Blockchain-based access management method and apparatus

Abstract

A blockchain-based access management method and device, involving a blockchain system, a first computing node and a second computing node belonging to different participants, a first smart contract deployed in the blockchain system, and a first application program deployed in the first computing node. The first computing node can respond to a state update request initiated by the first application program at a first time interval, and send a first transaction to the blockchain system at the first time interval, wherein the first transaction includes a first state indication of the first application program. The blockchain system can update the first state indication of the first application program in the contract state of the first smart contract according to the first transaction. The second computing node can obtain the first state indication from the contract state of the first smart contract at the first time interval, and determine whether the first application program can support normal access of the second computing node to it through the blockchain system according to the first state indication.

Description

Technical Field

[0001] The embodiments in this specification pertain to the field of blockchain, and particularly relate to blockchain-based access management methods and apparatus. Background Technology

[0002] Blockchain is a novel application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and cryptographic algorithms. In a blockchain system, data blocks are sequentially linked together to form a chain-like data structure, and a distributed ledger is cryptographically guaranteed to be immutable and unforgeable. Due to its decentralized, immutable, and autonomous characteristics, blockchain is receiving increasing attention and application. Summary of the Invention

[0003] The purpose of this invention is to provide a blockchain-based access management method and apparatus.

[0004] In a first aspect, a blockchain-based access management method is provided. The method involves a blockchain system, a first computing node and a second computing node belonging to different participants. A first smart contract is deployed in the blockchain system, and a first application is deployed in the first computing node. The method includes: the first computing node, in response to a state update request initiated by the first application at a first time interval, sending a first transaction to the blockchain system, including a first state indication of the first application; the blockchain system updating the first state indication of the first application in the contract state of the first smart contract according to the first transaction; and the second computing node, at the first time interval, obtaining the first state indication from the contract state of the first smart contract, and determining whether the first application can support normal access by the second application through the blockchain system based on the first state indication.

[0005] Secondly, a blockchain-based access management method is provided. This method involves a blockchain system, a first computing node and a second computing node belonging to different participants. A first smart contract is deployed in the blockchain system, and a first application is deployed in the first computing node. The contract state of the first smart contract includes a first state indication of the first application updated by the blockchain system in the contract state based on a first transaction received by the blockchain system. The first transaction is initiated by the first computing node based on a state update request initiated by the first application at a first time interval, and the first transaction includes the first state indication of the first application. The method includes: obtaining the first state indication from the contract state of the first smart contract at the first time interval; and determining, based on the first state indication, whether the first application can support the second application to normally access it through the blockchain system.

[0006] Thirdly, a blockchain-based access management device is provided, involving a blockchain system, a first computing node and a second computing node belonging to different participants. A first smart contract is deployed in the blockchain system, and a first application is deployed in the first computing node. The contract state of the first smart contract includes a first state indication of the first application updated by the blockchain system in the contract state of the first smart contract based on a first transaction received by the blockchain system. The first transaction is initiated by the first computing node based on a state update request initiated by the first application at a first time interval, and the first transaction includes the first state indication of the first application. The device includes: a state query unit configured to obtain the first state indication from the contract state of the first smart contract at the first time interval; and a state processing unit configured to determine, based on the first state indication, whether the first application can support the second application to access it normally through the blockchain system.

[0007] Fourthly, a computing device is provided, including a memory and a processor, wherein the memory stores computer programs / instructions, and the processor, when executing the computer programs / instructions, implements the method described in any one of the second aspects.

[0008] Fifthly, a computer-readable storage medium is provided having a computer program / instructions stored thereon, which, when executed in a computing device, cause the computing device to perform the method described in the second aspect.

[0009] In the embodiments of this specification, the first computing node can respond to a state update request initiated by the first application at a first time interval by sending a first transaction to the blockchain system, including the latest first state indication of the first application; the blockchain system can update the first state indication of the first application in the contract state of the first smart contract based on the first transaction; the second computing node can obtain the first state indication from the contract state of the first smart contract at the first time interval, and determine whether the first application can support the second computing node to access it normally through the blockchain system at the current moment based on the latest obtained first state indication. In this way, the second computing node can promptly know whether the first application can support the second computing node to access it normally through the blockchain system, which helps to avoid the second computing node continuing to initiate access requests to the first application through the blockchain system when the first application no longer supports the second computing node to access it normally through the blockchain system, thus avoiding resource waste. Attached Figure Description

[0010] To more clearly illustrate the technical solutions of the embodiments in this specification, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 This is a system framework diagram of the technical solutions provided in the embodiments of this specification;

[0012] Figure 2 This is a flowchart illustrating a blockchain-based access management method provided in the embodiments of this specification.

[0013] Figure 3 This is a schematic diagram of the structure of a blockchain-based access management device provided in the embodiments of this specification. Detailed Implementation

[0014] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this specification.

[0015] A blockchain system is a distributed network built from multiple nodes. Any two nodes within it communicate at the application layer through a peer-to-peer (P2P) network. See also... Figure 1 As shown, a blockchain system can, for example, contain nodes 1 to 4. Any two nodes from 1 to 4 can communicate at the application layer via a P2P network. The blockchain system utilizes a decentralized (or multi-centralized) distributed ledger constructed using a chain-like block structure, stored on each (or most) node in the distributed blockchain network. Therefore, the blockchain system needs to address the consistency and correctness of the ledger data across multiple decentralized (or multi-centralized) nodes. Each node in the blockchain system runs a blockchain program. Under certain fault-tolerance requirements, a consensus mechanism ensures that all loyal nodes have the same transactions, thereby guaranteeing consistent execution results for the same transactions. Multiple transactions arranged in sequence are packaged into a block, and the world state is updated based on the execution results of these transactions.

[0016] A transaction in a blockchain system refers to a task unit executed and recorded within the blockchain system. A transaction typically includes a From field, a To field, and a Data field. Specifically, in the case of a transfer transaction, the From field represents the account address initiating the transaction (i.e., initiating a transfer task to another account), the To field represents the account address receiving the transaction (i.e., receiving the transfer), and the Data field includes the transfer amount. In the case of a transaction calling a smart contract in the blockchain system, the From field represents the account address initiating the transaction, the To field represents the account address of the contract called by the transaction, and the Data field includes the function name in the called contract and the parameters passed to that function, which is used to retrieve and execute the function's code from the blockchain system during transaction execution.

[0017] Smart contracts in a blockchain system are contracts that can be triggered and executed by transactions. Smart contracts can be defined in the form of code. For example, calling a smart contract in a consortium blockchain involves initiating a transaction pointing to the smart contract's address, causing each node in the consortium blockchain network to run the smart contract code in a distributed manner. It's important to note that besides users creating smart contracts, the system can also set smart contracts in the genesis block. These contracts are generally called genesis contracts. Typically, genesis contracts can set some data structures, parameters, attributes, and methods of the blockchain system. Furthermore, accounts with system administrator privileges can create or modify system-level contracts (referred to as system contracts).

[0018] In smart contract deployment scenarios, a transaction containing smart contract creation information (i.e., a transaction used to create a smart contract) can be sent to the blockchain system. The `from` field of this transaction is the account address of the transaction initiator, the `data` field includes the code of the smart contract to be created (such as bytecode or machine code), and the `to` field is empty to indicate that the transaction is used to deploy the contract. After nodes reach a consensus through the consensus mechanism, the contract address is determined, a contract account corresponding to the smart contract's contract address is added to the state database, state storage corresponding to the contract account is allocated, and the contract code is stored in the smart contract's state storage.

[0019] In scenarios involving contract invocation, a transaction for invoking a smart contract can be sent to the blockchain system. The `from` field of this transaction is the account address of the transaction initiator, the `to` field is the contract address of the smart contract being invoked, and the `data` field includes the method and parameters for invoking the smart contract. After consensus is reached on this transaction within the blockchain system, each node can execute the transaction, thereby executing the smart contract and updating the corresponding state database based on the execution of the smart contract.

[0020] It's important to note that contract accounts typically also possess some state. These states are defined by state variables within the smart contract and acquire new values ​​during the smart contract's creation and execution. Contract accounts can be used to store the contract states related to the smart contract. Once an event triggers a clause in the smart contract (meeting the execution conditions), the code can be executed automatically. In a blockchain system, the contract state of a smart contract is stored in a storage trie. The hash value of the root node of this storage trie is stored in `storage_root`, thus locking all contract states of that contract under that contract account through hashing. The storage trie is an MPT tree structure that stores a key-value mapping from state addresses to state values. From the root node to the leaf node, each node stores the address of a state variable, and each leaf node stores the value of a state variable.

[0021] In some technical scenarios, a blockchain system can connect multiple computing nodes belonging to multiple participants. Computing nodes belonging to different participants may not be able to directly exchange information due to security requirements, and need to jointly execute relevant transactions with the support of the blockchain system. See also... Figure 1As shown, the blockchain system connects computing node 10 belonging to participant A, computing node 20 belonging to participant B, and computing node 30 belonging to participant C. Computing nodes belonging to different participants cannot communicate directly due to security requirements. Applications APP1, APP2, and APP3 are deployed sequentially in computing nodes 10, 20, and 30. Applications APP1 and APP2 can jointly execute transaction X12 through the blockchain system, and applications APP1 and APP3 can jointly execute transaction X13 through the blockchain system.

[0022] In the aforementioned technical scenario, if an application deployed on a computing node is currently unable to support normal access from other computing nodes, those nodes may still initiate requests through the blockchain system to jointly execute related transactions, resulting in wasted resources. For example, if application APP1 is offline, computing node 10 to which application APP1 belongs crashes, or application APP1 is configured by the administrator to prevent application APP2 from accessing it normally, application APP2 on computing node 20 may still initiate requests through the blockchain system to jointly execute one or more transactions X12, wasting the computing and storage resources of computing node 20 and the blockchain system.

[0023] In view of the above problems, this specification provides a blockchain-based access management method and apparatus in its embodiments. A first smart contract is deployed in the blockchain system. For a first computing node and a second computing node belonging to different participants, a first application is deployed in the first computing node. The first computing node can respond to a state update request initiated by the first application at a first time interval by sending a first transaction to the blockchain system, including the latest first state indication of the first application. The blockchain system can update the first state indication of the first application in the contract state of the first smart contract based on the first transaction. The second computing node can obtain the first state indication from the contract state of the first smart contract at a first time interval, and determine whether the first application can support normal access to it by the second computing node through the blockchain system at the current moment based on the latest obtained first state indication. In this way, the second computing node can promptly know whether the first application can support normal access by the second computing node through the blockchain system, which helps to avoid resource waste caused by the second computing node continuing to initiate access requests to the first application through the blockchain system when the first application no longer supports normal access by the second computing node through the blockchain system.

[0024] Figure 2 This is a flowchart illustrating a blockchain-based access management method provided in the embodiments of this specification. The method involves a blockchain system, a first computing node and a second computing node belonging to different participants. A first smart contract is deployed in the blockchain system, and a first application is deployed on the first computing node.

[0025] See Figure 2 As shown, the method may include, but is not limited to, some or all of the following steps S201 to S209.

[0026] In step S201, the first computing node responds to the state update request initiated by the first application at a first time interval by sending a first transaction to the blockchain system, which includes the first state indication of the first application.

[0027] For a single state update request Q1 initiated by the first application, it includes at least a first state indication at the time the first application initiates the state update request Q1. This first state indication is used to help computing nodes other than the first computing node determine whether they can normally access the first application through the blockchain system. The first state indication may include the initiation time Q of its associated state update request Q1. 1t And / or the first identifier of several third applications that are allowed to access the first application. Furthermore, the status update request Q1 may also include the third identifier of the first application.

[0028] For each state update request Q1, the first compute node can construct a corresponding first transaction for that state update request Q1. The first transaction is used to invoke the first smart contract. The Data field of the first transaction includes at least the first state indication included in its corresponding state update request Q1, and may also include the third identifier of the first application and the identifier of the first function F1 requested to be invoked in the first smart contract; the To field of the first transaction may include the contract address of the first smart contract.

[0029] In step S203, the blockchain system updates the first state indication of the first application in the contract state of the first smart contract according to the first transaction.

[0030] A blockchain system can execute a first smart contract based on a first transaction, thereby updating the first state indicator of the first application in the contract state of the first smart contract. For example, the blockchain system can execute function F1 in the first smart contract based on the identifier of the first function F1 included in the Data field of the first transaction, thereby: querying the stored first state indicator of the first application in the contract state of the first smart contract based on the third identifier of the first application included in the Data field of the first transaction, and replacing the queried first state indicator of the first application with the first state indicator of the first application included in the Data field of the first transaction.

[0031] In step S205, the second computing node obtains the first state indication of the first application from the contract state of the first smart contract according to the first time interval.

[0032] In one possible implementation, the second computing node can periodically send query transactions to the blockchain system at first time intervals to invoke the first smart contract. This allows the blockchain system to query the first application's first state indication within the contract state of the first smart contract based on the query transaction and return it to the second computing node. For example, the `data` field of the query transaction may include a third identifier of the first application and an identifier of the second function F2 requested to be invoked in the first smart contract. The `To` field of the query transaction may include the contract address of the first smart contract. The blockchain system can execute the second function F2 in the first smart contract based on the identifier of the second function F2 included in the `data` field of the query transaction, thereby: querying the first application's first state indication within the contract state of the first smart contract based on the third identifier of the first application included in the `Data` field of the query transaction, and returning the first application's first state indication to the second computing node.

[0033] In one possible implementation, the second computing node can call a dedicated data query interface in the blockchain system at a first time interval to obtain the first state indication of the first application from the contract state of the first smart contract.

[0034] In step S207, the second computing node determines, based on the first state indication, whether the first application can support the second computing node to access it normally through the blockchain system.

[0035] When the latest first state indication obtained by the second computing node includes the aforementioned initiation time Q 1t At that time, the second computing node can calculate the current time and the initiation time Q included in the first state indication. 1tIf the first time difference is greater than the first time interval, it indicates that the first application may be offline or the first computing node has crashed. The second computing node can then determine that the first application cannot support normal access to it through the blockchain system.

[0036] A second application can be deployed on the second computing node. In this case, the latest first status indication obtained by the second computing node may include first identifiers of several third applications that are allowed to access the first application. When the latest first status indication obtained by the second computing node includes first identifiers of several third applications that are allowed to access the first application, the second computing node can determine whether the several first identifiers included in the first status indication include the second identifier of the second application. If not, it means that the administrator of the first application has prohibited the second application from accessing it through the corresponding permission configuration, and the second computing node can determine that the first application cannot support the second computing node to access it normally through the blockchain system.

[0037] A second smart contract can be deployed in a blockchain system to support the joint execution of related transactions by the first and second applications through the blockchain system. This second smart contract may be the same as or different from the first smart contract.

[0038] When the second computing node has a second application deployed in it and the blockchain system has a second smart contract deployed in it, if the second computing node determines in step S207 that the first application cannot support the second computing node to access it normally through the blockchain system, the second computing node can then proceed to step S209 to provide alarm information to the second application, which instructs the second application to prohibit the second application from initiating access requests to the first application through the second smart contract.

[0039] When the alarm message is triggered, the second application will stop sending the target transaction containing the access request and used to call the second smart contract to the blockchain system. The contract state of the second smart contract will not be updated with new access requests from the second application that are expected to be queried by the first application, thus avoiding wasting the resources of the second computing node and the blockchain system.

[0040] When a second application is deployed on the second computing node, similar to steps S201 to S207 above, to avoid resource waste caused by the first computing node continuing to initiate access requests to the second application through the blockchain system when the second application no longer supports normal access by the first computing node, the second computing node can respond to the state update request initiated by the second application at a second time interval by sending a second transaction to the blockchain system, including a second state indication of the second application; the blockchain system can update the second state indication of the second application in the contract state of the first smart contract according to the second transaction; the first computing node can obtain the second state indication of the second application from the contract state of the first smart contract at a second time interval, and determine whether the second application can support normal access by the first computing node through the blockchain system based on the second state indication. In addition, if the first computing node determines that the second application cannot support normal access by the first computing node through the blockchain system, the first computing node can also provide alarm information to the first application to instruct the first application to prohibit access requests to the second application through the second smart contract.

[0041] In the aforementioned method embodiments, each method step executed by the blockchain system can be specifically executed by a blockchain node within the blockchain system.

[0042] Based on the same concept as the aforementioned method embodiments, this specification also provides a blockchain-based access management device 300, involving a blockchain system, a first computing node and a second computing node belonging to different participants. A first smart contract is deployed in the blockchain system, and a first application is deployed in the first computing node. The contract state of the first smart contract includes a first state indication of the first application updated by the blockchain system in the contract state of the first smart contract based on a first transaction received by the blockchain system. The first transaction is initiated by the first computing node based on a state update request initiated by the first application at a first time interval, and the first transaction includes the first state indication of the first application. The device 300 includes: a state query unit 301, configured to obtain the first state indication from the contract state of the first smart contract at the first time interval; and a state processing unit 303, configured to determine, based on the first state indication, whether the first application can support the second application to access it normally through the blockchain system.

[0043] In one possible implementation, the first status indication includes the initiation time of the status update request corresponding to its first transaction; wherein, the status processing unit 303 is configured to calculate a first time difference between the current time and the initiation time included in the first status indication; if the first time difference is greater than the first time interval, it is determined that the first application cannot support the second computing node to access it normally through the blockchain system.

[0044] In one possible implementation, a second application is deployed in the second computing node, and the first status indication further includes several first identifiers of several third applications; wherein, the status processing unit 303 is configured to determine whether the several first identifiers included in the first status indication include a second identifier of the second application, and if not, determine that the first application cannot support the second computing node to access it normally through the blockchain system.

[0045] In one possible implementation, the second identifier includes the identity identifier of the participant to which the second computing node belongs and the identity identifier assigned by the participant to which the second computing node belongs to the second application.

[0046] In one possible implementation, a second application is deployed in the second computing node, and a second smart contract is deployed in the blockchain system; wherein, the device 300 further includes: an alarm processing unit 305, configured to provide alarm information to the second application when it is determined that the first application cannot support the second computing node to access it normally through the blockchain system, for instructing the second application to prohibit the second application from initiating access requests to the first application through the second smart contract.

[0047] In one possible implementation, a second application is deployed in the second computing node, and the device 300 further includes: a state uploading unit 307 configured to send a second transaction to the blockchain system in response to a state update request initiated by the second application at a second time interval, including a second state indication of the second application, such that the blockchain system updates the second state indication of the second application in the contract state of the first smart contract according to the second transaction, and the first computing node obtains the second state indication from the contract state of the first smart contract at the second time interval, and determines whether the second application can support the first computing node to access it normally through the blockchain system according to the second state indication.

[0048] This specification also provides a computing device in its embodiments, including a memory and a processor. The memory stores computer programs / instructions, and when the processor executes the computer programs / instructions, it implements the various method steps executed by the blockchain system, the first computing node, or the second computing node in the aforementioned method embodiments.

[0049] This specification also provides a computer-readable storage medium storing a computer program / instruction, which, when executed in a computing device, causes the computing device to perform the various method steps executed by the blockchain system, the first computing node, or the second computing node in the aforementioned method embodiments.

[0050] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many methodological improvements today can be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that a methodological improvement cannot be implemented using hardware physical modules. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program and "integrate" a digital system onto a PLD themselves, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should understand that by simply performing some logic programming on the method flow using one of these hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.

[0051] The controller can be implemented in any suitable manner. For example, it can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. A memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code form, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included therein for implementing various functions can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0052] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or physical entities, or by products with certain functions. A typical implementation device is a server system. Of course, this application does not exclude the possibility that, with the future development of computer technology, the computer implementing the functions of the above embodiments can be, for example, a personal computer, a laptop computer, an in-vehicle human-machine interaction device, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or any combination of these devices.

[0053] While one or more embodiments of this specification provide the operational steps of the methods described in the embodiments or flowcharts, more or fewer operational steps may be included based on conventional or non-inventive means. The order of steps listed in the embodiments is merely one possible order of execution among many steps and does not represent the only possible order. In actual device or end product execution, the methods shown in the embodiments or drawings may be executed sequentially or in parallel (e.g., in a parallel processor or multi-threaded processing environment, or even a distributed data processing environment). The terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, product, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, product, or apparatus. Without further limitations, the presence of other identical or equivalent elements in the process, method, product, or apparatus that includes the elements is not excluded. For example, the use of terms such as "first," "second," etc., is to denote names and does not indicate any particular order.

[0054] For ease of description, the above devices are described in terms of function, divided into various modules. Of course, when implementing one or more of these specifications, the functions of each module can be implemented in one or more software and / or hardware components, or a module that performs the same function can be implemented by a combination of multiple sub-modules or sub-units. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection between devices or units, and may be electrical, mechanical, or other forms.

[0055] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0056] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0057] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0058] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0059] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0060] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage, graphene storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0061] Those skilled in the art will understand that one or more embodiments of this specification can be provided as a method, system, or computer program product. Therefore, one or more embodiments of this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0062] One or more embodiments of this specification can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a particular task or implement a particular abstract data type. One or more embodiments of this specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0063] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, system embodiments are basically similar to method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments. In the description of this specification, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of this specification. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described can be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification and the features of different embodiments or examples.

[0064] The above description is merely an embodiment of one or more embodiments of this specification and is not intended to limit the scope of these embodiments. Various modifications and variations can be made to these embodiments by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims.

Claims

1. A blockchain-based access management method, the method involving a blockchain system, a first computing node and a second computing node belonging to different participants, wherein the first computing node and the second computing node cannot communicate directly, a first smart contract is deployed in the blockchain system, and a first application is deployed in the first computing node, the method comprising: In response to a state update request initiated by the first application at a first time interval, the first computing node sends a first transaction to the blockchain system, which includes a first state indication of the first application, and the first state indication includes the time when the state update request corresponding to its first transaction was initiated. The blockchain system updates the first state indication of the first application in the contract state of the first smart contract according to the first transaction. The second computing node obtains the first status indication from the contract status of the first smart contract according to the first time interval, calculates the first time difference between the current time and the initiation time included in the first status indication, and determines that the first application cannot support the second computing node to access it normally through the blockchain system if the first time difference is greater than the first time interval.

2. The method according to claim 1, wherein a second application is deployed in the second computing node, and the first status indication further includes several first identifiers of several third applications; the method further includes: Determine whether the second identifier of the second application is included among the several first identifiers included in the first status indication. If not, determine that the first application cannot support the second computing node to access it normally through the blockchain system.

3. The method according to claim 2, wherein the second identifier includes the identity identifier of the participant to which the second computing node belongs and the identity identifier assigned by the participant to which the second computing node belongs to the second application. 4.The method of claim 1, wherein a second application is deployed in the second computing node, and a second smart contract is deployed in the blockchain system; wherein, The method further includes: when the second computing node determines that the first application cannot support the second computing node to access it normally through the blockchain system, the second computing node provides an alarm message to the second application, which instructs the second application to prohibit the second computing node from initiating access requests to the first application through the second smart contract.

5. The method according to any one of claims 1-4, wherein a second application is deployed in the second computing node, and the method further comprises: In response to a state update request initiated by the second application at a second time interval, the second computing node sends a second transaction to the blockchain system, which includes a second state indication of the second application. The blockchain system updates the second state indication of the second application in the contract state of the first smart contract according to the second transaction; The first computing node obtains the second status indication from the contract status of the first smart contract according to the second time interval, and determines whether the second application can support the first computing node to access it normally based on the second status indication.

6. A blockchain-based access management method, the method involving a blockchain system, a first computing node and a second computing node belonging to different participants, wherein the first computing node and the second computing node cannot communicate directly, a first smart contract is deployed in the blockchain system, a first application is deployed in the first computing node, the contract state of the first smart contract includes a first state indication of the first application updated in the contract state of the first smart contract by the blockchain system according to a first transaction it receives, the first transaction is initiated by the first computing node based on a state update request initiated by the first application at a first time interval, the first transaction includes the first state indication of the first application, the first state indication including the initiation time of the state update request corresponding to its first transaction; the method includes: According to the first time interval, obtain the first state indication from the contract state of the first smart contract; Calculate the first time difference between the current time and the initiation time included in the first state indication; If the first time difference is greater than the first time interval, it is determined that the first application cannot support the second computing node to access it normally through the blockchain system.

7. The method according to claim 6, wherein a second application is deployed in the second computing node, and the first status indication includes a plurality of first identifiers of a plurality of third applications; wherein The method further includes: determining whether the second identifier of the second application is included among the several first identifiers included in the first status indication; if not, determining that the first application cannot support the second computing node to access it normally through the blockchain system.

8. The method according to claim 7, wherein the second identifier includes the identity identifier of the participant to which the second computing node belongs, and the identity identifier assigned by the participant to which the second computing node belongs to the second application.

9. The method according to claim 6, wherein a second application is deployed in the second computing node, and a second smart contract is deployed in the blockchain system; wherein, The method further includes: if it is determined that the first application cannot support the second computing node to access it normally through the blockchain system, providing an alarm message to the second application to instruct the second application to prohibit the second application from initiating access requests to the first application through the second smart contract.

10. The method according to any one of claims 6-9, wherein a second application is deployed in the second computing node; wherein The method further includes: in response to a state update request initiated by the second application at a second time interval, sending a second transaction to the blockchain system, including a second state indication of the second application, such that the blockchain system updates the second state indication of the second application in the contract state of the first smart contract according to the second transaction, the first computing node obtains the second state indication from the contract state of the first smart contract at the second time interval, and determines whether the second application can support the first application to access it normally through the blockchain system according to the second state indication.

11. A blockchain-based access management device, comprising a blockchain system, a first computing node and a second computing node belonging to different participants, wherein the first computing node and the second computing node cannot communicate directly, a first smart contract is deployed in the blockchain system, a first application is deployed in the first computing node, the contract state of the first smart contract includes a first state indication of the first application updated in the contract state of the first smart contract by the blockchain system based on a first transaction received by the blockchain system, the first transaction being initiated by the first computing node based on a state update request initiated by the first application at a first time interval, the first transaction including the first state indication of the first application, the first state indication including the initiation time of the state update request corresponding to its first transaction; the device comprises: The status query unit is configured to obtain the first status indication from the contract status of the first smart contract according to the first time interval; The state processing unit is configured to calculate a first time difference between the current time and the initiation time included in the first state indication; if the first time difference is greater than the first time interval, it determines that the first application cannot support the second computing node to access it normally through the blockchain system.

12. The apparatus of claim 11, wherein the second computing node has a second application deployed therein, and the first status indication comprises a number of first identifications of a number of third applications; wherein, The state processing unit is further configured to determine whether the second identifier of the second application is included among the plurality of first identifiers included in the first state indication; if not, it is determined that the first application cannot support the second computing node to access it normally through the blockchain system.

13. The apparatus of claim 12, wherein the second identifier comprises an identity identifier of the participant to which the second computing node belongs and an identity identifier assigned by the participant to which the second computing node belongs to the second application. 14.The apparatus of claim 12, wherein a second application is deployed in the second computing node, and a second smart contract is deployed in the blockchain system; wherein, The device further includes an alarm processing unit configured to provide alarm information to the second application when it is determined that the first application cannot support the second computing node to access it normally through the blockchain system, thereby instructing the second application to prohibit the second application from initiating access requests to the first application through the second smart contract.

15. The apparatus of any of claims 11-14, the second computing node having a second application program deployed therein, the apparatus further comprising: The state upload unit is configured to send a second transaction to the blockchain system in response to a state update request initiated by the second application at a second time interval. The transaction includes a second state indication of the second application. This causes the blockchain system to update the second state indication of the second application in the contract state of the first smart contract based on the second transaction. The first computing node retrieves the second state indication from the contract state of the first smart contract at the second time interval and determines whether the second application can support the first computing node to access it normally through the blockchain system based on the second state indication.

16. A computing device comprising a memory and a processor, wherein the memory stores a computer program, and the processor, when executing the computer program, implements the method of any one of claims 6-10.

17. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computing device, causes the computing device to perform the method of any one of claims 6-10.

Images