Consensus node selection method and apparatus, API management system, and storage medium

Abstract

Embodiments of the present application provide a consensus node selection method, a consensus node selection device, an API management system, an electronic device, a chip, a storage medium and a computer program product. The method comprises: selecting blockchain nodes participating in a consensus algorithm in a block subchain according to weight values of the blockchain nodes in the block subchain; the weight values represent the security status of the corresponding blockchain nodes; wherein different block subchains are responsible for different API businesses, the blockchain nodes in the same block subchain are deployed in the business systems of upstream and downstream enterprises participating in the same API business, and the same API business is the API business responsible for the block subchain.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the technical field of large model, in particular to a consensus node selection method, a consensus node selection device, an API management system, an electronic device, a chip, a storage medium and a computer program product. BACKGROUND

[0002] With the vigorous development of cloud native and software open source technology, more and more development platforms and third-party services are emerging rapidly, and the complexity of application systems and functional units is continuously improving. Application development relies heavily on the mutual calling between application programming interfaces (APIs). As an important channel for connecting services and transmitting data, API has evolved from a simple interface to an important part of information technology (IT) architecture, becoming a new type of infrastructure in the digital age and an important and special digital asset in the digital age. Consequently, there is a need to consider API security issues. The current approach is to introduce a blockchain as a service (BaaS) solution in the field of industrial application security management. Different participating entities share API open information through blockchain technology and consensus algorithms. However, all nodes access the blockchain network and share the ledger and data through the consensus algorithm, which can easily lead to node compromise and data leakage, and cannot meet the requirements of secure data isolation and secure control. SUMMARY

[0003] The present application provides a consensus node selection method, a consensus node selection device, an API management system, an electronic device, a chip, a storage medium and a computer program product.

[0004] The consensus node selection method provided by the present application comprises:

[0005] According to the weight values of the blockchain nodes in the block subchain, the blockchain nodes participating in the consensus algorithm in the block subchain are selected. The weight values represent the security status of the corresponding blockchain nodes. Different block subchains are responsible for different API businesses, and the blockchain nodes in the same block subchain are deployed in the business systems of the upstream and downstream enterprises participating in the same API business. The same API business is the API business responsible for the block subchain.

[0006] The API management system provided by the present application comprises:

[0007] An industrial application security management system and a blockchain system.

[0008] The blockchain system comprises a plurality of block subchains; different block subchains are responsible for different API services, and the blockchain nodes in the same subchain are deployed in the business systems of the upstream and downstream enterprises participating in the same service;

[0009] The industrial application security management system is configured to connect to and collect API data of the business system and call the blockchain system to store the API data; when receiving a first API service request of the business system, the block subchain corresponding to the first API service is called to enable the block subchain corresponding to the first API service to select a consensus node by using the consensus node selection method provided in the embodiments of the application and perform block generation and data sharing operations through a consensus algorithm.

[0010] The consensus node selection device provided in the embodiments of the application comprises:

[0011] The selection unit is configured to select the blockchain nodes participating in the consensus algorithm in the block subchain according to the weight values of the blockchain nodes in the block subchain; the weight values represent the security status of the corresponding blockchain nodes; and the selection unit is configured to select the blockchain nodes participating in the consensus algorithm in the block subchain according to the weight values of the blockchain nodes in the block subchain.

[0012] Different block subchains are responsible for different API services, and the blockchain nodes in the same block subchain are deployed in the business systems of the upstream and downstream enterprises participating in the same API service, and the same API service is the API service responsible for the block subchain.

[0013] The electronic device provided in the embodiments of the application comprises a processor and a memory, the memory is configured to store a computer program, and the processor is configured to call and run the computer program stored in the memory to execute any consensus node selection method provided in the embodiments of the application.

[0014] The chip provided in the embodiments of the application comprises a processor configured to call and run a computer program from a memory to enable a device installed with the chip to execute any consensus node selection method provided in the embodiments of the application.

[0015] The storage medium provided in the embodiments of the application is configured to store a computer program, and the computer program enables a computer to execute any consensus node selection method provided in the embodiments of the application.

[0016] The computer program product provided in the embodiments of the application comprises a computer program, and the computer program enables a processor to implement any consensus node selection method provided in the embodiments of the application when executed.

[0017] Through the consensus node selection method provided in the embodiments of the application, different block subchains are loaded with different services, the API services are isolated from each other, high concurrency requirements are supported, the security status of the blockchain nodes is considered when selecting the consensus nodes, single-point failure is avoided, and data security is ensured. Attached Figure Description

[0018] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments of this application and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0019] Figure 1 Schematic diagram of the implementation process of the consensus node selection method provided in the embodiments of this application Figure 1 ;

[0020] Figure 2 Functional structure diagram of the large model federated fine-tuning system provided in the embodiments of this application;

[0021] Figure 3 This is a schematic diagram of the software architecture of the API management system provided in the embodiments of this application;

[0022] Figure 4 This is a schematic diagram of the network architecture of the industrial application security management system provided in the embodiments of this application;

[0023] Figure 5 This is a schematic diagram of the network topology of the blockchain system provided in the embodiments of this application;

[0024] Figure 6 A schematic diagram of the software architecture of the blockchain sub-chain provided in the embodiments of this application;

[0025] Figure 7 This is a schematic diagram of the business process of the API management system provided in the embodiments of this application;

[0026] Figure 8 This is a schematic diagram of the structure of the formula node selection device provided in the embodiments of this application;

[0027] Figure 9 A schematic structural diagram of an electronic device provided in the embodiments of this application;

[0028] Figure 10 This is a schematic structural diagram of the chip provided in the embodiments of this application. Detailed Implementation

[0029] The technical solutions of the embodiments of this application will now be described with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0030] It should be noted that in the embodiments of the present application, the term "and / or" is merely to describe the association relationship of the associated objects, and can represent the existence of three relationships, for example, A and / or B, which can represent the existence of A alone, the existence of A and B together, and the existence of B alone. In addition, in the embodiments of the present application, the character " / " generally represents an "or" relationship between the front and rear associated objects.

[0031] In the description of the embodiments of the present application, the term "corresponding" can represent a direct or indirect corresponding relationship between the two, can also represent an associated relationship between the two, and can also indicate a relationship such as being indicated, being configured, and the like.

[0032] In order to facilitate the understanding of the technical solutions of the embodiments of the present application, the related technologies of the embodiments of the present application are described as follows, and the following related technologies can be combined with the technical solutions of the embodiments of the present application in any way, which all belong to the protection scope of the embodiments of the present application.

[0033] With the vigorous development of cloud native and software open source technologies, more and more development platforms and third-party services are emerging rapidly, and the complexity of application systems and functional units is continuously improving. Application development relies heavily on the mutual calling between APIs. As an important channel for connecting services and transmitting data, API has evolved from a simple interface to an important part of IT architecture, becoming a new type of infrastructure in the digital age and an important and special digital asset in the digital age. Consequently, the issue of API security is being considered.

[0034] API abnormal access discovery and blocking is an important issue in the field of network security, especially in the context of digital transformation and rapid development of Internet business. As a key technology for data interaction and system integration, the security of API has attracted more and more attention.

[0035] The current mainstream method is to protect the whole application through a traditional Web Application Firewall (WAF). WAF is deployed in the Demilitarized Zone (DMZ) of the customer's site to analyze the security of the traffic in and out of the network. WAF usually analyzes and protects based on network traffic metadata, and cannot perform fine-grained analysis on specific APIs. The complexity and diversity of APIs require more fine-grained protection measures.

[0036] In the field of industrial application security management, the introduction of blockchain through blockchain technology and consensus algorithm (consensus algorithm is an algorithm used by different participating nodes in blockchain to reach agreement on exchanged information, used to quickly confirm information) enables different participating entities to share API open information, solving the problems of information asymmetry and centralized node security management.

[0037] In related solutions, the single node is analyzed and protected by the WAF, which has risks such as single node loss and data tampering. In addition, the single node has limited resources and cannot meet the full data synchronization and massive concurrent processing requirements. The API information is shared through the blockchain, all nodes are connected to the blockchain network, and the shared ledger and data are not considered in the node resource state, which can easily lead to node loss and leakage. The security risks and security conditions of the blockchain nodes are not considered, which can easily lead to information leakage and security non-compliance, and cannot meet the high security management requirements.

[0038] Figure 1 Implementation process of the consensus node selection method provided by the embodiments of the present application Figure 1 As shown in Figure 1 The embodiments of the present application provide a consensus node selection method, which comprises the following steps:

[0039] Step 101: selecting a blockchain node participating in a consensus algorithm in a block subchain according to a weight value of each blockchain node in the block subchain; the weight value represents the security condition of the corresponding blockchain node; wherein,

[0040] Different block subchains are responsible for different application programming interface (API) businesses, and the blockchain nodes in the same block subchain are deployed in the business systems of the upstream and downstream enterprises participating in the same API business, and the same API business is the API business responsible for the block subchain. In the embodiments of the present application, the blockchain system is introduced into the API management, different block subchains are responsible for storing different API business data, business isolation and high concurrency are realized, and when selecting the consensus nodes in the block subchain, the security condition of the business system where the blockchain node is deployed is considered, instead of all blockchain nodes being used as consensus nodes, so as to avoid single point loss and ensure the security of API data.

[0041] In the embodiments of the present application, the API business includes a manufacturing execution system (MES), a warehouse management system (WMS), a device management system, a data acquisition and monitoring system, etc.

[0042] In the embodiments of the present application, the weight value can be determined according to the security condition of the business system where the blockchain node is deployed and / or the condition of the business system where the blockchain node is deployed.

[0043] Based on this, in an optional embodiment of the present application, the weight value of the blockchain node is determined by first information and / or second information, the first information characterizing the security situation of the business system in which the blockchain node is deployed, and the second information characterizing the load situation of the business system in which the blockchain node is deployed.

[0044] In an optional embodiment of the present application, the first information includes the security protection level of the business system and / or the API security risk level of the business system.

[0045] The second information includes the calling load of the business system.

[0046] In an embodiment of the present application, the security protection level of the business system is a preset value, which can be set according to a standard.

[0047] The API security risk level of the business system is determined according to the sensitive data exposed by each API of the business system. For example, the risk value of each API can be determined according to the number of sensitive data exposed by each API, and the risk values of each API are weighted to obtain the API security risk level of the business system. For example, when an API does not expose sensitive data, the risk value of the API is set to 10, which is a low security risk. When an API exposes one piece of sensitive data, the risk value of the API is set to 30, which is a medium security risk. When an API exposes two pieces of sensitive data, the risk value of the API is set to 60, which is a high security risk. When an API exposes three or more pieces of sensitive data, the risk value of the API is set to 100, which is an extremely high security risk. The risk values of all APIs of the business system are added and divided by the number of APIs to calculate the weighted average value of the API risk level of the business system, which is the API security risk level of the business system.

[0048] The calling load of the business system can be calculated according to the current load information of the business system. The load information includes the central processing unit (CPU) usage, memory usage, and storage usage. For example, the calling load of the business system is obtained by using the following calculation formula: 1-CPU usage*memory usage*storage usage, so that the higher the CPU, memory, and storage usage of the business system, the later the calling load ranking of the business system. If one or more of the CPU, memory, and storage usage of the business system reaches 95%, the qualification of the blockchain node corresponding to the business system for participating in the consensus algorithm is cancelled.

[0049] Based on this, in an optional embodiment of the present application, the security protection level of the business system is a preset value; the calling load of the business system is determined by load information of the business system; the load information includes: CPU usage, memory usage, and storage usage; and the API security risk level of the business system is determined by sensitive data exposed by each API of the business system.

[0050] In the embodiments of the present application, the weight value of the blockchain node corresponding to the business system can be determined by the security protection level, the calling load, and the API security risk level of the business system. For example, weight coefficients are set for the security protection level, the calling load, and the API security risk level of the business system, and the weight value of the blockchain node is obtained by adding the weight coefficients.

[0051] Based on this, in an optional embodiment of the present application, the weight value of the blockchain node is obtained by the following method:

[0052] A first weight coefficient corresponding to the security protection level, a second weight coefficient corresponding to the calling load, and a third weight coefficient corresponding to the API security risk level are set.

[0053] According to the security protection level, the calling load, and the API security risk level of the business system in which the blockchain node is deployed, and the first weight coefficient, the second weight coefficient, and the third weight coefficient, the weight value of the blockchain node is calculated.

[0054] For example, the weight value of the blockchain node is calculated by the following formula:

[0055] W = security protection level * a + calling load * b + API security risk level * c; wherein W is the weight value of the blockchain node, a is the first weight coefficient corresponding to the security protection level, b is the second weight coefficient corresponding to the calling load, and c is the third weight coefficient corresponding to the API security risk level.

[0056] In the embodiments of the present application, the values of a, b, and c can be configured by a configuration file according to the attribute requirements of the business responsible by the block subchain, and online modification is supported. The values can be set to any non-negative number, and the default values are all 1. For example, if the security protection level needs to be considered as the priority in the current actual business, the value of a can be set to be greater than b and c. For example, if the resource calling load needs to be considered as the priority in the current actual business, the value of b can be set to be greater than a and c. For example, if the API risk needs to be considered as the priority in the current actual business, the value of c can be set to be greater than a and b.

[0057] In an embodiment of the present application, the consensus algorithm can adopt a Practical Byzantine Fault Tolerance (PBFT) algorithm, or other consensus algorithms such as Delegated Proof of Stake (DPoS) and Paxos, and the present application is not limited thereto. For example, the PBFT algorithm is taken as an example, the first 3f+1 blockchain nodes with the largest weight values in the block subchain are selected as consensus nodes, one consensus node is elected as a master node in each view, a new transaction request is broadcasted, and other nodes are coordinated to reach an agreement to complete block generation and data sharing operations.

[0058] Based on this, in an optional embodiment of the present application, the consensus algorithm is a pBFT algorithm, and the blockchain nodes participating in the consensus algorithm in the block subchain are selected according to the weight values of the blockchain nodes in the block subchain, including:

[0059] The first 3f+1 blockchain nodes with the largest weight values in the block subchain are selected as the blockchain nodes participating in the consensus algorithm in the block subchain according to the weight values of the blockchain nodes in the block subchain, and f is a preset value.

[0060] To ensure the security of the selected consensus nodes, the consensus nodes participating in the consensus algorithm in the block subchain can be re-determined after the block subchain completes f new blocks, so that the security and calling load of the blockchain nodes participating in the consensus algorithm meet the security requirements.

[0061] Based on this, in an optional embodiment of the present application, the method further includes:

[0062] The blockchain nodes participating in the consensus algorithm in the block subchain are re-selected after the block subchain completes f new blocks.

[0063] In an embodiment of the present application, f can be configured through a configuration file and supports online modification, and can be set to any integer greater than or equal to 2. If the value of f is not configured, the default value of f is 2. For example, in combination with the business size and system concurrency requirements, when the number of participants is less than or equal to 20, f is set to 2, when the number of participants is greater than 20 and less than or equal to 50, f is set to 3, and when the number of participants is greater than 50, f is set to 4.

[0064] Based on this, in an optional embodiment of the present application, if the value of f is not configured, the value of f is 2.

[0065] If the number of nodes of the block subchain is less than or equal to 20, the value of f is configured to be 2.

[0066] If the number of nodes of the block sub-chain is greater than 20 and less than or equal to 50, the value of f is configured as 3;

[0067] If the number of nodes of the block sub-chain is greater than 50, the value of f is configured as 4.

[0068] The consensus node selection method provided by the embodiment of the application uses the block chain technology, designs a new consensus algorithm based on the node security status (security protection level, node call load, API security risk level), comprehensively considers the security risks faced by the industrial application system, has wide adaptability and irreplaceability, enhances the stability and security of the block node, and meets the industrial application security management requirements such as business data isolation, high concurrency processing, system high security and high availability of the business system.

[0069] The embodiment of the application also provides an API management system, which refers to Figure 2 The API management system in the embodiment includes an industrial application security management system and a block chain system.

[0070] The block chain system includes a plurality of block sub-chains; different block sub-chains are responsible for different API businesses, and the block chain nodes in the same sub-chain are deployed in the business systems of the upstream and downstream enterprises participating in the same business;

[0071] The industrial application security management system is used to connect and collect API data of the business system, and call the block chain system to store the API data; when receiving a first API business request of the business system, the block sub-chain corresponding to the first API business is called, so that the block sub-chain corresponding to the first API business selects a consensus node by using the consensus node selection method provided by any embodiment of the application, and performs block generation and data sharing operations through a consensus algorithm.

[0072] Referring to Figure 3 , Figure 3 The software architecture diagram of the API management system provided by the embodiment of the application is shown in Figure 3 The API management system in the embodiment includes:

[0073] The industrial application security management DashBoard unit is used to display various data of the industrial application security management system, such as registered enterprises, registered users, security levels, security logs and the like.

[0074] The identity management unit is used to provide registration, hierarchical management, identity certificate management and the like for the related business systems and users participating in the industrial application security management system, and call the data storage unit to save related information.

[0075] API information entry unit: used for entering and managing industrial application API information, and calling the data storage unit to save related information;

[0076] API information reading unit: used for querying and managing industrial application API information, and calling the data authorization unit to confirm the query right of the query;

[0077] Node management unit: used for managing nodes accessing the industrial application security management system, and calling the data storage unit to save related information;

[0078] Event management unit: used for classifying and managing various abnormal events in the system, providing notification functions such as short message and email, and calling the data storage unit to save related information;

[0079] Log management unit: used for classifying and managing logs at various levels in the system, and calling the data storage unit to save related information;

[0080] Data storage unit: used for storing various data in the industrial application security management system by using a block chain system, to ensure data storage security;

[0081] Data authorization unit: used for identity authorization management of external opening of various data in the system, and calling the data storage unit to save related information;

[0082] Block chain system: used for providing underlying block chain data storage services, to meet the data security isolation, high concurrency and high availability requirements of the industrial application security management system.

[0083] In the embodiments of the present application, edge computing (EC) can be added to the API management system, the computing capability and data storage capability are pushed to the edge of the network, the API access information is processed locally at the edge node, the business processing timeliness is improved, the data transmission delay is reduced, and the burden of the center server is reduced, for reference Figure 4 , Figure 4 The network architecture schematic diagram of the industrial application security management system provided in the embodiments of the present application is as shown in Figure 4As shown, the industrial application security management system includes a cloud center, an edge node, and a gateway, wherein the cloud center is configured to participate in registration, identity certificate issuance, and data storage of each business system or user of the industrial application security management system; the edge node is a convergence node of an edge area where an industrial application security participant is located, and is configured to participate in participant identity authentication, data collection, and storage; and the gateway is configured to provide IaaS resources of a deployment infrastructure of the industrial application and the security management system, to interface with various industrial business systems in a southbound direction, to provide APIs, to be responsible for API application data access, to interface with the edge computing node in a northbound direction, to aggregate various data of the industrial application system, and to complete a computing task as the edge computing node.

[0084] In the embodiments of the present application, the business system can be directly used as an edge node, or an edge node can be newly deployed in the business system. In actual application, the design can be performed according to actual needs, and the embodiments of the present application do not limit this.

[0085] Reference Figure 5 , Figure 5 The network topology structure of the blockchain system provided by the embodiments of the present application is shown in FIG. 1. Figure 5 As shown, the cloud center can also be used as a blockchain node, and is configured to participate in registration, identity certificate issuance, and data storage of each business system or user of the industrial application security management system; the blockchain node is configured to provide a BaaS service for the industrial application security management system; in the embodiments of the present application, the blockchain node in the blockchain system is deployed in the business system, and the business system can be directly used as a blockchain node. If the business system is deployed with an edge node, the edge node can also be directly used as a blockchain node, or a blockchain node can be newly deployed in the business system. In actual application, the design can be performed according to actual needs, and the embodiments of the present application do not limit this. The gateway can be an industrial intelligent security gateway, and is configured to provide IaaS resources of a deployment infrastructure of the industrial security management business, to interface with various industrial business systems in a southbound direction, to provide APIs, to be responsible for application data access, to interface with the edge computing node in a northbound direction, to aggregate various data of the industrial application system, and to complete a computing task as the edge computing node.

[0086] In the embodiments of the present application, the blockchain system adopts a sub-chain technology, and different block sub-chains load different API businesses. Reference is made to FIG. 2. Figure 6 , Figure 6 The software architecture of the block sub-chain provided by the embodiments of the present application is shown in FIG. 3. Figure 6 As shown, the block sub-chain includes:

[0087] The smart contract interface is a smart contract service interface of the block sub-chain.

[0088] Identity authentication unit: used to provide blockchain node identity authentication management function, only the node passing the identity authentication can access the blockchain system and obtain relevant data; the identity authentication management function is realized based on X.509 identity certificate, and the X.509 identity certificate is extended to carry Security ID, and different sub-chains are distinguished based on Security ID, each sub-chain is used to deploy different business, and the block sub-chains are isolated from each other through identity certificates to meet the high security and high concurrency requirements;

[0089] Node management unit: calculate the security status (security protection level, node call load, API risk level) of the block sub-chain access node, update once every x seconds, and provide for the consensus algorithm, x can be configured through a configuration file, and the default value is 5;

[0090] Consensus algorithm unit: used to provide a new consensus algorithm, in order to ensure the security of the block node, meet the system stability and security requirements, based on the security status (security protection level, node call load, API security risk level) of the node, the following consensus algorithm is designed:

[0091] From the genesis block, the security status (security protection level, node call load, API security risk level) of the blockchain node is obtained through the node management unit, the weight value W = security protection level * a + node call load * b + API security risk level * c, a is the first weight coefficient corresponding to the security protection level, b is the second weight coefficient corresponding to the call load, and c is the third weight coefficient corresponding to the API security risk level, all the blockchain nodes in the block sub-chain are sorted according to the weight value, and the first 3f+1 nodes are selected to participate in the sorting service and block according to the pBFT algorithm; after completing f new blocks, the consensus nodes and block nodes are reselected according to the weight value of the blockchain node; wherein the security protection level can be set according to the standard, and is determined according to the business system level protection compliance requirements; the node call load is calculated according to the current CPU, memory and storage usage of the business system corresponding to the blockchain node, and the calculation method is: 1-CPU usage rate * memory usage rate * storage usage rate, the higher the CPU, memory and storage usage, the later the ranking; additional settings can also be added to improve processing efficiency, such as when the CPU, memory and storage usage of the business system reaches 95%, the qualification of the blockchain node corresponding to the business system is cancelled;

[0092] The API security risk level is calculated by weighting the risk levels of APIs exposed by the current node. For example, the risk values of the APIs can be determined according to the number of sensitive data exposed by each API, and the risk values of the APIs are weighted to obtain the API security risk level of the business system. For example, when an API does not expose sensitive data, the risk value of the API is set to 100, which is a low security risk. When an API exposes one piece of sensitive data, the risk value of the API is set to 60, which is a medium security risk. When an API exposes two pieces of sensitive data, the risk value of the API is set to 30, which is a high security risk. When an API exposes three or more pieces of sensitive data, the risk value of the API is set to 10, which is an extremely high security risk. The risk values of all APIs of the business system are added and divided by the number of APIs to calculate the weighted average value of the API risk level of the business system, which is the API security risk level of the business system.

[0093] The values of a, b, and c can be configured by a configuration file according to the attribute requirements of the business of the business sub-chain, and online modification is supported. They can be set to any non-negative number, and the default values are all 1. For example, if the actual business needs to focus on the security protection level, the value of a can be set to be greater than b and c. For example, if the actual business needs to focus on the resource call load, the value of b can be set to be greater than a and c. For example, if the actual business needs to focus on the API risk, the value of c can be set to be greater than a and b.

[0094] f can be configured by a configuration file and supports online modification. It can be set to any integer greater than or equal to 2, and the default value is 2. In combination with the business scale and system concurrency requirements, when the number of participants is less than or equal to 20, it is set to 2, when the number of participants is greater than 20 and less than or equal to 50, it is set to 3, and when the number of participants is greater than 50, it is set to 4.

[0095] The password suite unit is used to provide symmetric encryption, asymmetric encryption, digital signature, and other password suites for identity authentication, consensus algorithm, transaction management, block management, network management, and other units to call;

[0096] The transaction management unit is used to manage various types of supply chain transaction information submitted by the supply chain system, and is called by the consensus algorithm unit, block management unit, and other units;

[0097] The block management unit is used to locally manage the block information submitted by the consensus algorithm unit and received by the network management unit;

[0098] The network management unit is used to provide peer-to-peer (P2P) network functions to complete the transmission of node management, consensus algorithm, transaction management, block management, and other unit information;

[0099] Storage management unit: used for providing storage services for node management, transaction management, block management and other units.

[0100] The blockchain system provided by the embodiment of the application adopts a sub-chain technology, different block sub-chains load different services, the central cloud is combined with the blockchain, the service system selectively accesses the blockchain system according to requirements, the flexibility of the system is improved, the service sub-chain completes related specific services and shares the ledger among related participants, the service sub-chains are mutually isolated, concurrently executed, and maintain respective ledger information, thereby meeting the high concurrency requirements of services.

[0101] Reference Figure 7 , Figure 7 The business flowchart of the API management system provided by the embodiment of the application is shown in FIG. 1. Figure 7 The API management system includes an industrial application security management system and a blockchain system, the industrial application security management system is responsible for unified management of APIs of upstream and downstream participants of industrial applications, and is composed of a front-end DashBoard page, identity management, API information input, API information reading, node management, event management, log management, data authorization, data storage and other units, the cloud center management platform and the participants such as upstream and downstream enterprises of industrial applications call different units through the page to complete identity registration, data input and other work; related data is stored through the blockchain system by calling the data storage unit.

[0102] In the embodiment of the application, the blockchain system includes a plurality of sub-chains, for example, an identity management sub-chain, a service sub-chain A and a service sub-chain B; wherein the service sub-chain A is used for user registration API information registration; the service sub-chain B is used for specific service API information registration.

[0103] When a new service system accesses the API management system, the new service system accesses the gateway through a wired or wireless manner, performs identity authentication through an interface of the identity management sub-chain, if identity authentication information is stored in a blockchain node of the identity management sub-chain, a successful authentication result is directly returned, otherwise, a cloud center node interface getCenterAuth(int userToken, int SecurityID) is called to perform identity query, if the cloud center queries that the new service system is not registered, the new service system is prompted to register first; if the new service system is registered, the cloud center returns service system identity information, simultaneously, a blockchain node corresponding to the service system is added to the identity management and the new service system applies to join a service sub-chain corresponding to the service, and related identity and service information are synchronized to an edge node, and edge domain migration information synchronization is completed.

[0104] When the user registers API information, the industrial application security management system calls the interface of the business subchain A to register API, store data and chain, the business subchain A first calls the identity management subchain interface getID(int userToken, int SecurityID) to verify the identity information of the business system, and after verification, the user registers API information storage is completed by calling the business subchain A blockchain system interface, the consensus node is selected by the consensus node selection method provided by the embodiment of the application, the block is generated by the consensus algorithm, and is synchronized between different nodes.

[0105] When the user registers specific business API information, the industrial application security management system calls the interface of the business subchain B to register API, store data and chain, the business subchain B first calls the identity management subchain interface getID(int userToken, int SecurityID) to verify the identity information of the business system, and after verification, the user business API information storage is completed by calling the business subchain B blockchain system interface, the consensus node is selected by the consensus node selection method provided by the embodiment of the application, the block is generated by the consensus algorithm, and is synchronized between different nodes.

[0106] The industrial application business system calls different block subchains according to the API business type, obtains data, processes API business, and converges and displays on the front-end page.

[0107] The embodiment of the application also provides a consensus node selection device, referring to Figure 8 , Figure 8 The structure diagram of the formula node selection device provided by the embodiment of the application, the consensus node selection device in the embodiment, comprising:

[0108] The selection unit is used for selecting the blockchain node participating in the consensus algorithm in the block subchain according to the weight value of each blockchain node in the block subchain; the weight value represents the security situation of the corresponding blockchain node; wherein,

[0109] Different block subchains are responsible for different API businesses, and the blockchain nodes in the same block subchain are deployed in the business systems of the upstream and downstream enterprises participating in the same API business, and the same API business is the API business responsible for the block subchain.

[0110] In the embodiment of the application, the weight value of the blockchain node is determined by the first information and / or the second information, the first information represents the security situation of the business system where the blockchain node is deployed, and the second information represents the load situation of the business system where the blockchain node is deployed.

[0111] In an embodiment of the present application, the first information includes a security protection level of the business system and / or an API security risk level of the business system; and the second information includes a calling load of the business system.

[0112] In an embodiment of the present application, the selection unit is configured to set a first weight coefficient corresponding to the security protection level, a second weight coefficient corresponding to the calling load, and a third weight coefficient corresponding to the API security risk level; and calculate the weight value of the blockchain node according to the security protection level, the calling load, and the API security risk level of the business system to which the blockchain node is deployed, and the first weight coefficient, the second weight coefficient, and the third weight coefficient.

[0113] In an embodiment of the present application, the security protection level of the business system is a preset value; the calling load of the business system is determined by load information of the business system; the load information includes CPU usage, memory usage, and storage usage; and the API security risk level of the business system is determined by sensitive data exposed by each API of the business system.

[0114] In an embodiment of the present application, the consensus algorithm is a pBFT algorithm, and the selection unit is configured to select, according to the weight values of the blockchain nodes in the block subchain, the first 3f+1 blockchain nodes with the largest weight values in the block subchain as the blockchain nodes participating in the consensus algorithm in the block subchain, where f is a preset value.

[0115] In an embodiment of the present application, the selection unit is configured to reselect the blockchain nodes participating in the consensus algorithm in the block subchain after the block subchain completes f new blocks.

[0116] In an embodiment of the present application, if the value of f is not configured, the value of f is 2; if the number of nodes of the block subchain is less than or equal to 20, the value of f is configured as 2; if the number of nodes of the block subchain is greater than 20 and less than or equal to 50, the value of f is configured as 3; and if the number of nodes of the block subchain is greater than 50, the value of f is configured as 4.

[0117] Those skilled in the art should understand that, Figure 8 The implementation functions of each unit in the illustrated consensus node selection apparatus can be understood with reference to the related descriptions of the foregoing method. Figure 8 The functions of each unit in the illustrated consensus node selection apparatus can be implemented by a program running on a processor, or by a specific logic circuit.

[0118] Figure 9 FIG. 9 is a schematic structural diagram of an electronic device 900 according to an embodiment of the present application. Figure 9The electronic device 900 shown includes a processor 910, which can call and run a computer program from a memory to implement the method in the embodiments of the present application.

[0119] Optionally, as shown in the figure, Figure 9 The electronic device 900 shown can also include a memory 920. The processor 910 can call and run a computer program from the memory 920 to implement the method in the embodiments of the present application.

[0120] The memory 920 can be a separate device independent of the processor 910, or can be integrated in the processor 910.

[0121] Optionally, as shown in the figure, Figure 9 The electronic device 900 shown can also include a transceiver 930, which the processor 910 can control to communicate with other devices, specifically, to send information or data to other devices, or receive information or data sent by other devices.

[0122] The transceiver 930 can include a transmitter and a receiver. The transceiver 930 can further include an antenna, and the number of antennas can be one or more.

[0123] The electronic device 900 can be specifically a consensus node selection apparatus of the embodiments of the present application, and the electronic device 900 can implement the corresponding processes implemented by the consensus node selection apparatus in each method of the embodiments of the present application. For the sake of brevity, it will not be repeated here.

[0124] Exemplarily, the embodiments of the present application also provide a computer program product, which includes a computer program executable by the processor 910 of the communication device 900 to complete the steps of any of the preceding methods.

[0125] Figure 10 is a schematic structural diagram of a chip of the embodiments of the present application. Figure 10 The chip 1000 shown includes a processor 1010, which can call and run a computer program from a memory to implement the method in the embodiments of the present application.

[0126] Optionally, as shown in the figure, Figure 10 The chip 1000 shown can also include a memory 1020. The processor 1010 can call and run a computer program from the memory 1020 to implement the method in the embodiments of the present application.

[0127] The memory 1020 can be a separate device independent of the processor 1010, or can be integrated in the processor 1010.

[0128] Optionally, the chip 1000 can further include an input interface 1030. The processor 1010 can control the input interface 1030 to communicate with other devices or chips, and specifically, can obtain information or data sent by other devices or chips.

[0129] Optionally, the chip 1000 can further include an output interface 1040. The processor 1010 can control the output interface 1040 to communicate with other devices or chips, and specifically, can output information or data to other devices or chips.

[0130] The chip can be applied to the electronic device 900 in the embodiments of the present application, and the chip can implement the corresponding processes implemented by the electronic device 900 in the various methods of the embodiments of the present application. For brevity, details are not repeated here.

[0131] It should be understood that the chip mentioned in the embodiments of the present application can also be referred to as a system chip, a chip system, or a system on chip, etc.

[0132] It should be understood that the processor of the embodiments of the present application can be an integrated circuit chip with signal processing capability. In the implementation process, each step of the above method embodiments can be completed by integrated logic circuits or software form instructions in the hardware of the processor. The processor mentioned above can be a general processor, a digital signal processor (Digital Signal Processor, DSP), an application specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field programmable gate array (Field Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. Each method, step and logic block disclosed in the embodiments of the present application can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in conjunction with the embodiments of the present application can be directly embodied as a hardware code processor for execution, or a combination of hardware and software units in the code processor for execution. The software unit can be located in a random access memory, a flash memory, a read-only memory, a programmable read-only memory, an electrically erasable programmable memory, a register, etc. The storage medium is in the memory, and the processor reads the information in the memory, and combines the hardware to complete the steps of the above method.

[0133] It is to be understood that the memory in the embodiments of the present application can be a volatile memory or a nonvolatile memory, or can include both volatile and nonvolatile memory. Among them, the nonvolatile memory can be a read-only memory (Read-Only Memory, ROM), a programmable read-only memory (Programmable ROM, PROM), an erasable programmable read-only memory (Erasable PROM, EPROM), an electrically erasable programmable read-only memory (Electrically EPROM, EEPROM) or a flash memory. The volatile memory can be a random access memory (Random Access Memory, RAM) used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as static random access memory (Static RAM, SRAM), dynamic random access memory (Dynamic RAM, DRAM), synchronous dynamic random access memory (Synchronous DRAM, SDRAM), double data rate synchronous dynamic random access memory (Double Data Rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (Enhanced SDRAM, ESDRAM), synchronous link dynamic random access memory (Synchlink DRAM, SLDRAM) and direct memory bus random access memory (Direct Rambus RAM, DR RAM). It should be noted that the memory of the system and method described herein is intended to include, but not limited to, these and any other suitable types of memory.

[0134] It should be understood that the above-mentioned memory is exemplary but not limiting, for example, the memory in the embodiments of the present application can also be static random access memory (static RAM, SRAM), dynamic random access memory (dynamic RAM, DRAM), synchronous dynamic random access memory (synchronous DRAM, SDRAM), double data rate synchronous dynamic random access memory (double data rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous link dynamic random access memory (synch link DRAM, SLDRAM) and direct memory bus random access memory (Direct Rambus RAM, DR RAM) and the like. That is, the memory in the embodiments of the present application is intended to include, but not limited to, these and any other suitable types of memory.

[0135] The embodiment of the present application further provides a storage medium for storing a computer program. The storage medium can be applied to the electronic device 900 in the embodiment of the present application, and the computer program causes the computer to execute the corresponding procedures realized by the electronic device 900 in the various methods of the embodiment of the present application. For brevity, details are not repeated here.

[0136] Those skilled in the art can clearly understand that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be realized by electronic hardware or a combination of computer software and electronic hardware. Whether the functions are realized in hardware or software mode depends on the specific application and design constraints of the technical solution. The skilled person can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0137] Those skilled in the art can clearly understand that, for the convenience and brevity of the description, the specific working processes of the above-described system, device and unit can refer to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0138] In several embodiments provided in the present application, it should be understood that the disclosed system, device and method can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of the units is only a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some interface, device or unit, and can be electrical, mechanical or other forms.

[0139] The units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, that is, they can be located in one place, or can be distributed on a plurality of network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0140] In addition, each functional unit in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit.

[0141] If the functions are implemented in the form of software function units and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application or the parts of the technical solutions that essentially contribute to the prior art or the parts of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or an electronic device 900, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media that can store program codes.

[0142] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art can easily think of changes or replacements within the technical scope disclosed in the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A consensus node selection method, characterized in that, include: Based on the weight values ​​of each blockchain node in the sub-chain, blockchain nodes participating in the consensus algorithm are selected; the weight values ​​represent the security status of the corresponding blockchain nodes; wherein... Different blockchain subchains are responsible for different application programming interface (API) services; blockchain nodes in the same blockchain subchain are deployed in the business systems of upstream and downstream enterprises participating in the same API service, and the same API service is the API service that the blockchain subchain is responsible for. The weight value of the blockchain node is obtained in the following way: Set the first weight coefficient corresponding to the security protection level, the second weight coefficient corresponding to the call load, and the third weight coefficient corresponding to the API security risk level; The weight value of the blockchain node is calculated based on the security protection level, call load, and API security risk level of the business system in which the blockchain node is deployed, as well as the first weight coefficient, the second weight coefficient, and the third weight coefficient.

2. The method according to claim 1, characterized in that, The security protection level of the business system is a preset value; The call load of the business system is determined by the load information of the business system; the load information includes: CPU utilization, memory utilization, and storage utilization. The security risk level of the API of the business system is determined by the sensitive data exposed by each API of the business system.

3. The method according to claim 1 or 2, characterized in that, The consensus algorithm is the pBFT algorithm. The step of selecting blockchain nodes participating in the consensus algorithm in the sub-chain based on the weight values ​​of each blockchain node in the sub-chain includes: Based on the weight values ​​of each blockchain node in the sub-chain, the top 3f+1 blockchain nodes with the largest weight values ​​in the sub-chain are selected as the blockchain nodes participating in the consensus algorithm in the sub-chain, where f is a preset value.

4. The method according to claim 3, characterized in that, Also includes: After the subchain completes f new blocks, the blockchain nodes participating in the consensus algorithm in the subchain are reselected.

5. The method according to claim 4, characterized in that, If the value of f is not configured, the value of f is 2; If the number of nodes in the block subchain is less than or equal to 20, the value of f is configured as 2; If the number of nodes in the block subchain is greater than 20 and less than or equal to 50, the value of f is configured as 3; If the number of nodes in the block subchain is greater than 50, the value of f is configured as 4.

6. An API management system, comprising: Industrial application security management systems and blockchain systems; The blockchain system includes multiple sub-chains; Different subchains are responsible for different API services, and blockchain nodes in the same subchain are deployed in the business systems of upstream and downstream enterprises participating in the same business. The industrial application security management system is used to connect to and collect API data from business systems, and call the blockchain system to store the API data. When a first API business request is received from a business system, the system calls the block sub-chain corresponding to the first API business, so that the block sub-chain corresponding to the first API business selects a consensus node using the consensus node selection method as described in any one of claims 1 to 5, and performs block production and data sharing operations through the consensus algorithm.

7. A consensus node selection device, characterized in that, include: Selection unit: used to select blockchain nodes participating in the consensus algorithm in the sub-chain based on the weight values ​​of each blockchain node in the sub-chain; the weight values ​​represent the security status of the corresponding blockchain node; wherein, Different blockchain subchains are responsible for different API services. Blockchain nodes in the same blockchain subchain are deployed in the business systems of upstream and downstream enterprises participating in the same API service. The same API service is the API service that the blockchain subchain is responsible for. The weight value of the blockchain node is obtained in the following way: Set the first weight coefficient corresponding to the security protection level, the second weight coefficient corresponding to the call load, and the third weight coefficient corresponding to the API security risk level; The weight value of the blockchain node is calculated based on the security protection level, call load, and API security risk level of the business system in which the blockchain node is deployed, as well as the first weight coefficient, the second weight coefficient, and the third weight coefficient.

8. An electronic device, characterized in that, include: A processor and a memory, the memory for storing a computer program, the processor for calling and running the computer program stored in the memory to perform the consensus node selection method as described in any one of claims 1 to 5.

9. A chip, characterized in that, include: A processor for retrieving and running a computer program from memory, causing a device equipped with the chip to perform the consensus node selection method according to any one of claims 1 to 5.

10. A storage medium, characterized in that, Used to store a computer program that causes a computer to perform the consensus node selection method as described in any one of claims 1 to 5.

11. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the consensus node selection method as described in any one of claims 1 to 5.

Images