perform the method as described in any one of claims 1 to 4; The authorization server is adapted to send chain entry permission data, authorization quantity, and authorization information to the node server, and is also adapted to disconnect the communication connection with the subsequently connected node server in response to more than one node server communicating with the authorization server. The device is adapted to perform the method as described in claim 5.

7. A computing device, comprising: At least one processor; as well as A memory storing program instructions, wherein the program instructions are configured to be executed by the at least one processor, the program instructions including instructions for performing the method as claimed in any one of claims 1 to 5.

8. A readable storage medium storing program instructions that, when read and executed by a computing device, cause the computing device to perform the method as described in any one of claims 1 to 5.

Images