A data access method and device, and a storage medium

Abstract

The application discloses a data access method and device and a storage medium, relates to the technical field of secure communication, and can reduce the possibility of reading pipeline data by illegal equipment, thereby improving the security of pipeline data. The data access method comprises the following steps: a first pipe network server acquires first information, the first information comprising a digital certificate of an access device and a certificate of a first trust anchor; the first trust anchor is a trust anchor of a blockchain where the access device is located, and the first trust anchor is used for generating the digital certificate of the access device; the first pipe network server sends second information to the access device under the condition that the verification of the digital certificate of the access device is passed and the certificate of the first trust anchor has been included in the blockchain where the first pipe network server is located, the second information being used for indicating that the access device is allowed to read pipeline data in the blockchain where the first pipe network server is located.

Description

Technical Field

[0001] This application relates to the field of secure communication technology, and in particular to a data access method, apparatus and storage medium. Background Technology

[0002] In the construction, operation, and maintenance of oil and gas pipelines, blockchain can be used to record data related to pipeline design, construction, inspection, and maintenance. Through blockchain's immutability and traceability, the integrity and accuracy of pipeline data throughout its entire lifecycle can be ensured, facilitating pipeline asset management and improving the safety and reliability of pipeline operations.

[0003] However, during cross-blockchain communication, due to the transparency of information in blockchain technology, pipeline data in the blockchain may be accessed by devices that access the blockchain, thereby reducing the security of pipeline data stored in the blockchain. Summary of the Invention

[0004] The purpose of this application is to provide a data access method, apparatus, and storage medium that can minimize the possibility of unauthorized devices reading pipeline data, thereby improving the security of pipeline data.

[0005] To achieve the above objectives, this application adopts the following technical solution:

[0006] In a first aspect, this application provides a data access method applied to a first pipeline server. The method includes: obtaining first information, the first information including a digital certificate of an access device and a certificate of a first trust anchor; the first trust anchor is a trust anchor of the blockchain where the access device is located, and the first trust anchor is used to generate a digital certificate of the access device; and, after the verification of the digital certificate is successful and the verification that the blockchain where the first pipeline server is located includes the certificate of the first trust anchor, sending second information to the access device, the second information being used to instruct the access device to read pipeline data in the blockchain where the first pipeline server is located.

[0007] In the verification method provided in this application embodiment, a first pipeline server obtains the digital certificate of the accessing device and the certificate of the first trust anchor. The first pipeline server verifies the legitimacy of the accessing device through the digital certificate of the accessing device. The first pipeline server determines whether the blockchain where the accessing device is located is trusted by the blockchain where the first pipeline server is located by verifying whether the certificate of the first trust anchor exists in the blockchain where the first pipeline server is located. If the first pipeline server determines that the accessing device is a legitimate device and determines that the blockchain where the accessing device is located is trusted by the blockchain where the first pipeline server is located, the first pipeline server sends second information to the accessing device to instruct the accessing device to read the pipeline data in the blockchain where the first pipeline server is located.

[0008] In other words, before the first pipeline server allows an access device to read pipeline data in the blockchain where the first pipeline server is located, the first pipeline server needs to perform dual verification on the access device and the blockchain where the access device is located, in order to minimize the possibility of unauthorized devices reading pipeline data, thereby protecting the pipeline data and reducing the risk of pipeline data leakage.

[0009] In one possible implementation, the method further includes: receiving an access request from an access device, the access request requesting access to pipeline data in the blockchain where the first pipeline server resides, the access request including a digital certificate; generating a first random number for the access device based on a random number generator, and generating a first timestamp based on the first random number; the random number generator including a pseudo-random number generator and / or a hardware-based random number generator, the first timestamp being used to record the time of generating the first random number; publishing the first random number and the first timestamp in the blockchain where the first pipeline server resides; and sending the first random number and the first timestamp to the access device.

[0010] In one possible implementation, the method further includes: receiving a first signature and a digital certificate from an access device, wherein the first signature is obtained by signing the digital certificate, a first random number, and a first timestamp based on the access device's private key, and the first signature includes a first hash value; verifying the first signature based on the public key, the first random number, and the first timestamp in the digital certificate to obtain a second hash value; and determining that the verification of the digital certificate is successful if the second hash value is equal to the first hash value and the valid credentials of the digital certificate are verified.

[0011] In one possible implementation, the method further includes: sending third information to a second network server, the third information including a second random number, a sending request, and a second timestamp, the sending request being used to request a certificate for the first trust anchor, the second network server being a network server for the blockchain where the access device resides, and the second timestamp being used to record the time when the second random number was generated; receiving the third random number and the certificate for the first trust anchor from the second network server; and verifying whether the certificate for the first trust anchor is already included in the blockchain where the first network server resides if the third random number is equal to the second random number.

[0012] In one possible implementation, querying the certificate of the first trust anchor in the blockchain where the first pipeline server is located includes: generating the hash value of the certificate of the first trust anchor based on a hash algorithm; the hash algorithm includes any one of the following: SHA-256 algorithm, SHA-512 algorithm, MD5 algorithm; and querying the hash value of the certificate of the first trust anchor in the blockchain where the first pipeline server is located.

[0013] In one possible implementation, generating the hash value of the certificate of the first trust anchor based on a hash algorithm includes: converting the encoding format of the certificate of the first trust anchor to obtain the converted certificate of the first trust anchor; determining the key identifier content in the converted certificate of the first trust anchor, and using the key identifier content as input to the hash algorithm to obtain the hash value of the certificate of the first trust anchor.

[0014] In one possible implementation, the second information includes a cross-domain blockchain certificate for the accessing device. The method further includes: sending a fourth message to a second trust anchor, the second trust anchor being a trust anchor of the blockchain where the first pipeline server resides, the fourth message being used to instruct the generation of a cross-domain blockchain certificate; receiving the cross-domain blockchain certificate from the second trust anchor; and publishing the cross-domain blockchain certificate in the blockchain where the first pipeline server resides.

[0015] Secondly, this application provides a data access device, which includes: a communication unit and a processing unit; the processing unit is configured to instruct the communication unit to obtain first information, the first information including a digital certificate of the access device and a certificate of a first trust anchor; the first trust anchor is a trust anchor of the blockchain where the access device is located, and the first trust anchor is used to generate the digital certificate of the access device; the processing unit is further configured to instruct the communication unit to send second information to the access device after the verification of the digital certificate is successful and the verification that the blockchain where the first pipeline server is located has included the certificate of the first trust anchor, the second information being used to instruct the access device to read pipeline data in the blockchain where the first pipeline server is located.

[0016] In one possible implementation, the processing unit is further configured to instruct the communication unit to receive an access request from the access device, the access request being for requesting access to pipeline data in the blockchain where the first pipeline server is located, the access request including a digital certificate; the processing unit is further configured to generate a first random number for the access device based on a random number generator, and generate a first timestamp based on the first random number; the random number generator includes a pseudo-random number generator and / or a hardware-based random number generator, the first timestamp being used to record the time of generating the first random number; the processing unit is further configured to publish the first random number and the first timestamp in the blockchain where the first pipeline server is located; the processing unit is further configured to instruct the communication unit to send the first random number and the first timestamp to the access device.

[0017] In one possible implementation, the processing unit is further configured to instruct the communication unit to receive a first signature and a digital certificate from the access device, wherein the first signature is obtained by signing the digital certificate, a first random number, and a first timestamp based on the private key of the access device, and the first signature includes a first hash value; the processing unit is further configured to verify the first signature based on the public key in the digital certificate, the first random number, and the first timestamp to obtain a second hash value; the processing unit is further configured to determine that the verification of the digital certificate is successful if the second hash value is equal to the first hash value and the valid credentials of the digital certificate are verified.

[0018] In one possible implementation, the processing unit is further configured to instruct the communication unit to send third information to the second network server. The third information includes a second random number, a sending request, and a second timestamp. The sending request is used to request the certificate of the first trust anchor. The second network server is the network server of the blockchain where the access device is located. The second timestamp is used to record the time when the second random number was generated. The processing unit is further configured to instruct the communication unit to receive the third random number and the certificate of the first trust anchor from the second network server. The processing unit is further configured to verify whether the certificate of the first trust anchor is already included in the blockchain where the first network server is located, if the third random number is equal to the second random number.

[0019] In one possible implementation, the processing unit is further configured to generate a hash value of the certificate of the first trust anchor based on a hash algorithm; the hash algorithm includes any one of the following: SHA-256 algorithm, SHA-512 algorithm, MD5 algorithm; the processing unit is further configured to query the hash value of the certificate of the first trust anchor in the blockchain where the first pipeline server is located.

[0020] In one possible implementation, the processing unit is further configured to perform encoding format conversion on the certificate of the first trust anchor to obtain the converted certificate of the first trust anchor; the processing unit is further configured to determine the key identifier content in the converted certificate of the first trust anchor, and use the key identifier content as input to a hash algorithm to obtain the hash value of the certificate of the first trust anchor.

[0021] In one possible implementation, the processing unit is further configured to instruct the communication unit to send fourth information to the second trust anchor, the second trust anchor being the trust anchor of the blockchain where the first pipeline server is located, and the fourth information being used to instruct the generation of a cross-domain blockchain certificate; the processing unit is further configured to instruct the communication unit to receive the cross-domain blockchain certificate from the second trust anchor; the processing unit is further configured to publish the cross-domain blockchain certificate in the blockchain where the first pipeline server is located.

[0022] Thirdly, this application provides a data access device, which includes: a processor and a communication interface; the communication interface and the processor are coupled, and the processor is used to run computer programs or instructions to implement the data access method as described in the first aspect and any possible implementation thereof.

[0023] Fourthly, this application provides a computer-readable storage medium storing instructions that, when executed on a terminal, cause the terminal to perform the data access method described in the first aspect and any possible implementation thereof.

[0024] Fifthly, this application provides a computer program product containing instructions that, when run on a data access device, cause the data access device to perform the data access method as described in the first aspect and any possible implementation thereof.

[0025] In a sixth aspect, this application provides a chip including a processor and a communication interface, the communication interface being coupled to the processor, the processor being used to run computer programs or instructions to implement the data access method as described in the first aspect and any possible implementation thereof.

[0026] Specifically, the chip provided in this application also includes a memory for storing computer programs or instructions. Attached Figure Description

[0027] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0028] Figure 1 This is a schematic diagram of the structure of a data access system provided in an embodiment of this application;

[0029] Figure 2 This is a schematic diagram illustrating the composition of a data access device provided in an embodiment of this application;

[0030] Figure 3 A flowchart illustrating a data access method provided in an embodiment of this application;

[0031] Figure 4 A flowchart illustrating another data access method provided in this application embodiment;

[0032] Figure 5 A flowchart illustrating another data access method provided in this application embodiment;

[0033] Figure 6 A flowchart illustrating another data access method provided in this application embodiment;

[0034] Figure 7 A flowchart illustrating another data access method provided in this application embodiment;

[0035] Figure 8 A flowchart illustrating another data access method provided in this application embodiment;

[0036] Figure 9 A flowchart illustrating another data access method provided in this application embodiment;

[0037] Figure 10 An example diagram illustrating the modules included in the blockchain where the first pipeline server is located, provided as an embodiment of this application;

[0038] Figure 11 This is a schematic diagram of another data access device provided in an embodiment of this application. Detailed Implementation

[0039] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0040] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0041] In embodiments of this application, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, article, or apparatus that includes that element.

[0042] In the embodiments of this application, the terms "exemplary" or "for example" are used to indicate that something is an example, illustration, or description. Any embodiment or design that is described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design. Specifically, the use of the terms "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0043] In the description of this specification, specific features, structures, materials, or characteristics may be combined in any suitable manner in one or more embodiments or examples.

[0044] With the rapid development of internet technology, information security has received widespread attention. The decentralized nature of blockchain technology and the difficulty in tampering with the stored information have made blockchain technology a focus of attention from all sectors.

[0045] Using blockchain technology to store data can effectively alleviate data congestion caused by high centralization. In a blockchain, data is distributed and stored across multiple nodes, achieving decentralized storage characteristics. Through cross-domain technology or protocols, a node in one blockchain can also store data on a node in another blockchain, further expanding data storage and interaction capabilities.

[0046] Furthermore, blockchain technology possesses robust protocols (e.g., data verification protocols), enabling nodes in the blockchain not only to record data but also to participate in data verification. Data can only be stored in the blockchain after it has passed the verification of a majority of nodes. Moreover, data already stored in the blockchain is not easily tampered with; the more data added to the blockchain, the lower the likelihood of tampering.

[0047] With the increasing amount of data on the Internet, blockchain technology is being widely applied in various Internet scenarios.

[0048] For example, blockchain technology can be used to store data related to computer software development. As computer software becomes increasingly complex to perform more functions and improve user experience, developers are creating more and more data during the development process. By using blockchain to store this data, developers can reduce the risk of data modification and copying, thereby protecting the software and mitigating the risk of it being stolen.

[0049] Furthermore, blockchain technology can also be used to store pipeline data. Relevant departments are responsible for the interconnection of trunk pipelines and other pipelines to ensure a stable supply of energy such as crude oil, refined oil, and natural gas to users. To better construct and manage trunk pipelines, these departments need to store and manage pipeline data. To prevent unauthorized tampering, these departments can use blockchain technology to store pipeline data within a specific operational area. This data can include the pipeline's geographical location, operational status, historical maintenance records, and equipment data.

[0050] However, while blockchain technology improves the security and reliability of stored data, its decentralized nature means that every node in the blockchain can access the data stored within it.

[0051] In other words, when relevant departments use blockchain technology to store pipeline data within their operating areas, any device capable of accessing the blockchain can obtain the stored pipeline data, potentially leading to data leaks. Such leaks could disrupt the normal operations of these departments and even pose a potential threat to energy security.

[0052] With the development of information technology and intelligent systems, pipeline data stored by relevant departments is at risk of being stolen. The leakage of some sensitive pipeline data could affect the normal operation of these departments and even pose a potential threat to energy security.

[0053] In view of this, this application provides a data access method in which a first pipeline server obtains the digital certificate of the accessing device and the certificate of the first trust anchor. The first pipeline server verifies the legitimacy of the accessing device through the digital certificate of the accessing device. The first pipeline server determines whether the blockchain where the accessing device is located is trusted by the blockchain where the first pipeline server is located by verifying whether the certificate of the first trust anchor exists in the blockchain where the first pipeline server is located. If the first pipeline server determines that the accessing device is a legitimate device and determines that the blockchain where the accessing device is located is trusted by the blockchain where the first pipeline server is located, the first pipeline server sends second information to the accessing device to instruct the accessing device to read pipeline data in the blockchain where the first pipeline server is located.

[0054] In other words, before the first pipeline server allows an access device to read pipeline data in the blockchain where the first pipeline server is located, the first pipeline server needs to perform dual verification on the access device and the blockchain where the access device is located, in order to minimize the possibility of unauthorized devices reading pipeline data, thereby protecting the pipeline data and reducing the risk of pipeline data leakage.

[0055] For example, Figure 1The diagram shows a schematic of the structure of a data access system 10 provided in an embodiment of this application. The data access system 10 may include at least one first network server 101 and at least one access device 102, wherein the first network server 101 may be communicatively connected to the access device 102. Figure 1 Only one first network server 101 and one access device 102 are shown in the illustration. This application embodiment does not limit the number of first network servers 101 and access devices 102.

[0056] In one possible implementation, a first pipeline server 101 is used to obtain first information, which includes the identity information of the accessing device and the identification information of the blockchain where the accessing device is located; if the verification of the identity information of the accessing device is successful and the blockchain where the first pipeline server is located includes the identification information, the first information is sent to the accessing device, which is used to instruct the accessing device to read the pipeline data in the blockchain where the first pipeline server is located.

[0057] Optionally, the first pipeline server 101 can be deployed in a server cluster within the relevant department, or it can be deployed as a standalone device within the operational scope of the relevant department; this application does not impose any restrictions on this. The first pipeline server 101 can authenticate the access device 102, enabling the access device 102 to read pipeline data only after authentication by the first pipeline server 101, thereby protecting the pipeline data. Furthermore, the first pipeline server 101 can communicate with multiple access devices 102; this application does not impose any restrictions on this.

[0058] Optionally, when the access device 102 needs to read pipeline data within a specific operating area, it can send an access request to the first pipeline server 101 within that operating area. The access device 102 can be a terminal device within a relevant department in different areas, such as a smartphone, tablet, or computer. The access device 102 can also be a terminal device held by an individual or organization; this application does not impose any restrictions on this. Figure 1 The example shown is a computer, with access device 101 as an example.

[0059] It should be noted that, Figure 1 This is just an example framework diagram. Figure 1 The number of nodes included and the names of each device are unlimited, except for... Figure 1In addition to the functional nodes shown, the data access system 10 may also include other nodes, such as a second network server. The second network server is used to receive third information from the first network server 101, wherein the third information is used to request the identification information of the blockchain where the access device is located. The second network server can be the network server of the blockchain where the access device is located. The second network server is also used to send the identification information of the blockchain where the access device is located to the first network server 101, which is not limited in this application.

[0060] The application scenarios of the embodiments in this application are not limited. The system architecture and business scenarios described in the embodiments of this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. As those skilled in the art will know, with the evolution of network architecture and the emergence of new business scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0061] In practical implementation, Figure 1 All the equipment in the middle can be adopted Figure 2 The shown composition structure, or including Figure 2 The components shown. Figure 2 This is a schematic diagram illustrating the composition of a data access device 20 provided in an embodiment of this application. The data access device 20 can be a first network server 101 or a chip or system-on-a-chip within the first network server 101. Alternatively, the data access device 20 can be an access device 102 or a chip or system-on-a-chip within the access device 102. For example... Figure 2 As shown, the data access device 20 may include a processor 201 and a communication line 202.

[0062] Furthermore, the data access device 20 may also include a communication interface 203 and a memory 204. The processor 201, the memory 204, and the communication interface 203 can be connected via a communication line 202.

[0063] The processor 201 can be a central processing unit (CPU), a general-purpose processor, a network processor (NP), a digital signal processor (DSP), a microprocessor, a microcontroller, a programmable logic device (PLD), or any combination thereof. The processor 201 can also be other devices with processing capabilities, such as circuits, devices, or software modules, without limitation.

[0064] Communication line 202 is used to transmit information between the components included in data access device 20.

[0065] Communication interface 203 is used to communicate with other devices or other communication networks. These other communication networks can be Ethernet, radio access network (RAN), wireless local area networks (WLAN), etc. Communication interface 203 can be a module, circuit, communication interface, or any device capable of enabling communication.

[0066] Memory 204 is used to store instructions. These instructions can be computer programs.

[0067] The memory 204 can be a read-only memory (ROM) or other type of static storage device that can store static information and / or instructions; it can also be a random access memory (RAM) or other type of dynamic storage device that can store information and / or instructions; it can also be an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, etc., without limitation.

[0068] It should be noted that the memory 204 can exist independently of the processor 201 or can be integrated with the processor 201. The memory 204 can be used to store instructions, program code, or some data, etc. The memory 204 can be located inside or outside the data access device 20, without limitation. The processor 201 is used to execute the instructions stored in the memory 204 to implement the data access method provided in the following embodiments of this application.

[0069] In one example, processor 201 may include one or more CPUs, such as CPU0 and CPU1 (not shown in the figure).

[0070] As an optional implementation, the data access device 20 includes multiple processors.

[0071] As an optional implementation, the data access device 20 also includes output devices and input devices. For example, input devices are devices such as keyboards, mice, microphones, or joysticks, and output devices are devices such as displays or speakers.

[0072] It should be noted that the data access device 20 can be a desktop computer, laptop computer, network server, mobile phone, tablet computer, wireless terminal, embedded device, chip system, or other device. Figure 2 Equipment with a similar structure. Furthermore... Figure 2 The composition shown does not constitute a basis for this. Figure 1 as well as Figure 2 The limitations of each device in the process, except Figure 2 In addition to the components shown, Figure 1 as well as Figure 2 The various devices may include more or fewer components than illustrated, or combine certain components, or have different component arrangements.

[0073] In this embodiment of the application, the chip system may be composed of chips or may include chips and other discrete devices.

[0074] Furthermore, the actions, terms, etc., involved in the various embodiments of this application can be referenced interchangeably without limitation. The message names or parameter names in the messages exchanged between the various devices in the embodiments of this application are merely examples, and other names may be used in specific implementations without limitation.

[0075] The data access method provided in the embodiments of this application is described below with reference to the accompanying drawings. The actions, terminology, etc., involved in the various embodiments of this application can be referred to mutually without limitation. The message names or parameter names in the messages exchanged between various devices in the embodiments of this application are merely examples; other names may be used in specific implementations without limitation. The actions involved in the various embodiments of this application are merely examples; other names may be used in specific implementations. For example, "included in" in the embodiments of this application can also be replaced with "carried on" or "carried in," etc.

[0076] To address the problems existing in the prior art, this application proposes a data access method that minimizes the possibility of unauthorized devices reading pipeline data, thereby improving the security of pipeline data. For example... Figure 3 As shown, the method includes:

[0077] S301, the first pipeline server obtains the first information.

[0078] The first information includes the digital certificate of the access device and the certificate of the first trust anchor. The first trust anchor is the trust anchor of the blockchain where the access device is located, and the first trust anchor is used to generate the digital certificate of the access device.

[0079] Optionally, this application embodiment does not limit the time for the first network management server to obtain the digital certificate of the accessing device and the certificate of the first trust anchor. That is, the first network management server can simultaneously receive the digital certificate of the accessing device and the certificate of the first trust anchor. The first network management server can also receive the digital certificate of the accessing device and, if the verification of the digital certificate of the accessing device is successful, receive the certificate of the first trust anchor.

[0080] Optionally, the digital certificate for accessing the device may include at least one of the following information: the certificate issuing authority (CA) information, the certificate holder information, the validity period of the digital certificate, the purpose of the digital certificate, the signature algorithm of the digital certificate, or the signature value of the digital certificate, which is not limited in this application.

[0081] S302. After the first network server verifies the access device's digital certificate and confirms that the blockchain containing the first network server includes the certificate of the first trust anchor, it sends the second information to the access device. The access device then receives the second information.

[0082] The second piece of information is used to instruct access devices to read pipeline data in the blockchain where the first pipeline server is located.

[0083] Optionally, the second information can also be used to instruct access devices to read pipeline data stored on the first pipeline server.

[0084] In the verification method provided in this application embodiment, a first pipeline server obtains the digital certificate of the accessing device and the certificate of the first trust anchor. The first pipeline server verifies the legitimacy of the accessing device through the digital certificate of the accessing device. The first pipeline server determines whether the blockchain where the accessing device is located is trusted by the blockchain where the first pipeline server is located by verifying whether the certificate of the first trust anchor exists in the blockchain where the first pipeline server is located. If the first pipeline server determines that the accessing device is a legitimate device and determines that the blockchain where the accessing device is located is trusted by the blockchain where the first pipeline server is located, the first pipeline server sends second information to the accessing device to instruct the accessing device to read the pipeline data in the blockchain where the first pipeline server is located.

[0085] In other words, before the first pipeline server allows an access device to read pipeline data in the blockchain where the first pipeline server is located, the first pipeline server needs to perform dual verification on the access device and the blockchain where the access device is located, in order to minimize the possibility of unauthorized devices reading pipeline data, thereby protecting the pipeline data and reducing the risk of pipeline data leakage.

[0086] As described in the aforementioned S302, the first pipeline server determines the legitimacy of the accessing device based on its digital certificate. In other words, when an accessing device requests to read pipeline data, the first pipeline server needs to authenticate the accessing device. Therefore, if... Figure 4 As shown, the data access method described in the embodiments of this application may further include the following steps S401 to S404.

[0087] S401. The accessing device sends an access request to the first network server. Correspondingly, the first network server receives the access request.

[0088] The access request is used to request access to pipeline data in the blockchain where the first pipeline server is located, and the access request includes the digital certificate of the access device.

[0089] Optionally, the access request may not include the access device's digital certificate. That is, the access device may send its digital certificate to the first network management server independently. In the case where the access device sends its digital certificate to the first network management server independently, this embodiment does not restrict the order in which the access device sends its digital certificate and sends the access request.

[0090] S402. The first network server generates a first random number for the accessing device based on a random number generator, and generates a first timestamp based on the first random number.

[0091] The random number generator includes a pseudo-random number generator and / or a hardware-based random number generator, and the first timestamp is used to record the time when the first random number is generated.

[0092] Understandably, when authenticating access devices, the first network server sends a random number to the access device. Since the random number is dynamically generated—that is, a new random number is generated for each communication—the introduction of the random number increases the complexity of the information transmitted between the first network server and the access device, thus making it difficult for attacking devices to obtain the information transmitted between the first network server and the access device through simple guessing or brute-force methods.

[0093] S403. The first pipeline server publishes the first random number and the first timestamp in the blockchain where the first pipeline server is located.

[0094] Understandably, the first pipeline server publishes random numbers and timestamps on the blockchain where it resides, and this random number and timestamp are then stored on the blockchain. The first pipeline server can determine the corresponding transmitted information and its transmission time by detecting the random numbers and timestamps stored in its blockchain, thus enabling it to identify and reject any duplicate historical transmissions.

[0095] S404. The first network server sends a first random number and a first timestamp to the accessing device. Correspondingly, the accessing device receives the first random number and the first timestamp.

[0096] Understandably, the first network server sends a first random number to the accessing device so that the first network server can subsequently verify the validity of the first random number based on the public key in the accessing device's digital certificate, thereby providing a guarantee for the first network server to determine the legitimacy of the accessing device.

[0097] As described above regarding S302 and S404, the first network server needs to verify the legitimacy of the accessing device. Since the first network server sends a first random number and a first timestamp to the accessing device, it needs to determine whether the accessing device is legitimate based on the accessing device's signature of the first random number and the first timestamp. Therefore, if... Figure 5 As shown, the data access method provided in this application embodiment may include the following S501 to S503.

[0098] S501. The access device sends the first signature and its digital certificate to the first network server. Correspondingly, the first network server receives the first signature and the access device's digital certificate.

[0099] The first signature is obtained by signing the digital certificate, the first random number, and the first timestamp based on the private key of the access device. The first signature includes the first hash value.

[0100] Optionally, the process by which the access device obtains the first signature can be as follows: The access device uses a hash function to perform a hash operation on the access device's digital certificate, a first random number, and a first timestamp to obtain a hash value h. Based on a signature algorithm, the access device uses the private key in the digital certificate to perform a signature operation on the hash value h to obtain a signature value S, where S is the encrypted result of the hash value h, and S is generated by the access device based on the private key in the access device's digital certificate.

[0101] For example, the hash function can be the SHA-256 function or the SM3 function, and the signature algorithm can be the SM9 algorithm. The above is only an exemplary description of the hash function and signature algorithm. The hash function described in the embodiments of this application can also be other functions, and the signature algorithm described in the embodiments of this application can also be other algorithms. This application does not limit these possibilities.

[0102] S502, the first network server verifies the first signature based on the public key, the first random number, and the first timestamp in the access device's digital certificate, and obtains the second hash value.

[0103] Understandably, the first signature is generated by the accessing device using its private key to encrypt the digital certificate, the first random number, and the first timestamp. Therefore, the first pipeline server needs to decrypt the first signature using the public key to obtain the corresponding public key, the first random number, and the first timestamp. The process by which the accessing device encrypts the transmitted information enhances the security of the pipeline data path for the accessing device to access the blockchain where the first pipeline server resides.

[0104] S503. If the second hash value equals the first hash value and the valid credentials of the digital certificate are verified, the first network server determines that the digital certificate has been verified.

[0105] Optionally, the first network server verifies the validity of the digital certificate's credentials as follows: The first network server identifies the validity period of the access device's digital certificate. If the first network server determines that the access device's digital certificate is still valid, then the first network server determines that the validity of the access device's digital certificate's credentials has not expired.

[0106] As described above regarding S301, the first pipeline server needs to obtain the certificate of the first trust anchor. Since the certificate of the first trust anchor is managed by the second pipeline server in the blockchain, the first pipeline server needs to request the second pipeline server to send the certificate of the first trust anchor before receiving it itself. Therefore, as follows... Figure 6 As shown, the data access method provided in this application embodiment may further include the following steps S601 to S603.

[0107] S601, the first network server sends third information to the second network server. Correspondingly, the second network server receives the third information.

[0108] The third information includes a second random number, a sending request, and a second timestamp. The sending request is used to request the certificate of the first trust anchor. The second network server is the network server of the blockchain where the access device is located. The second timestamp is used to record the time when the second random number was generated.

[0109] Understandably, since the trust anchor in a blockchain is responsible for generating and managing the digital certificates of nodes within the blockchain, the trust anchor of the blockchain where the access device resides can generate the digital certificate for the access device. In other words, the first network server requests the second network server to send the trust anchor certificate of the blockchain where the access device resides, so that the first network server can subsequently verify the trust anchor certificate of the blockchain where the access device resides to determine that the trust anchor that issued the digital certificate for the access device is legitimate and trustworthy.

[0110] S602, the second network server sends a third random number and the certificate of the first trust anchor to the first network server. Correspondingly, the first network server receives the third random number and the certificate of the first trust anchor.

[0111] S603. When the third random number equals the second random number, the first pipeline server verifies whether the certificate of the first trust anchor has been included in the blockchain where the first pipeline server is located.

[0112] Furthermore, as one possible implementation, before the first pipeline server verifies whether the certificate of the first trust anchor is included in the blockchain where the first pipeline server resides, the first pipeline server can verify the validity period of the certificate of the first trust anchor. If the first pipeline server detects that the valid credentials of the first trust anchor certificate have expired within the validity period, the first pipeline server can directly confirm that the blockchain where the accessing device resides is not trusted by the blockchain where the first pipeline server resides.

[0113] As described in the aforementioned S603, the first pipeline server needs to verify whether the blockchain containing the first pipeline server already includes the certificate of the first trust anchor. In other words, the first pipeline server needs to query the blockchain containing the first trust anchor. Therefore, if... Figure 7 As shown, S603 described in the embodiments of this application can also be implemented by the following S701 to S702.

[0114] S701, The first pipeline server generates the hash value of the certificate of the first trust anchor based on the hash algorithm.

[0115] The hash algorithm includes any one of the following: SHA-256 algorithm, SHA-512 algorithm, and MD5 algorithm.

[0116] S702. The first pipeline server queries the hash value of the certificate of the first trust anchor in the blockchain where the first pipeline server is located.

[0117] As described in the aforementioned S701, the first network management server generates the hash value of the certificate for the first trust anchor based on a hash algorithm. Since different hash algorithms have different requirements for the format of the input content, the first network management server needs to convert the format of the certificate for the first trust anchor. Therefore, as follows... Figure 8 As shown, S701 described in the embodiments of this application can be implemented by the following S801 to S802.

[0118] S801, the first network server performs encoding format conversion on the certificate of the first trust anchor to obtain the converted certificate of the first trust anchor.

[0119] S802. The first pipeline server determines the key identifier content in the converted certificate of the first trust anchor, and uses the key identifier content as input to the hash algorithm to obtain the hash value of the certificate of the first trust anchor.

[0120] As described in the aforementioned S302, after the accessing device's authentication is successful and the blockchain where the first pipeline server resides has been verified to include the certificate of the first trust anchor, the first pipeline server instructs the accessing device to read the pipeline data. Due to the blockchain's consensus mechanism, before instructing the accessing device to read the pipeline data, the first pipeline server needs to publish information in the blockchain where the first pipeline server resides to indicate permission for the accessing device to read the pipeline data. Therefore, as follows... Figure 9 As shown, the data access method described in the embodiments of this application may further include the following steps S901 to S903.

[0121] S901, the first network server sends the fourth message to the second trusted anchor. Correspondingly, the second trusted anchor receives the fourth message.

[0122] Among them, the second trust anchor is the trust anchor of the blockchain where the first pipeline server is located, and the fourth information is used to instruct the second trust anchor to generate a cross-domain blockchain certificate for the access device. The second trust anchor is the trust anchor of the blockchain where the first pipeline server is located.

[0123] For example, the fourth information described above may include the digital certificate of the access device. The above is an exemplary description of the fourth information, and the fourth information described in the embodiments of this application may also include other information, which is not limited in this application.

[0124] S902, the second trust anchor generates a cross-domain blockchain certificate for the access device and sends the cross-domain blockchain certificate of the access device to the first network server. Correspondingly, the first network server receives the cross-domain blockchain certificate of the access device.

[0125] Optionally, the process of the second trust anchor generating the cross-domain blockchain certificate for the access device can be as follows: The second trust anchor verifies the authenticity of the access device's identity information. If the second trust anchor determines that the access device's identity information is authentic, it generates a request for a cross-domain blockchain certificate corresponding to the access device based on the access device's identity information and its access request. The second trust anchor then signs the cross-domain blockchain certificate request using its private key to obtain the cross-domain blockchain certificate corresponding to the access device.

[0126] For example, a cross-domain blockchain certificate request may include the identity information of the accessing device and the public key of the accessing device. The above is an exemplary description of a cross-domain blockchain certificate request. The cross-domain blockchain certificate request described in the embodiments of this application may also include other information, such as pipeline data information that the accessing device can read.

[0127] S903, The first pipeline server publishes a cross-domain blockchain certificate for accessing devices in the blockchain where the first pipeline server is located.

[0128] As one possible implementation, the above S903 implementation process can be as follows: the first network server uses a hash algorithm to obtain the hash value of the cross-domain blockchain certificate of the accessing device, and publishes the hash value of the cross-domain blockchain certificate of the accessing device on the blockchain where the first network server is located.

[0129] A blockchain can be divided into several modules: a data module, a network module, a consensus module, and a contract module. The data module stores data using timestamps and cryptographic algorithms for data transmission between nodes. The network module includes all nodes in the blockchain; all nodes are connected and have equal status, meaning there is no central node. Each node participates in block generation and collectively maintains the blockchain network. The consensus module determines the consensus mechanism based on different blockchain application scenarios, ensuring that nodes reach a consensus on the validity of the data stored in the blockchain, thus achieving final data unification. The contract module stores various types of code, algorithms, and the rules governing blockchain operation, such as contracts. Furthermore, smart contracts, as an automated form of contract, help the blockchain perform execution and verification functions.

[0130] For example, Figure 10 This application provides an example diagram illustrating the modules included in a blockchain containing a first pipeline server, as shown in an embodiment of the present application. Figure 10As shown, the data module can transmit information to the network module, the network module can transmit information to the consensus module, and the consensus module can transmit information to the contract module. In cross-domain blockchain communication, the first pipeline server is the network module, a collection of network topology, transmission mechanisms, and verification methods. The data module can obtain the access device's digital certificate, first signature, first timestamp, and the certificate of the first trust anchor. Subsequently, the nodes in the network module store the digital certificate, first signature, first timestamp, and certificate of the first trust anchor obtained by the data module.

[0131] In other words, the network module can store information transmitted between the first network server and the second network server, information transmitted between the first network server and the access device, and information transmitted between the first network server and the second trust anchor.

[0132] The consensus module verifies the legitimacy of the accessing device, the validity of the first signature, the first timestamp, and the validity of the certificate of the first trust anchor based on the information stored in the network module. Furthermore, the consensus module can also identify the validity of the transmitted first and second random numbers. If the accessing device is authenticated by the first network server, the contract module stores the cross-domain blockchain certificate of the accessing device.

[0133] It is understood that the above-described data access method can be implemented by a data access device. To achieve the above functions, the data access device includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should readily recognize that, based on the modules and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein, the embodiments disclosed in this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the embodiments disclosed in this application.

[0134] The embodiments disclosed in this application can divide the data access device generated according to the above method examples into functional modules. For example, each function can be divided into its own functional module, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. It should be noted that the module division in the embodiments disclosed in this application is illustrative and is only a logical functional division. In actual implementation, there may be other division methods.

[0135] Figure 11 This is a schematic diagram of the structure of a data access device provided in an embodiment of this application. Figure 11As shown, the data access device 110 can be used to perform... Figures 3-9 The data access method shown. The data access device 110 includes: a communication unit 1101 and a processing unit 1102.

[0136] The processing unit 1102 is configured to instruct the communication unit 1101 to obtain first information, the first information including the digital certificate of the access device and the certificate of the first trust anchor; the first trust anchor is the trust anchor of the blockchain where the access device is located, and the first trust anchor is used to generate the digital certificate of the access device; the processing unit 1102 is also configured to instruct the communication unit 1101 to send second information to the access device after the verification of the digital certificate is successful and the verification that the blockchain where the first pipeline server is located has included the certificate of the first trust anchor, the second information is used to instruct the access device to read the pipeline data in the blockchain where the first pipeline server is located.

[0137] In one possible implementation, the processing unit 1102 is further configured to instruct the communication unit 1101 to receive an access request from an access device, the access request being for requesting access to pipeline data in the blockchain where the first pipeline server is located, the access request including a digital certificate; the processing unit 1102 is further configured to generate a first random number for the access device based on a random number generator, and generate a first timestamp based on the first random number; the random number generator includes a pseudo-random number generator and / or a hardware-based random number generator, the first timestamp being used to record the time when the first random number was generated; the processing unit 1102 is further configured to publish the first random number and the first timestamp in the blockchain where the first pipeline server is located; the processing unit 1102 is further configured to instruct the communication unit 1101 to send the first random number and the first timestamp to the access device.

[0138] In one possible implementation, the processing unit 1102 is further configured to instruct the communication unit 1101 to receive a first signature and a digital certificate from the access device. The first signature is obtained by signing the digital certificate, a first random number, and a first timestamp based on the private key of the access device. The first signature includes a first hash value. The processing unit 1102 is further configured to verify the first signature based on the public key, the first random number, and the first timestamp in the digital certificate to obtain a second hash value. The processing unit 1102 is further configured to determine that the verification of the digital certificate is successful if the second hash value is equal to the first hash value and the valid credentials of the digital certificate are verified.

[0139] In one possible implementation, the processing unit 1102 is further configured to instruct the communication unit 1101 to send third information to the second network server. The third information includes a second random number, a sending request, and a second timestamp. The sending request is used to request the certificate of the first trust anchor. The second network server is the network server of the blockchain where the access device is located. The second timestamp is used to record the time when the second random number was generated. The processing unit 1102 is further configured to instruct the communication unit 1101 to receive the third random number and the certificate of the first trust anchor from the second network server. The processing unit 1102 is further configured to verify whether the certificate of the first trust anchor is already included in the blockchain where the first network server is located if the third random number is equal to the second random number.

[0140] In one possible implementation, the processing unit 1102 is further configured to generate a hash value of the certificate of the first trust anchor based on a hash algorithm; the hash algorithm includes any one of the following: SHA-256 algorithm, SHA-512 algorithm, MD5 algorithm; the processing unit 1102 is further configured to query the hash value of the certificate of the first trust anchor in the blockchain where the first pipeline server is located.

[0141] In one possible implementation, the processing unit 1102 is further configured to perform encoding format conversion on the certificate of the first trust anchor to obtain the converted certificate of the first trust anchor; the processing unit 1102 is further configured to determine the key identifier content in the converted certificate of the first trust anchor, and use the key identifier content as input to a hash algorithm to obtain the hash value of the certificate of the first trust anchor.

[0142] In one possible implementation, the processing unit 1102 is further configured to instruct the communication unit 1101 to send fourth information to the second trust anchor, the second trust anchor being the trust anchor of the blockchain where the first pipeline server is located, and the fourth information being used to instruct the generation of a cross-domain blockchain certificate; the processing unit 1102 is further configured to instruct the communication unit 1101 to receive the cross-domain blockchain certificate from the second trust anchor; the processing unit 1102 is further configured to publish the cross-domain blockchain certificate in the blockchain where the first pipeline server is located.

[0143] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A data access method, characterized in that, Applied to the first pipeline server, the method includes: Obtain first information, which includes the digital certificate of the access device and the certificate of the first trust anchor; the first trust anchor is the trust anchor of the blockchain where the access device is located, and the first trust anchor is used to generate the digital certificate of the access device. If the verification of the digital certificate is successful, and it is verified that the blockchain where the first pipeline server is located includes the certificate of the first trust anchor, a second message is sent to the access device. The second message is used to instruct the access device to read the pipeline data in the blockchain where the first pipeline server is located.

2. The method according to claim 1, characterized in that, The method further includes: Receive an access request from the access device, the access request being used to request access to pipeline data in the blockchain where the first pipeline server is located, the access request including the digital certificate; A first random number is generated for the access device based on a random number generator, and a first timestamp is generated based on the first random number; the random number generator includes a pseudo-random number generator and / or a hardware-based random number generator, and the first timestamp is used to record the time when the first random number was generated; Publish the first random number and the first timestamp in the blockchain where the first pipeline server is located; Send the first random number and the first timestamp to the access device.

3. The method according to claim 2, characterized in that, The method further includes: Receive a first signature and the digital certificate from the access device, wherein the first signature is obtained by signing the digital certificate, the first random number, and the first timestamp based on the private key of the access device, and the first signature includes a first hash value; Based on the public key in the digital certificate, the first random number, and the first timestamp, the first signature is verified to obtain the second hash value; If the second hash value is equal to the first hash value, and the valid credentials of the digital certificate are verified, the verification of the digital certificate is determined to be successful.

4. The method according to claim 1 or 3, characterized in that, The method further includes: Send a third message to the second network server. The third message includes a second random number, a sending request, and a second timestamp. The sending request is used to request the certificate of the first trust anchor. The second network server is the network server of the blockchain where the access device is located. The second timestamp is used to record the time when the second random number was generated. Receive a third random number from the second pipeline server and the certificate of the first trust anchor; If the third random number is equal to the second random number, verify whether the certificate of the first trust anchor has been included in the blockchain where the first pipeline server is located.

5. The method according to claim 4, characterized in that, The step of querying the certificate of the first trust anchor in the blockchain where the first pipeline server is located includes: The hash value of the certificate of the first trust anchor is generated based on a hash algorithm; the hash algorithm includes any one of the following: SHA-256 algorithm, SHA-512 algorithm, MD5 algorithm; Query the hash value of the certificate of the first trust anchor in the blockchain where the first pipeline server is located.

6. The method according to claim 5, characterized in that, The process of generating the hash value of the certificate for the first trust anchor based on a hash algorithm includes: The certificate of the first trust anchor is converted into an encoding format to obtain the converted certificate of the first trust anchor; The key identifier content in the certificate of the first trust anchor after the transformation is determined, and the key identifier content is used as the input of the hash algorithm to obtain the hash value of the certificate of the first trust anchor.

7. The method according to claim 1, characterized in that, The second information includes the cross-domain blockchain certificate of the access device, and the method further includes: Send a fourth message to the second trust anchor, where the second trust anchor is the trust anchor of the blockchain where the first pipeline server is located, and the fourth message is used to instruct the generation of the cross-domain blockchain certificate; Receive a cross-domain blockchain certificate from the second trust anchor; The cross-domain blockchain certificate is published in the blockchain where the first pipeline server is located.

8. A data access device, characterized in that, include: Memory and processor; The memory and the processor are coupled; The memory is used to store instructions that can be executed by the processor; When the processor executes the instruction, it performs the data access method as described in any one of claims 1-7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that, when executed on a computer, cause the computer to perform the data access method as described in any one of claims 1-7.

10. A computer program product, characterized in that, The computer program product includes computer program instructions that, when executed by a processor, implement the data access method as described in any one of claims 1-7.

Images