CN115694821A - BaaS network implementation method and device for alliance node certificate security - Google Patents

Abstract

The invention provides a BaaS network implementation method and device for alliance node certificate security. Among them, the BaaS network implementation method of alliance node certificate security includes: each organization of the alliance chain obtains the RABC authority control combined with kubernetes and the operator development framework of kubernetes; Deployment; each organization manages its own node certificates and account certificates based on the development framework. The present invention realizes the convenient and fast network deployment through the BaaS network implementation scheme based on Kubernetes. The user only needs to operate the graphical interface to complete the basic network deployment, and realizes the truly decentralized deployment. Each organization manages its own secrets data, no need to provide data to third parties. At the same time, the network deployed through the BaaS platform can also monitor the operation of the network at any time through the monitoring of the platform, and set corresponding early warning rules and alarm mechanisms to realize automatic operation and maintenance.

Description

BaaS network implementation method and device for alliance node certificate security

technical field

The present invention relates to the technical field related to blockchain, in particular to a BaaS network implementation method and device for alliance node certificate security.

Background technique

As a new type of technology, blockchain solves the problem of trust between organizations through decentralization, multi-node consensus and accounting, and can provide technical solutions with unique characteristics such as traceability, non-tampering, and reduced trust costs. plan.

When building a blockchain network, it is necessary to deploy nodes and establish connections in different organizations. If they are deployed independently by different organizations, it is necessary for different organizations to have very professional technicians to carry out independent operations and communicate and coordinate. The cost is very high, which will result in a long period of network deployment and subsequent maintenance is very difficult; if a unified third-party is deployed in a unified manner, the third party needs to have access to confidential data of different organizations (such as certificate data, such as the internal environment of the enterprise network) , requires different organizations to trust the third party, which violates the original intention of the blockchain network to build a trustless network, and greatly reduces the security factor of the network.

Contents of the invention

In view of this, a BaaS network implementation method and device for federated node certificate security are provided to solve problems in related technologies.

The present invention adopts following technical scheme:

In the first aspect, the embodiment of the present invention provides a BaaS network implementation method for alliance node certificate security, including:

RABC authority control based on kubernetes and baas platform development framework of kubernetes operator;

Each organization of the alliance chain is based on the development framework, and each organization of the alliance chain deploys alliance nodes by operating a graphical interface based on the development framework;

Each organization of the consortium chain manages its own node certificates and account certificates based on the development framework described above.

Optionally, each organization of the alliance chain deploys alliance nodes by operating a graphical interface based on the development framework; including:

Deploy the network through Kubernetes to deploy the system in a new environment and realize automatic operation and maintenance, shielding the physical differences of hardware.

Optionally, each organization of the alliance chain deploys alliance nodes by operating a graphical interface based on the development framework; including:

The Docker image and the Helm Chart warehouse adopt the cloud storage mode to deploy the system through deployment scripts.

Optionally, the development framework includes: baas-crd module, baas-operator module, baas-api module, and baas-frontend module;

Wherein, the baas-crd module and the baas-operator module are shared with all alliance organizations in the form of open source code.

Optionally, the development framework includes:

When deploying and installing the baas-operator module and baas-crd module, each organization of the consortium chain adds its own inspection code, so that the locally deployed baas-operator module and baas-crd module have stronger security.

Optionally, the organization views, adds and manages certificates based on a preset certificate management interface.

Optionally, the preset BaaS system provides preset general-purpose smart contracts for users to quickly select or the preset BaaS system obtains smart contracts written and uploaded by users for deployment.

In the second aspect, this application provides a BaaS network implementation device for alliance node certificate security, including:

The acquisition module is used to obtain the organizations of the consortium chain by combining the RABC authority control of kubernetes and the operator development framework of kubernetes;

The deployment module is used for each organization of the alliance chain to deploy the alliance nodes by operating a graphical interface based on the development framework, and each organization of the alliance chain is based on the development framework;

The management module is used for each organization of the consortium chain to manage their own node certificates and account certificates based on the development framework.

In the third aspect, a BaaS network implementation device for alliance node certificate security, including:

a processor, and a memory connected to the processor;

The memory is used to store computer programs, and the computer programs are at least used to implement the BaaS network implementation method for federation node certificate security described in the first aspect of the present application;

The processor is used to call and execute the computer program in the memory.

In a fourth aspect, the present application provides a storage medium, the storage medium stores a computer program, and when the computer program is executed by a processor, the BaaS network implementation method for alliance node certificate security as described in the first aspect of the application is implemented in each step.

The present invention realizes the convenient and fast network deployment through the Kubernetes-based BaaS network implementation scheme, and the user only needs to operate the graphical interface to complete the basic network deployment, realizing a truly decentralized deployment, and each organization manages its own secrets Data, no need to provide data to third parties, improve the security factor of the network.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only These are some embodiments of the present invention. Those skilled in the art can also obtain other drawings based on these drawings without creative work.

Fig. 1 is a flow chart of a BaaS network implementation method for alliance node certificate security provided by an embodiment of the present invention;

FIG. 2 is a schematic diagram of multi-cluster deployment in an embodiment provided by an embodiment of the present invention;

FIG. 3 is a schematic structural diagram of a BaaS network implementing device for alliance node certificate security provided by an embodiment of the present invention;

FIG. 4 is a schematic structural diagram of a BaaS network implementation device for federated node certificate security provided by an embodiment of the present invention.

Detailed ways

In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be described in detail below. Apparently, the described embodiments are only some of the embodiments of the present invention, but not all of them. Based on the embodiments of the present invention, all other implementations obtained by persons of ordinary skill in the art without making creative efforts fall within the protection scope of the present invention.

Firstly, the application scenario of the embodiment of the present invention is explained. As a new type of technology, the blockchain solves the problem of trust between organizations through decentralization, multi-node consensus and bookkeeping, and can provide traceable, unreliable Technical solutions with unique characteristics such as tampering and reducing the cost of trust. When building a blockchain network, it is necessary to deploy nodes and establish connections in different organizations. If they are deployed independently by different organizations, it is necessary for different organizations to have very professional technicians to carry out independent operations and communicate and coordinate. The cost is very high, which will result in a long period of network deployment and subsequent maintenance is very difficult; if a unified third-party is deployed in a unified manner, the third party needs to have access to confidential data of different organizations (such as certificate data, such as the internal environment of the enterprise network) , requires different organizations to trust the third party, which violates the original intention of the blockchain network to build a trustless network, and greatly reduces the security factor of the network. This application proposes a corresponding solution to this problem.

Example

FIG. 1 is a flowchart of a BaaS network implementation method for federated node certificate security provided by an embodiment of the present invention; the method can be executed by the BaaS network implemented method for federated node certificate security provided by an embodiment of the present invention. Fig. 2 is a schematic diagram of multi-cluster deployment in the embodiment provided by the embodiment of the present invention; referring to Fig. 1 and Fig. 2, the method may specifically include the following steps:

S101. Each organization of the consortium chain obtains by combining the RABC authority control of kubernetes and the operator development framework of kubernetes;

S102. Based on the development framework, each organization of the alliance chain deploys alliance nodes by operating a graphical interface;

S103. Each organization of the consortium chain manages its own node certificates and account certificates based on the development framework.

The present invention proposes a BaaS network implementation scheme based on kubernetes. By combining the RABC authority control of kubernetes and the operator development framework of kubernetes, it not only realizes the unified deployment and operation and maintenance of the network, but also ensures that each organization of the alliance network manages itself Node certificates and account certificates; by separating the deployment of the network from the use of certificates, it not only improves the deployment efficiency of the alliance chain network (minute level), but also ensures the data security of all alliance participating organizations.

Specifically, the main technical modules of the present invention include:

The baas-crd module mainly realizes CRD deployment and permission setting; this module mainly realizes the following functions: custom CRD, realizes custom kubernetes resource definitions for chain deployment and chain access, such as: chain node startup, consensus node startup, child Chain installation, contract installation and other functions crd; permission definition based on custom CRD; automatic installation and permission setting of CRD;

The baas-operator module is the secondary development of operator-sdk based on kubernetes; baas-operator implements the following main functions: function implementation based on custom CRD, encapsulated kubernetes functional services, including pod creation, service creation, secret access, Functional process scripts, etc.; generation of node certificates and account certificates; installation, startup and upgrade of baas-operator;

The baas-api module is a deployment and operation and maintenance platform based on the kubernetes user interface; this module realizes the operation and operation and maintenance functions of the baas platform, and supports the registration of alliance organizations, alliance network deployment, alliance network operation and maintenance and other main functions.

The baas-frontend module is a BaaS front-end page implemented based on the React framework; the main realization of this module is: through user-friendly interactive pages, the user can implement interface-based deployment and management of the BaaS platform, allowing users to complete the network through interface operations control without having to care about the underlying implementation details.

Among them: the baas-crd module and baas-operator module are shared with all alliance organizations in the form of open source code, and alliance organizations can conduct security reviews on code implementation; when deploying and installing baas-operator and baas-crd, you can Directly use the source code to compile, and can add your own inspection code, so that the locally deployed baas-operator and baas-crd have stronger security.

In the permission definition of baas-crd, the operation and access rights of CRD are defined. When baas-api is deployed and maintained, it can only operate on custom CRD, and cannot directly use pod, service and ingress of kubernetes And other basic resource service interfaces, and cannot directly access the user's secret (it can only be accessed locally through the operator, and the baas-api cannot read any secret information), thus ensuring the security of the user network and user certificate.

The baas-crd and baas-operator modules are released in the form of open source. By reviewing the relevant codes and processes, users can always determine whether there are security holes in user network access and operations, such as uncontrolled permission access and secret leakage.

The present invention realizes the convenient and fast network deployment through the Kubernetes-based BaaS network implementation scheme, and the user only needs to operate the graphical interface to complete the basic network deployment, realizing a truly decentralized deployment, and each organization manages its own secrets data, no need to provide data to third parties. At the same time, the network deployed through the BaaS platform can also monitor the operation of the network at any time through the monitoring of the platform, and set corresponding early warning rules and alarm mechanisms to realize automatic operation and maintenance.

The present invention proposes a BaaS network implementation based on kubernetes-based alliance node certificate security, and illustrates the key modules and functions for realizing certificate security and network deployment. In the specific implementation process, we deploy the network through Kubernetes, and use Kubernetes It can quickly deploy the system in a new environment and realize automatic operation and maintenance, which well shields the physical differences of hardware. Both the Docker image and the Helm Chart warehouse have adopted the cloud storage model, so that the system can be deployed through simple deployment scripts only by being able to connect to the Internet.

Some specific examples are given below to illustrate how to implement a BaaS network with federated node certificate security:

Network deployment is divided into blockchain deployment module, certificate management module, node management module and contract module, which separates network deployment and certificate management. The types of certificates are divided into user certificates, peer certificates, and orderer certificates. Users can add and manage them separately The corresponding certificate, when deploying the network, select the corresponding certificate for deployment.

Currently, the Fabric network versions that support deployment are 1.4, 2.0, and 2.1. When users initialize a consortium chain, they need to select the corresponding Fabric version and fill in the deployment parameter settings. The system selects the corresponding configuration through the cooperation of Kubernetes and Operator. Template, generate the corresponding template file to automate the deployment process. During deployment, the certificate file is provided by the user.

Among them, the way to invite participants to join the alliance chain is as follows:

A business is usually participated by multiple parties. After creating the initial consortium chain, other business parties need to be invited to join the consortium chain and participate in the governance of the consortium chain. In this BaaS system, a node corresponds to an entity organization, and each organization All nodes are added to the alliance chain, and the certificate files of new nodes are also selected by each organization, and the certificate files are managed by themselves, ensuring the data security of all alliance participating organizations.

The contract management method is as follows:

The BaaS system will provide some common smart contracts for users to quickly select. Users can view the installed smart contracts through the page, and deploy smart contracts by writing smart contracts and uploading them manually.

The way of node management is as follows:

Through the interface, it is convenient for users to view the status of peer nodes and orderer nodes in the alliance, and to edit peer or orderer nodes within the scope of authority.

The certificate management method is as follows:

Users can view the existing certificates on the certificate management interface, and can add a user certificate through simple page operations. When deploying the consortium chain, they can choose to automatically generate a certificate or choose from the user's existing certificates. The deployment and The certificate separation method ensures the data security of the organization.

FIG. 3 is a schematic structural diagram of a BaaS network implementation device for federated node certificate security provided by an embodiment of the present invention; referring to FIG. 3 , the BaaS network implementation device for federated node certificate security provided by this application includes:

The obtaining module 31 is used to obtain the various organizations of the consortium chain by combining the RABC authority control of kubernetes and the operator development framework of kubernetes;

The deployment module 32 is used for each organization of the alliance chain to deploy alliance nodes by operating a graphical interface based on the development framework, and each organization of the alliance chain is based on the development framework;

The management module 33 is used by each organization of the consortium chain to manage their own node certificates and account certificates based on the development framework.

FIG. 4 is a schematic structural diagram of a BaaS network implementation device for federated node certificate security provided by an embodiment of the present invention. Referring to Figure 4, a BaaS network implementation device for alliance node certificate security provided by this application includes:

a processor, and a memory connected to the processor;

The memory is used to store a computer program, and the computer program is at least used to implement the BaaS network implementation method for alliance node certificate security provided by this application;

The processor is used to call and execute the computer program in the memory.

The present application also provides a storage medium, the storage medium stores a computer program, and when the computer program is executed by a processor, each step in the BaaS network implementation method for alliance node certificate security as provided in the present application is implemented.

It can be understood that, the same or similar parts in the above embodiments can be referred to each other, and the content that is not described in detail in some embodiments can be referred to the same or similar content in other embodiments.

It should be noted that, in the description of the present invention, the terms "first", "second" and so on are only used for description purposes, and should not be understood as indicating or implying relative importance. In addition, in the description of the present invention, unless otherwise specified, the meaning of "plurality" means at least two.

Any process or method descriptions in flowcharts or otherwise described herein may be understood to represent modules, segments or portions of code comprising one or more executable instructions for implementing specific logical functions or steps of the process , and the scope of preferred embodiments of the invention includes alternative implementations in which functions may be performed out of the order shown or discussed, including substantially concurrently or in reverse order depending on the functions involved, which shall It is understood by those skilled in the art to which the embodiments of the present invention pertain.

It should be understood that various parts of the present invention can be realized by hardware, software, firmware or their combination. In the embodiments described above, various steps or methods may be implemented by software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented by any one or combination of the following techniques known in the art: Discrete logic circuits, ASICs with suitable combinational logic gates, programmable gate arrays (PGAs), field programmable gate arrays (FPGAs), etc.

Those of ordinary skill in the art can understand that all or part of the steps carried by the methods of the above embodiments can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium. During execution, one or a combination of the steps of the method embodiments is included.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing module, each unit may exist separately physically, or two or more units may be integrated into one module. The above-mentioned integrated modules can be implemented in the form of hardware or in the form of software function modules. If the integrated modules are realized in the form of software function modules and sold or used as independent products, they can also be stored in a computer-readable storage medium.

The storage medium mentioned above may be a read-only memory, a magnetic disk or an optical disk, and the like.

In the description of this specification, descriptions referring to the terms "one embodiment", "some embodiments", "example", "specific examples", or "some examples" mean that specific features described in connection with the embodiment or example , structure, material or characteristic is included in at least one embodiment or example of the present invention. In this specification, schematic representations of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

Although the embodiments of the present invention have been shown and described above, it can be understood that the above embodiments are exemplary and should not be construed as limiting the present invention, those skilled in the art can make the above-mentioned The embodiments are subject to changes, modifications, substitutions and variations.

Claims (10)

1. A BaaS network implementation method for security of an allied node certificate is characterized by comprising the following steps:

a alliance chain baas network development framework based on kubernets RABC authority control and kubernets operator deployment and maintenance;

based on the development framework, each organization of the alliance chain deploys alliance nodes through an operation graphical interface;

and each organization of the alliance chain manages the node certificate and the account certificate of the organization based on the development framework.

2. The BaaS network implementation method for security of the alliance node certificate as claimed in claim 1, wherein each organization of the alliance chain deploys alliance nodes through an operation graphical interface based on the development framework; the method comprises the following steps:

the network is deployed through Kubernetes, so that the system is deployed in a new environment, automatic operation and maintenance are realized, and physical differences of hardware are shielded.

3. The BaaS network implementation method for security of the alliance node certificate of claim 2, wherein each organization of the alliance chain deploys alliance nodes through an operation graphical interface based on the development framework; the method comprises the following steps:

the Docker mirror image and the Helm Chart warehouse adopt a cloud storage mode so as to deploy the system through a deployment script.

4. A federation node certificate secure BaaS network implementation method as claimed in claim 1, wherein the development framework comprises: a bas-crd module, a bas-operator module, a bas-api module and a bas-front module;

wherein, the baas-crd module and the baas-operator module are shared to all organizations of the alliance in the form of open source codes.

5. A federation node certificate secure BaaS network implementation method as claimed in claim 1, wherein the development framework comprises:

when the organizations of the alliance chain deploy and install the base-operator module and the base-crd module, the organizations increase their own check codes, so that the locally deployed base-operator module and the base-crd module have stronger safety.

6. The BaaS network implementation method for federation node certificate security of claim 1, wherein the organization views, adds and manages certificates based on a preset certificate management interface.

7. The BaaS network implementation method for federation node certificate security according to claim 1, wherein the preset BaaS system provides a preset general intelligent contract for a user to quickly select or the preset BaaS system obtains an intelligent contract written and uploaded by the user to deploy.

8. A BaaS network implementation device for security of an alliance node certificate is characterized by comprising:

the system comprises an acquisition module, a management module and a management module, wherein the acquisition module is used for acquiring RABC authority control combined with kubernets and operator development frames of the kubernets by all organizations of a union chain;

the deployment module is used for enabling all organizations of the alliance chain to be based on the development framework, and all organizations of the alliance chain are based on the development framework and deploy alliance nodes through an operation graphical interface;

and the management module is used for managing the node certificate and the account certificate of each organization of the alliance chain based on the development framework.

9. A BaaS network implementation device for federation node certificate security is characterized by comprising:

a processor, and a memory coupled to the processor;

the memory is configured to store a computer program for performing at least the league node certificate secure, baaS network-enabled method of any of claims 1-7;

the processor is used for calling and executing the computer program in the memory.

10. A storage medium storing a computer program which, when executed by a processor, implements each step in a leas network implementation method for federation node certificate security as recited in any one of claims 1 to 7.

Images