Blockchain security capability abstraction system and method

Abstract

The application provides a blockchain security capability abstraction system, comprising a smart contract subset module, a consensus subset module, a peer-to-peer (P2P) subset module, a state indication module and a blockchain ledger module, wherein the smart contract subset module is used for encapsulating script code and a smart contract of the blockchain; the consensus subset module is used for making the dispersed nodes in the blockchain reach a consensus on the validity of block data and encapsulating a consensus algorithm in the blockchain; the P2P subset module is used for transmitting transaction data and block data between the nodes in the blockchain; and the state indication module is used for obtaining abnormal state information output by the blockchain. The security capability of the blockchain technology is abstracted, and a tamper-proof and traceable security protection method is provided for a service flow through software-defined security (SDS) and network function virtualization (NFV) technology.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security. BACKGROUND

[0002] A network security system needs to provide different security services for various businesses. By deploying diversified security components or network security devices, such as firewalls, IDS, IPS, on a network architecture, the network security system can provide businesses with combinable and schedulable security capability support. The introduction of virtualization technology provides a more flexible way to build security capabilities. After one generation and two generations of development and evolution, the blockchain system is constantly popularized in different application fields and various networks, and becomes an important technical means for building a trusted environment. Currently, the introduction of blockchain in applications mainly through two ways, one is to build the required blockchain system based on the professional company's blockchain as a service BaaS platform, such as Ethereum, HyperlegerFabric, JD BaaS, etc. The other is to build a special blockchain system that meets the application requirements, such as a blockchain-based evidence storage system, a transaction system, etc. No matter which construction mode, it is to rely on a complete blockchain system for a specific application to design and implement the corresponding blockchain service, so as to obtain the security capabilities of the blockchain, such as tamper resistance, traceability, and distributed consensus. But in the face of the technical trend of dynamically arranging security services and security capabilities in the future network security field, as a comprehensive technology including network technology, cryptography, and database, how to abstract the security capabilities of the blockchain is an important problem to expand its application value, and is also the key to the deep integration of the blockchain with different systems, networks, and applications. SUMMARY

[0003] The present application aims to at least partially solve one of the problems of the related art.

[0004] To this end, the purpose of the present application is to propose a blockchain security capability abstraction system for abstracting the security capabilities of the blockchain technology.

[0005] To achieve the above-mentioned purpose, the first aspect of the present application proposes a blockchain security capability abstraction system, comprising:

[0006] The smart contract subset module, the consensus subset module, the peer-to-peer network P2P subset module, the state indication module, and the blockchain ledger module, wherein,

[0007] The smart contract subset module is configured to encapsulate the script code and the smart contract of the blockchain;

[0008] The consensus subset module is configured to enable the nodes dispersed in the blockchain to reach a consensus on the validity of the block data, and encapsulate the consensus algorithm in the blockchain;

[0009] The peer-to-peer network P2P subset module is configured to transmit transaction data and the block data among nodes in the blockchain;

[0010] The state indication module is configured to obtain abnormal state information output by the blockchain.

[0011] In addition, the blockchain security capability abstraction system according to the above-mentioned embodiment of the present application can further have the following additional technical features:

[0012] Further, in an embodiment of the present application, the smart contract subset module is further configured to:

[0013] The smart contract loading includes opening a calling interface to the outside; and

[0014] The smart contract execution includes compiling and executing the smart contract code from the outside, and calling the consensus operation interface provided by the consensus subset according to the contract logic.

[0015] Further, in an embodiment of the present application, the consensus subset module is further configured to:

[0016] The consensus operation includes completing the consensus protocol calling and executing; and

[0017] The blockchain ledger updating includes storing the on-chain data input by the blockchain security function calling into the blockchain database or data structure after block encapsulation.

[0018] Further, in an embodiment of the present application, the peer-to-peer network P2P subset module is further configured to:

[0019] The required peer node address is provided for the consensus subset to realize the distributed function.

[0020] Further, in an embodiment of the present application, the state indication module is further configured to:

[0021] The state change record of the tampered or attacked blockchain ledger is recorded, and the malicious operation is identified.

[0022] To achieve the above-mentioned purpose, the second aspect embodiment of the present application proposes a blockchain security capability abstraction method, applied to the blockchain security capability abstraction system as mentioned above, including:

[0023] Obtaining a smart contract, and inputting the smart contract into a target blockchain;

[0024] Loading the smart contract through a smart contract subset, and compiling and executing the smart contract;

[0025] According to the consensus operation of the peer-to-peer network P2P subset, the nodes dispersed in the target blockchain reach a consensus on the validity of the block data, encapsulate the consensus algorithm in the blockchain, and update the target blockchain ledger according to the consensus algorithm.

[0026] According to the consensus algorithm, the target blockchain ledger is updated, the ledger data is output, and the blockchain ledger structure of the target blockchain security capability output is formed.

[0027] Further, in an embodiment of the present application, after the target blockchain ledger is updated according to the consensus algorithm, the method further comprises:

[0028] The state change record of the tampered or attacked blockchain ledger is recorded, and the malicious operation is identified.

[0029] Further, in an embodiment of the present application, the method further comprises:

[0030] The security-abstracted blockchain is arranged with other security components to realize dynamic arrangement of security services.

[0031] To achieve the above purpose, the third aspect of the present application provides a computer device, which comprises a memory, a processor and a computer program stored in the memory and executable on the processor, and the processor executes the computer program to realize the blockchain security capability abstraction system as described above.

[0032] To achieve the above purpose, the fourth aspect of the present application provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to realize the blockchain security capability abstraction system as described above.

[0033] The blockchain security capability abstraction system provided by the embodiments of the present application abstracts the security capability of the blockchain technology, and provides a tamper-proof and traceable security protection method for business flow through the software-defined security SDS / network function virtualization NFV technology. When the application business flow data packet needs to complete the block chain operation, the abstracted blockchain security capability is called to manage the corresponding data packet or operation service in a non-tamperable and efficient identification manner. BRIEF DESCRIPTION OF DRAWINGS

[0034] The above and / or additional aspects and advantages of the present application will become apparent and more readily appreciated from the following description of the embodiments, taken in conjunction with the accompanying drawings, in which:

[0035] Figure 1 The structure diagram of the blockchain security capability abstraction system provided by the embodiments of the present application.

[0036] Figure 2A block chain ledger structure diagram after security capability abstraction provided by an embodiment of the present application.

[0037] Figure 3 A block chain security capability abstraction flow chart provided by an embodiment of the present application. DETAILED DESCRIPTION

[0038] Embodiments of the present application are described in detail below with reference to examples shown in the accompanying drawings, wherein the same or similar notations represent the same or similar elements or elements having the same or similar functions throughout. The embodiments described below by reference to the accompanying drawings are exemplary and are intended to explain the present application, and cannot be understood as limiting the present application.

[0039] A block chain security capability abstraction system of an embodiment of the present application is described below with reference to the accompanying drawings.

[0040] Figure 1 A block chain security capability abstraction system structure diagram provided by an embodiment of the present application.

[0041] As shown in the figure, the block chain security capability abstraction system comprises a smart contract subset module, a consensus subset module, a peer-to-peer network P2P subset module, a state indication module, and a block chain ledger module, wherein, Figure 1 The smart contract subset module is configured to encapsulate script code and smart contracts of the block chain.

[0042] The consensus subset module is configured to make the nodes in the block chain reach a consensus on the validity of block data, and encapsulate consensus algorithms in the block chain.

[0043] The peer-to-peer network P2P subset module is configured to transmit transaction data and block data between the nodes in the block chain.

[0044] The state indication module is configured to obtain abnormal state information output by the block chain.

[0045] One of the purposes of security capability abstraction is to virtualize various security devices and security systems / software as software-defined security controllers to be scheduled objects, and to combine and arrange security function service chains. As shown in the figure,

[0046] The present application abstracts the block chain security capability into two parts, one is security operation abstraction, and the other is block chain security capability output. Figure 1 The security operation abstraction comprises three subset operations: smart contract subset, consensus subset, and peer-to-peer network P2P subset.

[0047]

[0048] ​The smart contract subset is provided with two operations, a smart contract loading responsible for opening a calling interface to the outside, and a smart contract execution responsible for compiling and executing contract code from the outside and calling a consensus operation interface provided by the consensus subset according to contract logic.

[0049] The consensus subset includes two parts of a consensus operation and a blockchain ledger update, wherein the consensus operation is responsible for completing consensus protocol calling and execution, and after the consensus is completed, incoming on-chain data is called by a blockchain security function to be stored in a blockchain database or data structure after being encapsulated into a block, and the blockchain ledger update is completed.

[0050] The P2P subset provides peer node addresses required by the consensus subset and realizes distributed functions.

[0051] Further, in an embodiment of the present application, the smart contract subset module is further used for:

[0052] The smart contract loading includes opening a calling interface to the outside; and

[0053] The smart contract execution includes compiling and executing smart contract code from the outside and calling a consensus operation interface provided by the consensus subset according to contract logic.

[0054] The contract subset is responsible for encapsulating script code, algorithms and smart contracts of the blockchain and is the basis for realizing blockchain programming and operation data. The smart contract is a digital protocol written by algorithms and programs, deployed on the blockchain and capable of being automatically executed according to rules. In an ideal state, the smart contract is a program capable of being automatically executed according to pre-set rules and is not subject to human intervention. It exists to enable a set of complex digital commitments with trigger conditions to be correctly executed according to the will of participants.

[0055] Further, in an embodiment of the present application, the consensus subset module is further used for:

[0056] The consensus operation includes completing consensus protocol calling and execution; and

[0057] The blockchain ledger update includes storing incoming on-chain data in a blockchain database or data structure after being encapsulated into a block by a blockchain security function.

[0058] The consensus subset is responsible for reaching consensus on the validity of block data by dispersed nodes and encapsulating various consensus algorithms used in the blockchain system. The core of the blockchain system is the maintenance of blockchain ledger data, and therefore, the process of consensus is the process of verifying and updating the ledger by nodes, and the result of consensus is a unified ledger provided by the system to the outside.

[0059] Since the blockchain system does not limit the identity of the participating nodes, the nodes in the network may be fraudulent or malicious for the benefit, so in order to avoid malicious nodes, the system requires a certain cost for each time of accounting, and the remaining nodes only need a small cost to verify. The "cost" has many forms, such as computing resources, storage resources, special hardware, etc.

[0060] Further, in an embodiment of the present application, the peer-to-peer network P2P subset module is further used for:

[0061] Providing the required peer node address for the consensus subset to realize the distributed function.

[0062] The P2P protocol of the blockchain network is mainly used for transmitting transaction data and block data between nodes. In the blockchain network, each node has the characteristics of equality, division, distribution, and functions such as route discovery, broadcast transaction, and discovery of new nodes, and there is no centralized authoritative node and hierarchical structure. Nodes maintain communication by maintaining a common blockchain structure, and maintain the entire blockchain ledger together. According to the amount of data stored in the node, it can be divided into full nodes and lightweight nodes. The full node saves the complete blockchain data and updates the main chain in real time. The advantage is that it can independently complete the verification, query and update of block data, and the disadvantage is high space cost; the lightweight node only saves part of the block data, and needs to obtain the required data from the adjacent node to complete the block data verification.

[0063] The node listens to the data broadcast in the network at all times. When a new block is generated, the node that generates the block will broadcast it to the entire network. When other nodes receive the new transaction and new block, they will first verify the validity of the transaction and block, including the digital signature in the transaction and the proof of work in the block. Only the verified transaction and block will be processed and forwarded to prevent the spread of invalid data.

[0064] The blockchain security capability output is the result of abstraction and an important part of the present application. The output includes the blockchain ledger and the state indication. Unlike traditional blockchain systems, in order to achieve fast output of blockchain security capabilities, the present application adds a state indication, records the state change of the blockchain ledger that has been tampered with or attacked, and serves as part of the blockchain security capability output for applications or system management to quickly identify malicious operations.

[0065] Further, in an embodiment of the present application, the state indication module is further used for:

[0066] Recording the state change of the blockchain ledger that has been tampered with or attacked, and identifying malicious operations.

[0067] The design and implementation of the existing blockchain application is carried out from the perspective of the blockchain system, and the tracing of the ledger data and the execution process of the application itself are not synchronized in most scenarios, that is, under the action of the smart contract, the application completes the agreed transaction according to the planned logic processing flow, generates the corresponding block, and continuously updates the blockchain ledger. Once attacked by a malicious node, the tampered ledger data will directly reflect on the change of the corresponding block chain hash value under the action of the characteristics of the Merkel Trie structure. The application is designed from the perspective of abstracting the security capability of the blockchain, and the abstract method and security capability are used for design, therefore, in addition to the original attention to the output of the blockchain, that is, the ledger, the abnormal state information of the ledger is obtained in time, which is the necessary output content of the capability abstraction.

[0068] The state indication mechanism designed by the application is for all the ledgers generated by the application calling the security capability of the blockchain , The value is unique, and can be generated by using a correlation calculation method such as an application or a ledger genesis block hash; each element in the state indication set corresponds to the ledger state with the same subscript, the ledger is not tampered with, the ledger is tampered with. The state indication can be realized by using a vector or a bitmap.

[0069] As shown in Figure 2 , the data structure of the blockchain ledger in the application is a general structure, formed by a plurality of blocks in a chain, and the composition of each block includes a block header and a block body. The block header includes the metadata of the block, at least including: the hash value of the parent block, the block creation timestamp, the random value, the Merkle tree root hash (a data structure for effectively summarizing all transactions in the block). Each block header is connected to the previous block, which makes each transaction in the block traceable, and the hash value of the block can uniquely identify the block. Linking the blocks into a chain according to the hash pointers in the block header is the blockchain.

[0070] Merkle Trie is an important data structure of the data layer of the blockchain, and the hash value of the transaction in the blockchain is stored as part of the Merkle Trie. The Merkle Trie summarizes all transactions in the block by generating a digital fingerprint of the entire transaction set, so that users can verify whether the transaction is included in the block. The feature of the Merkle Trie that records the hash value layer by layer makes any change of the underlying data be transmitted to its parent node, and along the path to the tree root, which means that the value of the tree root actually represents the digital summary of all the underlying data, realizing the non-tamperability of the transaction data in the block. The Merkel tree makes the block header only need to include the root hash value without encapsulating all the underlying data, thereby greatly improving the running efficiency and scalability of the blockchain.

[0071] The blockchain security capability abstraction system provided by the embodiment of the present application abstracts the security capability of the blockchain technology, and provides a tamper-proof and traceable security protection method for a service flow through the software-defined security (SDS) and network function virtualization (NFV) technology. When an application service flow data packet needs to complete a block chaining operation, the abstracted blockchain security capability is called to perform tamper-proof and efficient identification management on the corresponding data packet or operation service.

[0072] In order to realize the above-mentioned embodiment, the present application further provides a blockchain security capability abstraction method.

[0073] Figure 3 A flowchart of a blockchain security capability abstraction method provided by the embodiment of the present application is shown.

[0074] As shown in Figure 3 , the blockchain security capability abstraction method comprises the following steps.

[0075] An intelligent contract is acquired, and the intelligent contract is input into a target blockchain.

[0076] The intelligent contract is loaded through an intelligent contract subset, and the intelligent contract is compiled and executed.

[0077] A consensus operation is completed according to a peer-to-peer (P2P) subset, so that the nodes dispersed in the target blockchain reach a consensus on the validity of block data, and a consensus algorithm in the blockchain is encapsulated.

[0078] The target blockchain ledger is updated according to the consensus algorithm, and ledger data is output, thereby forming a blockchain ledger structure output by the target blockchain security capability.

[0079] The running process of the blockchain security capability abstraction is a process in which an application uses the blockchain to complete a complete operation on the data required to be chained. Regardless of the specific intelligent contract compilation and execution program, consensus algorithm, P2P networking algorithm, different ledger data structure and updating algorithm, these are all internal operations of the blockchain system itself. The abstraction of the security capability is reflected in the output. Based on this, Figure 3 is a blockchain security capability abstraction flowchart involved in the present application. For a processing flow of a call of the blockchain security capability, it is:

[0080] An application calls an abstraction module and inputs an intelligent contract.

[0081] The abstraction module first completes loading of the contract.

[0082] The contract is compiled and executed.

[0083] The source node creates a transaction, constructs a digital signature and checks an output address by calling a consensus subset; the source node broadcasts the transaction to other nodes in the network by relying on a peer-to-peer network to build a peer pair address; a node participating in consensus verifies the rationality of the transaction; if the node obtains block power, the node updates the block packaged by itself to the local main chain; the node broadcasts the block to the network; other nodes in the network confirm the block and update the main chain. The normal consensus processing flow is to realize the common maintenance of data recognized by everyone. This sub-process includes node joining, transaction information sending, network propagation and verification, block election and consensus, etc.

[0084] If the consensus fails, the corresponding operation is performed according to the exception handling rule in the smart contract;

[0085] After the consensus is completed, the blockchain ledger corresponding to the application is updated, and the ledger data is output to form the blockchain ledger part of the blockchain security capability output;

[0086] In order to realize the rapid feedback of the ledger state, the state indication mechanism is designed, and after updating the ledger each time, the "state indication generation" operation is triggered, and the state indication data is output to form the state indication part of the blockchain security capability output.

[0087] Further, in an embodiment of the present application, after the target blockchain ledger is updated according to the consensus algorithm, it further comprises:

[0088] The state change record of the tampered or attacked blockchain ledger is recorded, and the malicious operation is identified.

[0089] Further, in an embodiment of the present application, it further comprises:

[0090] The security-abstracted blockchain is arranged with other security components to realize dynamic arrangement of security services.

[0091] To achieve the above purpose, the third aspect embodiment of the present application proposes a computer device, characterized by comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor executes the computer program to realize the blockchain security capability abstraction system as described above.

[0092] To achieve the above purpose, the fourth aspect embodiment of the present application proposes a computer readable storage medium having a computer program stored thereon, characterized by that the computer program is executed by a processor to realize the blockchain security capability abstraction system as described above.

[0093] In the description of the specification, the description of the terms "one embodiment", "some embodiments", "an example", "a specific example", or "some examples" and the like means that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present application. In the specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Also, the specific features, structures, materials or characteristics described can be combined in any appropriate manner in any one or more embodiments or examples. In addition, the person skilled in the art can combine and combine the different embodiments or examples described in the specification and the features of the different embodiments or examples, without contradiction.

[0094] In addition, the terms "first", "second" are only for descriptive purposes and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the technical features indicated. Therefore, the features defined with "first", "second" can explicitly or implicitly include at least one of the features. In the description of the present application, the meaning of "a plurality of" is at least two, for example, two, three, etc., unless otherwise specifically limited.

[0095] Although the embodiments of the present application have been shown and described above, it is understood that the above-described embodiments are exemplary and cannot be construed as limiting the present application, and those skilled in the art can make changes, modifications, replacements and variations to the above-described embodiments within the scope of the present application.

Claims

1. A blockchain security capability abstraction system, characterized in that, include: The module includes a smart contract subset module, a consensus subset module, a peer-to-peer (P2P) network subset module, a status indicator module, and a blockchain ledger module. The smart contract subset module is used to encapsulate blockchain script code and smart contracts; The consensus subset module is used to enable the decentralized nodes in the blockchain to reach a consensus on the validity of the block data, and encapsulates the consensus algorithm in the blockchain; The peer-to-peer (P2P) subset module is used to transmit transaction data and block data between nodes in the blockchain. The status indication module is used to obtain abnormal status information output by the blockchain.

2. The system according to claim 1, characterized in that, The smart contract subset module is also used for: Smart contract loading includes providing external API calls; and Smart contract execution includes compiling and executing smart contract code from external sources, and calling consensus operation interfaces provided by the consensus subset according to the contract logic.

3. The system according to claim 1, characterized in that, The consensus subset module is also used for: Consensus operations include completing consensus protocol invocations and executions; and Blockchain ledger updates include encapsulating on-chain data passed in by blockchain security function calls into blocks and storing them in a blockchain database or data structure.

4. The system according to claim 1, characterized in that, The peer-to-peer (P2P) subset module is also used for: Provide the required peer node addresses for the consensus subset to achieve distributed functionality.

5. The system according to claim 1, characterized in that, The status indication module is also used for: Record state changes of blockchain ledgers that have been tampered with or attacked, and identify malicious operations.

6. A blockchain security capability abstraction method, applied to the blockchain security capability abstraction system as described in claim 1, characterized in that, include: Obtain the smart contract and input the smart contract into the target blockchain; The smart contract is loaded through a subset of smart contracts, and the smart contract is compiled and executed. Consensus operations are completed based on a P2P subset of the peer-to-peer network, enabling the dispersed nodes in the target blockchain to reach a consensus on the validity of the block data, and encapsulating the consensus algorithm in the blockchain. The target blockchain ledger is updated according to the consensus algorithm, and ledger data is output to form a blockchain ledger structure that outputs the security capabilities of the target blockchain.

7. The method according to claim 6, characterized in that, After updating the target blockchain ledger according to the consensus algorithm, the process also includes: Record state changes of blockchain ledgers that have been tampered with or attacked, and identify malicious operations.

8. The method according to claim 6, characterized in that, Also includes: The blockchain, after undergoing security abstraction, is orchestrated with other security components to achieve dynamic orchestration of security services.

9. A computer device, characterized in that, It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, it implements the blockchain security capability abstraction method as described in any one of claims 6-8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the blockchain security capability abstraction method as described in any one of claims 6-8.

Images