A layered blockchain network architecture and deployment method

Abstract

The present invention discloses a hierarchical blockchain network architecture and deployment method, including: a number of business management layers divided according to the management level of specific business; management components, the management components include: a network planning management unit, which is used to determine the hierarchical structure of the blockchain network of the business management layer according to pre-set demand information and determine the upper and lower access mechanism of the business management layer; a blockchain network management unit, which is used to cooperate with the blockchain software library, the partner CA, and the blockchain network CA to build, configure and change the hierarchical structure of the blockchain network and the upper and lower access mechanism of the business management layer from top to bottom. Advantages: It can meet the business department corresponding to the upper blockchain to view the information in the blockchain belonging to the lower department and issue tasks to the lower department; the lower business department cannot view the information of the blockchain belonging to the upper department; the construction of temporary task blockchain requirements; the stability requirements of the blockchain system.

Description

Technical Field

[0001] The present invention relates to a layered blockchain network architecture and a deployment method, and belongs to the technical field of blockchain. Background Art

[0002] In order to establish a trust relationship in a multi-party cooperation scenario, a distributed ledger technology such as blockchain can be used to share the operation records, transactions and other data of each party on the blockchain. When there is a hierarchical relationship among the cooperating parties and the business nodes of the parties at the same level need to cooperate, or even if the organizational structure level within the cooperating parties is not considered, because there are many participating nodes, if a flat blockchain network is built, the amount of data information shared in the network will be too large, and a hierarchical and domain-based blockchain architecture will also be considered.

[0003] Because the number of hierarchical blockchain levels is related to the specific business or the management level of the partners, it is necessary to design a blockchain network architecture that can build any level.

[0004] Due to management needs, the superior blockchain can view the information in the subordinate blockchain and issue tasks to the subordinate; the subordinate cannot view the information of the superior blockchain, but can report the normal working status and other information to the superior. When encountering special circumstances, it can also issue emergency alarm information. It can also further summarize and process the status information obtained in the blockchain before reporting it to the superior blockchain, while the original data is retained at the current blockchain level for the superior to view. This requires the classification and processing of the transaction information shared in the blockchain.

[0005] When executing some tasks, sometimes both superiors and subordinates need to participate at the same time. At this time, it is necessary to break the original hierarchy and build a temporary flat blockchain network. This requires the blockchain network architecture to have high flexibility and scalability.

[0006] When executing specific tasks, the network environment in which the blockchain node is located may be unstable, and the blockchain node itself may fail due to faults and other reasons. Therefore, it is also necessary to design corresponding node management and operation plans to better ensure information transmission.

[0007] Some existing methods have proposed a layered blockchain architecture, but it cannot meet the requirements of the above scenarios. Summary of the invention

[0008] The technical problem to be solved by the present invention is to overcome the defects of the prior art and provide a layered blockchain network architecture and deployment method.

[0009] In order to solve the above technical problems, the present invention provides a layered blockchain network architecture, including:

[0010] Several business management layers divided according to the management level of specific businesses, each of which includes at least one blockchain network, each node unit of each blockchain network corresponds to a business department or a business entity that needs to cooperate, and each node unit is provided with an interface for data reading, writing and monitoring;

[0011] Management component, the management component includes a network planning management unit, a blockchain network management unit, a blockchain software library, a partner CA, and a blockchain network CA; the network planning management unit is used to determine the hierarchical structure of the blockchain network of the business management layer according to pre-set demand information and determine the upper and lower access mechanism of the business management layer, the upper and lower access mechanism is used to control the upper node unit to read, write, and monitor the data of the lower node unit, but the lower node unit can only return the data monitored by the upper node unit; the blockchain network management unit is used to cooperate with the blockchain software library, the partner CA, and the blockchain network CA to build, configure and change the hierarchical structure of the blockchain network and the upper and lower access mechanism of the business management layer from top to bottom.

[0012] Furthermore, the hierarchical structure of the blockchain network includes blockchain network hierarchical structure data, blockchain deployment server information, blockchain network related installation package information and script information, and the installation package information includes the name and version of the smart contract, node unit and client.

[0013] Furthermore, the partner CA is used to distribute a digital identity certificate and a related private key for access control to each partner's node unit, so as to be used for access control of upper and lower node units.

[0014] Furthermore, the blockchain network CA is used to apply for group certificates and private keys for nodes in the blockchain network.

[0015] Furthermore, the network planning management unit is also used to set up the temporary blockchain network structure according to pre-set demand information.

[0016] Furthermore, the blockchain network management unit is also used to configure the Linji blockchain network structure or generate node units in the Linji blockchain network;

[0017] The configuration or generation of node units in the temporary blockchain network includes:

[0018] When a node unit already exists, add configuration to it; when it does not exist, generate a node unit and configure the Linji blockchain network so that each node unit is constructed into an operational Linji blockchain network; each blockchain network management unit corresponds to one or more Linji blockchain networks.

[0019] Furthermore, the blockchain software library manages the codes and installation packages of blockchain nodes, smart contracts, and blockchain clients.

[0020] Furthermore, it also includes a business system, which accesses the node units in the corresponding blockchain network through an access client, including reading, writing, and monitoring the data of the current node and the lower-level node units that the system has preset access rights.

[0021] Furthermore, if a partner in each blockchain network has multiple node units, one of the node units is set as the master node unit. The master node unit is used as the default node when the upper-level blockchain network reads, writes, and monitors the lower-level blockchain network. The complete block data is synchronized between the master node units of each party, and then synchronized separately to other node units within the partner. When the master node unit fails, other node units are replaced as new master node units.

[0022] Furthermore, the node unit includes a blockchain client, a blockchain node, an authentication module and a switching module;

[0023] The authentication module is used for authentication when an external business system accesses it and is also used for initial authentication when a blockchain client of other node units needs to request access to the internal blockchain node data of the node;

[0024] The blockchain client includes access tools provided by the blockchain platform and certificates used to verify the identity of blockchain nodes; the blockchain client also includes a general interface for reading, writing, and monitoring external business systems;

[0025] Blockchain nodes are peer nodes in the blockchain network, used to store ledgers and deploy and execute smart contracts. Peer nodes in the blockchain network can communicate with each other to send and receive block data;

[0026] The switching module is used to detect the network communication indicators of the blockchain node. When the network communication indicators are lower than the preset communication indicator threshold, the blockchain node is switched to the client, and the client is controlled to only send and listen to necessary information. When it is detected that the network communication indicators of the client are not lower than the preset communication indicator threshold, it is switched back to the identity of the blockchain node.

[0027] Furthermore, the switching module is also used to receive an external switching message to switch the blockchain node to a client or to switch the client to a blockchain node. Furthermore, the blockchain network management unit includes a blockchain management unit server and a blockchain management unit client. The blockchain network management unit server sends management instructions, scripts and installation packages to the blockchain management client. The blockchain management client receives the instructions and performs specific management operations.

[0028] The blockchain management client is deployed on a server where a blockchain network node has been installed or is to be installed.

[0029] Furthermore, the upper and lower level access mechanism includes one or more of the following access authentications:

[0030] Access authentication is performed based on the node unit ID;

[0031] Access authentication is performed based on the pre-planned access relationship between node units;

[0032] Access authentication based on blockchain network ID;

[0033] Access authentication is performed based on pre-planned access relationships between blockchain networks.

[0034] A method for deploying a layered blockchain network architecture, comprising:

[0035] The network planning management unit sends a blockchain network creation request to the blockchain management unit server according to the created blockchain network structure data;

[0036] The blockchain management server applies to the blockchain software library for the required installation package according to the installation package information in the blockchain network structure data to be created contained in the blockchain network creation request, wherein the installation package information includes the smart contract, node and client name and version;

[0037] The blockchain management unit server sends the installation package or its download link to the blockchain management unit client on the blockchain node to be deployed server;

[0038] After receiving the installation package or its download link, the blockchain management unit client executes the installation script on its server to install and deploy the node unit;

[0039] The blockchain management unit server sends a configuration instruction to the blockchain management unit client;

[0040] After receiving the configuration instruction, the blockchain management unit client sends the identity information of the blockchain node therein to the partner CA for applying for a certificate and a private key for the blockchain client and the blockchain node; the identity information of the blockchain node includes node department information, node name, node ID and type;

[0041] Initial configuration of blockchain nodes;

[0042] After the initial configuration of all blockchain nodes is completed, a blockchain network configuration script is generated according to the blockchain network attributes in the blockchain network structure data, and then the configuration script and the installation package required for the configuration are sent to the blockchain management unit client where the master node is located, which executes the script to establish a blockchain network; the blockchain network attributes include: node unit deployment server and port information, blockchain network channel information, smart contract installation script, and the installation package required for the configuration includes: smart contract installation package or download address.

[0043] Furthermore, the initial configuration of the blockchain node includes:

[0044] Put the blockchain client certificate and private key into the folder set by the blockchain client of the node unit; the blockchain client certificate is used to prove the identity when the blockchain client accesses the blockchain node;

[0045] Put the blockchain node certificate and private key into the folder of the blockchain node setting of the node unit;

[0046] Put the blockchain client certificate into the blockchain node's trusted client list for the blockchain network;

[0047] Set the node partner CA and the CA that comes with the node authentication module as the trusted CA of the blockchain node.

[0048] Furthermore, when the blockchain network belongs to a hierarchical blockchain network structure, and the superior-subordinate access mechanism is an superior-subordinate access mechanism that performs access authentication based on the blockchain node ID or based on a pre-planned access relationship between node units, the blockchain client certificate is used to prove its identity when the blockchain node accesses a subordinate blockchain node, so that the subordinate node can determine whether it has access rights.

[0049] Furthermore, the establishment of the blockchain network includes: the blockchain management unit client configures the blockchain network according to the configuration script and the installation package required for configuration, and the configuration includes: establishing a blockchain network channel and installing a smart contract.

[0050] Furthermore, when the blockchain network belongs to a hierarchical blockchain network structure, and the upper and lower access mechanism is to perform access authentication according to the blockchain network ID or to perform access authentication according to the pre-planned access relationship between blockchain networks, the following steps are also included:

[0051] The blockchain management server applies to the blockchain network CA for the blockchain network group certificate and the private key of each node based on the blockchain network structure information;

[0052] The blockchain management server sends the access configuration information, the blockchain network group certificate, and the private key of each blockchain node to the blockchain management client corresponding to each blockchain node; the access configuration information is used to determine whether the upper-level blockchain node has access rights when the upper-level blockchain node accesses it;

[0053] The blockchain management client saves the access configuration information and puts the blockchain network certificate and private key into the folder set by the blockchain client of the node unit for it to prove its identity when accessing the lower-level network nodes of the network.

[0054] Further, the determining whether the upper-level node unit has access rights includes:

[0055] When the accessed blockchain node receives the request information, it obtains the information of the blockchain network to which the upper-level blockchain node belongs from the blockchain network certificate carried in the request message, and determines whether the node of the blockchain network to which the upper-level blockchain node belongs can access the blockchain network node to which the current node unit belongs through the data of the access relationship between the networks. If so, it has access rights, otherwise, it does not have access rights.

[0056] The beneficial effects achieved by the present invention are:

[0057] The present invention can realize that the business department corresponding to the upper blockchain can view the information in the blockchain belonging to the lower department and issue tasks to the lower department. At the technical level, it is required that the upper node is readable and writable to the lower node; the lower business department cannot view the information of the blockchain belonging to the upper department, but can report the normal working status and other information to the upper department, and can also issue emergency warning information when encountering special circumstances. It can also further summarize the status information obtained in the blockchain and then report it to the upper blockchain, while the original data is retained at the current blockchain level for the convenience of the upper department to view; the construction of temporary task blockchain requirements: the architecture needs to be able to support the scenario where the upper and lower levels participate at the same time when executing tasks, which requires breaking the original hierarchical relationship and building a temporary flattened blockchain network; the stability requirements of the blockchain system: when executing specific tasks or the network environment where the underlying nodes of the blockchain may be unstable, or the blockchain node itself is unstable, the normal operation of the blockchain is guaranteed. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 It is a hierarchical blockchain requirements graph;

[0059] Figure 2 It is the overall system architecture;

[0060] Figure 3 It is a node unit module diagram;

[0061] Figure 4It is a module diagram of the network planning and management unit;

[0062] Figure 5 It is a block chain network management unit module diagram;

[0063] Figure 6 It is the access client module diagram;

[0064] Figure 7 This is a schematic diagram of an example of network ID allocation in a blockchain network ID authentication method;

[0065] Figure 8 This is a schematic diagram of an example of planning the access relationship between networks in the blockchain network access relationship authentication method;

[0066] Fig. 9 This is a schematic diagram of the blockchain network node status when the network environment is good;

[0067] Fig.10 This is a schematic diagram of the blockchain network node status when the network environment is poor;

[0068] Fig.11 This is a diagram of an example of the blockchain network deployment process. DETAILED DESCRIPTION

[0069] The present invention will be further described below in conjunction with the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and cannot be used to limit the protection scope of the present invention.

[0070] Example 1

[0071] This embodiment introduces a layered blockchain network architecture, including:

[0072] Several business management layers divided according to the management level of specific businesses, each of which includes at least one blockchain network, each node unit of each blockchain network corresponds to a business department or a business entity that needs to cooperate, and each node unit is provided with an interface for data reading, writing and monitoring;

[0073] Management component, the management component includes a network planning management unit, a blockchain network management unit, a blockchain software library, a partner CA, and a blockchain network CA; the network planning management unit is used to determine the hierarchical structure of the blockchain network of the business management layer according to pre-set demand information and determine the upper and lower access mechanism of the business management layer, the upper and lower access mechanism is used to control the upper node unit to read, write, and monitor the data of the lower node unit, but the lower node unit can only return the data monitored by the upper node unit; the blockchain network management unit is used to cooperate with the blockchain software library, the partner CA, and the blockchain network CA to build, configure and change the hierarchical structure of the blockchain network and the upper and lower access mechanism of the business management layer from top to bottom.

[0074] The hierarchical structure of the blockchain network includes blockchain network hierarchical structure data, blockchain deployment server information, blockchain network related installation package information and script information, and the installation package information includes the name and version of the smart contract, node unit and client.

[0075] The partner CA is used to distribute a digital identity certificate and a related private key for access control to each partner's node unit, so as to be used for access control of upper and lower node units.

[0076] The blockchain network CA is used to apply for group certificates and private keys for nodes in the blockchain network.

[0077] The network planning management unit is also used to set up an ad hoc blockchain network structure according to pre-set demand information.

[0078] The blockchain network management unit is also used to configure the Linji blockchain network structure or generate node units in the Linji blockchain network;

[0079] The configuration or generation of node units in the temporary blockchain network includes:

[0080] When a node unit already exists, add configuration to it; when it does not exist, generate a node unit and configure the Linji blockchain network so that each node unit is constructed into an operational Linji blockchain network; each blockchain network management unit corresponds to one or more Linji blockchain networks.

[0081] The blockchain software library management includes the code and installation package of blockchain nodes, smart contracts, and blockchain clients.

[0082] It also includes a business system, which accesses the node units in the corresponding blockchain network through an access client, including reading, writing, and monitoring the data of the current node and the lower-level node units for which the system has preset access rights.

[0083] It also includes a switching mechanism, which is used to detect the network bandwidth of the node unit. When the network bandwidth is lower than a preset bandwidth threshold, the node unit is switched from a blockchain node to a client. The client is only used to send and listen to pre-set necessary data (the data type of necessary data needs to be configured, and the client listens according to the type, and the data sent by the external system is also filtered according to the type). When it is detected that the bandwidth of the client is not lower than the preset bandwidth threshold, it switches back to the identity of the blockchain node.

[0084] If a partner in each blockchain network has multiple node units, one of the node units is set as the master node unit. The master node unit is used as the default node when the upper blockchain network reads, writes, and monitors the lower blockchain network. The complete block data is synchronized between the master node units of each party, and then synchronized separately to other node units within the partner. When the master node unit fails, other node units are replaced as new master node units.

[0085] The blockchain network management unit includes a blockchain management unit server and a blockchain management unit client. The blockchain network management unit server sends management instructions, scripts and installation packages to the blockchain management client, and the blockchain management client receives the instructions and performs specific management operations;

[0086] The blockchain management client is deployed on a server where a blockchain network node has been installed or is to be installed.

[0087] Embodiment 2, the present invention provides a method for deploying a layered blockchain network architecture, comprising:

[0088] The network planning management unit sends a blockchain network creation request to the blockchain management unit server according to the created blockchain network structure data;

[0089] The blockchain management server applies to the blockchain software library for the required installation package according to the installation package information in the blockchain network structure data to be created contained in the blockchain network creation request, wherein the installation package information includes the smart contract, node and client name and version;

[0090] The blockchain management unit server sends the installation package or its download link to the blockchain management unit client on the node unit to be deployed server of the blockchain;

[0091] After receiving the installation package or its download link, the blockchain management unit client executes the installation script on its server to install and deploy the node unit;

[0092] The blockchain management unit server sends a configuration instruction to the blockchain management unit client;

[0093] After receiving the configuration instruction, the blockchain management unit client sends the node unit identity information of the blockchain therein to the partner CA for applying for certificates and private keys for the blockchain client and blockchain node; the node unit identity information of the blockchain includes node department information, node name, node ID and type;

[0094] Initial configuration of the blockchain's node units;

[0095] After the initial configuration of the node units of all blockchains is completed, a blockchain network configuration script is generated according to the blockchain network attributes in the blockchain network structure data, and then the configuration script and the installation package required for the configuration are sent to the blockchain management unit client where the master node is located, which executes the script to establish a blockchain network; the blockchain network attributes include: node unit deployment server and port information, blockchain network channel information, smart contract installation script, and the installation package required for the configuration includes: smart contract installation package or download address.

[0096] The initial configuration of the node unit of the blockchain includes:

[0097] Put the blockchain client certificate and private key into the folder set by the blockchain client of the node unit;

[0098] Put the blockchain node certificate and private key into the folder of the blockchain node setting of the node unit;

[0099] Put the blockchain client certificate into the blockchain node's trusted client list for the blockchain network;

[0100] Set the node partner CA and the CA that comes with the node authentication module as the trusted CA of the blockchain node.

[0101] The establishment of the blockchain network includes: the blockchain management unit client configures the blockchain network according to the configuration script and the installation package required for configuration, and the configuration includes: establishing a blockchain network channel and installing a smart contract.

[0102] When the blockchain network belongs to a hierarchical blockchain network structure, and the upper and lower level access method is the upper and lower level access based on the blockchain network information, the following steps are also included:

[0103] The blockchain management server applies to the blockchain network CA for the blockchain network group certificate and the private key of each node based on the blockchain network structure information;

[0104] The blockchain management server sends the access configuration information, the blockchain network group certificate, and the private key of each node to the blockchain management client corresponding to each node unit; the access configuration information is used to determine whether the upper-level node unit has access rights when the upper-level node unit accesses;

[0105] The blockchain management client saves the access configuration information and places the blockchain network certificate and private key into the folder set by the blockchain client of the blockchain node unit for proving the identity when accessing the lower-level network nodes of the network.

[0106] The determining whether the upper-level node unit has access rights includes:

[0107] When the accessed node unit receives the request information, it obtains the information of the blockchain network to which the upper-level node unit belongs from the blockchain network certificate carried in the request message, and determines whether the node of the blockchain network to which the upper-level node unit belongs can access the blockchain network node to which the current node unit belongs through the data of the access relationship between the networks. If so, it has access rights, otherwise, it does not have access rights.

[0108] Example 3, as a specific example, Figure 1 and Figure 2A hierarchical blockchain network architecture of the present invention is shown, and the business management layer is divided according to the management level of specific business. Each management level has 1 to multiple blockchain networks, and each node of each blockchain network corresponds to a business department or a business entity that needs to cooperate. Each node has an interface for data reading, writing and monitoring, which can be used by an external business system. In addition, the upper node unit and the lower node unit can also transmit data. The upper node unit can read, write and monitor the data of the lower node unit through the setting of the access mechanism, but the lower node unit can only return the data monitored by the upper node unit. The management component includes a network planning management unit, a partner CA, a blockchain network CA, a blockchain network management unit, and a blockchain software library. The network planning management unit is used by the administrator to plan, design and maintain the hierarchical structure of the blockchain network, including blockchain network hierarchical structure data, blockchain deployment server information, blockchain network related installation package and script information, and the installation package information includes but is not limited to smart contracts, node and client names and versions. The partner CA is used to assign digital identity certificates and related private keys for access control to each partner's node unit, and the organization and level of the identity need to be reflected for access control of upper and lower node units. The blockchain network CA is used to apply for group certificates and private keys for nodes in the blockchain network. In some usage scenarios, nodes in the blockchain network can use blockchain network group certificates to prove their identities when accessing lower-level nodes. The blockchain network management unit is used to build and manage the blockchain network. It can generate nodes in the blockchain network according to a single-layer network structure in the overall structure designed by the network planning management unit, including installation, deployment, and configuration (including the certificates and private keys generated by CA for each node), and configure the blockchain network so that each node can be constructed into a blockchain network that can be run. Each blockchain network management unit can correspond to one blockchain network or multiple blockchain networks. It can also be used to build and manage temporary blockchain networks. It can configure or generate nodes in the temporary blockchain network according to a temporary blockchain network structure designed by the network planning management unit. When the node already exists, it needs to be configured. When it does not exist, it needs to generate a node, and configure the temporary blockchain network so that each node can be constructed into a temporary blockchain network that can be run. Each blockchain network management unit can correspond to one temporary blockchain network or multiple. Blockchain software library management includes but is not limited to the code and installation packages of blockchain nodes, smart contracts, and blockchain clients. These software information is provided to the network planning management unit for the planning and design of the blockchain network, and the installation package used for deployment is provided to the blockchain network management unit. The business system accesses the node units in the corresponding blockchain network through the access client, including reading, writing, and monitoring the data of the node and the lower-level node units that the system has preset access rights.

[0109] The system administrator designs the hierarchical structure of the blockchain network, the properties of the blockchain network, the relationship between the blockchain networks that are allowed to be accessed, and configures the properties of each node (partner information, deployment server information, level, node code installation package, other accessible blockchain networks or node information) through the network planning management unit, and sends these design information (in the form of files or messages) to the blockchain network management unit for blockchain network construction. The construction order is from top to bottom, first building the first layer of blockchain network, then building the second layer... until the bottom layer. The blockchain network management unit obtains the installation package, generates the deployment script and configuration file for each node unit based on a certain blockchain network configuration, the configuration information of the nodes in the blockchain network, and the information of other blockchain networks accessible to the blockchain network, and then sends them to the server where the blockchain network management client is located. The management client on the server installs and deploys the nodes and configures each node to form a blockchain network that can be run. The configuration includes obtaining the node's certificate and private key from the partner CA corresponding to the node.

[0110] Each node unit corresponds to a business department or entity, and the corresponding business information system can read, write, or monitor specific types of data on the blockchain network where the node is located through the data access interface provided by the node unit. When the business department corresponding to the node needs to access the blockchain node information of the subordinate business department, it can pass the identification, data parameters and access address of the subordinate node through the access interface provided by the current node (the access address can also be obtained from the network planning management unit by the current node according to the identification of the subordinate node) and send an access request to the subordinate node. The subordinate node verifies the identity information in the request and agrees to access if it comes from the superior node. The superior of the business department can send instructions to the subordinate by writing to the subordinate through the superior blockchain node, and the subordinate can send data to the superior through the message monitoring channel established by the superior to the subordinate.

[0111] When executing specific tasks, it may be necessary to have both superiors and subordinates participate at the same time. This requires breaking the original hierarchical relationship and building a flat blockchain network for Linji. By designing the Linji blockchain network structure through the network planning management unit, nodes in the original hierarchical blockchain network structure can be selected as Linji blockchain network nodes, and new nodes can be added.

[0112] The Linji blockchain network management unit will build and manage the blockchain network according to the Linji blockchain network structure. It can generate nodes in the Linji blockchain network according to a Linji blockchain network structure and configuration attributes designed by the network planning management unit. When a node already exists, it is necessary to add configuration to it and perform network construction operations on each node in the Linji blockchain network so that each node can be constructed into a Linji blockchain network that can run.

[0113] Because nodes in the ad hoc blockchain or the underlying blockchain network nodes in the layered blockchain may be in a mobile network environment, facing problems such as poor network signals and limited bandwidth, if the complete blockchain information is sent between nodes, it may occupy too much bandwidth and affect the sending of business messages. This solution also designs a switching mechanism for this unstable network. When the entity where the node unit is located detects that the network bandwidth is insufficient, it is allowed to switch from a blockchain node to a client, only sending and monitoring necessary data, and then switching back to the node identity when the signal is restored.

[0114] If a partner in each blockchain network has multiple nodes, a master node can be set as the default node when the upper blockchain network reads, writes, and monitors the lower blockchain network. In order to reduce unnecessary data transmission, the complete block data can be synchronized between the master nodes of each party, and then synchronized separately to other nodes within the partner. When the master node fails, a new master node can be elected.

[0115] The partner CA in this embodiment specifically includes:

[0116] Each participating organization needs to have its own CA, which is used to issue certificates to participating blockchain nodes. In addition to the public key of the node, the certificate must also contain attribute information, including but not limited to: role, level, and department identification. The department identification is used to determine the mutual subordinate relationship between the participating departments of the partner. The optional department identification can contain all information from the top department to the current department. The role is related to the responsibility, such as (client, blockchain node).

[0117] The blockchain software library in this embodiment specifically includes:

[0118] Code and installation packages for managing blockchain nodes, smart contracts, blockchain clients, and related data processing plug-ins. This module provides an interface to the network planning management unit for receiving software information (including but not limited to name, version, and category), through which the administrator can select appropriate software, including software version and plug-ins. This module can receive a software package acquisition request issued by the blockchain network management unit and return the download address of the software package and installation script. The software package and installation script can be generated by the blockchain software library based on the source code, or uploaded by the administrator.

[0119] like Figure 3 As shown, the node unit in this embodiment specifically includes:

[0120] The node unit corresponds to the node in the blockchain network and is used to build the blockchain network. The node unit in the present invention is not only used to build a flat blockchain network, but also can be accessed by the node unit in the upper blockchain network through the set access rules, and access the node unit of the lower blockchain network, in this way to build a channel for upper and lower level access to the blockchain network. The node unit includes a blockchain client, a blockchain node, an authentication module and a switching module. The authentication module is used for authentication when the external business system accesses and is also used for the initial authentication when the blockchain client of other node units needs to request access to the internal blockchain node data of the node. The blockchain client includes the access tool provided by the blockchain platform and the certificate for blockchain node identity verification, and can directly access the data in the blockchain node, including the way of reading, writing and listening. The blockchain client provides a general interface for reading, writing and listening to the external business system. The blockchain node is a peer node in the blockchain network, which is used to store the account book and deploy and execute smart contracts. The peer nodes in the blockchain network can communicate with each other to send and receive block data. The switching module is used to switch the blockchain node to the client when the network bandwidth is insufficient, and control the client to only send and listen to necessary messages. When the bandwidth is restored, the client state is switched back to the blockchain node state. The switching module can receive the switching message sent by the system, or it can have a built-in network status detection unit to detect network communication indicator data to determine whether to switch. The network indicators include but are not limited to bandwidth and packet loss rate.

[0121] The monitoring means that the blockchain client can register a monitoring event for a smart contract with the blockchain node. When the blockchain node receives a block, it checks whether there is a transaction of the registered smart contract in it, and notifies the client if there is one. Different types of messages can be processed by different smart contracts, so the blockchain client can monitor different types of messages.

[0122] The authentication module contains the root CA of the node unit, which can generate an identity certificate and secret key for the external business system that accesses the node unit for access to the external business system. In addition to the node root CA, the authentication module also trusts the partner CA. If an external blockchain client needs to access the blockchain node inside the node unit, it verifies whether it is a certificate issued by the partner CA and the certificate attributes meet the access rules (see the node upper and lower access method in the blockchain network for details). If the conditions are met, the certificate is added to the client access list of the blockchain node, and the blockchain node can be directly accessed later. If access between upper and lower nodes between different partners is required, the node authentication module needs to trust multiple partner CAs.

[0123] Access method: When the business department corresponding to the upper node unit accesses the blockchain network data of the lower business department, the blockchain client in the upper business node unit directly accesses the blockchain node in the lower node unit. The certificate issued by the partner CA held by the upper node unit is required to meet the access rules for accessing the lower node unit. Messages on the blockchain network may come from node units at other levels. Therefore, when the client writes a message to the blockchain node, the information of the node to which the client belongs must be added as the message prefix to indicate the source of the message.

[0124] Blockchain client interface:

[0125] Write interface (authentication required): message type, message content, write blockchain node information (address: port); read interface (authentication required): message type, query parameters, read blockchain node information (address: port); listen interface: message type, listen blockchain node information (address: port).

[0126] Node switching method: When the business entity deployed by the node unit detects that the network bandwidth is insufficient, it sends a switch-to-client instruction to the node unit, or the switching module of the node unit contains a network quality detection unit. When it detects that the network quality is lower than the threshold, the switching module will perform the following steps:

[0127] 1. Call the blockchain client to obtain the message monitoring type, and then cancel the message monitoring for the blockchain node;

[0128] 2. Query the node units connected to each blockchain network in the blockchain node, call the blockchain client to send an authentication request (carrying the blockchain client certificate) to it. If a blockchain network has multiple connected nodes, connect them in sequence until an acceptance message is returned; if no node responds, wait for a while before continuing to connect, and send an alarm message to the blockchain network management client;

[0129] 3. If the request is accepted, the connection method of the external blockchain node is added to the connection address of the blockchain client;

[0130] 4. Call the blockchain client to switch to connecting to the external blockchain node;

[0131] 5. The switching module sends the necessary monitoring message information configured in advance to the blockchain client, and the blockchain client sends a monitoring registration request to the external blockchain node to register the necessary monitoring message;

[0132] 6. The switch module stops the blockchain node (to avoid sending and receiving messages).

[0133] When the network bandwidth is detected to be restored, the business module sends a switch-to-node instruction to the node unit, and the switch module performs the following operations:

[0134] 1. Start the blockchain node;

[0135] 2. Call the blockchain node to send a blockchain ledger synchronization request to other nodes to pull the blockchain ledger and replace the original ledger;

[0136] 3. Call the blockchain client to send a request to cancel monitoring to the external blockchain node;

[0137] 4. The switching module switches the blockchain client to connect to the internal blockchain node;

[0138] 5. Call the blockchain client to set the monitored message type to the message type saved before switching.

[0139] like Figure 4 As shown, the network planning management unit in this embodiment includes:

[0140] Used to manage the design and management of the blockchain hierarchical network structure or the ad hoc blockchain network structure. The network planning management unit includes a visual design interface, which can design the blockchain network structure. Users can design network attributes, network node attributes, and the access relationship between the network level and network nodes through the interface. The network structure data management module is a background module corresponding to the design interface, which can verify the rationality of the network design structure and generate structured data. The structured data can be sent to the blockchain network management unit and the business information system in the form of a file or message (for the business system to access nodes through the hierarchical blockchain system). This module contains a list of blockchain server information (the information is provided by each partner and can be imported by the administrator). Users can configure the network node deployment location based on this server information. This module also contains a list of blockchain software library information (which can be synchronized from the blockchain software library). Users can configure blockchain network nodes, clients, and smart contract software versions based on this information.

[0141] Blockchain hierarchical network structure design method:

[0142] Users design the blockchain network of each business management layer through a visual design interface;

[0143] Users can define each blockchain network's properties, including:

[0144] 1. Generate the corresponding blockchain network ID number (can be automatically generated by the system);

[0145] 2. Network name (optional, for display purposes);

[0146] 3. Network attributes (whether it is a layered network, whether it is an ad hoc blockchain network, whether it is an unstable blockchain network);

[0147] 4. Network channel identifier (generated by the system by default, used for message isolation when a node joins different blockchain networks);

[0148] 5. Node software version number;

[0149] 6. Smart contracts that need to be installed (can be defined per network or specified individually in node properties);

[0150] 7. Select the message format that the blockchain network needs to process (an optional attribute, based on which you can select the data processing plug-in integrated in the blockchain client).

[0151] The smart contract is a smart contract included in the blockchain software library, and the message format list is a format list corresponding to the message processing plug-in included in the blockchain software library. The channel is used to isolate the messages of the blockchain network. When a blockchain node can be in a layered blockchain network and one or more ad hoc blockchain networks, a different channel is designed for each blockchain network to ensure that a node communicates securely in different blockchain networks.

[0152] For each blockchain network, users can define the node attributes of each blockchain network, including but not limited to:

[0153] 1. Node name (optional);

[0154] 2. The partner to which the node belongs;

[0155] 3. Server where the node is deployed;

[0156] 4. Whether it is the master node in the blockchain network (when a partner has multiple nodes, one of them can be selected as the master node);

[0157] 5. Node type (such as message transmission node, execution node, control node);

[0158] 6. Department information of the node.

[0159] Methods for accessing nodes in blockchain network:

[0160] Users can also set the upper and lower level access methods of nodes in different levels of blockchain networks through the network planning management unit.

[0161] This solution designs four methods for superior-subordinate access. The first method is a superior-subordinate access method based on each node, and one node corresponds to only one direct superior. This method corresponds to the superior-subordinate access method in traditional cognition, that is, the node corresponding to the superior department within the same partner can directly access the node corresponding to the subordinate, so the department information can be used to determine whether it is a superior-subordinate relationship. If there is a temporary superior-subordinate relationship in some scenarios, but one node still corresponds to only one direct superior, it is only necessary to generate virtual department information, and the ID is used to represent the department information in the solution. The second method is also a superior-subordinate access method based on each node, but considering some special scenarios: such as the existence of different management domains, the department corresponding to a node may be directly managed by two or more departments, and it cannot be simply judged by department information. There is also a need for superior-subordinate access across partners. The access relationship of each node is designed through the management planning management unit. Each accessed node can determine whether the access node has access rights based on the access relationship between nodes. Because the relationship between nodes needs to be preserved, if there is a scenario where nodes change in the blockchain network, such as the original node is damaged and a new node needs to be added to replace it, this situation is not applicable. Therefore, two other methods of superior and subordinate access based on blockchain networks are designed for scenarios where nodes change. Methods 3 and 4 regard the blockchain network as a whole to plan and judge the access relationship between blockchain networks. Each blockchain network corresponds to a department that cooperates together. It is necessary to apply for a group certificate for the blockchain network. When superior and subordinate access, it is only necessary to determine whether it is a superior and subordinate relationship based on the network identity information in the blockchain network certificate carried in the request. Method 3 is applicable to scenarios where a blockchain network has only one direct superior and superior and subordinate access is required between multiple mutually trusted partners. The fourth method is applicable to scenarios where a blockchain network can correspond to two or more blockchain networks as direct superiors. For example, in scenarios where there are multiple management domains, cross-partner access can also be facilitated. The management of group certificates is relatively complex, so the node-based access method is preferred, and the above four methods can also be used in combination. For example, in actual usage scenarios, nodes in the upper management layer are usually more stable, and nodes in the lower management layer are more likely to change (such as failures and loss leading to unavailability). The node-based access method can be used in the first n layers of management, and the upper and lower level access method based on the blockchain network can be used after the n+1 layer. The same level can also have different access methods. If the accessible relationships between all upper and lower nodes form a directed graph, if there are multiple connected branches, different access methods can be used within each connected branch.

[0162] Method 1: Access authentication based on node ID.

[0163] If within the same partner or mutually trusted partners, each blockchain node corresponds to only one blockchain node in the upper management layer as its direct superior blockchain node, the management relationship between blockchain nodes forms a tree structure diagram. The following method can be used:

[0164] 1) Define a hierarchical blockchain node ID, from which the superior-subordinate relationship of the blockchain node can be determined. The hierarchical node ID definition format is: the first-layer blockchain node ID is the internal node identifier of this layer; the i-th layer (i>1) blockchain node ID is the parent node ID separator and the internal node identifier of this layer.

[0165] 2) When a node receives an access request, the accessed node compares the ID in the access node certificate carried in the request with the ID of the accessed node. If the ID of the accessing node is a prefix of the ID of the accessed node, it is the superior of the accessed node. If they belong to the same partner or mutually trusted partners, access can be made.

[0166] Method 2: Perform access authentication based on the planned access relationship between nodes.

[0167] If there are multiple upper-level blockchain nodes in the direct upper management layer of a blockchain node, the user needs to design the blockchain nodes of the same partner or mutually trusted partners into a sequence relationship according to the upper-lower relationship of the management layer in the blockchain planning management unit. The access relationship between nodes can be displayed using a Hasse diagram that can represent the sequence relationship. The Hasse diagram is a DAG diagram (because it implies arrows). According to the DAG diagram, each node can determine which nodes are upper-level nodes that can be accessed by it, and which nodes are lower-level nodes that can be accessed by it. The upper-lower access method of blockchain network nodes is as follows:

[0168] 1) Generate a unique ID for each blockchain node

[0169] 2) Design a Hasse graph of superior-subordinate access based on the user blockchain network structure, which is also a DAG graph. The specific method is: define each blockchain node as a point in the graph. If node i is the direct superior of node j, there is a directed edge between i and j. This directed graph can be represented by the adjacency matrix A.

[0170] 3) Find the path matrix A' corresponding to the adjacency matrix A representing the DAG graph, then the element a in the i-th row of the matrix A' is ij 1 means j is a point reachable by i, i.e., a lower-level node. If a ij A value of 1 indicates that j is a point that can reach i, that is, a superior node.

[0171] 4) Save the matrix A' to the authentication module configuration of the node unit.

[0172] 5) When other nodes access, it can be calculated based on the node ID in its blockchain node certificate and the matrix A' in the authentication module configuration whether the node is a subordinate node of the access node. If so, access is allowed.

[0173] The access method of the upper and lower levels based on the blockchain network:

[0174] Each blockchain network corresponds to a business department that cooperates with it. The access rights are determined by the blockchain network as a unit, and each node needs to prove the identity of the blockchain network to which it belongs. The blockchain network ID is added to the group certificate of each blockchain network. When the upper node accesses the lower node, the blockchain network certificate is substituted in the request. The accessed node needs to verify the blockchain network certificate carried in the access node request. If it is the upper network, it will then determine whether it is a mutually trusted partner based on the partner information in the node certificate to decide whether it can be accessed.

[0175] Method 3: Access authentication based on blockchain network ID.

[0176] If each blockchain network only corresponds to one blockchain network in the upper management layer as its direct superior blockchain network, the management relationship between blockchain networks forms a tree structure diagram. The following method can be used:

[0177] 1) Define a hierarchical blockchain network ID, from which the hierarchical network's subordinate relationship can be determined. The hierarchical network ID definition format is: the first-layer blockchain network ID is the internal blockchain network identifier of this layer; the i-th layer (i>1) blockchain network ID is the parent blockchain network ID separator and the internal blockchain network identifier of this layer.

[0178] 2) When a node receives an access request, the accessed node compares the ID in the blockchain network certificate of the accessing node carried in the request with the blockchain network ID of the accessed node. If the ID of the blockchain network to which the accessing node belongs is the prefix of the ID of the blockchain network to which the accessed node belongs, then it is the superior of the accessed node. If they belong to the same partner or mutually trusted partners, access can be made.

[0179] Method 4: Perform access authentication based on the planned access relationship between blockchain networks.

[0180] If the blockchain network has one or more superior blockchain networks in the direct upper management layer, the user needs to design the superior-subordinate relationship of the blockchain network into a sequence relationship in the blockchain planning management unit. The access relationship between blockchain networks can be displayed using a Hasse diagram that can represent the sequence relationship. The Hasse diagram is a DAG diagram (because it implies arrows). According to the DAG diagram, each node can determine which nodes are superiors and can be accessed by it, and which nodes are subordinates and can be accessed by it. The superior-subordinate access method on the blockchain network is as follows:

[0181] 1) Generate a unique ID for each blockchain network

[0182] 2) Generate a Hasse graph of upper and lower level access based on the user blockchain network structure design, which is also a DAG graph. The specific method is: define each blockchain network as a point in the graph. If network i is the direct superior of network j, there is a directed edge between i and j. This directed graph can be represented by the adjacency matrix A.

[0183] 3) Find the path matrix A' corresponding to the adjacency matrix A representing the DAG graph, then the element a in the i-th row of the matrix A' is ij 1 means j is a point reachable by i, i.e., a lower-level node. If a ij A value of 1 indicates that j is a point that can reach i, that is, a superior node.

[0184] 4) Save the matrix A' to the authentication module configuration of the node unit.

[0185] 5) When other nodes access, based on the network ID in its blockchain network certificate and the matrix A' in the authentication module configuration, it can be calculated whether the network described by the node is a subordinate of the blockchain network to which the access node belongs. If so, and it belongs to a partner or a mutually trusted partner, access is allowed.

[0186] Layered network structure verification method:

[0187] When the hierarchical network design is completed, the network planning management unit verifies the following:

[0188] 1. Whether the upper and lower level access methods and access relationships match:

[0189] 1) When the upper and lower blockchain networks use the blockchain node ID or blockchain network ID to perform access authentication, any blockchain node or blockchain network cannot have two direct superiors. If there are two direct superiors, it is prohibited, and it is recommended to modify it to perform access authentication based on the planned access relationship between blockchain nodes or networks;

[0190] 2) When the upper and lower blockchain networks use the planned access relationship between blockchain nodes or networks for access authentication, if any blockchain node or blockchain network has only one direct superior, it is suggested to change the access authentication method to one based on the blockchain node ID or blockchain network ID;

[0191] 3) When the upper n-layer blockchain network adopts the upper and lower level access method based on the blockchain network as a unit, the lower-level blockchain network can only use the upper and lower level access method based on the blockchain network as a unit;

[0192] 4) When the upper n-level network adopts the upper and lower level access method based on blockchain nodes, the lower-level blockchain network can be the upper and lower level access method based on blockchain nodes or blockchain networks;

[0193] 5) When the upper n-layer blockchain network performs access authentication based on the blockchain node ID, the lower-level blockchain network can perform access authentication based on the access relationship of the planned blockchain node;

[0194] 6) When the upper n-layer blockchain network performs access authentication based on the blockchain network ID, the lower-level blockchain network can perform access authentication based on the access relationship of the planned blockchain network.

[0195] 2. If access authentication is performed based on the planned access relationship between blockchain nodes or networks, check whether the Hasse diagram is correct.

[0196] 3. Whether the blockchain network where the upper node is located can process the message type of the accessible lower node blockchain network. If it cannot be processed, a prompt will be given, or the message type of the lower network node will be directly added.

[0197] 4. Optionally, when the blockchain client of the node unit contains a data processing plug-in, check whether the message types processed by the network smart contract and the blockchain client in the node unit match.

[0198] Linji blockchain network planning and design method:

[0199] Users design the Linji blockchain network through the visual design interface of the network planning management unit:

[0200] 1. Define the properties of the ad hoc blockchain network, which are the same as the blockchain network properties in the hierarchical network structure design method.

[0201] 2. You can select existing nodes in the hierarchical blockchain network as temporary blockchain network nodes. The node attributes use the original attributes without additional configuration. You can also add new blockchain network nodes. For new nodes, users can define the node attributes of each blockchain network. Refer to the blockchain network node attributes in the hierarchical network structure design method. The node attributes need to be set for new nodes.

[0202] In this embodiment, the blockchain network CA specifically includes:

[0203] In a hierarchical network structure, in addition to access based on the hierarchical relationship of node departments, access can also be made based on the hierarchical relationship of the blockchain network (for example, a temporarily appointed management agency may not have a direct hierarchical relationship with its subordinate units), so the access node needs to prove the identity of the blockchain network it is in. The blockchain network CA can receive a request from the blockchain network management unit and establish a group certificate for the nodes in the blockchain network. The certificate contains the blockchain network ID to prove the group identity, the group certificate contains the public key of the group, and a private key is assigned to each blockchain node participating in the group (corresponding to the blockchain network). The blockchain node can prove its identity as a group member (i.e., belonging to the blockchain network) by signing.

[0204] like Figure 5 As shown, in this embodiment, the blockchain network management unit specifically includes:

[0205] The blockchain network management unit generates an installation package, deployment script and configuration file for each node unit based on a blockchain network configuration, the configuration information of the nodes in the blockchain network, and the information of other blockchain networks accessible to the blockchain network, and then sends them to the server where the blockchain network management client is located. The management client on the server installs and deploys the nodes and configures each node to form a blockchain network that can be operated.

[0206] The blockchain network management unit manages the blockchain network, including the deployment module, configuration management module, addition module, and 3 sub-modules, and completes the corresponding management functions. The blockchain network management unit consists of two parts: the server and the client. The blockchain network management unit server sends management instructions, scripts, and installation packages to the blockchain management client, and the blockchain management client receives instructions and performs specific management operations. The blockchain management client is deployed on the server where the blockchain network node has been installed or is to be installed, and the server deployment location is not required and can be deployed together with the network planning management unit or on other servers.

[0207] Server deployment module: This module downloads the packaged node installation package and the corresponding installation script from the blockchain software library according to the network attributes in the blockchain network structure data (including but not limited to the list of smart contracts and the list of message formats to be processed) and the following attribute information of each node unit (blockchain node installation package version, blockchain client installation package version). The message format list that needs to be processed by the blockchain network is used by the blockchain software library to find a suitable data processing plug-in and integrate it into the blockchain client (optional). Then the blockchain network management server deployment module packages the node installation package and the installation script and sends it to the blockchain network management client, and then sends the deployment instruction to the blockchain management client. After receiving the deployment instruction, the blockchain management client executes the installation script to install the installation package. If the node is the master node, the deployment module will also send one or more smart contract software packages corresponding to the smart contract list to the network management client, which will be used for the subsequent installation of smart contracts on each node by the blockchain network management client.

[0208] Configuration management module: The configuration management module of the blockchain management server also issues certificate acquisition instructions and blockchain node identity information to the blockchain management client where each newly added node is located according to the blockchain network structure data. The configuration module of the blockchain management client sends the newly added blockchain node identity information (including node information and the network information) to the CA for applying for certificates and private keys for the blockchain client and blockchain node, and performs initial configuration on the node, including: 1) putting the blockchain client certificate and private key into the folder set by the blockchain client of the node unit; 2) putting the blockchain node certificate and private key into the folder set by the blockchain node of the node unit; 3) the configuration management module puts the certificate of the blockchain client into the trusted client list of the blockchain node for the blockchain network; 4) the configuration management module also sets the node partner CA and the CA of the node authentication module as the trusted CA of the blockchain node. The blockchain node identity information includes node department information, node name, node ID and type (such as: blockchain client or blockchain node), where the node department number and type will be used as attributes of the certificate.

[0209] After the initial configuration of the node is completed, the configuration management module also needs to perform blockchain network initialization configuration. The blockchain network initialization configuration includes the following steps: 1) Generate a blockchain network configuration script based on the blockchain network attributes in the blockchain network structure data (the blockchain network attributes include but are not limited to: node unit deployment server and port information, blockchain network channel information, smart contract installation script) 2) Send the configuration script to the blockchain client to execute the script to establish a blockchain network.

[0210] Optional: When the blockchain network belongs to a hierarchical blockchain network structure, and the upper and lower access methods are to determine the access rights based on the planned access relationship in units of nodes, the configuration module also needs to be configured as follows:

[0211] The node list that can be accessed by each node in the blockchain network structure data is sent to the corresponding configuration module of the blockchain network management client. Each element in the node list contains information such as (node ​​ID, blockchain network to which the node belongs). The module applies to the CA for the certificate of the corresponding node and saves it to the folder of the blockchain node unit for the certificates allowed by the blockchain network for the node (a blockchain node can participate in different blockchain networks).

[0212] Optionally, when the blockchain network belongs to a hierarchical blockchain network structure, and the upper and lower level access method is the upper and lower level access method based on the blockchain network information, the configuration module also needs to be configured as follows:

[0213] 1) According to the blockchain network structure information, apply for the blockchain network group certificate and the private key of each node from the blockchain network CA, and send them to the blockchain management client corresponding to each node. The blockchain management client puts the blockchain network certificate and private key into the folder set by the blockchain client of the blockchain node unit for identity verification when accessing the lower-level network nodes of the network.

[0214] 2) Configure each node to determine whether the node has access rights when the upper node accesses it. The configuration management module processes the network hierarchy data, extracts the data that can represent the access relationship between all networks, and sends it to each node unit to determine whether the access node has the right to access it when the node is accessed. The judgment method is that when the accessed node receives the request, it obtains the information of the blockchain network to which the access node belongs from the blockchain network certificate carried in the request message, and determines whether the node of the blockchain network to which the access node belongs can access the blockchain network node to which the current node belongs through the data of the access relationship between the networks, and if so, it can access it.

[0215] The configuration management module can also accept the node addition instruction issued by the change module to add one or more new nodes to the existing blockchain network. The node addition operation can be that the server-side configuration management module sends the node addition instruction and node information (including: address, port, certificate) to the main node configuration management client, and the configuration management client sends the information of the new node to each node of the blockchain network for adding configuration by executing the script. After the configuration is completed, the new node is added to the blockchain network channel. The added configuration includes but is not limited to the following operations: adding the certificate of the new node to the accessible list of the existing node, and saving the new node information (address, port) as a communicable node in the configuration.

[0216] The configuration management module can also accept the node deletion instruction issued by the change module to delete one or more nodes from the blockchain network. The node deletion operation is performed by the server-side configuration management module sending the node deletion instruction and node information to the master node configuration management client. The configuration management client executes the script to send the node deletion information to each node that has not been deleted in the blockchain network for deletion configuration. When the deletion configuration operation of each node is completed, the node is deleted from the blockchain network. The deletion configuration includes but is not limited to the following operations: deleting the certificate node of the deleted node from the accessible list, and deleting the deleted node information (address, port) from the communicable node information.

[0217] Change module: This module receives the change message sent by the network planning management unit and finds the changed nodes in a blockchain network in the updated blockchain network structure data:

[0218] If the node is a newly added node, perform the following operations:

[0219] 1) Send the node information and network structure data to the deployment module, which will install the node unit on behalf of the deployment module, including all installation packages of the node unit and the smart contract corresponding to the blockchain network;

[0220] 2) After the deployment module is deployed, it returns a message to the change module server. After receiving the message, the change module server sends the newly added node information and network structure data to the configuration management module, which applies for a certificate and private key for the newly added node and performs initial configuration on the node;

[0221] 3) The configuration management module returns a message after completing the node configuration;

[0222] 4) After all nodes have completed the initial configuration, the change module server sends all newly added node information to the configuration management module server to add them to the blockchain network;

[0223] 5) The change module server sends a data synchronization instruction to the change module client of the newly added node deployment server;

[0224] 6) The change module client performs data pull operations on the node;

[0225] 7) Blockchain nodes will synchronize block data from other nodes.

[0226] If the node is to be deleted, perform the following operations:

[0227] 1) The change module sends the command to stop the connection to the change module client corresponding to the undeleted node

[0228] 2) After receiving the instruction, the change module client sends an instruction to the blockchain node to stop the connection;

[0229] 3) The blockchain node checks whether there is a long network connection with the deleted node, and disconnects if so.

[0230] 4) The change module sends the deletion instruction and node information to the configuration management module. The configuration management module configures the undeleted nodes in the blockchain network and deletes their network connection configuration and authentication configuration information.

[0231] In this embodiment, the unstable blockchain network management method specifically includes:

[0232] When the nodes in the constructed blockchain network may be in an unstable network environment, this solution also provides a switching mechanism, that is, when the entity where the node unit is located detects that the network communication index is lower than the preset communication index threshold, it is allowed to switch from a blockchain node to a client, only sending and listening to necessary data, and then switching back to the node identity when the signal is restored; network communication indicators include but are not limited to network bandwidth and packet loss rate. This requires adding the following functions based on the original network planning method:

[0233] 1. When designing a hierarchical blockchain network or an ad hoc blockchain network, the designer needs to predict which nodes may be in an unstable network environment. For these nodes, in addition to specifying the message types that the corresponding blockchain clients inside and outside the node unit need to monitor from the blockchain node when they are used as blockchain nodes (when the network conditions are good) (the comprehensive message types that need to be monitored), and the message types that the blockchain clients inside and outside the node unit need to monitor from the blockchain node after switching to a client (when the network conditions are poor) (the minimum message types that need to be monitored).

[0234] 2. In case some nodes may become unavailable due to loss or failure, the designer can select important nodes to provide corresponding protection for them, establish a master-slave mechanism for the nodes, and configure the master node and the backup node at the same time.

[0235] The master node is a node that is used preferentially and can be the same node as the master node of the partner in the blockchain network. The backup node will synchronize the data of the master node. When the master node fails, the backup node will replace the master node and notify the administrator to prepare a new backup node through the blockchain network management unit.

[0236] 3. The network planning management unit allows all node units to be switched. However, each partner needs to designate at least one master node and set up a protection mechanism for the master node to ensure that the master node represents the partner as a peer node in the blockchain network. The master node can be replaced through the design of the network planning management unit, or it can be re-elected in other nodes within the partner.

[0237] like Figure 6 As shown, in this embodiment, accessing the client includes:

[0238] The access client can be integrated as a plug-in by the external information system, or it can run independently on the server where the external business system is located. The access client can have a corresponding node unit in the hierarchical blockchain network, and hold the access credentials applied by the administrator from the corresponding node unit for direct access to it. The access client includes a data processing module and a network access module. The data processing module can accept the customization of the business system, process the data to be written into the node unit into a format accepted by the node unit, so as to save it in the blockchain; it can also restore the data returned by the node unit into a format acceptable to the external business system. The network access module can obtain from the network planning management unit when the business system needs to access the lower-level node data, the network access module can obtain the blockchain network structure data from the network planning management unit, and convert it into visual information for display. The business system can view the blockchain network structure through the access client, and select the node with access rights to read, write and monitor data. The access process includes that if the node with access rights is the node unit corresponding to the business system, its address is known and only the request data and access credentials need to be sent, otherwise the network access module queries the address of the node from the blockchain network structure data according to the node identifier selected by the user, and sends the request data, access credentials and address together to the corresponding node unit.

[0239] like Figure 7 As shown, an example of allocating access authentication based on the blockchain network ID.

[0240] The blockchain network identifier is Arabic numerals, and the separator is ".". Arrows represent the relationship between direct superiors and subordinates. From the ID number of blockchain network 1.1.1, it can be seen that the blockchain network is located at the third level of the business hierarchy and is the blockchain network with network identifier 1 in the network under the jurisdiction of blockchain network 1.1.

[0241] The parent network of blockchain network 1.1 is blockchain network 1, which can be accessed by this network. The subordinate networks are all networks prefixed with network 1.1, in this case blockchain networks 1.1.1 and 1.1.2, and these networks can be directly accessed.

[0242] like Figure 8 As shown, an example of inter-network access relationship planning in the blockchain inter-network access relationship authentication method is shown.

[0243] Figure 8 The figure below is an example of a relationship diagram of direct superior-subordinate access between blockchain networks in the network design and planning interface. The directed edges with arrows represent the accessible relationship between blockchain networks. This diagram omits the indirect superior-subordinate access relationship. It implies that network 1.2 can access networks 3.3 and 3.4, and network 1.1 can access networks 3.1, 3.2, and 3.3. If the diagram is inverted and the arrows are removed, it can be viewed as a Hasse diagram.

[0244] Figure 8 In the scenario involved in the example, blockchain network 1.1 and blockchain network 1.2 belong to different management areas, while network 2.2 and network 3.3 are involved in both areas, so they can be managed by both network 1.1 and network 1.2 respectively, but the messages read and listened to are different.

[0245] Create matrix A for this graph:

[0246] 1) Number the network sequentially and correspond the numbers to the nodes in the graph;

[0247]

[0248] Then the node set of the graph is abstracted as V = {v1, v2, ... v9}, and the adjacency matrix A of the graph is as follows:

[0249]

[0250] 2) According to the adjacency matrix A, the path matrix A' is obtained as:

[0251]

[0252] 3) Store A' and table x in the authentication module of the node unit;

[0253] 4) When a node in network 2.2 needs to access a node in network 3.3, the authentication module finds v4 corresponding to network 2.2 and v8 corresponding to network 3.3 in table x according to the network ID number 2.2 in its blockchain network certificate. According to the fact that a48 in the matrix A' in the configuration is 1, it is judged that the node is the parent node of the current network node in the network structure. If the node certificate belongs to the same partner CA or a trusted partner CA, it can be accessed.

[0254] Examples of unstable blockchain networks:

[0255] An example of an unstable blockchain network is given. There are three partner node units that form a blockchain network. The three partner node units are represented by a, b, and c respectively. When the network environment of all node units is good, they all participate in the blockchain network in the form of blockchain nodes, such as Fig. 9 This example shows the status and connection status of each node in the blockchain network in this case. When the node unit network environment is poor, it can switch from a blockchain node to a blockchain client. Fig.10 An example of the status and connection of each node in the blockchain network in this case is shown, where each partner has only one node unit running as a blockchain node, namely node units a1, b1 and c1, while the remaining nodes access the corresponding node units of the partner as clients.

[0256] like Fig.11 As shown in the figure, an example of the blockchain network deployment process is as follows:

[0257] Step 1. The network planning management unit sends a blockchain network creation request to the blockchain management unit server according to the created blockchain network structure data;

[0258] Step 2. The blockchain management server applies to the blockchain software library for the required installation package according to the installation package information in the blockchain network structure data to be created contained in the blockchain network creation request. The installation package information includes but is not limited to the smart contract, node and client name and version;

[0259] Step 3. The blockchain management unit server sends the software installation package or its download link to the blockchain management client on the blockchain node to be deployed server.

[0260] Step 4. After receiving the deployment instruction, the blockchain management unit client executes the installation script on the server where it is located to install and deploy the node unit;

[0261] Step 5. The blockchain management unit server sends configuration instructions to the blockchain management unit client.

[0262] Step 6. After receiving the configuration instruction, the blockchain management unit client sends the blockchain node identity information (including node information and the network information) therein to the partner CA for applying for certificates and private keys for the blockchain client and blockchain node.

[0263] Step 7. Initial configuration of the node, including: 1) putting the blockchain client certificate and private key into the folder set by the blockchain client of the node unit; 2) putting the blockchain node certificate and private key into the folder set by the blockchain node of the node unit; 3) the configuration management module puts the blockchain client certificate into the trusted client list of the blockchain node for the blockchain network; 4) the configuration management module also sets the node partner CA and the CA of the node authentication module as the trusted CA of the blockchain node. The blockchain node identity information includes node department information, node name, node ID and type (such as: blockchain client or blockchain node), where the node department number and type will be used as attributes of the certificate.

[0264] Step 8. After all nodes are created, the blockchain management server generates a blockchain network configuration script according to the blockchain network attributes in the blockchain network structure data, and then sends the configuration script and the installation package required for configuration to the blockchain client where the master node is located, which executes the script to establish a blockchain network; the blockchain network attributes are not limited to: node unit deployment server and port information, blockchain network channel information, smart contract installation script, and the installation package required for configuration is not limited to: smart contract installation package or download address

[0265] Step 9. After receiving the blockchain network configuration instructions and scripts, the blockchain management client configures the blockchain network, including but not limited to: establishing a blockchain network channel and installing a smart contract;

[0266] Step 10. The blockchain management server applies to the blockchain network CA for the blockchain network group certificate and the private key of each node according to the blockchain network structure information;

[0267] Step 11. The blockchain management server sends the access configuration information, the blockchain network group certificate, and the private key of each node to the blockchain management client corresponding to each node. The access configuration is used to determine whether the node has access rights when the upper node accesses it. The configuration management module processes the network hierarchy data, extracts the data that can represent the access relationship between all networks, and sends it to each node unit to determine whether the access node has the authority to access it when the node is accessed. The judgment method is that when the accessed node receives a request, it obtains the information of the blockchain network to which the access node belongs from the blockchain network certificate carried in the request message, and determines whether the node of the blockchain network to which the access node belongs can access the node of the blockchain network to which the current node belongs through the data of the access relationship between the networks. If so, access can be made;

[0268] Step 12. The blockchain management client saves the access configuration and puts the blockchain network certificate and private key into the folder set by the blockchain client of the blockchain node unit for proving the identity when accessing the lower-level network nodes of the network.

[0269] The above steps 10-12 are optional steps. These steps need to be included when the blockchain network belongs to a layered blockchain network structure and the superior-subordinate access method is the superior-subordinate access method based on the blockchain network information.

[0270] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0271] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0272] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0273] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0274] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A layered blockchain network architecture, characterized in that: include: Several business management layers divided according to the management level of specific businesses, each of which includes at least one blockchain network, each node unit of each blockchain network corresponds to a business department or a business entity that needs to cooperate, and each node unit is provided with an interface for data reading, writing and monitoring; Management components, including a network planning management unit, a blockchain network management unit, a blockchain software library, a partner CA, and a blockchain network CA; The network planning management unit is used to determine the hierarchical structure of the blockchain network of the business management layer according to the preset demand information and determine the upper and lower access mechanism of the business management layer. The upper and lower access mechanism is used to control the upper node unit to read, write, and monitor the data of the lower node unit, but the lower node unit can only return the data monitored by the upper node unit; the blockchain network management unit is used to cooperate with the blockchain software library, the partner CA, and the blockchain network CA to construct, configure and change the hierarchical structure of the blockchain network and the upper and lower access mechanism of the business management layer from top to bottom; The node unit includes a blockchain client, a blockchain node, an authentication module and a switching module; The authentication module is used for authentication when an external business system accesses it and is also used for initial authentication when a blockchain client of other node units needs to request access to the internal blockchain node data of the node; The blockchain client includes access tools provided by the blockchain platform and certificates for blockchain node identity verification; the blockchain client also includes a general interface for reading, writing, and monitoring external business systems; the blockchain node is a peer node in the blockchain network, which is used to store ledgers and deploy and execute smart contracts. Peer nodes in the blockchain network can communicate with each other to send and receive block data; the switching module is used to detect the network communication index of the blockchain node. When the network communication index is lower than the preset communication index threshold, the blockchain node is switched to the client, and the client is controlled to only send and monitor necessary information. When it is detected that the network communication index of the client is not lower than the preset communication index threshold, the identity of the blockchain node is switched back; When the business department corresponding to the upper node unit accesses the blockchain network data of the lower business department, the blockchain client in the upper business node unit directly accesses the blockchain node in the lower node unit; need The certificate issued by the partner CA held by the upper node unit meets the access rules for accessing the lower node unit; The upper and lower level access mechanism includes one or more of the following access authentications: Method 1: Access authentication is performed based on the node unit ID, including: if within the same partner or mutually trusted partners, each blockchain node only corresponds to one blockchain node in the upper management layer as its direct superior blockchain node, and the management relationship between blockchain nodes constitutes a tree structure diagram, the authentication adopts the following method: 1) Define a hierarchical blockchain node ID, and determine the superior-subordinate relationship of the blockchain node from the blockchain node ID number. The blockchain node ID definition format of the hierarchical node is: the first-layer blockchain node ID is the internal node identifier of the layer; the i-th layer blockchain node ID is the parent node ID plus a separator plus the internal node identifier of the layer, i>1; 2) When the node receives an access request, the accessed node compares the ID in the access node certificate carried in the request with the ID of the accessed node. If the ID of the access node is the ID prefix of the accessed node, it is the superior of the accessed node. If they belong to the same partner or mutually trusted partners, the access is performed; Method 2: Access authentication is performed based on the planned access relationship between nodes, including: if there is a situation where a blockchain node has multiple superior blockchain nodes in the direct upper management layer, the user is required to extract the blockchain nodes within the same partner or mutually trusted partners into an order relationship according to the management layer superior-subordinate relationship in the blockchain planning management unit, and the access relationship between nodes is displayed using a Hasse graph that can represent the order relationship. The Hasse graph is converted into a DAG graph, and the superior node of each node i is determined according to the DAG graph, that is, i can be accessed, and the subordinate node of i is determined, that is, i can be accessed; the method for superior and subordinate access of blockchain network nodes is as follows: 1) Generate an ID that uniquely identifies its identity for each blockchain node; 2) Extract the Hasse graph of the superior and subordinate access relationship based on the user's blockchain network structure, and then convert it into a DAG graph. The conversion method is: define each blockchain node as a point in the DAG graph, and for any two endpoints i and j of an edge, if the i node is the direct superior of the j node, convert the edge {i, j} into a directed edge<i,j> , after all edges are converted, the Hasse graph becomes a DAG graph. Let the adjacency matrix of the DAG graph be A; 3) Find the path matrix A' corresponding to the adjacency matrix A, then the element in the i-th row and j-th column of the path matrix A' is 1 means j is a point reachable by i, j is a subordinate node of i, and i is a superior node of j; 4) Save the path matrix A' to the authentication module configuration of the node unit; 5) When other nodes access, calculate whether the accessed node is a subordinate node of the accessing node based on the node ID in its blockchain node certificate and the path matrix A' in the authentication module configuration, and if so, allow access; The access method between superiors and subordinates based on blockchain networks: Each blockchain network corresponds to a cooperating business department. The access rights are determined based on the blockchain network. Each node needs to prove the identity of the blockchain network to which it belongs. The blockchain network ID is added to the group certificate of each blockchain network. When the superior node accesses the subordinate node, the blockchain network certificate is carried in the request. The accessed node needs to verify the blockchain network certificate carried in the access node request. If it is the superior network, it will determine whether it is a mutually trusted partner based on the partner information in the node certificate to decide whether it can be accessed. Method 3: Access authentication based on blockchain network ID, including: if each blockchain network corresponds to only one blockchain network in the upper management layer as its direct superior blockchain network; the management relationship between blockchain networks constitutes a tree structure diagram, the following method is adopted: 1) define a hierarchical blockchain network ID, and judge the superior-subordinate relationship of the blockchain network from the network ID number; the hierarchical network ID definition format is: the first-layer blockchain network ID is the internal blockchain network identifier of this layer; the i-th-layer blockchain network ID is the parent blockchain network ID plus a separator plus the internal blockchain network identifier of this layer, i>1; 2) when a node receives an access request, the accessed node compares the blockchain network ID of the accessed node with the ID in the blockchain network certificate of the accessed node carried in the request. If the ID of the blockchain network to which the accessed node belongs is the ID prefix of the blockchain network to which the accessed node belongs, it is the superior of the accessed node. If they belong to the same partner or mutually trusted partners, they can be accessed; Method 4: Perform access authentication based on the planned access relationship between blockchain networks, including: if the blockchain network has one or more superior blockchain networks in the direct upper management layer, the user is required to extract the superior-subordinate relationship of the blockchain network into an order relationship in the blockchain planning management unit. The access relationship between blockchain networks can be displayed using a Hasse graph that can represent the order relationship. The Hasse graph is converted into a DAG graph. According to the DAG graph, the superior node of each node i is determined, that is, i can be accessed, and the subordinate node of i is determined, that is, i can be accessed. The method for superior-subordinate access on the blockchain network is as follows: 1) Generate an ID for each blockchain network that uniquely identifies its identity; 2) Extract the Hasse graph of superior-subordinate access based on the user's blockchain network structure, and then convert it into a DAG graph. The conversion method is: define each blockchain network as a point in the DAG graph. For any two endpoints i and j of an edge, if the i network is the direct superior of the j network, convert the edge {i, j} into a directed edge<i,j> , after all edges are converted, the Hasse graph becomes a DAG graph. Let the adjacency matrix of the DAG graph be A; 3) Find the path matrix A' corresponding to the adjacency matrix A, then the element in the i-th row and j-th column of the path matrix A' is 1 represents j is a point reachable by i, j is a subordinate node of i, and i is a superior node of j; 4) Save the path matrix A' to the authentication module configuration of the node unit; 5) When other nodes access, calculate whether the network described by the accessed node is a subordinate of the blockchain network to which the accessed node belongs based on the network ID in its blockchain network certificate and the path matrix A' in the authentication module configuration. If so, and it belongs to a partner or a mutually trusted partner, access is allowed; Node switching method: When the business entity deployed by the node unit detects that the network bandwidth is insufficient, it sends a switch-to-client instruction to the node unit, or the switching module of the node unit contains a network quality detection unit. When it detects that the network quality is lower than the threshold, the switching module will perform the following steps: 1) Call the blockchain client to obtain the message monitoring type, and then cancel the message monitoring for the blockchain node; 2) Query the node unit connected to each blockchain network in the blockchain node, call the blockchain client to send an authentication request to it, if a blockchain network has multiple connected nodes, connect in sequence until the acceptance message is returned; if there is no node response, wait for a period of time and continue to connect, and send an alarm message to the blockchain network management client; 3) If the request is accepted, add the connection method of the external blockchain node to the connection address of the blockchain client; 4) Call the blockchain client to switch to connect to the external blockchain node; 5) The switching module sends the necessary monitoring message information configured in advance to the blockchain client, and the blockchain client sends a monitoring registration request to the external blockchain node to register the necessary monitoring message; 6) The switching module stops the blockchain node; When it is detected that the network bandwidth has been restored, the business module sends a switch-to-node instruction to the node unit, and the switch module performs the following operations: 1) Start the blockchain node; 2) Call the blockchain node to send a blockchain ledger synchronization request to other nodes to pull the blockchain ledger and replace the original ledger; 3) Call the blockchain client to send a cancel listening request to the external blockchain node; 4) The switch module switches the blockchain client to connect to the internal blockchain node; 5) Call the blockchain client to set the listening message type to the message type saved before the switch.

2. The layered blockchain network architecture according to claim 1, characterized in that: The hierarchical structure of the blockchain network includes blockchain network hierarchical structure data, blockchain deployment server information, blockchain network related installation package information and script information, and the installation package information includes the name and version of the smart contract, node unit and client.

3. The layered blockchain network architecture according to claim 1, characterized in that: The partner CA is used to distribute a digital identity certificate and a related private key for access control to each partner's node unit, so as to be used for access control of upper and lower node units.

4. The layered blockchain network architecture according to claim 1, characterized in that: The blockchain network CA is used to apply for group certificates and private keys for nodes in the blockchain network.

5. The layered blockchain network architecture according to claim 1, characterized in that: The network planning management unit is also used to set up an ad hoc blockchain network structure according to pre-set demand information.

6. The layered blockchain network architecture according to claim 5, characterized in that: The blockchain network management unit is also used to configure the Linji blockchain network structure or generate node units in the Linji blockchain network; The configuration or generation of node units in the temporary blockchain network includes: When a node unit already exists, add configuration to it; when it does not exist, generate a node unit and configure the Linji blockchain network so that each node unit is constructed into an operational Linji blockchain network; each blockchain network management unit corresponds to one or more Linji blockchain networks.

7. The layered blockchain network architecture according to claim 1, characterized in that: The blockchain software library management includes the code and installation package of blockchain nodes, smart contracts, and blockchain clients.

8. The layered blockchain network architecture according to claim 1, characterized in that: It also includes a business system, which accesses the node units in the corresponding blockchain network through an access client, including reading, writing, and monitoring the data of the current node and the lower-level node units for which the system has preset access rights.

9. The layered blockchain network architecture according to claim 1, characterized in that: If a partner in each blockchain network has multiple node units, one of the node units is set as the master node unit. The master node unit is used as the default node when the upper blockchain network reads, writes, and monitors the lower blockchain network. The complete block data is synchronized between the master node units of each party, and then synchronized separately to other node units within the partner. When the master node unit fails, other node units are replaced as new master node units.

10. The layered blockchain network architecture according to claim 9, characterized in that: The switching module is also used to receive an external switching message to switch the blockchain node to a client or to switch the client to a blockchain node.

11. The layered blockchain network architecture according to claim 1, characterized in that: The blockchain network management unit includes a blockchain management unit server and a blockchain management unit client. The blockchain network management unit server sends management instructions, scripts and installation packages to the blockchain management client, and the blockchain management client receives the instructions and performs specific management operations; The blockchain management client is deployed on a server where a blockchain network node has been installed or is to be installed.

12. A deployment method based on the layered blockchain network architecture of claim 11, characterized in that: include: The network planning management unit sends a blockchain network creation request to the blockchain management unit server according to the created blockchain network structure data; The blockchain management server applies to the blockchain software library for the required installation package according to the installation package information in the blockchain network structure data to be created contained in the blockchain network creation request, wherein the installation package information includes the smart contract, node and client name and version; The blockchain management unit server sends the installation package or its download link to the blockchain management unit client on the blockchain node to be deployed server; After receiving the installation package or its download link, the blockchain management unit client executes the installation script on its server to install and deploy the node unit; The blockchain management unit server sends a configuration instruction to the blockchain management unit client; After receiving the configuration instruction, the blockchain management unit client sends the identity information of the blockchain node therein to the partner CA for applying for a certificate and a private key for the blockchain client and the blockchain node; the identity information of the blockchain node includes node department information, node name, node ID and type; Initial configuration of blockchain nodes; After the initial configuration of all blockchain nodes is completed, a blockchain network configuration script is generated according to the blockchain network attributes in the blockchain network structure data, and then the configuration script and the installation package required for the configuration are sent to the blockchain management unit client where the master node is located, which executes the script to establish a blockchain network; The blockchain network attributes include: node unit deployment server and port information, blockchain network channel information, smart contract installation script, and the installation package required for the configuration includes: smart contract installation package or download address.

13. The deployment method according to claim 12, characterized in that: The initial configuration of the blockchain node includes: Put the blockchain client certificate and private key into the folder set by the blockchain client of the node unit; the blockchain client certificate is used to prove the identity when the blockchain client accesses the blockchain node; Put the blockchain node certificate and private key into the folder of the blockchain node setting of the node unit; Put the blockchain client certificate into the blockchain node's trusted client list for the blockchain network; Set the node partner CA and the CA that comes with the node authentication module as the trusted CA of the blockchain node.

14. The deployment method according to claim 13, characterized in that: When the blockchain network belongs to a hierarchical blockchain network structure, and the superior-subordinate access mechanism is an superior-subordinate access mechanism that performs access authentication based on the blockchain node ID or based on a pre-planned access relationship between node units, the blockchain client certificate is used to prove its identity when the blockchain node accesses a subordinate blockchain node, so that the subordinate node can determine whether it has access rights.

15. The deployment method according to claim 13, characterized in that: The establishment of the blockchain network includes: the blockchain management unit client configures the blockchain network according to the configuration script and the installation package required for configuration, and the configuration includes: establishing a blockchain network channel and installing a smart contract.

16. The deployment method according to claim 13, characterized in that: When the blockchain network belongs to a hierarchical blockchain network structure, and the upper and lower access mechanism is to perform access authentication based on the blockchain network ID or to perform access authentication based on the pre-planned access relationship between blockchain networks, the following steps are also included: The blockchain management server applies to the blockchain network CA for the blockchain network group certificate and the private key of each node based on the blockchain network structure information; The blockchain management server sends the access configuration information, the blockchain network group certificate, and the private key of each blockchain node to the blockchain management client corresponding to each blockchain node; the access configuration information is used to determine whether the upper-level blockchain node has access rights when the upper-level blockchain node accesses it; The blockchain management client saves the access configuration information and puts the blockchain network certificate and private key into the folder set by the blockchain client of the node unit for it to prove its identity when accessing the lower-level network nodes of the network.

17. The deployment method according to claim 16, characterized in that: The determining whether the upper-level node unit has access rights includes: When the accessed blockchain node receives the request information, it obtains the information of the blockchain network to which the upper-level blockchain node belongs from the blockchain network certificate carried in the request message, and determines whether the node of the blockchain network to which the upper-level blockchain node belongs can access the blockchain network node to which the current node unit belongs through the data of the access relationship between the networks. If so, it has access rights, otherwise, it does not have access rights.

Images