Access permission verification method and device, electronic equipment, storage medium and product

Abstract

The invention provides an access permission verification method and device, electronic equipment, a storage medium and a product, and the method comprises the steps: receiving an access permission verification request of a target object for a business system, the access permission verification request comprising an object identifier of the target object and a system identifier of the business system; and according to the object identifier, the system identifier and the access permission token of the target smart contract in the block chain, determining an access permission verification result of the target object to the service system, so that the access permission is stored and verified through the block chain, and the security is improved.

Description

Technical Field

[0001] The present disclosure relates to the field of blockchain technology, and in particular to methods, devices, electronic devices, storage media and products for verifying access rights. Background Art

[0002] At present, business systems usually need to manage access rights for users. In related technologies, the permissions of each user are usually stored in a database. Then, when a user accesses a business system, the database is queried to determine whether the user has access rights. However, in this method, the user's permission data is stored in the database, and the database is at a high risk of being attacked, which can easily lead to the loss or change of user permission data, reducing security. Summary of the invention

[0003] The present invention provides a method, device, electronic device, storage medium and product for verifying access rights to improve the accuracy and security of access rights verification.

[0004] In a first aspect, the present disclosure provides a method for verifying access rights, the method for verifying access rights comprising:

[0005] Receive a request from a target object to verify access rights to a business system, the request including an object identifier of the target object and a system identifier of the business system;

[0006] Determine a result of verifying the access rights of the target object to the business system based on the object identifier, the system identifier, and the access rights token of the target smart contract in the blockchain.

[0007] In a second aspect, the present disclosure provides a device for verifying access rights, the device for verifying access rights comprising:

[0008] A receiving module, configured to receive a request from a target object to verify access rights to a business system, wherein the request includes an object identifier of the target object and a system identifier of the business system;

[0009] A verification module is used to determine a verification result of the access rights of the target object to the business system based on the object identifier, the system identifier, and the access rights token of the target smart contract in the blockchain.

[0010] In a third aspect, the present disclosure provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores one or more computer programs executable by the at least one processor, and one or more of the computer programs are executed by the at least one processor so that the at least one processor can execute the above-mentioned access permission verification method.

[0011] In a fourth aspect, the present disclosure provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the above-mentioned access rights verification method when executed by a processor.

[0012] In a fifth aspect, the present disclosure provides a computer program product, including a computer-readable code, or a non-volatile computer-readable storage medium carrying a computer-readable code. When the computer-readable code runs in a processor of an electronic device, the processor in the electronic device executes the above-mentioned access right verification method.

[0013] The access permission verification method provided by the embodiment of the present disclosure, when receiving a target object's access permission verification request for a business system, obtains the access permission verification result by calling the target smart contract in the blockchain. In this way, the access permission is saved in the blockchain through the smart contract in the blockchain, which improves security and reliability. Furthermore, when performing access permission verification, a query is performed through the smart contract, which improves security and accuracy and reduces the risk of access permission being attacked or changed.

[0014] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The accompanying drawings are used to provide a further understanding of the present disclosure and constitute a part of the specification. Together with the embodiments of the present disclosure, they are used to explain the present disclosure and do not constitute a limitation of the present disclosure. The above and other features and advantages will become more apparent to those skilled in the art by describing detailed example embodiments with reference to the accompanying drawings, in which:

[0016] Figure 1 An application scenario diagram provided for an embodiment of the present disclosure;

[0017] Figure 2 A schematic diagram of the system architecture of a method for verifying access rights in an embodiment of the present disclosure;

[0018] Figure 3 A flowchart of a method for verifying access rights provided by an embodiment of the present disclosure;

[0019] Figure 4 A flowchart of another access rights verification method provided by an embodiment of the present disclosure;

[0020] Figure 5 A block diagram of a device for verifying access rights provided by an embodiment of the present disclosure;

[0021] Figure 6 A block diagram of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0022] In order to enable those skilled in the art to better understand the technical solutions of the present disclosure, the exemplary embodiments of the present disclosure are described below in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, those of ordinary skill in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0023] In the absence of conflict, the various embodiments of the present disclosure and the various features therein may be combined with each other.

[0024] As used herein, the term "and / or" includes any and all combinations of one or more of the associated listed items.

[0025] The terms used herein are only used to describe specific embodiments and are not intended to limit the present disclosure. As used herein, the singular forms "a" and "the" are also intended to include plural forms, unless the context clearly indicates otherwise. It will also be understood that when the terms "including" and / or "made of" are used in this specification, the presence of the features, wholes, steps, operations, elements and / or components is specified, but the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or groups thereof is not excluded. "Connected" or "connected" and similar words are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect.

[0026] Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by those of ordinary skill in the art. It will also be understood that terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with their meaning in the context of the relevant art and the present disclosure, and will not be interpreted as having an idealized or overly formal meaning unless explicitly defined as such herein.

[0027] In the technical solution disclosed in this disclosure, the collection, storage, use, processing, transmission, provision and disclosure of user personal information involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals. The use of user data in this technical solution complies with relevant national laws and regulations (for example, the "Information Security Technology Personal Information Security Specification", etc.). For example: corresponding prescribed measures are taken for personal information access control; prescribed restrictions are imposed on the display of personal information; the purpose of using personal information does not exceed the scope of direct or reasonable association; when using personal information, clear identity orientation is eliminated to avoid precise positioning of specific individuals.

[0028] To facilitate understanding of the embodiments of the present disclosure, several concepts are briefly introduced below:

[0029] Blockchain: Blockchain is a decentralized distributed ledger that is tamper-proof, secure and reliable. It combines distributed storage, peer-to-peer transmission, consensus mechanism, cryptography, smart contracts and other technologies. It records transactions and information through a growing data block chain, which can ensure the security and transparency of data.

[0030] Smart Contract: A smart contract is a computing code that automatically executes a contract and runs on a blockchain. It usually contains the rules and logic of the contract and is executed through nodes on the blockchain network to ensure that the execution of the contract is transparent and cannot be tampered with.

[0031] Non-Fungible Token (NFT): NFT is a digital asset based on blockchain technology. NFT can also be understood as a unique token that is unique and irreplaceable. For example, in the embodiment of the present disclosure, the user's access rights can be NFTized, and NFTs can be assigned to users who have access rights to a certain business system. If it is queried that the user has the NFT, it means that the user has access rights to the business system.

[0032] Externally Owned Account (EOA) address: It is an account type on the blockchain (such as Ethereum), which is directly calculated and transformed from the public key. The EOA address is an account type owned by the user and is not controlled by the smart contract.

[0033] JSON Web Token (JWT): JWT is an open standard based on JSON for delivering declarations between network application environments. It defines a concise, self-contained method for securely transmitting information between communicating parties in the form of JSON objects. JWT is usually secure and reliable because it uses digital signatures.

[0034] To ensure security and other requirements, business systems can manage access rights for users. In related technologies, the permissions of each user are usually stored in a database. When a user accesses a business system, the database is queried to determine whether the user has access rights. However, in this method, the user's permission data is stored in the database, and the database is at a high risk of being attacked, which can easily lead to the loss or change of user permission data, reducing security.

[0035] Therefore, a method for verifying access rights is provided in an embodiment of the present disclosure. When a target object requests verification of access rights for a business system, the result of the access rights verification is obtained by calling the target smart contract in the blockchain. In this way, the access rights are saved in the blockchain through the smart contract in the blockchain, which improves security and reliability. Furthermore, when performing access rights verification, queries are performed through the smart contract, which improves security and accuracy and reduces the risk of access rights being attacked or changed.

[0036] Figure 1 The application scenario diagram of the access rights verification method and device provided by the embodiment of the present disclosure is schematically shown.

[0037] like Figure 1 As shown, the application scenario of the embodiment of the present disclosure may include a terminal device 101, a network 103 and a server 102. The network 103 is used to provide a medium for a communication link between the terminal device 101 and the server 102. The network 103 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0038] The user can use the terminal device 101 to interact with the server 102 through the network 103 to receive or send messages, etc. Various communication client applications can be installed on the terminal device 101, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples).

[0039] The terminal device 101 may be any electronic device having a display screen and supporting web browsing, including but not limited to a smart phone, a tablet computer, a laptop computer, a desktop computer, and the like.

[0040] The server 102 may be a server that provides various services, such as a background management server (only as an example) that provides support for websites browsed by users using the terminal device 101. The background management server may analyze and process received data such as user requests, and feed back processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0041] It should be noted that the access permission verification method and apparatus provided in the embodiments of the present disclosure may be executed by the server 102. Accordingly, the access permission verification method and apparatus provided in the embodiments of the present disclosure may be set in the server 102. The access permission verification method and apparatus provided in the embodiments of the present disclosure may also be executed by a server or server cluster that is different from the server 102 and can communicate with the terminal device 101 and / or the server 102. Accordingly, the access permission verification method and apparatus provided in the embodiments of the present disclosure may also be set in a server or server cluster that is different from the server 102 and can communicate with the terminal device 101 and / or the server 102.

[0042] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0043] It should be noted that in the embodiments of the present disclosure, a smart contract is created in the blockchain mainly based on the blockchain technology. The smart contract is used to store the user's access permission token, and a corresponding system architecture is provided. Figure 2 FIG. 1 is a schematic diagram of a system architecture of a method for verifying access rights in an embodiment of the present disclosure. Figure 2 As shown, the architecture may include terminal devices, single sign-on (SSO) systems, business systems, rights management systems, and blockchains.

[0044] 1)Terminal equipment.

[0045] The user may request to access the business system through the terminal device. For example, the user may click on the page information of the business system through the terminal device to request to access the page information. Then the terminal device sends a business access request to the business system.

[0046] 2)SSO system.

[0047] The SSO system is a solution for the integration of multiple business systems. In multiple business systems, users only need to log in once to access all mutually trusted business systems. Users do not need to log in multiple times for verification, which can improve efficiency. For example, different business systems such as A reading, A movie, A forum, etc. can be integrated together for identity management, and all business systems share an identity authentication system. In this way, when a user visits a business system for the first time, if he has not logged in yet, he can log in to the SSO system. The SSO system performs identity authentication based on the login information entered by the user. After the identity authentication is passed, the SSO system will assign an identity authentication token to the user. When the user visits other business systems again, he does not need to enter the login information again. He can carry the identity authentication token for access, and then he only needs to verify the identity authentication token. If the verification is passed, he can access other business systems without logging in again.

[0048] In the disclosed embodiment, a user logs in to the SSO system through a terminal device. After successful login, the SSO system generates a JWT for the user as an identity authentication token. The JWT may include information such as user ID and user name. The user can then access the business system based on the JWT and send a business access request to the business system. The business access request includes at least the user's JWT.

[0049] 3)Business system.

[0050] In the disclosed embodiment, there is no restriction on the business system and it can be applicable to various application scenarios. After receiving the business access request, the business system can send an access permission verification request to the permission management system based on the user's JWT and the system identifier of the business system to request the permission management system to verify the user's access permission.

[0051] 4) Rights management system.

[0052] In the disclosed embodiment, the permission management system is mainly used to call the smart contract in the blockchain to complete the authorization and access permission verification of the user. The permission management system can interact with the business system and the blockchain respectively. For example, the permission management system receives the access permission verification request of the business system, and obtains the access permission verification result by querying the access permission token stored in the blockchain, and returns the access permission verification result to the business system, wherein the access permission token includes NFT.

[0053] In an embodiment of the present disclosure, the rights management system supports automatic generation of blockchain account addresses for new users, and specifically provides a possible implementation method. When it is determined that the target object is a new user of the business system, the blockchain account address of the target object is generated, and a first mapping relationship between the object identifier and the blockchain account address is stored through a first smart contract.

[0054] Furthermore, in the embodiment of the present disclosure, the rights management system may also support the deployment of a corresponding second smart contract for the new business system, and through the second smart contract, a second mapping relationship between the storage system identifier and the NFT contract address.

[0055] Among them, the third smart contract includes various NFT-related processing methods and defines information such as NFT specifications. For example, the third smart contract stores NFT query methods, NFT generation methods, NFT destruction methods, etc., and sets NFT as non-transferable in the third smart contract to avoid the transfer of access rights between users, which can further improve security.

[0056] 5) Blockchain.

[0057] In the disclosed embodiment, mainly based on the smart contract technology in the blockchain, three different smart contracts are provided, including a first smart contract, a second smart contract and a third smart contract, wherein the first smart contract is used to store a first mapping relationship between an object identifier and a blockchain account address, the second smart contract is used to store a second mapping relationship between a system identifier and an NFT contract address, and the third smart contract is used to standardize and define various NFT methods, and the transfer method of the third smart contract is set to be non-transferable to improve security and avoid transfer between access rights of different users. In the disclosed embodiment, the change record of user access rights can also be stored based on the blockchain log of the blockchain. Since the blockchain log has the characteristic of being tamper-proof, the risk of tampering with the change record of access rights can be reduced, thereby improving security.

[0058] Among them, the implementation methods of the SSO system, business system, and authority management system can be implemented based on different servers, which is not limited in the embodiments of the present disclosure.

[0059] In this way, in the disclosed embodiment, the user's access rights are stored in a decentralized blockchain, thereby improving security, and the blockchain log of the blockchain itself can be used to record changes in the user's access rights, eliminating the need for separate development and design, thereby improving efficiency. Furthermore, the rights management system can verify the user's access rights by calling different smart contracts in the blockchain, thereby also improving security and efficiency.

[0060] Based on the above embodiments, the following takes the permission management system as an example to illustrate the method for verifying access rights in the embodiments of the present disclosure. Figure 3 As shown, Figure 3 A flowchart of a method for verifying access rights provided by an embodiment of the present disclosure, the method comprising:

[0061] S301: Receive a request from a target object to verify access rights to a business system. The request includes an object identifier of the target object and a system identifier of the business system.

[0062] In an embodiment of the present disclosure, when the target object, i.e., the user, accesses the business system through a terminal device, a business access request is sent to the business system. After receiving the business access request, the business system can send an access permission verification request to the permission management system to first verify whether the target object has access permission. In a possible embodiment of the present disclosure, for a single sign-on scenario, the access permission verification request includes an identity authentication token for an object identifier. Before executing the following step S302, it also includes: determining that the identity authentication token is valid, and extracting the object identifier from the identity authentication token, wherein the identity authentication token is generated after the identity authentication of the target object is passed.

[0063] Among them, the identity authentication token is, for example, JWT, which may include an information header, a payload and a signature. The information header usually includes the JWT token type and the signature algorithm. The payload is used to store the main valid information and may include the object name, object identifier, etc. In the embodiment of the present disclosure, the object identifier can be stored in the payload part. The signature can be obtained by signing the encoded information header and payload based on the signature algorithm and key indicated in the information header.

[0064] For example, the target object enters the username and password in the SSO system to log in. After the SSO system verifies the username and password, the user logs in successfully. At this time, the SSO system can generate a JWT for the target object, and then the target object accesses the business system based on the JWT, and sends a business access request containing the JWT to the business system. The business system then sends an access permission verification request to the permission management system based on the target object's JWT and its own system identification. After receiving the access permission verification request, the permission management system determines the validity of the JWT in the access permission verification request, where the validity verification of the JWT can include verification of the validity period of the JWT, verification of the correctness of the signature, etc., and the object identification of the target object can be extracted from the payload of the JWT.

[0065] S302: Determine the access permission verification result of the target object to the business system according to the object identifier, the system identifier, and the access permission token of the target smart contract in the blockchain.

[0066] In the disclosed embodiment, an access permission token can be pre-allocated to a user who has access rights to a business system, and stored in a blockchain through a target smart contract. Thus, if the access permission token is queried through the blockchain, it means that the user has access rights, and if the access permission token is not queried, it means that the user does not have access rights.

[0067] For example, if the access permission check result is that the target object has access permission, the business system can control the target object to access and return relevant business content to the target object. For another example, if the access permission check result is that the target object does not have access permission, the business system can control the target object to access and return a prompt message indicating that the target object does not have access permission to the target object.

[0068] In the disclosed embodiment, an access permission token can be assigned to an object with access permission, and the access permission token can be stored in the blockchain through a target smart contract, thereby improving security and reducing the risk of loss or change of access permission. When an access permission verification request is received, the result of the access permission verification of the target object to the business system can be determined based on the object identifier of the target object and the system identifier of the business system in the access permission verification request, as well as the access permission token of the target smart contract in the blockchain, thereby improving security and reliability.

[0069] Based on the above embodiment, the above step S302 is specifically described below. In the embodiment of the present disclosure, three different blockchain smart contracts are included, that is, the above target smart contract includes a first smart contract, a second smart contract and a third smart contract, and the access permission token includes an NFT. For the above step S302, the present disclosure provides possible implementation methods, including:

[0070] 1) Based on the first mapping relationship stored in the first smart contract, the blockchain account address of the target object is obtained, where the first mapping relationship represents a mapping relationship between the object identifier and the blockchain account address.

[0071] Among them, the blockchain account address is, for example, an EOA address.

[0072] 2) Based on the second mapping relationship stored in the second smart contract, the NFT contract address of the business system is obtained. The second mapping relationship represents the mapping relationship between the system identifier and the NFT contract address.

[0073] 3) Through the query method of the NFT contract address stored in the third smart contract, query whether there is an NFT in the blockchain account address and obtain the NFT query result.

[0074] For example, the query method is the balanceof method, which is used to return the number of NFTs owned by a specific address. If the calling method is: NFT contract address.balanceof(blockchain account address), the number of NFTs for the business system owned by the blockchain account address can be obtained.

[0075] 4) Based on the query results of NFT, determine the access permission verification results of the target object to the business system.

[0076] In this step, the present disclosure provides a possible implementation method, which determines the result of the access permission verification of the target object to the business system based on the query result of the NFT, including: when the query result indicates that there is an NFT at the blockchain account address, determining that the target object has access permission to the business system; when the query result indicates that there is no NFT at the blockchain account address, determining that the target object does not have access permission to the business system.

[0077] In this way, in the disclosed embodiment, access rights are represented by NFT, which improves security and processing efficiency, and stores the NFT of the target object through the smart contract in the blockchain, reducing risks.

[0078] Furthermore, in the embodiment of the present disclosure, a corresponding possible implementation method is also provided for allocating or canceling access rights to the target object. The third smart contract also includes an NFT generation method and an NFT destruction method, specifically including:

[0079] 1) Receive the NFT generation request of the target object, and generate the NFT of the target object through the NFT generation method of the NFT contract address in the third smart contract.

[0080] For example, the generation method is the mint method. Through the mint method of the NFT contract address, an NFT can be generated for the target object, and then the generated NFT can be stored in the EOA address of the target object.

[0081] Furthermore, in the embodiments of the present disclosure, the access rights of the business system can be divided into a more fine-grained manner. For example, access rights can be managed separately for each business module of the business system. In this way, corresponding NFTs can be generated for the access rights of the target object to different business modules of the business system, and stored through smart contracts, thereby achieving more fine-grained access control.

[0082] 2) Receive the NFT destruction request of the target object, and destroy the NFT of the target object through the NFT destruction method of the NFT contract address in the third smart contract.

[0083] For example, the destruction method is the burn method. Through the burn method of the NFT contract address, the NFT that the target object has for the business system can be destroyed.

[0084] In addition, in the embodiment of the present disclosure, in order to reduce memory usage, when the target object's account is cancelled, it is also possible to traverse the NFT contract addresses of all NFTs held by the target object's blockchain account address to obtain the NFT contract addresses, and call the burn method to destroy the NFTs owned by the target object for all business systems.

[0085] In this way, in the embodiment of the present disclosure, through the smart contract technology in the blockchain, access permission tokens can be generated or destroyed for the target object, which is flexible and convenient, improves the management efficiency of access permissions, and is implemented through the blockchain to improve security.

[0086] The following uses a specific application scenario to illustrate, taking the target object having access rights to the business system as an example. Figure 4 As shown, Figure 4 A flowchart of another access rights verification method provided by an embodiment of the present disclosure, the method comprising:

[0087] S401: The terminal device sends a service access request of a target object to the service system.

[0088] The service access request at least includes the object identifier of the target object.

[0089] S402: The business system determines whether the target object has logged in.

[0090] S403: If it is determined that the target object is not logged in, redirect the target object to the SSO system for login.

[0091] S404: The SSO system authenticates the identity of the target object. After the identity authentication is passed, the login is successful, and an identity authentication token is generated for the target object.

[0092] For example, the target object enters the user name and password on the login page, and the SSO system can authenticate the user name and password. After the authentication is passed, an authentication token is generated. For example, the authentication token is JWT, which includes information such as the object identifier.

[0093] S405: The SSO system returns the identity authentication token of the target object to the terminal device.

[0094] S406: The terminal device sends a service access request including an identity authentication token to the service system.

[0095] S407: The business system sends an access rights verification request to the rights management system.

[0096] The access permission verification request includes at least the identity authentication token of the target object and the system identifier of the business system.

[0097] S408: After determining that the identity authentication token is valid, the rights management system extracts the object identifier of the target object from the identity authentication token.

[0098] S409: The rights management system calls the first smart contract and the second smart contract in the blockchain according to the object identifier and the system identifier.

[0099] S410: The rights management system obtains the blockchain account address of the target object and the NFT contract address of the business system from the blockchain.

[0100] S411: The rights management system queries whether there is an NFT in the blockchain account address through the query method of the NFT contract address stored in the third smart contract in the blockchain.

[0101] S412: The rights management system obtains the query results of NFT.

[0102] S413: When the rights management system determines that the query result indicates the existence of the NFT, it determines that the target object has access rights to the business system.

[0103] S414: The rights management system returns to the business system that the target object has access rights.

[0104] S415: The business system returns the business content to the terminal device.

[0105] For example, after receiving the message with access permission, the business system can return the business content requested by the target object, and then the target object can access the business system through the terminal device.

[0106] Furthermore, if the rights management system determines that the target object does not have access rights, the business system may return a prompt message of not having access rights to the terminal device after receiving the message of not having access rights, so as to prompt the target object.

[0107] In the disclosed embodiment, access permission tokens are stored in the blockchain, and whether the target object has access permission can be verified based on whether the NFT exists in the blockchain account address of the target object. The NFT is stored on the blockchain, which reduces the possibility of loss or malicious change of access permission, making it more secure and reliable. Changes in the target object's access permission will also trigger blockchain events, which can be recorded in the blockchain log. The blockchain log has the characteristic of being tamper-proof, which improves security.

[0108] It can be understood that the above-mentioned various method embodiments mentioned in the present disclosure can be combined with each other to form a combined embodiment without violating the principle logic. Due to space limitations, the present disclosure will not repeat them. It can be understood by those skilled in the art that in the above-mentioned method of the specific implementation method, the specific execution order of each step should be determined according to its function and possible internal logic.

[0109] In addition, the present disclosure also provides an access rights verification device, an electronic device, and a computer-readable storage medium, all of which can be used to implement any access rights verification method provided by the present disclosure. The corresponding technical solutions and descriptions are referred to in the corresponding records of the method part and will not be repeated here.

[0110] Figure 5 A block diagram of a device for verifying access rights provided by an embodiment of the present disclosure.

[0111] Reference Figure 5 The present disclosure provides a device for verifying access rights, and the device for verifying access rights includes:

[0112] A receiving module 51, configured to receive a request from a target object to verify access rights to a business system, wherein the request includes an object identifier of the target object and a system identifier of the business system;

[0113] The verification module 52 is used to determine the access permission verification result of the target object to the business system according to the object identifier, the system identifier and the access permission token of the target smart contract in the blockchain.

[0114] In a possible embodiment, the access permission token includes a non-fungible token NFT, the target smart contract includes a first smart contract, a second smart contract, and a third smart contract, and when determining the access permission verification result of the target object to the business system according to the object identifier, the system identifier, and the access permission token of the target smart contract in the blockchain, the verification module 52 is used to:

[0115] Based on a first mapping relationship stored in the first smart contract, obtaining a blockchain account address of the target object, wherein the first mapping relationship represents a mapping relationship between the object identifier and the blockchain account address;

[0116] Based on the second mapping relationship stored in the second smart contract, the NFT contract address of the business system is obtained, where the second mapping relationship represents the mapping relationship between the system identifier and the NFT contract address;

[0117] Through the query method of the NFT contract address stored in the third smart contract, query whether the blockchain account address has the NFT, and obtain the query result of the NFT;

[0118] According to the query result of the NFT, the access permission verification result of the target object to the business system is determined.

[0119] In a possible embodiment, when determining the access permission verification result of the target object to the business system according to the query result of the NFT, the verification module 52 is used to:

[0120] When the query result indicates that the NFT exists at the blockchain account address, it is determined that the target object has access rights to the business system.

[0121] In a possible embodiment, when determining the access permission verification result of the target object to the business system according to the query result of the NFT, the verification module 52 is used to:

[0122] When the query result indicates that the NFT does not exist at the blockchain account address, it is determined that the target object does not have access rights to the business system.

[0123] In a possible embodiment, an identity authentication module 53 is further included, the access permission verification request includes an identity authentication token of the object identifier, and before determining the access permission verification result of the target object to the business system, the identity authentication module 53 is used to:

[0124] It is determined that the identity authentication token is valid, and the object identifier is extracted from the identity authentication token, wherein the identity authentication token is generated after the identity authentication of the target object is passed.

[0125] In a possible embodiment, a processing module 54 is further included, and the third smart contract also includes an NFT generation method and an NFT destruction method. The processing module 54 is used to:

[0126] Receiving the NFT generation request of the target object, generating the NFT of the target object through the NFT generation method of the NFT contract address in the third smart contract;

[0127] Upon receiving the NFT destruction request of the target object, the NFT of the target object is destroyed through the NFT destruction method of the NFT contract address in the third smart contract.

[0128] Each module in the above-mentioned access rights verification device can be implemented in whole or in part by software, hardware or a combination thereof. Each of the above-mentioned modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each of the above modules.

[0129] Figure 6 A block diagram of an electronic device provided in an embodiment of the present disclosure.

[0130] Reference Figure 6An embodiment of the present disclosure provides an electronic device, which includes: at least one processor 601; at least one memory 602, and one or more I / O interfaces 603, connected between the processor 601 and the memory 602; wherein the memory 602 stores one or more computer programs that can be executed by the at least one processor 601, and the one or more computer programs are executed by the at least one processor 601 so that the at least one processor 601 can execute the above-mentioned access right verification method.

[0131] Each module in the above electronic device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0132] The present disclosure also provides a computer-readable storage medium on which a computer program is stored, wherein the computer program implements the above-mentioned access right verification method when executed by a processor. The computer-readable storage medium may be a volatile or non-volatile computer-readable storage medium.

[0133] The embodiments of the present disclosure also provide a computer program product, including a computer-readable code, or a non-volatile computer-readable storage medium carrying the computer-readable code. When the computer-readable code runs in a processor of an electronic device, the processor in the electronic device executes the above-mentioned access rights verification method.

[0134] It will be appreciated by those skilled in the art that all or some of the steps, systems, and functional modules / units in the methods disclosed above may be implemented as software, firmware, hardware, and appropriate combinations thereof. In a hardware implementation, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or may be implemented as hardware, or may be implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable storage medium, which may include a computer storage medium (or a non-transitory medium) and a communication medium (or a temporary medium).

[0135] As is known to those of ordinary skill in the art, the term computer storage media includes volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable program instructions, data structures, program modules or other data). Computer storage media include, but are not limited to, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), static random access memory (SRAM), flash memory or other memory technology, portable compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and can be accessed by a computer. In addition, it is known to those of ordinary skill in the art that communication media typically contain computer-readable program instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transmission mechanism, and may include any information delivery medium.

[0136] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0137] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be customized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0138] The computer program product described herein may be implemented in hardware, software, or a combination thereof. In one optional embodiment, the computer program product is embodied as a computer storage medium, and in another optional embodiment, the computer program product is embodied as a software product, such as a software development kit (SDK), etc.

[0139] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0140] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processor of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0141] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0142] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of the module, program segment or instruction includes one or more executable instructions for realizing the specified logical function. In some alternative implementations, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or action, or can be implemented with a combination of special hardware and computer instructions.

[0143] Example embodiments have been disclosed herein, and although specific terms are employed, they are used and should be interpreted only in a general illustrative sense and not for limiting purposes. In some instances, it will be apparent to those skilled in the art that, unless otherwise expressly noted, features, characteristics, and / or elements described in conjunction with a particular embodiment may be used alone or in combination with features, characteristics, and / or elements described in conjunction with other embodiments. Therefore, those skilled in the art will appreciate that various changes in form and detail may be made without departing from the scope of the present disclosure as set forth in the appended claims.

Claims

1. A method for verifying access rights, characterized in that: include: Receive a request from a target object to verify access rights to a business system, the request including an object identifier of the target object and a system identifier of the business system; Determine a result of verifying the access rights of the target object to the business system based on the object identifier, the system identifier, and the access rights token of the target smart contract in the blockchain.

2. The method according to claim 1, characterized in that: The access permission token includes a non-fungible token NFT, the target smart contract includes a first smart contract, a second smart contract, and a third smart contract, and determining the access permission verification result of the target object to the business system according to the object identifier, the system identifier, and the access permission token of the target smart contract in the blockchain, includes: Based on a first mapping relationship stored in the first smart contract, obtaining a blockchain account address of the target object, wherein the first mapping relationship represents a mapping relationship between the object identifier and the blockchain account address; Based on the second mapping relationship stored in the second smart contract, the NFT contract address of the business system is obtained, where the second mapping relationship represents the mapping relationship between the system identifier and the NFT contract address; Through the query method of the NFT contract address stored in the third smart contract, query whether the blockchain account address has the NFT, and obtain the query result of the NFT; According to the query result of the NFT, the access permission verification result of the target object to the business system is determined.

3. The method according to claim 2, characterized in that Determining the result of verifying the access rights of the target object to the business system according to the query result of the NFT includes: When the query result indicates that the NFT exists at the blockchain account address, it is determined that the target object has access rights to the business system.

4. The method according to claim 2, characterized in that: Determining the result of verifying the access rights of the target object to the business system according to the query result of the NFT includes: When the query result indicates that the NFT does not exist at the blockchain account address, it is determined that the target object does not have access rights to the business system.

5. The method according to any one of claims 1 to 4, characterized in that: The access permission verification request includes an identity authentication token of the object identifier. Before determining a result of the access permission verification of the target object to the business system, the method further includes: It is determined that the identity authentication token is valid, and the object identifier is extracted from the identity authentication token, wherein the identity authentication token is generated after the identity authentication of the target object is passed.

6. The method according to any one of claims 2 to 4, characterized in that: The third smart contract includes an NFT generation method and an NFT destruction method, and the method further includes: Receiving the NFT generation request of the target object, generating the NFT of the target object through the NFT generation method of the NFT contract address in the third smart contract; Upon receiving the NFT destruction request of the target object, the NFT of the target object is destroyed through the NFT destruction method of the NFT contract address in the third smart contract.

7. A device for verifying access rights, characterized in that: include: A receiving module, configured to receive a request from a target object to verify access rights to a business system, wherein the request includes an object identifier of the target object and a system identifier of the business system; A verification module is used to determine a verification result of the access rights of the target object to the business system based on the object identifier, the system identifier, and the access rights token of the target smart contract in the blockchain.

8. An electronic device, characterized in that: include: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores one or more computer programs executable by the at least one processor, and the one or more computer programs are executed by the at least one processor so that the at least one processor can execute the access authority verification method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the computer program implements the access authority verification method according to any one of claims 1 to 6.

10. A computer program product, characterized in that The invention comprises a computer-readable code or a non-volatile computer-readable storage medium carrying the computer-readable code. When the computer-readable code runs in a processor of an electronic device, the processor in the electronic device executes the access authority verification method as described in any one of claims 1 to 6.

Images