Service authority management method, device, node device, system and storage medium

Abstract

The present invention relates to the technical field of authority management, and provides a service authority management method, device, node device, system and storage medium. A node device in a blockchain network is deployed with a master control smart contract, and the node device receives a service authority application sent by a target business platform to obtain basic information and an associated service identifier; when the associated service identifier is found in a service list, the node device obtains application information based on the basic information of the target business platform and saves it to the application list; the application information is reviewed according to the application review instruction sent by the operation and maintenance personnel, and when the review is passed, a root token is generated and sent to the target business platform; a service access application sent by the target business platform based on the root token is received and verified, and when the verification is passed, a target service end is determined and an access token acquisition request is sent to it, and the access token returned by the target service end and its service information are sent to the target business platform, so that the target business platform has access rights to the target service end.

Description

Technical Field

[0001] The present invention relates to the technical field of rights management, and in particular to a service rights management method, apparatus, node equipment, system and storage medium. Background Art

[0002] In the microservices model, different functional modules of an application can be independently deployed to form distinct services. Each service focuses on completing a specific function, and these services are independent of each other and can use different programming languages ​​and data storage. Existing system architectures generally use a central device to allocate and control permissions for various services. This centralized approach to permission management, however, creates a single point of failure and can easily lead to system anomalies. Summary of the Invention

[0003] In view of this, an object of the present invention is to provide a service authority management method, apparatus, node device, system and storage medium.

[0004] In order to achieve the above object, the technical solution adopted by the present invention is as follows:

[0005] In a first aspect, the present invention provides a service rights management method, which is applied to any node device in a blockchain network, wherein the node device is communicatively connected to multiple service terminals and multiple business platforms, and the node device is deployed with a master smart contract, wherein the master smart contract includes a service list and an application list, and the service rights management method includes:

[0006] Receiving a service permission application sent by a target business platform, and obtaining basic information of the target business platform, the basic information including an associated service identifier; wherein the target business platform is any business platform;

[0007] When the associated service identifier of the target service platform is found in all the service information in the service list, obtaining the application information of the target service platform according to the basic information of the target service platform and saving it to the application list;

[0008] According to the application review instruction of the target business platform sent by the operation and maintenance personnel, the application information of the target business platform is reviewed, and if the application information of the target business platform passes the review, the root token of the target business platform is generated and sent to the target business platform;

[0009] receiving a service access application sent by the target business platform based on its root token, and verifying the service access application; if the service access application passes the verification, determining a target server corresponding to the associated service identifier of the target business platform;

[0010] An access token acquisition request is sent to the target server, and an access token is received from the target server. The service information and access token of the target server are sent to the target business platform, so that the target business platform has access rights to the target server.

[0011] In an optional implementation manner, any service information in the service list is obtained in the following manner:

[0012] Receive the service registration instruction sent by the operation and maintenance personnel, obtain the digital signature in the service registration instruction and the service name, IP address, access port and service public key of the server to be registered;

[0013] Verifying the digital signature of the service registration instruction to authenticate the operation and maintenance personnel;

[0014] If the digital signature in the service registration instruction passes verification, a hash operation is performed based on the IP address, access port, and service public key of the server to be registered to obtain the service identifier of the server to be registered;

[0015] The service name, IP address, access port, service public key and service identifier of the server to be registered are used as the service information of the server to be registered and saved in the service list.

[0016] In an optional implementation manner, the basic information further includes the platform name, platform domain name and platform public key;

[0017] The step of obtaining the application information of the target business platform based on the basic information of the target business platform and saving it to the application list includes:

[0018] Perform a hash operation based on the platform name, platform domain name, platform public key, and associated service identifier of the target business platform to obtain the application identifier of the target business platform;

[0019] The platform name, platform domain name, platform public key, associated service identifier and application identifier of the target service platform are used as the application information of the target service platform;

[0020] The application information of the target business platform is saved in the application list, and the application information of the target business platform is marked as pending review.

[0021] In an optional embodiment, the step of reviewing the application information of the target business platform according to the application review instruction of the target business platform sent by the operation and maintenance personnel, and generating a root token of the target business platform and sending it to the target business platform if the application information of the target business platform passes the review, includes:

[0022] Receive the application review instruction for the target business platform sent by the operation and maintenance personnel, and obtain the review opinion, application identification and digital signature in the application review instruction;

[0023] If the review opinion in the application review instruction is disagreement, determine that the application information of the target business platform has not passed the review, and mark the application information of the target business platform as a review failure status;

[0024] If the review opinion in the application review instruction is approval, verify the application identifier in the application review instruction according to the application list, and verify the digital signature in the application review instruction according to the platform public key of the target business platform;

[0025] If the application identifier and / or digital signature in the application review instruction fails to pass the verification, the application information of the target service platform is determined to have failed the review, and the application information of the target service platform is marked as failed review;

[0026] If the application identifier and digital signature in the application review instruction are both verified, the application information of the target service platform is determined to have passed the review, and the application information of the target service platform is marked as reviewed and passed;

[0027] When the application information of the target business platform passes the review, an encryption operation is performed based on the platform public key and application identifier of the target business platform to obtain the root token of the target business platform and send it to the target business platform.

[0028] In an optional implementation manner, the step of receiving a service access application sent by the target service platform based on its root token and verifying the service access application includes:

[0029] Receiving a service access application sent by the target service platform based on its root token, and obtaining an application identifier, a digital signature, and a root token in the service access application;

[0030] Verifying the application identifier in the service access application according to the application list, verifying the digital signature in the service access application according to the platform public key of the target service platform, and verifying the root token in the service access application according to the platform public key and application identifier of the target service platform;

[0031] If any one of the application identifier, the root token and the digital signature in the service access application fails to pass the verification, determining that the service access application fails to pass the verification;

[0032] If the application identifier, the root token and the digital signature in the service access application are all verified, it is determined that the service access application has passed the verification.

[0033] In an optional implementation manner, the service authority management method further includes:

[0034] Receive a service permission disabling instruction from an operation and maintenance personnel, and obtain a digital signature and application identifier in the service permission disabling instruction;

[0035] Authenticating the operation and maintenance personnel by verifying the digital signature in the service permission disabling instruction;

[0036] If the digital signature in the service permission disabling instruction passes verification, obtaining, from all application information in the application list, pending application information including the application identifier in the service permission disabling instruction;

[0037] By deleting the pending application information from the application list, the service access permission of the business platform to which the pending application information belongs is disabled.

[0038] In a second aspect, the present invention provides a service rights management device, which is applied to any node device in a blockchain network, wherein the node device is communicatively connected to multiple service terminals and multiple business platforms, and the node device is deployed with a master control smart contract, wherein the master control smart contract includes a service list and an application list, and the service rights management device includes:

[0039] An application information receiving module is configured to receive a service permission application from a target business platform and obtain basic information of the target business platform, the basic information including an associated service identifier; wherein the target business platform is any business platform;

[0040] When the associated service identifier of the target service platform is found in all the service information in the service list, obtaining the application information of the target service platform according to the basic information of the target service platform and saving it to the application list;

[0041] An application information review module is used to review the application information of the target business platform according to the application review instruction of the target business platform sent by the operation and maintenance personnel, and if the application information of the target business platform passes the review, generate a root token of the target business platform and send it to the target business platform;

[0042] an access rights management module, configured to receive a service access application sent by the target business platform based on its root token, verify the service access application, and determine a target server corresponding to the associated service identifier of the target business platform if the service access application passes the verification;

[0043] An access token acquisition request is sent to the target server, and an access token is received from the target server. The service information and access token of the target server are sent to the target business platform, so that the target business platform has access rights to the target server.

[0044] In a third aspect, the present invention provides a node device, which is arranged in a blockchain network, and the node device includes a processor and a memory, and the memory stores a computer program. When the processor executes the computer program, it implements the service authority management method described in any one of the aforementioned embodiments.

[0045] In a fourth aspect, the present invention provides a system comprising a server, a service platform, and the node device described in the aforementioned embodiment.

[0046] In a fifth aspect, the present invention provides a storage medium having a computer program stored thereon. When the computer program is executed by a processor, the service authority management method described in any one of the aforementioned embodiments is implemented.

[0047] The present invention provides a service authority management method, device, node device, system and storage medium. The node device in the blockchain network is deployed with a master smart contract. The node device receives the service authority application sent by the target business platform to obtain basic information and the associated service identifier therein; when the associated service identifier is found in the service list, the application information is obtained according to the basic information of the target business platform and saved to the application list; the application information of the target business platform is reviewed according to the application review instruction sent by the operation and maintenance personnel, and when the review is passed, a root token is generated and sent to the target business platform; the service access application sent by the target business platform based on its root token is received and verified, and when the verification is passed, the target service end is determined and an access token acquisition request is sent to it, and the access token returned by the target service end and its service information are sent to the target business platform, so that the target business platform has access rights to the target server end. By managing service permissions through a decentralized blockchain network architecture, single points of failure are avoided, the security and reliability of service permissions are guaranteed, and the stability of the system is improved.

[0048] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. It should be understood that the following drawings only illustrate certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without paying any creative work.

[0050] Figure 1 A schematic diagram of a system provided by an embodiment of the present invention is shown;

[0051] Figure 2 A block diagram of a node device provided by an embodiment of the present invention is shown;

[0052] Figure 3 A schematic diagram showing a flow chart of a service authority management method provided by an embodiment of the present invention;

[0053] Figure 4 A functional module diagram of a service authority management device provided by an embodiment of the present invention is shown.

[0054] Icon: 110 - bus; 120 - processor; 130 - memory; 150 - I / O module; 170 - communication module; 300 - service authority management device; 310 - service information generation module; 330 - application information receiving module; 350 - application information review module; 370 - access authority management module. DETAILED DESCRIPTION

[0055] The following will be combined with the accompanying drawings to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings herein can be arranged and designed in various different configurations.

[0056] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention as claimed, but is merely intended to represent selected embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative work are within the scope of protection of the present invention.

[0057] It should be noted that relational terms such as "first" and "second" are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus comprising the element.

[0058] See also Figure 1 , is a schematic diagram of the system provided by an embodiment of the present invention. The system includes a server, a business platform, and node devices in a blockchain network, wherein Figure 1 The number of server terminals, service platforms, and node devices shown is merely an example and does not limit the present invention and can be set according to actual conditions.

[0059] A server refers to a device that provides specific functionality within a microservices model. A business platform refers to a device that accesses services to execute business processes. A node device is a computer or device that participates in data recording, transmission, and verification within a blockchain network. Each node device maintains a complete copy of the blockchain and communicates and coordinates with other nodes through encryption algorithms and consensus mechanisms to jointly maintain the security and consistency of the entire blockchain network. Node devices can range from personal devices to servers to large data centers.

[0060] Blockchain is a decentralized, distributed database technology that records transactions, events, and data while ensuring that these records are immutable and transparent. The core concept of blockchain is to ensure the security and reliability of transactions and data through the use of cryptography and distributed consensus algorithms, without relying on centralized institutions or third-party intermediaries. The basic component of a blockchain is a "block," each of which contains transactions or data, as well as metadata such as a timestamp and the hash of the previous block. These blocks are linked together to form a continuously growing chain, hence the name "blockchain."

[0061] In cryptography, a key refers to secret information used in cryptographic applications such as encryption, decryption, and integrity verification. In symmetric cryptography, the same key is used for both encryption and decryption. In asymmetric cryptography, keys are divided into public and private keys; the public key can be made public, while the private key must be kept secret.

[0062] It can be understood that the present invention manages service permissions through a decentralized system architecture such as blockchain to ensure the security and reliability of service permissions, avoid single point failures, improve system stability, and ensure normal operation of the system.

[0063] See also Figure 2 , is a block diagram of a node device provided by an embodiment of the present invention. The node device includes a bus 110, a processor 120, a memory 130, an I / O module 150, and a communication module 170.

[0064] The bus 110 may be a circuit that connects the above-mentioned elements to each other and transfers communications between the elements.

[0065] The processor 120 can receive instructions from the other components mentioned above (such as the memory 130, the I / O module 150, the communication module 170, etc.) via the bus 110, can interpret the received instructions, and can perform calculations or data processing based on the interpreted instructions. The processor 120 can be an integrated circuit chip with signal processing capabilities. The processor 120 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0066] The memory 130 can store instructions or data received from the processor 120 or other components (e.g., the I / O module 150, the communication module 170, etc.), or instructions or data generated by the processor 120 or other components. The memory 130 can be, but is not limited to, a random access memory (RAM), a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), or an electrically erasable programmable read-only memory (EEPROM).

[0067] The I / O module 150 can receive instructions or data input from the user via input-output means (such as sensors, keyboards, touch screens, etc.), and can transmit the received instructions or data to the processor 120 or memory 130 via the bus 110. It is also used to display various information received, stored, and processed by the above components, and can display videos, images, data, etc. to the user.

[0068] The communication module 170 may be used to communicate signals or data with other devices.

[0069] It is understandable that Figure 2 The structure shown is only a schematic diagram of the node device structure. The node device may also include Figure 2 More or fewer components than shown, or with Figure 2 Different configurations shown. Figure 2 Each component shown in the figure can be implemented by hardware, software or a combination thereof.

[0070] It should be noted that node devices are deployed with a master smart contract. Due to the information-sharing nature of blockchain, if any node device in the blockchain network deploys the master smart contract, all node devices in the blockchain network will also deploy the master smart contract simultaneously. Node devices implement the service rights management method provided by the embodiments of the present invention by running the master smart contract.

[0071] The above-mentioned node device will be used as the execution subject to execute each step of each method provided in the embodiment of the present invention and achieve the corresponding technical effects.

[0072] See also Figure 3 , Figure 3 This is a flow chart of a service authority management method provided by an embodiment of the present invention.

[0073] Step S210: receiving a service permission application sent by a target business platform, and obtaining basic information of the target business platform, including an associated service identifier; wherein the target business platform is any business platform;

[0074] Step S212: When the associated service identifier of the target service platform is found in all the service information in the service list, the application information of the target service platform is obtained according to the basic information of the target service platform and saved in the application list;

[0075] It is understandable that each service platform applies for service access rights from the node device in a similar manner. For the sake of simplicity, the embodiment of the present invention uses any service platform as a target service platform for illustration.

[0076] In this embodiment, a master smart contract is deployed on the node device, and the master smart contract contains a service list and an application list. The service list can be understood as a data storage structure for storing service information, for example, serv[d] can be used to represent the service list. The application list can be understood as a data storage structure for storing application information, for example, sys[n] can be used to represent the application list.

[0077] The target business platform can send a service permission application to the node device to trigger the permission application function to apply for access rights to a certain service; the node device receives the service permission application sent by the target business platform and obtains the basic information of the target business platform from the service permission application. The basic information includes the associated service identifier. The associated service identifier of the target business platform can be understood as the identifier of the service applied for by the target business platform.

[0078] The node device then searches the entire service information in the service list for the target service platform's associated service identifier. If the target service platform's associated service identifier is not found, it indicates that the service requested by the target service platform does not exist, and an application failure message is returned to the target service platform. If the target service platform's associated service identifier is found, it indicates that the service requested by the target service platform exists, and based on the target service platform's basic information, the node device obtains the target service platform's application information and saves it to the application list.

[0079] Step S214: Review the target business platform's application information according to the target business platform's application review instruction sent by the operation and maintenance personnel. If the target business platform's application information passes the review, generate a root token for the target business platform and send it to the target business platform.

[0080] Step S216: receiving a service access request sent by the target business platform based on its root token, and verifying the service access request. If the service access request passes the verification, determining the target server corresponding to the associated service identifier of the target business platform;

[0081] In this embodiment, to ensure the security of service permissions and to ensure that the business platform applying for the service matches the functionality provided by the service, an audit is required after obtaining the application information from the business platform. Specifically, the operator of the master smart contract can generate an application audit instruction for the target business platform by performing an audit on the application information of the target business platform.

[0082] The node device receives the application review instruction from the operation and maintenance personnel for the target business platform and reviews the target business platform's application information. If the target business platform's application information fails the review, an application failure message is returned to the target business platform. If the target business platform's application information passes the review, a root token for the target business platform is generated and sent to the target business platform.

[0083] The target business platform obtains the root token, which means that the target business platform has the basic identity of the service it applies for. Then the target business platform can send a service access request to the node device based on its root token to trigger the service access request function to apply for the access token of the service.

[0084] The node device receives the service access request sent by the target service platform and verifies the service access request. If the service access request fails verification, it returns an application failure message to the target service platform. If the service access request passes verification, it determines the corresponding target server based on the associated service identifier of the target service platform.

[0085] Step S218: Send an access token acquisition request to the target server, receive the access token returned by the target server, and send the target server's service information and access token to the target business platform, so that the target business platform has access rights to the target server.

[0086] In this embodiment, after determining the target server, the node device sends an access token acquisition request to the target server; the target server receives the access token acquisition request, generates an access token and its validity period according to customized rules, and returns it to the node device. The access token can be understood as a temporary token used to access the target server.

[0087] The node device receives the access token and its validity period returned by the target server, encrypts the target server's service information, the access token, and its validity period, and sends it to the target business platform, granting the target business platform access to the target server. This means that the target business platform can access the target server and use its functions within the validity period based on the target server's service information and access token.

[0088] This embodiment of the present invention deploys a master smart contract on node devices within a blockchain network and uses it to manage the business platform's access rights to services. This decentralized blockchain network architecture manages service permissions, avoiding single points of failure, ensuring the security and reliability of service permissions, and improving system stability.

[0089] It can be seen that based on the above steps, the node devices in the blockchain network are deployed with a master smart contract. The node devices receive the service permission application sent by the target business platform to obtain basic information and the associated service identifier; when the associated service identifier is found in the service list, the application information is obtained based on the basic information of the target business platform and saved to the application list; the application information of the target business platform is reviewed according to the application review instructions sent by the operation and maintenance personnel, and when it passes the review, a root token is generated and sent to the target business platform; the service access application sent by the target business platform based on its root token is received and verified, and when it passes the verification, the target server is determined and an access token acquisition request is sent to it, and the access token returned by the target server and its service information are sent to the target business platform, so that the target business platform has access rights to the target server. By managing service permissions through a decentralized blockchain network architecture, single points of failure are avoided, the security and reliability of service permissions are guaranteed, and the stability of the system is improved.

[0090] Optionally, for the service information in the above service list, an embodiment of the present invention provides an implementation method for obtaining the service information.

[0091] Step S202: Receive a service registration instruction sent by the operation and maintenance personnel, obtain the digital signature in the service registration instruction and the service name, IP address, access port, and service public key of the server to be registered;

[0092] Step S204: verifying the digital signature in the service registration instruction to authenticate the operation and maintenance personnel;

[0093] Step S206: If the digital signature in the service registration instruction passes verification, a hash operation is performed based on the IP address, access port, and service public key of the server to be registered to obtain the service identifier of the server to be registered;

[0094] Step S208: The service name, IP address, access port, service public key and service identifier of the server to be registered are taken as service information of the server to be registered and saved in the service list.

[0095] In this embodiment, the operation and maintenance personnel can trigger the service registration function to generate a service registration instruction by performing a service registration operation. The node device receives the service registration instruction sent by the operation and maintenance personnel and obtains the digital signature in the service registration instruction and the service name, IP address, access port, and service public key of the server to be registered. The digital signature in the service registration instruction is generated based on the private key of the account entered by the operation and maintenance personnel.

[0096] The node device verifies the digital signature in the service registration instruction using the public keys of multiple accounts pre-stored in the master smart contract to authenticate the operator. If the digital signature in the service registration instruction fails to pass verification, it means that the authentication has failed, and a service registration failure message will be returned.

[0097] If the digital signature in the service registration instruction passes the verification, it means that the identity authentication is successful. Then, a hash operation is performed based on the IP address, access port and service public key of the server to be registered to obtain the service identifier of the server to be registered. Then, the service name, IP address, access port, service public key and service identifier of the server to be registered are used as the service information of the server to be registered and saved in the service list.

[0098] Optionally, for the process of obtaining the application information of the target service platform according to the basic information of the target service platform and saving it to the application list in step S212, an embodiment of the present invention provides a possible implementation method.

[0099] Step S212-1, performing a hash operation based on the platform name, platform domain name, platform public key, and associated service identifier of the target business platform to obtain the application identifier of the target business platform;

[0100] Step S212-3: The platform name, platform domain name, platform public key, associated service identifier, and application identifier of the target business platform are used as the application information of the target business platform;

[0101] Step S212 - 5 : Save the application information of the target business platform to the application list, and mark the application information of the target business platform as pending review.

[0102] It is understandable that the basic information of the business platform includes the platform name, platform domain name, platform public key and associated service identifier of the business platform.

[0103] In this embodiment, after obtaining the associated service identifier of the target service platform, the node device can determine whether the service requested by the target service platform exists by searching the service list for the associated service identifier of the target service platform. If the associated service of the target service platform is not found in the service list, it means that the service requested by the target service platform does not exist, and the node device returns an application failure message to the target service platform.

[0104] If the associated service identifier of the target business platform is found in the service list, it means that the service applied for by the target business platform exists. Then, a hash operation is performed based on the platform name, platform domain name, platform public key and associated service identifier of the target business platform to obtain the application identifier of the target business platform. Then, the platform name, platform domain name, platform public key, associated service identifier and application identifier of the target business platform are used as the application information of the target business platform, and the application information of the target business platform is saved to the application list, and the application information of the target business platform is marked as pending review.

[0105] Optionally, for step S214, an embodiment of the present invention provides a possible implementation method.

[0106] Step S214-1: Receive the application review instruction of the target business platform sent by the operation and maintenance personnel, and obtain the review opinion, application identifier and digital signature in the application review instruction;

[0107] Step S214-3: If the review opinion in the application review instruction is "disagree," the application information of the target business platform is determined to have failed the review, and the application information of the target business platform is marked as "failed review";

[0108] Step S214-5: If the review opinion in the application review instruction is approval, verify the application identifier in the application review instruction according to the application list, and verify the digital signature in the application review instruction according to the platform public key of the target business platform;

[0109] Step S214-7A: If the application identifier and / or digital signature in the application review instruction fails to pass verification, the application information of the target service platform is determined to have failed the review, and the application information of the target service platform is marked as failed review;

[0110] Step S214-7B: If the application identifier and digital signature in the application review instruction are both verified, the application information of the target business platform is determined to have passed the review, and the application information of the target business platform is marked as reviewed and passed;

[0111] Step S214-9: If the application information of the target business platform passes the review, an encryption operation is performed based on the platform public key and application identifier of the target business platform to obtain the root token of the target business platform and send it to the target business platform.

[0112] In this embodiment, the operation and maintenance personnel can trigger the application review function to generate an application review instruction for the target business platform by performing an audit operation on the application information of the target business platform. The node device receives the application review instruction sent by the operation and maintenance personnel and obtains the review opinion, application identifier, and digital signature in the application review instruction. The digital signature in the application review instruction is generated based on the platform private key entered by the operation and maintenance personnel.

[0113] The node device verifies the review opinion in the application review instruction. If the review opinion in the application review instruction is "disagree" (e.g., "False"), the target service platform's application information is determined to have failed the review and is marked as "failed." If the review opinion in the application review instruction is "agree" (e.g., "True"), the application identifier and digital signature in the application review instruction are verified separately.

[0114] The node device can verify the application by searching the application list to see if the application identifier in the application review instruction exists. If the application identifier in the application review instruction is not found in the application list, the application identifier in the application review instruction is determined to have failed verification. If the application identifier in the application review instruction is found in the application list, the application identifier in the application review instruction is determined to have passed verification.

[0115] The node device can verify the digital signature in the application review instruction based on the platform public key of the target service platform. If the digital signature in the application review instruction fails verification, it means that the digital signature in the application review instruction was not generated based on the platform private key of the target service platform, that is, the identity verification failed. If the digital signature in the application review instruction passes verification, it means that the digital signature in the application review instruction was generated based on the platform private key of the target service platform, that is, the identity verification succeeded.

[0116] When the review opinion in the application review instruction is approval, if the application identifier and / or digital signature in the application review instruction fails to pass the verification, then the application information of the target business platform is determined to have failed the review, and the application information of the target business platform is marked as a failed review status; if the application identifier and digital signature in the application review instruction are both verified, then the application information of the target business platform is determined to have passed the review, and the application information of the target business platform is marked as a passed review status.

[0117] If the application information of the target business platform passes the review, encryption operation is performed based on the platform public key and application identifier of the target business platform to obtain the root token of the target business platform and send it to the target business platform so that the target business platform has the basic identity of the service it applied for.

[0118] Optionally, for the process of receiving the service access application sent by the target service platform based on its root token and verifying the service access application in step S216, an embodiment of the present invention provides a possible implementation method.

[0119] Step S216-1: Receive a service access application sent by the target service platform based on its root token, and obtain the application identifier, digital signature, and root token in the service access application;

[0120] Step S216-3: Verify the application identifier in the service access application according to the application list, verify the digital signature in the service access application according to the platform public key of the target service platform, and verify the root token in the service access application according to the platform public key and application identifier of the target service platform;

[0121] Step S216-5: if any one of the application identifier, root token, and digital signature in the service access application fails to pass verification, it is determined that the service access application fails to pass verification;

[0122] Step S216 - 7 : If the application identifier, root token, and digital signature in the service access application are all verified, it is determined that the service access application has passed the verification.

[0123] In this embodiment, the node device receives a service access application sent by the target business platform based on its root token, obtains the application identifier, digital signature and root token in the service access application, the digital signature in the service access application is generated based on the platform private key entered by the administrator of the target business platform, and then verifies the application identifier, digital signature and root token in the service access application respectively.

[0124] The node device can verify the service access application by searching the application list to see if the application identifier in the service access application exists. If the application identifier in the service access application is not found in the application list, the application identifier in the service access application is determined to have failed verification. If the application identifier in the service access application is found in the application list and the application information to which the application identifier belongs is in the approved status, the application identifier in the service access application is determined to have passed verification.

[0125] The node device can verify the digital signature in the service access request based on the target service platform's platform public key. If the digital signature in the service access request fails verification, it means that the digital signature in the service access request was not generated based on the target service platform's platform private key, indicating that the identity verification has failed. If the digital signature in the service access request passes verification, it means that the digital signature in the service access request was generated based on the target service platform's platform private key, indicating that the identity verification has succeeded.

[0126] The node device can verify the root token obtained by encrypting the target service platform's platform public key and the application identifier with the root token in the service access application. If the two are inconsistent, the root token in the service access application is considered to have failed verification. If the two are consistent, the root token in the service access application is considered to have passed verification.

[0127] If any one of the application identifier, root token and digital signature in the service access application fails to pass verification, the service access application is judged to have failed verification; if the application identifier, root token and digital signature in the service access application all pass verification, the service access application is judged to have passed verification.

[0128] Optionally, the operation and maintenance personnel may also cancel the access permission of any business platform to a certain service, and thus the embodiment of the present invention provides a possible implementation method.

[0129] Step S220: Receive the service permission disabling instruction sent by the operation and maintenance personnel, and obtain the digital signature and application identifier in the service permission disabling instruction;

[0130] Step S222: verifying the digital signature in the service permission disabling instruction to authenticate the operation and maintenance personnel;

[0131] Step S224: if the digital signature in the service permission disabling instruction passes verification, obtain the pending application information containing the application identifier in the service permission disabling instruction from all the application information in the application list;

[0132] Step S226 , deleting the pending application information from the application list to disable the service access permission of the business platform to which the pending application information belongs.

[0133] In this embodiment, the operation and maintenance personnel can trigger the service permission disabling function to generate a service permission disabling instruction by executing a service permission cancel operation. The node device receives the service permission disabling instruction sent by the operation and maintenance personnel and obtains the digital signature and application identifier in the service permission disabling instruction.

[0134] The node device verifies the digital signature in the service permission disable instruction using the public keys of multiple accounts pre-stored in the master smart contract to authenticate the operation and maintenance personnel. If the digital signature in the service permission disable instruction fails to pass the verification, it means that the authentication has failed, and a permission disable failure message will be returned.

[0135] If the digital signature in the service permission disabling instruction passes the verification, it means that the identity authentication is successful. Then, the pending application information containing the application identifier is obtained from all the application information in the application list, and the service access permission of the business platform to which the pending application information belongs is disabled by deleting the pending application information from the application list, that is, the access permission of the business platform to the server corresponding to the associated service identifier in the pending application information is cancelled.

[0136] It can be understood that the embodiment of the present invention deletes the application information of the business platform from the application list, so that there is no application information of the business platform for a certain service in the application list. Then, when the business platform initiates a service access application for the service, since the application list does not have the application information of the business platform for the service, the service access application cannot be verified, and then the access token for the service will not be issued to the business platform, thereby canceling the business platform's access rights to the service.

[0137] In order to execute the corresponding steps in the above embodiments and various possible methods, a method for implementing a service authority management device is given below. Figure 4 , Figure 4 This is a functional module diagram of the service authority management device 300 provided in an embodiment of the present invention. It should be noted that the basic principles and technical effects of the service authority management device 300 provided in this embodiment are the same as those of the above embodiments. For the sake of simplicity, any matters not mentioned in this embodiment can be referred to the corresponding contents in the above embodiments. The service authority management device 300 includes:

[0138] The application information receiving module 330 is used to receive the service permission application sent by the target business platform and obtain the basic information of the target business platform, including the associated service identifier; wherein the target business platform is any business platform;

[0139] When the associated service identifier of the target business platform is found in all the service information in the service list, the application information of the target business platform is obtained according to the basic information of the target business platform and saved in the application list;

[0140] The application information review module 350 is used to review the application information of the target business platform according to the application review instruction of the target business platform sent by the operation and maintenance personnel, and if the application information of the target business platform passes the review, generate a root token of the target business platform and send it to the target business platform;

[0141] The access rights management module 370 is configured to receive a service access request from a target business platform based on its root token, verify the service access request, and determine the target server corresponding to the associated service identifier of the target business platform if the service access request passes the verification.

[0142] Send an access token acquisition request to the target server and receive the access token returned by the target server. Then, send the service information and access token of the target server to the target business platform so that the target business platform has access rights to the target server.

[0143] Optionally, the service authority management device 300 also includes a service information generation module 310, which is used to: receive a service registration instruction sent by the operation and maintenance personnel, obtain the digital signature in the service registration instruction and the service name, IP address, access port and service public key of the server to be registered; verify the digital signature in the service registration instruction to authenticate the operation and maintenance personnel; if the digital signature in the service registration instruction passes the verification, perform a hash operation based on the IP address, access port and service public key of the server to be registered to obtain the service identification of the server to be registered; use the service name, IP address, access port, service public key and service identification of the server to be registered as the service information of the server to be registered and save it to the service list.

[0144] Optionally, the application information receiving module 330 is also used to: perform a hash operation based on the platform name, platform domain name, platform public key and associated service identifier of the target business platform to obtain the application identifier of the target business platform; use the platform name, platform domain name, platform public key, associated service identifier and application identifier of the target business platform as the application information of the target business platform; save the application information of the target business platform to the application list, and mark the application information of the target business platform as pending review status.

[0145] Optionally, the application information review module 350 is further used to: receive an application review instruction of the target business platform sent by the operation and maintenance personnel, obtain the review opinion, application identifier and digital signature in the application review instruction; if the review opinion in the application review instruction is disagreement, determine that the application information of the target business platform has not passed the review, and mark the application information of the target business platform as a failed review status; if the review opinion in the application review instruction is approval, verify the application identifier in the application review instruction according to the application list, and verify the digital signature in the application review instruction according to the platform public key of the target business platform; if the application identifier and / or digital signature in the application review instruction fail to pass the verification, determine that the application information of the target business platform has failed the review, and mark the application information of the target business platform as a failed review status; if the application identifier and digital signature in the application review instruction both pass the verification, determine that the application information of the target business platform has passed the review, and mark the application information of the target business platform as a passed review status; if the application information of the target business platform has passed the review, perform encryption operation based on the platform public key and application identifier of the target business platform to obtain the root token of the target business platform and send it to the target business platform.

[0146] Optionally, the access permission management module 370 is also used to: receive a service access application sent by the target business platform based on its root token, and obtain the application identifier, digital signature and root token in the service access application; verify the application identifier in the service access application according to the application list, and verify the digital signature in the service access application according to the platform public key of the target business platform, and verify the root token in the service access application according to the platform public key and application identifier of the target business platform; if any one of the application identifier, root token and digital signature in the service access application fails to pass the verification, it is determined that the service access application has failed the verification; if the application identifier, root token and digital signature in the service access application all pass the verification, it is determined that the service access application has passed the verification.

[0147] Optionally, the access permission management module 370 is also used to: receive a service permission disabling instruction sent by the operation and maintenance personnel, obtain the digital signature and application identifier in the service permission disabling instruction; authenticate the operation and maintenance personnel by verifying the digital signature in the service permission disabling instruction; when the digital signature in the service permission disabling instruction passes the verification, obtain the pending application information containing the application identifier in the service permission disabling instruction from all the application information in the application list; and disable the service access rights of the business platform to which the pending application information belongs by deleting the pending application information in the application list.

[0148] An embodiment of the present invention also provides a node device, which is arranged in a blockchain network and includes a processor and a memory. The memory stores a computer program. When the processor executes the computer program, the service authority management method disclosed in the embodiment of the present invention is implemented.

[0149] An embodiment of the present invention further provides a system, which includes a server, a service platform, and a node device provided by an embodiment of the present invention.

[0150] An embodiment of the present invention further provides a storage medium on which a computer program is stored. When the computer program is executed by a processor, the service authority management method disclosed in the embodiment of the present invention is implemented.

[0151] In the several embodiments provided by the present invention, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architectures, functions, and operations of the devices, methods, and computer program products according to multiple embodiments of the present invention. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or part of the code, which contains one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions marked in the boxes can also occur in an order different from that marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, as well as the combination of boxes in the block diagram and / or flowchart, can be implemented using a dedicated hardware-based system that performs the specified functions or actions, or can be implemented using a combination of dedicated hardware and computer instructions.

[0152] In addition, the functional modules in the various embodiments of the present invention may be integrated together to form an independent part, or each module may exist independently, or two or more modules may be integrated to form an independent part.

[0153] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0154] The foregoing description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Those skilled in the art will readily appreciate that various modifications and variations of the present invention are possible. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention are intended to be within the scope of protection of the present invention.

Claims

1. A service authority management method, characterized in that: Applied to any node device in a blockchain network, the node device is in communication with multiple service terminals and multiple business platforms, the node device is deployed with a master control smart contract, the master control smart contract contains a service list and an application list, and the service authority management method includes: Receiving a service permission application sent by a target business platform, and obtaining basic information of the target business platform, the basic information including an associated service identifier; wherein the target business platform is any business platform; When the associated service identifier of the target service platform is found in all the service information in the service list, obtaining the application information of the target service platform according to the basic information of the target service platform and saving it to the application list; According to the application review instruction of the target business platform sent by the operation and maintenance personnel, the application information of the target business platform is reviewed, and if the application information of the target business platform passes the review, the root token of the target business platform is generated and sent to the target business platform; receiving a service access application sent by the target business platform based on its root token, and verifying the service access application; if the service access application passes the verification, determining a target server corresponding to the associated service identifier of the target business platform; An access token acquisition request is sent to the target server, and an access token is received from the target server. The service information and access token of the target server are sent to the target business platform, so that the target business platform has access rights to the target server.

2. The service authority management method according to claim 1, characterized in that: Any service information in the service list is obtained in the following manner: Receive the service registration instruction sent by the operation and maintenance personnel, obtain the digital signature in the service registration instruction and the service name, IP address, access port and service public key of the server to be registered; Verifying the digital signature of the service registration instruction to authenticate the operation and maintenance personnel; If the digital signature in the service registration instruction passes verification, a hash operation is performed based on the IP address, access port, and service public key of the server to be registered to obtain the service identifier of the server to be registered; The service name, IP address, access port, service public key and service identifier of the server to be registered are used as the service information of the server to be registered and saved in the service list.

3. The service authority management method according to claim 1, characterized in that: The basic information also includes the platform name, platform domain name and platform public key; The step of obtaining the application information of the target business platform based on the basic information of the target business platform and saving it to the application list includes: Perform a hash operation based on the platform name, platform domain name, platform public key, and associated service identifier of the target business platform to obtain the application identifier of the target business platform; The platform name, platform domain name, platform public key, associated service identifier and application identifier of the target service platform are used as the application information of the target service platform; The application information of the target business platform is saved in the application list, and the application information of the target business platform is marked as pending review.

4. The service authority management method according to claim 3, characterized in that: The step of reviewing the application information of the target business platform according to the application review instruction of the target business platform sent by the operation and maintenance personnel, and generating a root token of the target business platform and sending it to the target business platform if the application information of the target business platform passes the review, includes: Receive the application review instruction of the target business platform sent by the operation and maintenance personnel, and obtain the review opinion, application identification and digital signature in the application review instruction; If the review opinion in the application review instruction is disagreement, determine that the application information of the target business platform has not passed the review, and mark the application information of the target business platform as a review failure status; If the review opinion in the application review instruction is approval, verify the application identifier in the application review instruction according to the application list, and verify the digital signature in the application review instruction according to the platform public key of the target business platform; If the application identifier and / or digital signature in the application review instruction fails to pass the verification, the application information of the target service platform is determined to have failed the review, and the application information of the target service platform is marked as failed review; If the application identifier and digital signature in the application review instruction are both verified, the application information of the target service platform is determined to have passed the review, and the application information of the target service platform is marked as reviewed and passed; When the application information of the target business platform passes the review, an encryption operation is performed based on the platform public key and application identifier of the target business platform to obtain the root token of the target business platform and send it to the target business platform.

5. The service authority management method according to claim 3, characterized in that: The step of receiving the service access application sent by the target business platform based on its root token and verifying the service access application includes: Receiving a service access application sent by the target service platform based on its root token, and obtaining an application identifier, a digital signature, and a root token in the service access application; Verifying the application identifier in the service access application according to the application list, verifying the digital signature in the service access application according to the platform public key of the target service platform, and verifying the root token in the service access application according to the platform public key and application identifier of the target service platform; If any one of the application identifier, the root token, and the digital signature in the service access application fails to pass the verification, determining that the service access application fails to pass the verification; If the application identifier, the root token and the digital signature in the service access application are all verified, it is determined that the service access application is verified.

6. The service authority management method according to claim 3, characterized in that: The service authority management method further includes: Receive a service permission disabling instruction from an operation and maintenance personnel, and obtain a digital signature and application identifier in the service permission disabling instruction; Authenticating the operation and maintenance personnel by verifying the digital signature in the service permission disabling instruction; If the digital signature in the service permission disabling instruction passes verification, obtaining, from all application information in the application list, pending application information including the application identifier in the service permission disabling instruction; By deleting the pending application information from the application list, the service access permission of the business platform to which the pending application information belongs is disabled.

7. A service authority management device, characterized in that: Applied to any node device in a blockchain network, the node device is in communication with multiple service terminals and multiple business platforms, the node device is deployed with a master control smart contract, the master control smart contract contains a service list and an application list, and the service authority management device includes: An application information receiving module is configured to receive a service permission application from a target business platform and obtain basic information of the target business platform, the basic information including an associated service identifier; wherein the target business platform is any business platform; When the associated service identifier of the target service platform is found in all the service information in the service list, obtaining the application information of the target service platform according to the basic information of the target service platform and saving it to the application list; An application information review module is used to review the application information of the target business platform according to the application review instruction of the target business platform sent by the operation and maintenance personnel, and if the application information of the target business platform passes the review, generate a root token of the target business platform and send it to the target business platform; an access rights management module, configured to receive a service access application sent by the target business platform based on its root token, verify the service access application, and determine a target server corresponding to the associated service identifier of the target business platform if the service access application passes the verification; An access token acquisition request is sent to the target server, and an access token is received from the target server. The service information and access token of the target server are sent to the target business platform, so that the target business platform has access rights to the target server.

8. A node device, characterized in that: The node device is set in a blockchain network, and the node device includes a processor and a memory. The memory stores a computer program, and when the processor executes the computer program, the service authority management method according to any one of claims 1 to 6 is implemented.

9. A system, characterized in that: The system includes a server, a service platform and the node device according to claim 8.

10. A storage medium, characterized in that: The storage medium stores a computer program, which, when executed by a processor, implements the service authority management method according to any one of claims 1 to 6.

Images