Consensus node selection method and device, API management system and storage medium

Abstract

The embodiment of the invention provides a consensus node selection method, a consensus node selection device, an API management system, electronic equipment, a chip, a storage medium and a computer program product, and the method comprises the steps: selecting block chain nodes participating in a consensus algorithm in a block sub-chain according to the weight value of each block chain node in the block sub-chain; the weight value represents the security status of the corresponding block chain node; wherein different block sub-chains are responsible for different API services, the block chain nodes in the same block sub-chain are deployed in service systems of upstream and downstream enterprises participating in the same API service, and the same API service is the API service responsible for the block sub-chain.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of large model technology, and specifically to a consensus node selection method, a consensus node selection device, an API management system, an electronic device, a chip, a storage medium, and a computer program product. Background Art

[0002] With the vigorous development of cloud native and software open source technologies, more and more development platforms and third-party services are emerging rapidly, the complexity of application systems and functional units is constantly increasing, and application development is deeply dependent on the mutual calls between application programming interfaces (APIs). As an important channel for connecting services and transmitting data, API has transformed from a simple interface to an important part of the information technology (IT) architecture, becoming a new infrastructure in the digital age and an important and special digital asset in the digital age. With this, there is a consideration of API security issues. The current practice is to introduce blockchain as a service (BaaS) solutions in the field of industrial application security management. Through blockchain technology and consensus algorithms, API open information is shared between different participating entities. However, all nodes are connected to the blockchain network and share ledgers and data through consensus algorithms. Nodes are prone to failure and data leakage, which cannot meet the requirements of secure data isolation and security control. Summary of the invention

[0003] Embodiments of the present application provide a consensus node selection method, a consensus node selection device, an API management system, an electronic device, a chip, a storage medium, and a computer program product.

[0004] The consensus node selection method provided in the embodiment of the present application includes:

[0005] According to the weight value of each blockchain node in the block sub-chain, the blockchain node participating in the consensus algorithm in the block sub-chain is selected; the weight value represents the security status of the corresponding blockchain node; wherein different block sub-chains are responsible for different API services, and the blockchain nodes in the same block sub-chain are deployed in the business systems of upstream and downstream enterprises participating in the same API service, and the same API service is the API service that the block sub-chain is responsible for.

[0006] The API management system provided in the embodiment of the present application includes:

[0007] Industrial application safety management systems and blockchain systems;

[0008] The blockchain system includes multiple blockchain subchains; different blockchain subchains are responsible for different API services, and blockchain nodes in the same subchain are deployed in the business systems of upstream and downstream enterprises participating in the same business;

[0009] The industrial application security management system is used to connect to and collect API data of the business system, and call the blockchain system to store the API data; when a first API business request from the business system is received, the block sub-chain corresponding to the first API business is called, so that the block sub-chain corresponding to the first API business adopts the consensus node selection method provided in the embodiment of the present application to select a consensus node, and executes block generation and data sharing operations through a consensus algorithm.

[0010] The consensus node selection device provided in the embodiment of the present application includes:

[0011] Selection unit: used to select the blockchain nodes participating in the consensus algorithm in the block subchain according to the weight values ​​of each blockchain node in the block subchain; the weight values ​​represent the security status of the corresponding blockchain nodes; wherein,

[0012] Different blockchain sub-chains are responsible for different API services. The blockchain nodes in the same blockchain sub-chain are deployed in the business systems of upstream and downstream enterprises participating in the same API service. The same API service is the API service that the blockchain sub-chain is responsible for.

[0013] The electronic device provided in an embodiment of the present application includes: a processor and a memory, the memory is used to store a computer program, and the processor is used to call and run the computer program stored in the memory to execute any consensus node selection method provided in the embodiment of the present application.

[0014] The chip provided in the embodiment of the present application includes: a processor, which is used to call and run a computer program from a memory, so that a device equipped with the chip executes any consensus node selection method provided in the embodiment of the present application.

[0015] The storage medium provided in the embodiments of the present application is used to store a computer program, and the computer program enables a computer to execute any consensus node selection method provided in the embodiments of the present application.

[0016] The computer program product provided in the embodiments of the present application includes a computer program, which, when executed by a processor, implements any consensus node selection method provided in the embodiments of the present application.

[0017] Through the consensus node selection method provided in the embodiment of the present application, different block sub-chains carry different services, so that API services are isolated from each other, high concurrency requirements are supported, and when selecting consensus nodes, the security status of blockchain nodes is considered to avoid single points of failure and ensure data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0019] Figure 1 Schematic diagram of the implementation process of the consensus node selection method provided in the embodiment of the present application Figure 1 ;

[0020] Figure 2 A functional structure diagram of a large-model federated fine-tuning system provided for an embodiment of the present application;

[0021] Figure 3 A schematic diagram of the software architecture of the API management system provided in the embodiment of the present application;

[0022] Figure 4 A schematic diagram of the network architecture of the industrial application security management system provided in the embodiment of the present application;

[0023] Figure 5 A schematic diagram of the network topology of the blockchain system provided in the embodiment of the present application;

[0024] Figure 6 A schematic diagram of the software architecture of the blockchain subchain provided in the embodiment of the present application;

[0025] Figure 7 A business process diagram of the API management system provided in the embodiment of the present application;

[0026] Figure 8 A schematic diagram of the structure of a formula node selection device provided in an embodiment of the present application;

[0027] Fig. 9 A schematic structural diagram of an electronic device provided in an embodiment of the present application;

[0028] Fig.10 A schematic structural diagram of a chip provided in an embodiment of the present application. DETAILED DESCRIPTION

[0029] The following will describe the technical solutions in the embodiments of the present application in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0030] It should be noted that in the embodiments of the present application, the term "and / or" is only a description of the association relationship of the associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the embodiments of the present application, the character " / " generally indicates that the associated objects before and after are in an "or" relationship.

[0031] In the description of the embodiments of the present application, the term "corresponding" may indicate a direct or indirect correspondence between two items, or an association relationship between the two items, or a relationship between indication and being indicated, configuration and being configured, and the like.

[0032] To facilitate understanding of the technical solutions of the embodiments of the present application, the relevant technologies of the embodiments of the present application are described below. The following related technologies can be arbitrarily combined with the technical solutions of the embodiments of the present application as optional solutions, and they all belong to the protection scope of the embodiments of the present application.

[0033] With the booming development of cloud-native and open source software technologies, more and more development platforms and third-party services are emerging rapidly, the complexity of application systems and functional units is constantly increasing, and application development is deeply dependent on the mutual calls between APIs. As an important channel for connecting services and transmitting data, API has transformed from a simple interface to an important part of IT architecture, becoming a new infrastructure in the digital age, and an important and special digital asset in the digital age. With this comes the consideration of API security issues.

[0034] Discovery and blocking of abnormal API access is an important issue in the field of network security. Especially in the context of digital transformation and rapid development of Internet business, API, as a key technology for data interaction and system integration, has received increasing attention for its security.

[0035] The current mainstream method is to protect the entire application through a traditional Web Application Firewall (WAF). WAF is deployed in the customer's on-site demilitarized zone (DMZ) to perform security analysis on traffic in and out of the network. WAF usually analyzes and protects based on network traffic metadata and cannot perform detailed analysis on specific APIs. The complexity and diversity of APIs require more sophisticated protection measures.

[0036] Introducing blockchain in the field of industrial application security management through blockchain technology and consensus algorithm (consensus algorithm is an algorithm used by different participating nodes in the blockchain to reach a consensus on the exchanged information and is used to quickly confirm information), API open information is shared between different participating entities to solve problems such as information asymmetry and centralized node security management.

[0037] In the relevant solutions, single nodes are analyzed and protected through WAF, which poses risks such as single node loss and easy data tampering. At the same time, single node resources are limited and cannot meet the needs of full data synchronization and massive concurrent processing. API information is shared through blockchain, and all nodes are connected to the blockchain network to share ledgers and data. The node resource status is not considered, which can easily lead to node loss and leakage. The security risks and security conditions faced by blockchain nodes are not considered, which can easily lead to information leakage, security non-compliance and other problems, and cannot meet high security management requirements.

[0038] Figure 1 Schematic diagram of the implementation process of the consensus node selection method provided in the embodiment of the present application Figure 1 ,like Figure 1 As shown, the embodiment of the present application provides a consensus node selection method, the method comprising the following steps:

[0039] Step 101: According to the weight value of each blockchain node in the block subchain, select the blockchain node in the block subchain that participates in the consensus algorithm; the weight value represents the security status of the corresponding blockchain node; wherein,

[0040] Different blockchain subchains are responsible for different application programming interface (API) services. The blockchain nodes in the same blockchain subchain are deployed in the business systems of upstream and downstream enterprises participating in the same API business. The same API business is the API business that the blockchain subchain is responsible for. In the embodiment of the present application, the blockchain system is introduced into API management, and different blockchain subchains are responsible for storing different API business data, achieving business isolation and supporting high concurrency. When selecting the consensus node in the blockchain subchain, the security status of the business system deployed by the blockchain node is considered, rather than using all blockchain nodes as consensus nodes, to avoid single point failure and ensure the security of API data.

[0041] In the embodiment of the present application, the API business includes: Manufacturing Execution System (MES), Warehouse Management System (WMS), Equipment Management System, Data Collection and Monitoring System, etc.

[0042] In the embodiment of the present application, the weight value can be determined based on the security situation of the business system where the blockchain node is deployed and / or the situation of the business system where the blockchain node is deployed.

[0043] Based on this, in an optional implementation of the present application, the weight value of the blockchain node is determined by first information and / or second information, wherein the first information represents the security situation of the business system where the blockchain node is deployed, and the second information represents the load situation of the business system where the blockchain node is deployed.

[0044] In an optional implementation manner of the present application, the first information includes: a security protection level of the business system and / or an API security risk level of the business system;

[0045] The second information includes: the calling load of the business system.

[0046] In the embodiment of the present application, the security protection level of the business system is a preset value and can be set according to the standard.

[0047] The API security risk level of the business system is determined based on the sensitive data exposed by each API of the business system. Exemplarily, the risk value of each API can be determined based on the amount of sensitive data exposed by each API, and the risk value of each API is weighted to obtain the API security risk level of the business system; for example, when the API does not expose sensitive data, the risk value of the API is set to 10, which is a low security risk; when the API exposes one sensitive data, the risk value of the API is set to 30, which is a medium security risk; when the API exposes two sensitive data, the risk value of the API is set to 60, which is a high security risk; when the API exposes three or more sensitive data, the risk value of the API is set to 100, which is an extremely high security risk; the risk values ​​of all APIs of the business system are added up and divided by the number of APIs to calculate the weighted average risk level of the APIs of the business system, which is the API security risk level of the business system.

[0048] The call load of the business system can be calculated based on the current load information of the business system. The load information includes: central processing unit (CPU) utilization, memory utilization and storage utilization. Exemplarily, the call load of the business system is obtained by the following calculation formula: 1-CPU utilization * memory utilization * storage utilization, so that the higher the CPU, memory and storage utilization of the business system, the lower the call load ranking of the business system; if the utilization rate of one or more of the CPU, memory and storage of the business system reaches 95%, the blockchain node corresponding to the business system will be disqualified from participating in the consensus algorithm.

[0049] Based on this, in an optional implementation of the present application, the security protection level of the business system is a preset value; the call load of the business system is determined by the load information of the business system; the load information includes: CPU usage, memory usage, and storage usage; the API security risk level of the business system is determined by the sensitive data exposed by each API of the business system.

[0050] In an embodiment of the present application, the weight value of the blockchain node corresponding to the business system can be determined by the security protection level, call load and API security risk level of the business system. For example, weight coefficients are set for the security protection level, call load and API security risk level of the business system, respectively, and the weight value of the blockchain node is obtained by adding them together.

[0051] Based on this, in an optional implementation manner of the present application, the weight value of the blockchain node is obtained by:

[0052] Set a first weight coefficient corresponding to the security protection level, a second weight coefficient corresponding to the call load, and a third weight coefficient corresponding to the API security risk level;

[0053] The weight value of the blockchain node is calculated based on the security protection level, call load, API security risk level of the business system where the blockchain node is deployed, and the first weight coefficient, the second weight coefficient, and the third weight coefficient.

[0054] Exemplarily, the weight value of the blockchain node is calculated using the following formula:

[0055] W=security protection level*a+call load*b+API security risk level*c; where W is the weight value of the blockchain node, a is the first weight coefficient corresponding to the security protection level, b is the second weight coefficient corresponding to the call load, and c is the third weight coefficient corresponding to the API security risk level.

[0056] In the embodiment of the present application, the values ​​of a, b, and c can be configured through a configuration file according to the attribute requirements of the business that the block subchain is responsible for, and support online modification. They can be set to any non-negative number, and the default value is 1. If the current actual business needs to focus on the security protection level, the value of a can be set greater than b and c; if the current actual business needs to focus on the resource call load, the value of b can be set greater than a and c; if the current actual business needs to focus on the API risk situation, the value of c can be set greater than a and b.

[0057] In the embodiment of the present application, the consensus algorithm may adopt the Practical Byzantine Fault Tolerance (PBFT) algorithm, or other consensus algorithms, such as Delegated Proof of Stake (DPoS), Paxos, etc. The embodiment of the present application does not limit this. For example, taking the PBFT algorithm as an example, the first 3f+1 blockchain nodes with the largest weight value in the block subchain are selected as consensus nodes, and a consensus node is elected as the master node in each view to broadcast new transaction requests, coordinate other nodes to reach a consensus, and complete the block generation and data sharing operations.

[0058] Based on this, in an optional implementation of the present application, the consensus algorithm is a pBFT algorithm, and the selection of blockchain nodes in the block subchain that participate in the consensus algorithm according to the weight value of each blockchain node in the block subchain includes:

[0059] According to the weight value of each blockchain node in the block sub-chain, the first 3f+1 blockchain nodes with the largest weight value in the block sub-chain are selected as the blockchain nodes participating in the consensus algorithm in the block sub-chain, and f is a preset value.

[0060] To ensure the security of the selected consensus nodes, after the block sub-chain completes f new blocks, the consensus nodes participating in the consensus algorithm in the block sub-chain can be re-determined, so that the security and call load of the blockchain nodes participating in the consensus algorithm meet the security requirements.

[0061] Based on this, in an optional implementation manner of the present application, the method further includes:

[0062] After the block subchain completes f new blocks, the blockchain nodes participating in the consensus algorithm in the block subchain are reselected.

[0063] In the embodiment of the present application, f can be configured through a configuration file and supports online modification. It can be set to any integer greater than or equal to 2. If the value of f is not configured, the default value of f is 2. For example, based on the business scale and system concurrency requirements, when the number of participants is less than or equal to 20, it is set to 2; when the number of participants is greater than 20 and less than or equal to 50, it is set to 3; when the number of participants is greater than 50, it is set to 4.

[0064] Based on this, in an optional implementation of the present application, if the f value is not configured, the value of f is 2;

[0065] If the number of nodes in the block subchain is less than or equal to 20, the value of f is configured to be 2;

[0066] If the number of nodes in the block subchain is greater than 20 and less than or equal to 50, the value of f is configured to be 3;

[0067] If the number of nodes in the block subchain is greater than 50, the value of f is configured to be 4.

[0068] The consensus node selection method provided in the embodiment of the present application uses blockchain technology to design a new consensus algorithm based on the node security status (security protection level, node call load, API security risk level), comprehensively considers the security risks faced by industrial application systems, has wide adaptability and irreplaceability, enhances the stability and security of block-producing nodes, and meets the industrial application security management requirements such as business system business data isolation, high concurrency processing, high system security and high availability.

[0069] The present application also provides an API management system. Figure 2 , the API management system in this embodiment includes: an industrial application security management system and a blockchain system;

[0070] The blockchain system includes multiple blockchain subchains; different blockchain subchains are responsible for different API services, and blockchain nodes in the same subchain are deployed in the business systems of upstream and downstream enterprises participating in the same business;

[0071] The industrial application security management system is used to connect to and collect API data of the business system, and call the blockchain system to store the API data; when a first API business request from the business system is received, the block sub-chain corresponding to the first API business is called, so that the block sub-chain corresponding to the first API business adopts the consensus node selection method provided in any embodiment of the present application to select a consensus node, and execute block generation and data sharing operations through a consensus algorithm.

[0072] refer to Figure 3 , Figure 3 The software architecture diagram of the API management system provided in the embodiment of the present application is as follows: Figure 3 As shown, in this embodiment, the API management system includes:

[0073] Industrial application security management DashBoard unit: used to display various data of the industrial application security management system, such as registered enterprises, registered users, security levels, security logs and other information;

[0074] Identity management unit: used to provide registration, hierarchical management, identity certificate management and other services to relevant business systems and users participating in the industrial application security management system, and call the data storage unit to save relevant information;

[0075] API information entry unit: used to enter and manage industrial application API information and call the data storage unit to save relevant information;

[0076] API information reading unit: used to query and manage industrial application API information, and call the data authorization unit to confirm that the query has the query authority;

[0077] Node management unit: used to manage nodes connected to the industrial application security management system and call the data storage unit to save relevant information;

[0078] Event management unit: used to manage various abnormal events in the system in a hierarchical manner, provide notification functions such as SMS and email, and call the data storage unit to save relevant information;

[0079] Log management unit: used to classify and manage logs at all levels in the system and call the data storage unit to save relevant information;

[0080] Data storage unit: used to use the blockchain system to partition and store various types of data in the industrial application safety management system to ensure data storage security;

[0081] Data authorization unit: used to conduct identity authorization management for the opening of various types of data in the system to the outside world, and call the data storage unit to save relevant information;

[0082] Blockchain system: used to provide underlying blockchain data storage services to meet the data security isolation, high concurrency and high availability requirements of industrial application security management systems.

[0083] In the embodiment of the present application, edge computing (EC) can be added to the API management system to push computing power and data storage capabilities to the edge of the network, process API access information locally at the edge node, improve business processing timeliness, reduce data transmission delays, and reduce the burden on the central server. Figure 4 , Figure 4 A schematic diagram of the network architecture of the industrial application security management system provided in the embodiment of the present application is shown in FIG. Figure 4As shown, the industrial application security management system includes a cloud center, edge nodes, and gateways, among which the cloud center is used for registration, ID card issuance, and data storage of various business systems or users participating in the industrial application security management system; the edge node is the aggregation node in the edge area where the industrial application security participants are located, and is used for participant identity authentication, data collection, and storage; the gateway is used to provide Infrastructure as a Service (IaaS) resources for deploying industrial applications and security management systems, connect to various industrial business systems in the south, provide APIs, and be responsible for accessing various API application data; connect to edge computing nodes in the north to aggregate various data of industrial application systems; the gateway itself can also be used as an edge computing node to complete computing tasks.

[0084] In the embodiments of the present application, the business system can be used directly as an edge node, or an edge node can be newly deployed in the business system. In actual application, it can be designed according to actual needs, and the embodiments of the present application do not limit this.

[0085] refer to Figure 5 , Figure 5 A schematic diagram of the network topology of the blockchain system provided in the embodiment of the present application is shown in FIG. Figure 5 As shown, the cloud center can also be used as a blockchain node for registration, ID card issuance, and data storage of various business systems or users participating in the industrial application security management system; blockchain node: used to provide BaaS services for the industrial application security management system; in the embodiment of the present application, the blockchain node in the blockchain system is deployed in the business system, and the business system can be used directly as a blockchain node. If the business system is deployed with an edge node, the edge node can also be used directly as a blockchain node, or a new blockchain node can be deployed in the business system. In actual application, it can be designed according to actual needs. The embodiment of the present application does not limit this. The gateway can adopt an industrial intelligent security gateway to provide IaaS resources for deploying industrial security management services, connect to various industrial business systems in the south, provide APIs, and be responsible for accessing various application data; connect to edge computing nodes in the north to aggregate various data of the industrial application system; the gateway itself can also be used as an edge computing node.

[0086] In the embodiment of the present application, the blockchain system adopts sub-chain technology, and different blockchain sub-chains carry different API services. Figure 6 , Figure 6 A schematic diagram of the software architecture of the blockchain subchain provided in the embodiment of the present application; Figure 6 As shown, the block subchain includes:

[0087] Smart contract interface: as the smart contract service interface of the blockchain subchain;

[0088] Identity verification unit: used to provide blockchain node identity verification management function. Only nodes that have passed identity verification can access the blockchain system and obtain relevant data. The identity verification management function is implemented based on the X.509 identity certificate, and the X.509 identity certificate is extended to carry the Security ID. Different subchains are distinguished based on the Security ID. Each subchain is used to deploy different services. Blockchain subchains are isolated from each other through identity certificates to meet high security and high concurrency requirements.

[0089] Node management unit: calculates the security status of the block subchain access node (security protection level, node call load, API risk level), updates every x seconds for use by the consensus algorithm, x can be configured through the configuration file, and the default value is 5;

[0090] Consensus algorithm unit: used to provide a new consensus algorithm. In the embodiment of the present application, in order to ensure the high security of the block-producing node and meet the system stability and security requirements, the following consensus algorithm is designed based on the node security status (security protection level, node call load, API security risk level):

[0091] Starting from the genesis block, the security status of the blockchain node (security protection level, node call load, API security risk level) is obtained through the node management unit. The weight value W = security protection level * a + node call load * b + API security risk level * c, where a is the first weight coefficient corresponding to the security protection level, b is the second weight coefficient corresponding to the call load, and c is the third weight coefficient corresponding to the API security risk level. All blockchain nodes in the block subchain are sorted by weight value, and the first 3f+1 nodes are selected to participate in sorting services and block generation according to the pBFT algorithm; after completing f new blocks, according to the weight value of the blockchain node Re-sort and re-select consensus nodes and block nodes; the security protection level can be set according to the standard, and is determined according to the compliance requirements of the business system level protection; the node call load is calculated according to the current CPU, memory, and storage usage of the business system corresponding to the blockchain node, and the calculation method is: 1-CPU usage * memory usage * storage usage. The higher the CPU, memory, and storage usage, the lower the ranking; additional settings can also be added to improve processing efficiency. For example, when the CPU, memory, and storage usage of a business system reaches 95%, the blockchain node corresponding to the business system will be disqualified;

[0092] The API security risk level is calculated by weighting the API risk level exposed by the current node. For example, the risk value of each API can be determined based on the amount of sensitive data exposed by each API. After weighting the risk values ​​of each API, the API security risk level of the business system is obtained. For example, when the API does not expose sensitive data, the risk value of the API is set to 100, which is a low security risk. When the API exposes one piece of sensitive data, the risk value of the API is set to 60, which is a medium security risk. When the API exposes two pieces of sensitive data, the risk value of the API is set to 30, which is a high security risk. When the API exposes three or more pieces of sensitive data, the risk value of the API is set to 10, which is an extremely high security risk. The risk values ​​of all APIs in the business system are added up and divided by the number of APIs to calculate the weighted average of the API risk levels of the business system, which is the API security risk level of the business system.

[0093] The values ​​of a, b, and c can be configured through the configuration file according to the attribute requirements of the business that the business subchain is responsible for, and support online modification. They can be set to any non-negative number. The default value is 1. If the current actual business needs to focus on the security protection level, the value of a can be set greater than b and c; if the current actual business needs to focus on the resource call load, the value of b can be set greater than a and c; if the current actual business needs to focus on the API risk situation, the value of c can be set greater than a and b.

[0094] f can be configured through the configuration file and supports online modification. It can be set to any integer greater than or equal to 2. The default value is 2. Based on the business scale and system concurrency requirements, when the number of participants is less than or equal to 20, it is set to 2; when the number of participants is greater than 20 and less than or equal to 50, it is set to 3; when the number of participants is greater than 50, it is set to 4;

[0095] Cryptographic suite unit: used to provide cryptographic suites such as symmetric encryption, asymmetric encryption, and digital signatures for use by identity authentication, consensus algorithm, transaction management, block management, network management, and other units;

[0096] Transaction management unit: used to manage various supply chain transaction information submitted by the supply chain system, and to be called by consensus algorithm, block management and other units;

[0097] Block management unit: used to locally manage the block information submitted by the consensus algorithm unit and received by the network management unit;

[0098] Network management unit: used to provide peer-to-peer (P2P) network functions and complete unit information transmission such as node management, consensus algorithm, transaction management, and block management;

[0099] Storage management unit: used to provide storage services for units such as node management, transaction management, and block management.

[0100] The blockchain system provided in the embodiment of the present application adopts sub-chain technology. Different block sub-chains carry different businesses, combining the central cloud with the blockchain. The business system selectively accesses the blockchain system according to needs to improve the flexibility of the system. The business sub-chain completes related specific businesses and shares the ledger between related participants. The business sub-chains are isolated from each other and executed concurrently, and their own ledger information is maintained separately, thereby meeting the high concurrency requirements of the business.

[0101] refer to Figure 7 , Figure 7 The following is a business process diagram of the API management system provided in the embodiment of the present application. Figure 7 As shown, the API management system includes an industrial application security management system and a blockchain system. The industrial application security management system is responsible for unified management of the APIs of upstream and downstream participants of industrial applications. It consists of front-end DashBoard pages, identity management, API information entry, API information reading, node management, event management, log management, data authorization, data storage and other units. The cloud center management platform, upstream and downstream enterprises of industrial applications and other participants call different units through the page to complete identity registration, data entry and other tasks; the relevant data is stored through the blockchain system by calling the data storage unit.

[0102] In an embodiment of the present application, the blockchain system includes multiple sub-chains, such as, for example, an identity management sub-chain, a business sub-chain A, and a business sub-chain B; wherein, business sub-chain A is used for user registration API information registration; and business sub-chain B is used for specific business API information registration.

[0103] When a new business system is connected to the API management system, the new business system is connected to the gateway via wired or wireless means, and identity authentication is performed through the interface of the identity management subchain. If the blockchain node of the identity management subchain stores identity authentication information, the authentication success result is directly returned. Otherwise, the cloud center node interface getCenterAuth(intuserToken, int SecurityID) is called to query the identity. If the cloud center finds that the new business system is not registered, the new business system is prompted to register first; if it is registered, the cloud center returns the business system identity information, and at the same time adds the blockchain node corresponding to the business system to the identity management and the business subchain corresponding to the new business system's application to join the business, and synchronizes the relevant identity and business information to the edge node to complete the edge domain migration information synchronization.

[0104] When a user registers API information, the industrial application security management system calls the interface of business sub-chain A to perform API registration, data storage and chain upload. Business sub-chain A first calls the identity management sub-chain interface getID (int userToken, intSecurityID) to verify the business system identity information. After the verification is passed, the business sub-chain A blockchain system interface is called to complete the user registration API information storage. The consensus node selection method provided in the embodiment of the present application is used to select the consensus node, and the block is generated through the consensus algorithm and synchronized between different nodes.

[0105] When a user registers specific business API information, the industrial application security management system calls the interface of business sub-chain B to perform API registration, data storage and chain upload. Business sub-chain B first calls the identity management sub-chain interface getID (int userToken, int SecurityID) to verify the business system identity information. After the verification is passed, the business sub-chain B blockchain system interface is called to complete the user business API information storage. The consensus node selection method provided in the embodiment of the present application is used to select the consensus node, and the block is generated through the consensus algorithm and synchronized between different nodes.

[0106] The industrial application business system calls different blockchain sub-chains to obtain data according to the API business type, performs API business processing, and aggregates and displays it on the front-end page.

[0107] The present application also provides a consensus node selection device, referring to Figure 8 , Figure 8 This is a schematic diagram of the structure of a formula node selection device provided in an embodiment of the present application. The consensus node selection device in this embodiment includes:

[0108] Selection unit: used to select the blockchain nodes participating in the consensus algorithm in the block subchain according to the weight values ​​of each blockchain node in the block subchain; the weight values ​​represent the security status of the corresponding blockchain nodes; wherein,

[0109] Different blockchain sub-chains are responsible for different API services. The blockchain nodes in the same blockchain sub-chain are deployed in the business systems of upstream and downstream enterprises participating in the same API service. The same API service is the API service that the blockchain sub-chain is responsible for.

[0110] In an embodiment of the present application, the weight value of the blockchain node is determined by first information and / or second information, wherein the first information represents the security status of the business system in which the blockchain node is deployed, and the second information represents the load status of the business system in which the blockchain node is deployed.

[0111] In an embodiment of the present application, the first information includes: the security protection level of the business system and / or the API security risk level of the business system; the second information includes: the call load of the business system.

[0112] In an embodiment of the present application, the selection unit is used to set a first weight coefficient corresponding to the security protection level, a second weight coefficient corresponding to the call load, and a third weight coefficient corresponding to the API security risk level; and calculate the weight value of the blockchain node according to the security protection level, call load, API security risk level of the business system in which the blockchain node is deployed, and the first weight coefficient, the second weight coefficient, and the third weight coefficient.

[0113] In an embodiment of the present application, the security protection level of the business system is a preset value; the call load of the business system is determined by the load information of the business system; the load information includes: CPU usage, memory usage, and storage usage; the API security risk level of the business system is determined by the sensitive data exposed by each API of the business system.

[0114] In an embodiment of the present application, the consensus algorithm is a pBFT algorithm, and the selection unit is used to select the first 3f+1 blockchain nodes with the largest weight values ​​in the block subchain as the blockchain nodes participating in the consensus algorithm in the block subchain according to the weight values ​​of each blockchain node in the block subchain, where f is a preset value.

[0115] In an embodiment of the present application, the selection unit is used to reselect the blockchain nodes participating in the consensus algorithm in the block subchain after the block subchain completes f new blocks.

[0116] In the embodiment of the present application, if the f value is not configured, the value of f is 2; if the number of nodes in the block sub-chain is less than or equal to 20, the value of f is configured to 2; if the number of nodes in the block sub-chain is greater than 20 and less than or equal to 50, the value of f is configured to 3; if the number of nodes in the block sub-chain is greater than 50, the value of f is configured to 4.

[0117] Those skilled in the art should understand that Figure 8 The implementation functions of each unit in the consensus node selection device shown can be understood by referring to the relevant description of the aforementioned method. Figure 8 The functions of each unit in the consensus node selection device shown can be implemented by a program running on a processor, or by a specific logic circuit.

[0118] Fig. 9 It is a schematic structural diagram of an electronic device 900 provided in an embodiment of the present application. Fig. 9The electronic device 900 shown includes a processor 910, which can call and run a computer program from a memory to implement the method in the embodiment of the present application.

[0119] Alternatively, if Fig. 9 As shown, the electronic device 900 may further include a memory 920. The processor 910 may call and run a computer program from the memory 920 to implement the method in the embodiment of the present application.

[0120] The memory 920 may be a separate device independent of the processor 910 , or may be integrated into the processor 910 .

[0121] Alternatively, if Fig. 9 As shown, the electronic device 900 may further include a transceiver 930, and the processor 910 may control the transceiver 930 to communicate with other devices, specifically, may send information or data to other devices, or receive information or data sent by other devices.

[0122] The transceiver 930 may include a transmitter and a receiver. The transceiver 930 may further include an antenna, and the number of the antennas may be one or more.

[0123] The electronic device 900 can specifically be a consensus node selection device in an embodiment of the present application, and the electronic device 900 can implement the corresponding processes implemented by the consensus node selection device in each method of the embodiment of the present application, which will not be repeated here for the sake of brevity.

[0124] Exemplarily, an embodiment of the present application further provides a computer program product, including a computer program, and the computer program can be executed by the processor 910 of the communication device 900 to complete the steps of any of the aforementioned methods.

[0125] Fig.10 It is a schematic structural diagram of the chip of an embodiment of the present application. Fig.10 The chip 1000 shown includes a processor 1010, which can call and run a computer program from a memory to implement the method in the embodiment of the present application.

[0126] Alternatively, if Fig.10 As shown, the chip 1000 may further include a memory 1020. The processor 1010 may call and run a computer program from the memory 1020 to implement the method in the embodiment of the present application.

[0127] The memory 1020 may be a separate device independent of the processor 1010 , or may be integrated into the processor 1010 .

[0128] Optionally, the chip 1000 may further include an input interface 1030. The processor 1010 may control the input interface 1030 to communicate with other devices or chips, and specifically, may obtain information or data sent by other devices or chips.

[0129] Optionally, the chip 1000 may further include an output interface 1040. The processor 1010 may control the output interface 1040 to communicate with other devices or chips, and specifically, may output information or data to other devices or chips.

[0130] The chip can be applied to the electronic device 900 in the embodiment of the present application, and the chip can implement the corresponding processes implemented by the electronic device 900 in the various methods of the embodiment of the present application, which will not be described in detail here for the sake of brevity.

[0131] It should be understood that the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

[0132] It should be understood that the processor of the embodiment of the present application may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method embodiment can be completed by the hardware integrated logic circuit or software instructions in the processor. The above processor can be a general processor, a digital signal processor (Digital Signal Processor, DSP), an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field programmable gate array (Field Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in the embodiment of the present application can be directly embodied as a hardware decoding processor to perform, or the hardware and software units in the decoding processor are combined and executed. The software unit can be located in a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, and other mature storage media in the art. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0133] It can be understood that the memory in the embodiments of the present application can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct RAM bus random access memory (DR RAM). It should be noted that the memory of the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0134] It should be understood that the above-mentioned memory is exemplary but not restrictive. For example, the memory in the embodiments of the present application may also be static random access memory (static RAM, SRAM), dynamic random access memory (dynamic RAM, DRAM), synchronous dynamic random access memory (synchronous DRAM, SDRAM), double data rate synchronous dynamic random access memory (double data rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous link dynamic random access memory (synch link DRAM, SLDRAM) and direct memory bus random access memory (Direct Rambus RAM, DR RAM), etc. That is to say, the memory in the embodiments of the present application is intended to include but not limited to these and any other suitable types of memory.

[0135] The present application also provides a storage medium for storing a computer program. The storage medium can be applied to the electronic device 900 in the present application, and the computer program enables the computer to execute the corresponding process implemented by the electronic device 900 in each method of the present application, which will not be described in detail for the sake of brevity.

[0136] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0137] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0138] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0139] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0140] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0141] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or an electronic device 900, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0142] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A consensus node selection method, characterized in that: include: According to the weight value of each blockchain node in the block subchain, the blockchain node participating in the consensus algorithm in the block subchain is selected; the weight value represents the security status of the corresponding blockchain node; wherein, Different blockchain sub-chains are responsible for different application program interface API services; the blockchain nodes in the same blockchain sub-chain are deployed in the business systems of upstream and downstream enterprises participating in the same API service, and the same API service is the API service that the blockchain sub-chain is responsible for.

2. The method according to claim 1, characterized in that The weight value of the blockchain node is determined by the first information and / or the second information, wherein the first information represents the security situation of the business system where the blockchain node is deployed, and the second information represents the load situation of the business system where the blockchain node is deployed.

3. The method according to claim 2, characterized in that include: The first information includes: the security protection level of the business system and / or the API security risk level of the business system; The second information includes: the calling load of the business system.

4. The method according to claim 3, characterized in that The weight value of the blockchain node is obtained as follows: Set a first weight coefficient corresponding to the security protection level, a second weight coefficient corresponding to the call load, and a third weight coefficient corresponding to the API security risk level; The weight value of the blockchain node is calculated based on the security protection level, call load, API security risk level of the business system where the blockchain node is deployed, and the first weight coefficient, the second weight coefficient, and the third weight coefficient.

5. The method according to claim 3, characterized in that: The security protection level of the business system is a preset value; The call load of the business system is determined by the load information of the business system; the load information includes: CPU usage, memory usage, and storage usage; The API security risk level of the business system is determined by the sensitive data exposed by each API of the business system.

6. The method according to any one of claims 1 to 5, characterized in that The consensus algorithm is the pBFT algorithm, and the selection of the blockchain nodes in the block subchain that participate in the consensus algorithm according to the weight value of each blockchain node in the block subchain includes: According to the weight value of each blockchain node in the block sub-chain, the first 3f+1 blockchain nodes with the largest weight value in the block sub-chain are selected as the blockchain nodes participating in the consensus algorithm in the block sub-chain, and f is a preset value.

7. The method according to claim 6, characterized in that Also includes: After the block subchain completes f new blocks, reselect the blockchain nodes participating in the consensus algorithm in the block subchain.

8. The method according to claim 7, characterized in that If the f value is not configured, the value of f is 2; If the number of nodes in the block subchain is less than or equal to 20, the value of f is configured as 2; If the number of nodes in the block subchain is greater than 20 and less than or equal to 50, the value of f is configured to be 3; If the number of nodes in the block subchain is greater than 50, the value of f is configured to be 4.

9. An API management system, comprising: Industrial application safety management systems and blockchain systems; The blockchain system includes multiple blockchain subchains; different blockchain subchains are responsible for different API services, and blockchain nodes in the same subchain are deployed in the business systems of upstream and downstream enterprises participating in the same business; The industrial application safety management system is used to connect to and collect API data of the business system, and call the blockchain system to store the API data; when receiving the first API business request of the business system, call the block sub-chain corresponding to the first API business, so that the block sub-chain corresponding to the first API business adopts the consensus node selection method described in any one of claims 1 to 8 to select a consensus node, and execute block generation and data sharing operations through the consensus algorithm.

10. A consensus node selection device, characterized in that: include: Selection unit: used to select the blockchain nodes participating in the consensus algorithm in the block subchain according to the weight values ​​of each blockchain node in the block subchain; the weight values ​​represent the security status of the corresponding blockchain nodes; wherein, Different blockchain sub-chains are responsible for different API services. The blockchain nodes in the same blockchain sub-chain are deployed in the business systems of upstream and downstream enterprises participating in the same API service. The same API service is the API service that the blockchain sub-chain is responsible for.

11. An electronic device, characterized in that: include: A processor and a memory, the memory being used to store a computer program, the processor being used to call and run the computer program stored in the memory to execute the consensus node selection method as described in any one of claims 1 to 8.

12. A chip, characterized in that: include: A processor, used to call and run a computer program from a memory so that a device equipped with the chip executes the consensus node selection method described in any one of claims 1 to 8.

13. A storage medium, characterized in that: Used to store a computer program, wherein the computer program enables a computer to execute the consensus node selection method as described in any one of claims 1 to 8.

14. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the computer program implements the consensus node selection method as described in any one of claims 1 to 8.

Images