Disclosure of Invention
The present disclosure provides a chain code communication method, apparatus, electronic device, and storage medium.
According to a first aspect of the present disclosure, a chain code communication method is provided. The method comprises the following steps:
the node program sends an authentication request to the chain code;
the chain code obtains a status code according to the authentication request;
the chain code sends the state code and the public key in the created key pair to a node program;
the node program sends the status code and the public key to an authentication center to obtain an authentication result;
if the authentication result is reliable, the node program and the chain code establish communication connection.
Further, the node program operates in an untrusted environment.
Further, the chain code operates in a trusted environment.
Further, the chain code obtains a status code according to the authentication request, including:
and executing the chain code under a preset rule according to the authentication request to obtain a state code.
Further, the key pair includes a public key and a private key.
Further, the chain code sends the state code, the public key of the created key pair, to a node program, including:
the chain code generates a key pair through an elliptic curve encryption algorithm.
Further, if the authentication result is trusted, the node program and the chain code establish a communication connection, including:
respectively judging whether the signature, the public key and the authentication center identity of the authentication result are credible;
if the signature, the public key and the authentication center identity of the authentication result are all trusted, the authentication result is trusted.
According to a second aspect of the present disclosure, a chain code communication device is provided. The device comprises:
the first sending module is used for sending an authentication request to the chain code by the node program;
the determining module is used for obtaining a status code according to the authentication request by the chain code;
the second sending module is used for sending the state code and the public key in the created key pair to the node program by the chain code;
the third sending module is used for sending the status code and the public key to an authentication center by the node program to obtain an authentication result;
and the communication module is used for establishing communication connection between the node program and the chain code if the authentication result is credible.
According to a third aspect of the present disclosure, an electronic device is provided. The electronic device includes: the system comprises a memory and a processor, wherein the memory stores a computer program, and the processor realizes the method when executing the program.
According to a fourth aspect of the present disclosure, there is provided a computer readable storage medium having stored thereon a computer program which when executed by a processor implements the method.
The method comprises the steps that an authentication request is sent to a chain code through a node program; the chain code obtains a status code according to the authentication request; the chain code sends the state code and the public key in the created key pair to a node program; the node program sends the status code and the public key to an authentication center to obtain an authentication result; if the authentication result is reliable, the node program and the chain code establish communication connection, so that the security of the data before the uplink is ensured, and the security of the data is improved.
It should be understood that what is described in this summary is not intended to limit the critical or essential features of the embodiments of the disclosure nor to limit the scope of the disclosure. Other features of the present disclosure will become apparent from the following description.
Detailed Description
For the purposes of making the objects, technical solutions and advantages of the embodiments of the present disclosure more apparent, the technical solutions of the embodiments of the present disclosure will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present disclosure, and it is apparent that the described embodiments are some embodiments of the present disclosure, but not all embodiments. All other embodiments, which can be made by one of ordinary skill in the art based on the embodiments in this disclosure without inventive faculty, are intended to be within the scope of this disclosure.
In addition, the term "and/or" herein is merely an association relationship describing an association object, and means that three relationships may exist, for example, a and/or B may mean: a exists alone, A and B exist together, and B exists alone. In addition, the character "/" herein generally indicates that the front and rear associated objects are an "or" relationship.
Fig. 1 shows a flowchart of a chain code communication method 100 according to an embodiment of the present disclosure, the method 100 comprising:
s101, the node program sends an authentication request to the chain code.
In some embodiments, the node program operates in an untrusted environment.
In some embodiments, the chain code operates in a trusted environment.
In some embodiments, the node program sending an authentication request to the chain code may be performed by: the node program generates an authentication request, wherein the authentication request contains identity information of the node program and other related information required by authentication, and the identity information can be a public key, a digital certificate or other identifiers of the node program so as to prove the legitimacy and the credibility of the node program; in order to ensure the security and integrity of the authentication request, the node program can encrypt the request by using a corresponding encryption algorithm, and digitally sign the request by using a private key of the node program, wherein the encryption can prevent the request from being tampered or stolen, and the digital signature can verify the authenticity of the request and the identity of the node program; the encrypted and signed authentication request may be sent to the chain code via a predefined communication protocol (e.g., HTTP, webSocket, etc.), the request may be transmitted over a network, and the location of the chain code may be reached via a channel of the network connection.
S102, the chain code obtains a state code according to the authentication request.
In some embodiments, the chain code obtains a status code according to the authentication request, including: and executing the chain code under a preset rule according to the authentication request to obtain a state code.
In some embodiments, the obtaining the status code by the chain code according to the authentication request may be performed by: the chain code receives an authentication request from the node program, wherein the authentication request contains identity information of the node program and other information required by related authentication; the chain code processes the authentication request according to predefined authentication logic and rules, which may involve operations of communicating with an external authentication system, verifying the validity of an identity credential, etc.; and generating a corresponding state code as an authentication result by the chain code according to the processing result of the authentication request. The status code may be a predefined enumeration value for representing different states of authentication, such as authentication success, authentication failure, lack of authority, etc.; the chain code returns the generated state code to the node program through a communication protocol (such as an HTTP response, etc.). The node program can judge the result of the authentication request according to the received state code and take corresponding processing measures according to the need.
And S103, the chain code sends the state code and the public key of the created key pair to the node program.
In some embodiments, the key pair includes a public key and a private key.
In some embodiments, the chain code transmits the state code, the public key of the created key pair, to a node program, comprising: the chain code generates a key pair through an elliptic curve encryption algorithm.
In some embodiments, the chain code transmitting the state code, the public key of the created key pair, to the node program may be performed by: the chain code creates a key pair comprising a public key and a private key, the key pair typically being generated using an asymmetric encryption algorithm, wherein the private key is used to sign the authentication request and the public key is used to verify the signature and encrypt the communication; the chain code sends the generated state code and the public key to the node program, which is usually realized through a communication protocol (such as HTTP response), wherein the state code is used for informing the authentication result of the node program, and the public key is used for the subsequent encrypted communication process; the node program receives the status code and the public key sent by the chain code, and can take corresponding processing measures based on the status code, such as executing different operations according to whether authentication is successful or not.
And S104, the node program sends the status code and the public key to an authentication center to obtain an authentication result.
In some embodiments, the node program sends the status code and the public key to the authentication center, and the authentication result may be obtained by the following steps: the node program transmits the status code and the public key transmitted by the chain code to the authentication center through a predefined communication protocol (such as an HTTP request); after receiving the status code and the public key sent by the node program, the authentication center generates a corresponding authentication request according to a specific authentication mechanism and flow, wherein the authentication request comprises the identity information of the node program, authentication operation required to be performed and related information comprising the status code and the public key; the authentication center uses the public key of the node program to verify the validity of the status code and the public key, and by decrypting and verifying the signature by using the public key sent by the chain code, the authentication center can ensure that the information comes from the legal node program and is not tampered or forged; the authentication center generates an authentication result according to the processing result of the authentication request. This may include identity verification and authentication operations by way of communication with other certification authorities, checking rights, verifying digital certificates, etc.; the authentication center returns the generated authentication result to the node program through a communication protocol (such as an HTTP response), wherein the authentication result comprises authentication state (success or failure) and other relevant authentication result information such as authorization information, validity period and the like.
And S105, if the authentication result is reliable, the node program and the chain code establish communication connection.
In some embodiments, if the authentication result is trusted, the node program and the chain code establish a communication connection, including: respectively judging whether the signature, the public key and the authentication center identity of the authentication result are credible; if the signature, the public key and the authentication center identity of the authentication result are all trusted, the authentication result is trusted.
In some embodiments, if the authentication result is trusted, the node program and the chain code establish a communication connection through the following steps: the node program receives an authentication result returned by the authentication center, wherein the authentication result comprises an authentication state and other relevant information. The node program can judge whether the authentication is successful or not according to the authentication state; the node program verifies the authenticity of the authentication result using a predefined mechanism, which may include the steps of checking the identity and trust chain of the authentication center, verifying the digital signature, etc. Ensuring the credibility of the authentication result is critical to prevent the counterfeit or tampered authentication result from affecting the security of the system; if the authentication result is confirmed to be trusted by the node program, the node program and the chain code can establish a communication connection, and the communication connection mode can be determined according to the system requirement, such as using a network connection, a message passing mechanism and the like; in order to ensure the safety of communication, the node program and the chain code can adopt an encryption communication mode to carry out data transmission, and a symmetric encryption algorithm or an asymmetric encryption algorithm can be used for encrypting communication data so as to prevent the data from being stolen or tampered; through the established communication connection, the node program may send a request to the chain code or acquire data. The chain code can perform corresponding operation according to the request of the node program and return the result to the node program.
In some embodiments, the chain code is packaged into a container where the node program is located, the trusted building program is started, and the trusted information of the node program is added into the program of the chain code; by trusted building the program, intel sgx Enclave is started and the program of chain code is pushed to intel sgx Enclave and compiled within enclaspe.
In some embodiments, because the memory isolation mechanism of the intel sgx technology cannot obtain the external trusted verification information such as a key and a certificate, an enclaspe configuration file needs to be configured in advance, information such as a configuration file mount and an environment variable is required to be configured, after a chain code container running in the enclaspe runs, a configuration file is created and the size information of an enclaspe stack is set through a trusted construction program, and the environment variable is transmitted to the enclaspe (including a chain code id, a key path information and the like) through the trusted construction program; and finally, mounting the trusted information, and performing identity authentication between the chain code in the Enclave and the external node by using an Enclave endorsement verification mechanism.
According to an embodiment of the present disclosure, an authentication request is sent to a chain code by a node program; the chain code obtains a status code according to the authentication request; the chain code sends the state code and the public key in the created key pair to a node program; the node program sends the status code and the public key to an authentication center to obtain an authentication result; if the authentication result is reliable, the node program and the chain code establish communication connection, so that the security of the data before the uplink is ensured, and the security of the data is improved.
It should be noted that, for simplicity of description, the foregoing method embodiments are all described as a series of acts, but it should be understood by those skilled in the art that the present disclosure is not limited by the order of acts described, as some steps may be performed in other orders or concurrently in accordance with the present disclosure. Further, those skilled in the art will also appreciate that the embodiments described in the specification are all alternative embodiments, and that the acts and modules referred to are not necessarily required by the present disclosure.
The foregoing is a description of embodiments of the method, and the following further describes embodiments of the present disclosure through examples of apparatus.
Fig. 2 shows a block diagram of a chain code communication device 200 according to an embodiment of the present disclosure, the device 200 comprising:
a first sending module 201, configured to send an authentication request to a chain code by a node program;
a determining module 202, configured to obtain a status code according to the authentication request by using the chain code;
a second sending module 203, configured to send, by using the chain code, the state code and the public key in the created key pair to a node program;
a third sending module 204, configured to send the status code and the public key to an authentication center by using a node program, so as to obtain an authentication result;
and the communication module 205 is configured to establish a communication connection between the node program and the chain code if the authentication result is trusted.
It will be clear to those skilled in the art that, for convenience and brevity of description, specific working procedures of the described modules may refer to corresponding procedures in the foregoing method embodiments, which are not described herein again.
In the technical scheme of the disclosure, the acquisition, storage, application and the like of the related user personal information all conform to the regulations of related laws and regulations, and the public sequence is not violated.
According to embodiments of the present disclosure, the present disclosure also provides an electronic device and a readable storage medium.
Fig. 3 shows a schematic block diagram of an electronic device 300 that may be used to implement embodiments of the present disclosure. Electronic devices are intended to represent various forms of digital computers, such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular telephones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions, are meant to be exemplary only, and are not meant to limit implementations of the disclosure described and/or claimed herein.
The electronic device 300 includes a computing unit 301 that can perform various appropriate actions and processes according to a computer program stored in a ROM302 or a computer program loaded from a storage unit 308 into a RAM 303. In the RAM303, various programs and data required for the operation of the electronic device 300 may also be stored. The computing unit 301, the ROM302, and the RAM303 are connected to each other by a bus 304. I/O interface 305 is also connected to bus 304.
Various components in the electronic device 300 are connected to the I/O interface 305, including: an input unit 306 such as a keyboard, a mouse, etc.; an output unit 307 such as various types of displays, speakers, and the like; a storage unit 308 such as a magnetic disk, an optical disk, or the like; and a communication unit 309 such as a network card, modem, wireless communication transceiver, etc. The communication unit 309 allows the electronic device 300 to exchange information/data with other devices through a computer network such as the internet and/or various telecommunication networks.
The computing unit 301 may be a variety of general and/or special purpose processing components having processing and computing capabilities. Some examples of computing unit 301 include, but are not limited to, a Central Processing Unit (CPU), a Graphics Processing Unit (GPU), various specialized Artificial Intelligence (AI) computing chips, various computing units running machine learning model algorithms, a Digital Signal Processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 301 performs the respective methods and processes described above, such as a chain code communication method. For example, in some embodiments, the chain code communication method may be implemented as a computer software program tangibly embodied on a machine-readable medium, such as storage unit 308. In some embodiments, part or all of the computer program may be loaded and/or installed onto the electronic device 300 via the ROM302 and/or the communication unit 309. When the computer program is loaded into RAM303 and executed by computing unit 301, one or more steps of the chain code communication method described above may be performed. Alternatively, in other embodiments, the computing unit 301 may be configured to perform the chain code communication method in any other suitable way (e.g. by means of firmware).
Various implementations of the systems and techniques described here above may be implemented in digital electronic circuitry, integrated circuitry, field Programmable Gate Arrays (FPGAs), application Specific Integrated Circuits (ASICs), application Specific Standard Products (ASSPs), systems-on-chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and/or combinations thereof. These various embodiments may include: implemented in one or more computer programs, the one or more computer programs may be executed and/or interpreted on a programmable system including at least one programmable processor, which may be a special purpose or general-purpose programmable processor, that may receive data and instructions from, and transmit data and instructions to, a storage system, at least one input device, and at least one output device.
Program code for carrying out methods of the present disclosure may be written in any combination of one or more programming languages. These program code may be provided to a processor or controller of a general purpose computer, special purpose computer, or other programmable data processing apparatus such that the program code, when executed by the processor or controller, causes the functions/operations specified in the flowchart and/or block diagram to be implemented. The program code may execute entirely on the machine, partly on the machine, as a stand-alone software package, partly on the machine and partly on a remote machine or entirely on the remote machine or server.
In the context of this disclosure, a readable storage medium may be a tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. The readable storage medium may be a machine-readable signal medium or a machine-readable storage medium. The readable storage medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of a readable storage medium would include an electrical connection based on one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.
To provide for interaction with a user, the systems and techniques described here can be implemented on a computer having: display means for displaying information to a user; and a keyboard and pointing device (e.g., a mouse or trackball) by which a user can provide input to the computer. Other kinds of devices may also be used to provide for interaction with a user; for example, feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form, including acoustic input, speech input, or tactile input.
The systems and techniques described here can be implemented in a computing system that includes a background component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front-end component (e.g., a user computer having a graphical user interface or a web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such background, middleware, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: local Area Networks (LANs), wide Area Networks (WANs), and the internet.
The computer system may include a client and a server. The client and server are typically remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. The server may be a cloud server, a server of a distributed system, or a server incorporating a blockchain.
It should be appreciated that various forms of the flows described above may be used to reorder, add, or delete steps. For example, the steps recited in the present disclosure may be performed in parallel, sequentially, or in a different order, provided that the desired results of the technical solutions of the present disclosure are achieved, and are not limited herein.
The above detailed description should not be taken as limiting the scope of the present disclosure. It will be apparent to those skilled in the art that various modifications, combinations, sub-combinations and alternatives are possible, depending on design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present disclosure are intended to be included within the scope of the present disclosure.