WO2019127278A1 - Safe access blockchain method, apparatus, system, storage medium, and electronic device - Google Patents

Abstract

Disclosed are a safe access blockchain method, apparatus, system, storage medium, and electronic device. The method comprises: a new node preparing to access a blockchain network acquiring endorsement data obtained by a trusted node preset in the blockchain network using a private key thereof to sign a public key of a target node, and performing signature verification of the endorsement data; if the signature verification passes, then determining that the identity authentication of the target node is successful; the target node queries from the permissions preset by the blockchain network the permission of the public key of the new node corresponding to the account address and, on the basis of the permission, determines whether the identity authentication of the new node is successful. Thus, in the present disclosure, two way authentication of the new node and the target node directly uses the public and private keys of a blockchain network node account and does not require a centralised third party or a digital certificate, avoiding the high level of complexity of issuing digital certificates, and implementing secure access between nodes in a blockchain network.

Description

Method, device, system, storage medium and electronic device for securely accessing blockchain Technical field

The present disclosure relates to the field of computers, and in particular, to a method, an apparatus, a storage medium, and an electronic device for securely accessing a blockchain.

Background technique

Blockchain is a technical solution for collectively maintaining a reliable database through decentralization. In the blockchain, nodes are connected to each other through a P2P (Peer-to-Peer) network.

In the current blockchain technology, a node (for example, a new node, including various terminals, a blockchain light node, a blockchain full node, etc.) does not verify when accessing a target node on the blockchain network. The legitimacy of the target node, the target node will not verify the legitimacy of the node. However, in some scenarios where information security is required, this type of access may lead to the disclosure of critical information. For example, multiple organizations, such as banks and enterprises, participate in a blockchain at the same time to complete the business. Different organizations participating in the same blockchain may acquire key information that they do not want the other party to obtain. Therefore, it is imperative that inter-node access in the blockchain network complete mutual authentication. The traditional identity authentication method is generally implemented by mutual transfer of digital certificates issued by third parties. This traditional identity authentication method is over-centralized, and the problem of high complexity of digital certificate is not applicable to decentralized. Blockchain network.

Therefore, how to achieve secure mutual access between nodes in a blockchain network has become an annoying problem.

Summary of the invention

In view of this, the present disclosure provides a method, apparatus, system, storage medium, and electronic device for securely accessing a blockchain for implementing secure access in a blockchain network.

In order to achieve the above object, according to a first aspect of an embodiment of the present disclosure, a method for securely accessing a blockchain is provided, which is applied to prepare a new node for accessing a target node in a blockchain network, the method comprising: determining whether a need is needed The trusted node preset in the blockchain network endorses the target node; if the trusted node is required to endorse the target node, acquiring the trusted node to use the private key to the target An endorsement data obtained by signing a node public key; and providing a public key of the new node to the target node, wherein a public key of the new node is used to make the target node in the blockchain network Querying, in the preset permission permission, the permission permission of the account address corresponding to the public key of the new node, determining whether the identity authentication of the new node is successful according to the queried permission, and performing signature verification on the endorsement data; If the signature verification is passed, it is determined that the identity authentication of the target node is successful.

According to a second aspect of an embodiment of the present disclosure, there is provided an apparatus for securely accessing a blockchain, configured to prepare to access or access a new node of a target node in a blockchain network. The apparatus includes a determination module configured to determine whether a trusted node preset in the blockchain network is required to endorse the target node. The endorsement obtaining module is configured to acquire, when the trusted node is required to endorse the target node, the endorsement data obtained by the trusted node using the private key to sign the target node public key. a public key providing module configured to provide a public key of the new node to the target node, wherein a public key of the new node is used to enable a license of the target node to be preset in the blockchain network Querying the permission permission of the account address corresponding to the public key of the new node, and determining whether the identity authentication of the new node is successful according to the queried permission. The target identity authentication module is configured to perform signature verification on the endorsement data, and if the signature verification is passed, determine that the identity authentication of the target node is successful.

According to a third aspect of an embodiment of the present disclosure, there is provided a method of securely accessing a blockchain, applied to a target node in a blockchain network. The method includes: acquiring a public key of the new node in response to receiving an access or access request issued by a new node; querying a public key corresponding to the new node in a permission permission preset by the blockchain network The license right owned by the account address; determining whether the identity authentication of the new node is successful according to the queried permission.

According to a fourth aspect of an embodiment of the present disclosure, there is provided an apparatus for securely accessing a blockchain, configured in a target node in a blockchain network. The apparatus includes a new node public key acquisition module configured to acquire a public key of the new node in response to receiving an access or access request issued by the new node. The new node permission query module is configured to query, in the license rights preset by the blockchain network, the permission rights owned by the account address corresponding to the public key of the new node. The new node identity authentication module is configured to determine whether the identity authentication of the new node is successful according to the queried permission.

According to a fifth aspect of an embodiment of the present disclosure, there is provided a method of securely accessing a blockchain, the method being applied to a trusted node preset in a blockchain network. The method includes: in response to preparing a new node accessing a target node in a blockchain network, requiring a trusted node to endorse the target node, obtaining a public key of the target node; using the trusted node's own private key to the target The node's public key is signed to obtain endorsement data; the endorsement data is provided to the new node, so that the new node determines whether the identity authentication of the target node is successful by performing signature verification on the endorsement data.

According to a sixth aspect of an embodiment of the present disclosure, there is provided an apparatus for securely accessing a blockchain, the apparatus being configured with a trusted node preset in a blockchain network. The apparatus includes a target public key acquisition module configured to acquire a public key of the target node in response to a new node that is ready to access a target node in the blockchain network, requiring the trusted node to endorse the target node. The signature module is configured to use the trusted node's own private key to sign the public key of the target node to obtain endorsement data. An endorsement providing module configured to provide the endorsement data to the new node to cause the new node to perform signature verification on the endorsement data, and if the new node signature verification passes, the new node determines a location The identity authentication of the target node is successful.

According to a seventh aspect of the embodiments of the present disclosure, there is provided a computer readable storage medium comprising one or more programs for performing the first embodiment of the present disclosure The method described on the one hand.

According to an eighth aspect of the embodiments of the present disclosure, there is provided an electronic device comprising: the computer readable storage medium of the seventh aspect of the embodiments of the present disclosure; and one or more processors for executing the computer Read the program in the storage medium.

According to a ninth aspect of the embodiments of the present disclosure, there is provided a computer readable storage medium comprising one or more programs for performing the first embodiment of the present disclosure The method described in three aspects.

According to a tenth aspect of the embodiments of the present disclosure, there is provided an electronic device comprising: the computer readable storage medium of the ninth aspect of the embodiments of the present disclosure; and one or more processors for executing the computer Read the program in the storage medium.

According to an eleventh aspect of the embodiments of the present disclosure, there is provided a computer readable storage medium comprising one or more programs for performing the embodiments of the present disclosure The method of the fifth aspect.

According to a twelfth aspect of the embodiments of the present disclosure, there is provided an electronic device comprising: the computer readable storage medium of the eleventh aspect of the embodiments of the present disclosure; and one or more processors for executing A program in a computer readable storage medium.

According to a thirteenth aspect of an embodiment of the present disclosure, a system for securely accessing a blockchain is provided. The system includes: a new node implemented by the electronic device according to the eighth aspect of the present disclosure; a target node implemented by the electronic device according to the tenth aspect of the embodiment of the present disclosure; The trusted node implemented by the electronic device of the second aspect; wherein the new node, the target node, and the trusted node belong to the same blockchain network.

Through the above technical solution of the present disclosure, a new node preparing to access the blockchain network acquires endorsement data obtained by the trusted node preset in the blockchain network using the private key to sign the target node public key, and performs signature verification on the endorsement data. If the signature verification is passed, it is determined that the identity authentication of the target node is successful, and the target node queries the permission permission of the account address corresponding to the public key of the new node in the permission permission preset by the blockchain network, according to the permission of the query. The authority determines whether the identity authentication of the new node is successful, and the trusted node responds to the new node that is ready to access the target node in the blockchain network, and the trusted node needs to endorse the target node, obtain the public key of the target node, and use the The private key of the target node is signed by the private key of the target node to obtain endorsement data; the endorsement data is provided to the new node, and therefore, the mutual authentication of the new node and the target node of the disclosure directly utilizes the blockchain network. The public and private keys of the node account do not require a centralized third party to participate in the digital certificate, avoiding the digital certificate award Brought about by high complexity, inter-block chain to achieve a secure access network node.

The above general description and the following detailed description are intended to be illustrative and not restrictive.

DRAWINGS

FIG. 1 is a schematic structural diagram of a blockchain network according to an exemplary embodiment of the present disclosure.

2 is a flow chart of a method of securely accessing a blockchain, according to an exemplary embodiment of the first aspect of the present disclosure.

FIG. 3 is a schematic diagram of signaling interaction of a method for securely accessing a blockchain according to another exemplary embodiment of the first aspect of the present disclosure.

FIG. 4 is a block diagram of an apparatus for securely accessing a blockchain, according to an exemplary embodiment of the second aspect of the present disclosure.

FIG. 5 is a block diagram of an apparatus for securely accessing a blockchain, according to another exemplary embodiment of the second aspect of the present disclosure.

FIG. 6 is a block diagram of an apparatus for securely accessing a blockchain, according to still another exemplary embodiment of the second aspect of the present disclosure.

FIG. 7 is a flowchart of a method for securely accessing a blockchain according to an exemplary embodiment of the third aspect of the present disclosure.

FIG. 8 is a block diagram of an apparatus for securely accessing a blockchain, according to an exemplary embodiment of the fourth aspect of the present disclosure.

FIG. 9 is a block diagram of an apparatus for securely accessing a blockchain, according to another exemplary embodiment of the fourth aspect of the present disclosure.

FIG. 10 is a block diagram of an apparatus for securely accessing a blockchain, according to still another exemplary embodiment of the fourth aspect of the present disclosure.

FIG. 11 is a flowchart of a method for securely accessing a blockchain according to an exemplary embodiment of the fifth aspect of the present disclosure.

FIG. 12 is a block diagram of an apparatus for securely accessing a blockchain, according to an exemplary embodiment of the sixth aspect of the present disclosure.

FIG. 13 is a block diagram of an apparatus for securely accessing a blockchain, according to another exemplary embodiment of the sixth aspect of the present disclosure.

FIG. 14 is a block diagram of an electronic device, according to an exemplary embodiment.

Detailed ways

Exemplary embodiments will be described in detail herein, examples of which are illustrated in the accompanying drawings. The following description refers to the same or similar elements in the different figures unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with aspects of the present disclosure as detailed in the appended claims.

Before introducing the method, device, system, storage medium and electronic device of the secure access blockchain provided by the present disclosure, the blockchain network is first introduced briefly. The blockchain network shown in Figure 1 is a P2P-based peer-to-peer network composed of several nodes. Each node in the blockchain network maintains a string of blockchains generated using cryptographic methods. The latest blocks are obtained by broadcasting between the nodes, so that the blocks between the nodes are maintained synchronously. Each node has an account that describes its identity. This account consists of public and private key pairs. The hash coded value of the public key is the address of the "account". The private key is kept by the account owner and cannot be made public.

In order to make the disclosed technical solution easier to understand, a possible blockchain network structure involved in various embodiments of the present disclosure is introduced. For example, FIG. 1 is a schematic diagram of a blockchain network structure according to an exemplary embodiment. As shown in FIG. 1, the blockchain network may include a new node 110, a target node 120, a trusted node 130, a management node 140, and a participating node 150. among them:

The new node 110 may include, but is not limited to, various terminals, a blockchain light node, a blockchain full node, etc., and needs to generate its own blockchain account, but may not synchronize any block data of the target blockchain network. .

The target node 120 may include, but is not limited to, various terminals, and may be any node in the blockchain network, and block the block data of the blockchain network.

The trusted node 130 may include, but is not limited to, various terminals, and is a default trusted node that the management node 140 presets into the blockchain network, and may have multiple.

The management node 140 may include, but is not limited to, various terminals, management nodes in the blockchain network, and may configure the permission rights of other blockchain node accounts.

The participating nodes 150 may include, but are not limited to, various terminals, and any number of nodes other than the default trusted nodes in the blockchain network are not limited.

In a blockchain network, each node can generate its own blockchain node account by running a blockchain program on the corresponding node server. The management node 140 can configure the permission rights of each node through the node control platform, for example, access permission rights, and the rights configuration is sent to the blockchain network by means of transaction, and is written into the blockchain after being verified by the blockchain network node. And finally through the P2P network to all nodes in the blockchain network.

2 is a flow chart of a method of securely accessing a blockchain, according to an exemplary embodiment of the first aspect of the present disclosure. The method is applied to a new node that is ready to access a target node in a blockchain network. As shown in FIG. 2, the method may include:

In step 210, the new node determines whether a trusted node preset in the blockchain network is required to endorse the target node.

Endorsement, in the present disclosure, refers to a process in which a node uses a blockchain account private key of a node itself to sign endorean data (such as public key, communication encrypted data) of a blockchain node that needs to be endorsed.

It can be understood that the target node that is not trusted in the present disclosure needs to be endorsed. A target node that is preset as a trusted node or endorsed (endorsed is not expired) can be regarded as a trusted node for the new node, and does not need to endorse, but is not preset as a target node of the trusted node or expires without endorsement or endorsement. The target node is an untrusted node and needs to be endorsed.

In the present disclosure, the trusted node of the new node requesting endorsement can be preset by the new node after the new node generates its own node account. The node information of the preset trusted node may include an IP or a domain name and an account public key of the trusted node. For example, the manner in which the new node presets the default trusted node may include: the client accessing the blockchain by the new node presets the default trusted node information internally, or the client accessing the blockchain by the new node prompts the user to input the default. Information about the node. If the new node does not have other node information in the chain, it can also obtain other node information from the trusted node, and refresh the local trusted node information list, such as adding/removing trusted nodes and refreshing the trusted node validity period.

After completing the above presets, the new node can issue a connection request to the target node. In order to prevent replay attacks, after the new node issues a connection request to the target node, the new node may also receive a random challenge code from the target node, sign the random challenge code using the new node's own private key, and send the signed random challenge code. Give the target node.

In step 220, if the trusted node is required to endorse the target node, the endorsement data obtained by the trusted node using the private key to sign the target node public key is obtained.

In a possible implementation manner, the new node sends the IP or domain name of the trusted node and the endorsement determination indication to the target node. The list of trusted nodes and the validity period can be locally updated and maintained at the new node.

For example, the endorsement determination indication may be used to cause the target node to pre-store from the local query according to the IP or domain name of the trusted node, and the trusted node performs the target node public key by using its own private key. The endorsement data obtained by the signature transmits the endorsement data to the new node if the endorsement data has not expired. In the case that the target node does not have unexpired endorsement data locally, the corresponding endorsement request may be sent to the trusted node, the endorsement data is obtained from the trusted node, and the endorsement data is sent to the new node. Since the embodiment obtains the endorsement data locally from the target node, it is not necessary to obtain the endorsement data from the trusted node every time, thereby effectively reducing the burden on the trusted node.

For another example, the endorsement determination indication may be used to cause the target node to issue a corresponding endorsement request to the trusted node, obtain endorsement data from the trusted node, and send the endorsement data to the new node. The new node receives the endorsement data sent by the target node for the endorsement determination indication. In the process of interacting with the trusted node, the random challenge code can also be used to prevent replay attacks. In addition, in order to ensure the security of the endorsement data, after receiving the endorsement request of the target node, the trusted node may query the account address corresponding to the public key of the target node in the permission permission preset by the blockchain network. Permission authority, determining whether to endorse the target node according to the queried permission, and in the case of determining endorsement of the target node, using the private key to sign the public key of the target node and the communication encrypted data Get endorsed data.

Optionally, the new node may send the endorsement determination indication to the target node along with the signed random challenge code. In order to reduce the number of interactions and improve the authentication efficiency, the communication encrypted data generated by the new node can also be sent to the target node together with the endorsement determination indication. The communication encrypted data is used by the new node and the target node to perform encrypted communication with each other using the communication encrypted data after the identity authentication is passed. For example, the communication encrypted data may include: a communication encrypted symmetric key, or a communication encrypted random number. The new node encrypts the communication encrypted data. For example, in a possible implementation manner, the target node may send the random challenge code and its own public key to the new node after receiving the connection request of the new node. In this way, the new node can encrypt the communication encrypted data by using the target node public key, and send the encrypted communication encrypted data, the endorsement determination indication, and the signed random challenge code to the target node. In this embodiment, the communication encrypted data for encrypted communication is generated by the new node client and transmitted to the other party in the two-way authentication process, thereby reducing the number of interactions and improving the authentication efficiency.

In another possible implementation manner, in case the trusted node is required to endorse the target node, the new node may send an endorsement request to the trusted node. Receiving endorsement data that the trusted node requests feedback for the endorsement. In this embodiment, the new node directly obtains the endorsement data from the trusted node, and the endorsement data does not pass through the target node, and the security is higher.

In step 230, the public key of the new node is provided to the target node.

The public key of the new node is used to enable the target node to query the permission rights of the account address corresponding to the public key of the new node in the permission permission preset by the blockchain network, according to the query. The permission determines whether the identity authentication for the new node is successful. For example, here, corresponding to the access or access request of the new node, the target node checks the access permission of the new node account on the current blockchain, that is, checks whether the account of the new node has its corresponding in the current blockchain network. Access permission, if any, determines that the identity authentication for the new node was successful.

In step 240, signature verification is performed on the endorsement data.

In step 250, if the signature verification is passed, it is determined that the identity authentication for the target node is successful.

In addition, if the signature verification fails, it can be determined that the identity authentication failed.

After the identity authentication between the new node and the target node is successful, communication can be performed.

It can be seen that, through the foregoing technical solution of the present disclosure, a new node that is ready to access the blockchain network acquires endorsement data obtained by the trusted node preset in the blockchain network using the private key to sign the target node public key, and performs endorsement data on the endorsement data. Signature verification, if the signature verification is passed, it determines that the identity authentication of the target node is successful. The identity authentication directly utilizes the public and private keys of the blockchain network node account, and does not require a centralized third party to participate in the digital certificate, thereby avoiding the digital certificate issuing office. The high complexity brings about secure access between nodes in the blockchain network.

In order to make the technical solutions of the present disclosure easier to understand, the technical solutions of the present disclosure are further described in detail through the signaling interaction diagrams of the following possible implementation manners.

FIG. 3 is a schematic diagram of signaling interaction of a method for securely accessing a blockchain according to another exemplary embodiment of the first aspect of the present disclosure. It should be noted that before the new node and the target node authenticate each other, the new node may first generate a node account and preset the trusted node public key. The new node, such as the local no-chain intra-node information, can obtain the intra-chain node information from the trusted node and refresh the trusted node information list. The trusted node presets the trusted node information in the blockchain network and adds the new node account to the blockchain. Understandably, these preset operations need only be completed in advance, and do not need to be performed before each authentication.

In step 310, the new node issues a connection request to the target node.

In step 311, the new node receives the random challenge code and the target node public key from the target node.

In step 312, the new node signs the random challenge code using its own private key.

In step 313, the new node generates a communication encryption symmetric key and encrypts the communication encryption symmetric key using the target node public key.

In another possible implementation, in order to enhance security, a communication encrypted random number may be used instead of the encrypted symmetric key.

In step 314, the new node determines whether the target node is trusted, that is, determines whether the trusted node preset in the blockchain network needs to endorse the target node.

In step 315, if the new node determines that the target node is trusted, the signed random challenge code, the encrypted communication encryption symmetric key, and the endorsement negative indication are carried together in the access or access request and sent to the target node. .

In step 316, when the new node determines that the target node is not trusted, that is, if the trusted node is required to endorse the target node, the IP address of the trusted node or the domain name and the signed random challenge code are encrypted. The communication encrypts the symmetric key, and the endorsement determination indication is carried along with the access or access request to the target node.

In step 320, the target node performs signature verification on the random challenge code carried in response to receiving the access or access request, and obtains the public key of the new node according to the signature.

In step 321, the target node queries the permission rights of the account address corresponding to the public key of the new node in the permission permission preset by the blockchain network.

In step 322, the target node determines whether the identity authentication of the new node is successful according to the queried permission.

It can be understood that the account authority corresponding to the account address of the new node of the new node may include multiple types, where the target node checks the access of the new node account on the current blockchain, corresponding to the access or access request of the new node. Permission, that is, checking whether the account of the new node has its corresponding access permission in the current blockchain network.

In step 323, the target node determines whether the endorsement determination indication or the endorsement negative indication is received in the case that it is determined that the identity authentication of the new node is successful.

In step 324, if the target node determines that the endorsement determination indication is received, the target node carries the communication encryption symmetric key in the endorsement request according to the IP or domain name of the trusted node carried in the access or access request. Send to the corresponding trusted node.

In another possible implementation manner, in order to alleviate the burden on the trusted node, the target node may locally maintain the endorsement of the trusted node, including end-of-life management of the endorsement. Within the validity period of the endorsement, the target node may not need to endorse the trusted node again, which reduces the burden on the trusted node. Specifically, the target node may locally query, according to the IP address or the domain name of the trusted node, the previously stored endorsement data obtained by the trusted node using the private key to sign the target node public key, in the endorsement data. If not expired, the endorsement data is sent to the new node. It can be understood that if there is no endorsement of the trusted node that has not expired locally, the endorsement data can be obtained by sending an endorsement request to the trusted node.

It can be understood that, when the target node determines that the endorsement negative indication is received, it means that the new node determines that the target node is trusted, and the target node can decrypt the communication encryption symmetric key by using its own private key, and use its own private key. The decrypted communication encryption symmetric key is signed, and the signed communication encryption symmetric key is sent to the new node, and the new node performs signature verification on the received communication encryption symmetric key. After the verification is passed, the new node is The target nodes can communicate with each other.

In step 325, the target node receives a random challenge code from the trusted node.

In step 326, the target node signs the random challenge code using its own private key.

In step 327, the target node sends the signed random challenge code to the trusted node.

In step 330, the trusted node performs signature verification on the received random challenge code, and obtains the public key of the target node after the verification is passed.

In step 331, the trusted node queries the permission rights of the target node's public key corresponding account address in the license rights preset by the blockchain network.

In step 332, the trusted node determines whether to endorse the target node according to the queried permission.

It can be understood that the public key of the target node may have multiple license rights corresponding to the account address, where the trusted node may check the access permission of the target node account on the current blockchain corresponding to the endorsement request of the target node. That is, it checks whether the account of the target node has its corresponding access permission right in the current blockchain network. If the inspection is passed, the target node can be endorsed. If it is not passed, it will not be endorsed.

In step 333, the trusted node, when determining to endorse the target node, uses the private key to sign the public key of the target node and the communication encryption symmetric key to obtain endorsement data.

In step 334, the trusted node sends the endorsement data to the target node.

In step 340, the target node decrypts the communication encryption symmetric key using its own private key and signs the communication encryption symmetric key using its own private key.

In step 341, the target node transmits the signed communication encryption symmetric key and the endorsement data to the new node. That is, the trusted node provides the endorsement data to the new node through the target node.

In step 342, the new node determines whether the identity authentication of the target node is successful by performing signature verification on the received endorsement data.

It can be understood that if the signature verification succeeds, the identity authentication succeeds, and if the signature verification fails, the identity authentication fails.

In step 343, the new node performs signature verification on the signed communication encrypted symmetric key to obtain the public key of the target node. If the signature verification passes, the new node determines that the identity authentication of the target node is successful, and the new node will target the node. The public key is added to the list of trusted nodes of the new node and configured for its validity period. Thereafter, the new node can communicate with the target node with each other.

In the case where the communication encryption random number is used instead of the communication encryption symmetric key, the new node and the target node need to calculate the encryption key according to the communication encrypted random number before the communication, and use the encryption key to perform the encrypted communication. The communication encrypted random number may be a true random number segment generated by the new node and having the same length as the plaintext byte number. When the encryption key is generated, the encryption key can be generated by adding or XORing the plaintext one-to-one. Decryption is the inverse of encryption.

It can be seen that, through the above technical solution of the present disclosure, the two-way authentication of the new node and the target node directly utilizes the public and private keys of the node of the blockchain network node, and does not require a centralized third party to participate in the digital certificate, thereby avoiding the digital certificate issuance. High complexity enables secure access between nodes in the blockchain network. Moreover, the target node adopts a challenge response manner to prevent replay attacks, and the encryption key of the subsequent encrypted communication is generated by the new node client, and is transmitted to the other party in the two-way authentication process, which reduces the number of interactions, and the identity authentication efficiency is higher.

FIG. 4 is a block diagram of an apparatus 400 for securely accessing a blockchain, according to an exemplary embodiment of the second aspect of the present disclosure. The device is configured to a new node that is ready to access a target node in the blockchain network. As shown in FIG. 4, the apparatus may include: a determining module 410, an endorsement obtaining module 420, a public key providing module 430, and a target identity authentication module 440.

The determining module 410 may be configured to determine whether a trusted node preset in the blockchain network is required to endorse the target node.

The endorsement obtaining module 420 may be configured to acquire, when the trusted node is required to endorse the target node, the endorsement data obtained by the trusted node using the private key to sign the target node public key. .

The public key providing module 430 may be configured to provide the public key of the new node to the target node, wherein a public key of the new node is used to pre-stage the target node in the blockchain network The permission permission of the account address corresponding to the public key of the new node is queried, and the identity authentication of the new node is determined according to the privileged permission.

The target identity authentication module 440 can be configured to perform signature verification on the endorsement data, and if the signature verification is passed, determine that the identity authentication of the target node is successful.

It can be seen that, through the foregoing technical solution of the present disclosure, a new node that is ready to access the blockchain network acquires endorsement data obtained by the trusted node preset in the blockchain network using the private key to sign the target node public key, and performs endorsement data on the endorsement data. Signature verification, if the signature verification is passed, it is determined that the identity authentication of the target node is successful, and the identity authentication directly utilizes the public and private keys of the blockchain network node account, and does not require a centralized third party to participate in the digital certificate, thereby avoiding the digital certificate issuance. The high complexity has resulted in secure access between nodes in the blockchain network.

FIG. 5 is a block diagram of an apparatus 500 for securely accessing a blockchain, according to another exemplary embodiment of the second aspect of the present disclosure. As shown in FIG. 5, in the apparatus, the endorsement obtaining module 420 may include: a first request sending submodule 421, and may be configured to: if the trusted node is required to endorse the target node, The IP or domain name and endorsement determination indication of the trusted node is sent to the target node. The first endorsement receiving sub-module 422 may be configured to receive endorsement data sent by the target node for the endorsement determination indication.

In a possible implementation manner, the endorsement determination indication may be used to enable the target node to locally query, according to the IP address or the domain name of the trusted node, the pre-stored, trusted node to use its own private key pair. The endorsement data obtained by signing the target node public key is sent to the new node if the endorsement data has not expired. In this embodiment, if there is no unexpired endorsement data locally in the target node, the corresponding endorsement request may be sent to the trusted node, the endorsement data is obtained from the trusted node, and the endorsement data is sent to the Describe the new node. Since the embodiment obtains the endorsement data locally from the target node, it is not necessary to obtain the endorsement data from the trusted node every time, thereby effectively reducing the burden on the trusted node.

In another possible implementation manner, the endorsement determination indication may be used to enable the target node to issue a corresponding endorsement request directly to the trusted node, obtain endorsement data from the trusted node, and use the endorsement data Sent to the new node.

FIG. 6 is a block diagram of an apparatus 600 for securely accessing a blockchain, according to yet another exemplary embodiment of the second aspect of the present disclosure. As shown in FIG. 6, in the apparatus, the endorsement obtaining module 420 may include: a second request sending submodule 423, which may be configured to request an endorsement if the trusted node is required to endorse the target node Sent to the trusted node. The second endorsement receiving sub-module 424 can be configured to receive endorsement data that the trusted node requests feedback for the endorsement.

In this embodiment, the new node directly obtains the endorsement data from the trusted node, and the endorsement data does not pass through the target node, and the security is higher.

In a possible implementation, as shown in FIG. 5 and FIG. 6, the apparatus may further include: a communication encrypted data generating module 450, which may be configured to generate communication encrypted data. The communication encrypted data is used by the new node and the target node to perform encrypted communication with each other using the communication encrypted data after the identity authentication is passed. The communication encrypted data encryption module 451 can be configured to encrypt the communication encrypted data. The communication encrypted data transmitting module 452 may be configured to, when transmitting the endorsement determination indication to the target node, transmit the encrypted communication encrypted data together with the endorsement determination indication to the target node. The communication encrypted data may include: a communication encryption symmetric key, or a communication encryption random number.

Through this embodiment, the number of interactions between the new node and the target node is reduced, and the authentication efficiency is improved.

In another possible implementation manner, as shown in FIG. 5 and FIG. 6, the apparatus may further include: a challenge code receiving module 460, configured to receive a random challenge code from the target node. The challenge code signature module 461 can be configured to sign the random challenge code using the new node's own private key. The challenge code sending module 462 can be configured to send the signed random challenge code to the target node.

With this embodiment, replay attacks can be prevented and the security of interaction between nodes can be improved.

FIG. 7 is a flowchart of a method for securely accessing a blockchain according to an exemplary embodiment of the third aspect of the present disclosure. The method is applied to a target node in a blockchain network. As shown in FIG. 7, the method may include:

In step 710, the target node acquires the public key of the new node in response to receiving an access or access request issued by the new node.

In a possible implementation manner, the target node may further receive an IP address or a domain name and an endorsement determination indication of the trusted node sent by the new node, and according to the receiving the endorsement determination indication, locally query the corresponding IP or domain name. Pre-stored endorsement data, wherein the endorsement data is obtained by the trusted node using the private key to sign the target node public key, and if the endorsement data has not expired, the endorsement is performed Data is sent to the new node. For example, in this embodiment, the IP or domain name and endorsement determination indication of the trusted node sent by the new node may be carried in an access or access request sent by the new node, and the target node obtains the trusted from the access or access request. The IP or domain name of the node and the endorsement determine the indication.

In another possible implementation manner, the target node may further receive an IP or a domain name and an endorsement determination indication of the trusted node sent by the new node, and according to the receiving the endorsement determination indication, may correspond to the IP or the domain name. The letter node sends an endorsement request, wherein the endorsement request is used to enable the trusted node to acquire the public key of the target node, and use the trusted node's own private key to sign the public key of the target node to obtain an endorsement Data, the target node obtains the endorsement data from the trusted node, and the target node sends the endorsement data to the new node.

In step 720, the license authority owned by the account address corresponding to the public key of the new node is queried in the license authority preset by the blockchain network.

In step 730, it is determined whether the identity authentication of the new node is successful according to the queried permission.

Through the above technical solution of the present disclosure, the target node determines the license right of the account address corresponding to the public key of the new node in the permission permission preset by the blockchain network, and determines the identity authentication of the new node according to the checked permission. Whether it is successful, therefore, the identity authentication directly utilizes the public and private keys of the blockchain network node account, and does not require a centralized third party to participate in the digital certificate, thereby avoiding the high complexity brought by the digital certificate issuance and realizing the blockchain network. Secure access between nodes.

In addition, the method for the secure access block chain applied to the target node provided by the present disclosure may be further described in detail with reference to the signaling interaction diagram shown in FIG. 3 , and details are not described herein again.

FIG. 8 is a block diagram of an apparatus 800 for securely accessing a blockchain, according to an exemplary embodiment of the fourth aspect of the present disclosure. The device is configured at a target node in a blockchain network. As shown in FIG. 8, the apparatus may include: a new node public key obtaining module 810, a new node authority querying module 820, and a new node identity authentication module 830.

The new node public key obtaining module 810 can be configured to acquire the public key of the new node in response to receiving an access or access request issued by the new node.

The new node permission query module 820 can be configured to query the license rights owned by the account address corresponding to the public key of the new node in the license rights preset by the blockchain network.

The new node identity authentication module 830 can be configured to determine whether the identity authentication of the new node is successful according to the queried permission.

FIG. 9 is a block diagram of an apparatus 900 for securely accessing a blockchain, according to another exemplary embodiment of the fourth aspect of the present disclosure. As shown in FIG. 9, the apparatus may further include: an endorsement indication obtaining module 840, configured to receive an IP or domain name and an endorsement determination indication of the trusted node sent by the new node. The endorsement data query module 841 may be configured to, according to the receipt of the endorsement determination indication, locally query the pre-stored endorsement data corresponding to the IP or the domain name, wherein the endorsement data is used by the trusted node. The private key of the target node is signed by the private key. The endorsement sending first module 842 can be configured to send the endorsement data to the new node if the endorsement data has not expired.

FIG. 10 is a block diagram of an apparatus 1000 for securely accessing a blockchain, according to yet another exemplary embodiment of the fourth aspect of the present disclosure. As shown in FIG. 10, the apparatus may further include: an endorsement indication obtaining module 1010, configured to receive an IP or domain name and an endorsement determination indication of the trusted node sent by the new node. The endorsement request sending module 1011 may be configured to issue an endorsement request to the trusted node corresponding to the IP or the domain name according to the received endorsement determination indication, where the endorsement request is used to obtain the trusted node Describe the public key of the target node, and use the trusted node's own private key to sign the public key of the target node to obtain endorsement data. The endorsement data receiving module 1012 can be configured to obtain the endorsement data from the trusted node. The endorsement sending second module 1013 can be configured to send the endorsement data to the new node.

It can be seen that, in the foregoing technical solution of the present disclosure, the target node queries the permission permission of the account address corresponding to the public key of the new node in the permission permission preset by the blockchain network, and determines the identity of the new node according to the obtained permission permission. Whether the authentication is successful, therefore, the identity authentication directly utilizes the public and private keys of the blockchain network node account, and does not require a centralized third party to participate in the digital certificate, thereby avoiding the high complexity brought by the digital certificate issuance and realizing the blockchain. Secure access between network nodes.

FIG. 11 is a flowchart of a method for securely accessing a blockchain according to an exemplary embodiment of the fifth aspect of the present disclosure. The method is applied to a trusted node preset in a blockchain network. As shown in FIG. 11, the method may include:

In step 1110, the trusted node responds to the new node that is ready to access the target node in the blockchain network, and the trusted node needs to endorse the target node to obtain the public key of the target node.

In a possible implementation manner, the trusted node may acquire the public key of the target node in response to receiving the endorsement request sent by the target node, where the endorsement request is received by the target node according to the The IP or domain name of the trusted node sent by the new node and the endorsement determination indication are correspondingly issued.

In another possible implementation manner, the trusted node may acquire the public key of the target node in response to receiving an endorsement request for the target node from the new node.

In step 1120, the public key of the target node is signed using the trusted node's own private key to obtain endorsement data.

In an implementation manner of receiving an endorsement request from the target node, the trusted node may further query, in the permission permission preset by the blockchain network, the permission permission of the account address corresponding to the public key of the target node, according to the query. The permission authority determines whether to endorse the target node, and if it is determined to endorse the target node, re-enter the signature of the public key of the target node by using the private key of the trusted node itself The step of endorsing data.

In step 1130, the endorsement data is provided to the new node, so that the new node performs signature verification on the endorsement data, and if the new node signature verification passes, the new node determines the target The identity authentication of the node is successful.

For example, in an embodiment in which an endorsement request is received from a target node, the endorsement data may be sent to the target node, and the endorsement data is sent to the new node via the target node.

As another example, in an embodiment in which an endorsement request is received from a new node, the endorsement data can be sent directly to the new node.

Through the above technical solution of the present disclosure, since the trusted node uses the private key to sign the public key of the target node to obtain endorsement data, the endorsement data is provided to the new node, and therefore, the new node and the target node of the present disclosure The two-way authentication directly utilizes the public and private keys of the blockchain network node account, and does not require a centralized third party to participate in the digital certificate, thereby avoiding the high complexity brought by the digital certificate issuance and realizing the secure access between the nodes of the blockchain network. .

In addition, the method for the secure access block chain applied to the trusted node provided by the present disclosure may be further described in detail with reference to the signaling interaction diagram shown in FIG. 3 , and details are not described herein again.

FIG. 12 is a block diagram of an apparatus 1200 for securely accessing a blockchain, according to an exemplary embodiment of the sixth aspect of the present disclosure. The device is configured on a trusted node in a blockchain network. As shown in FIG. 12, the apparatus may include: a target public key obtaining module 1210, a signature module 1220, and an endorsement providing module 1230.

The target public key obtaining module 1210 may be configured to acquire a public key of the target node in response to preparing a new node of the target node in the blockchain network to require the trusted node to endorse the target node.

The signature module 1220 can be configured to use the trusted node's own private key to sign the public key of the target node to obtain endorsement data.

The endorsement providing module 1230 may be configured to provide the endorsement data to the new node, so that the new node performs signature verification on the endorsement data, and if the new node signature verification passes, the new node Determining that the identity authentication of the target node is successful.

In a possible implementation manner, the target public key obtaining module 1210 may be configured to acquire a public key of the target node in response to receiving an endorsement request sent by the target node, where the endorsement request is The target node is correspondingly sent according to the IP or domain name of the trusted node sent by the new node and the endorsement determination indication. The endorsement providing module 1230 may be configured to send the endorsement data to the target node, and the endorsement data is sent to the new node via the target node.

In another possible implementation manner, the target public key obtaining module 1210 may be configured to acquire the public key of the target node in response to receiving an endorsement request to the target node from the new node. The endorsement providing module 1230 can be configured to send the endorsement data directly to the new node.

FIG. 13 is a block diagram of an apparatus 1300 for securely accessing a blockchain, according to another exemplary embodiment of the sixth aspect of the present disclosure. As shown in FIG. 13, the apparatus may further include: a target authority querying module 1240, configured to query, in the permission permission preset by the blockchain network, after receiving the endorsement request sent by the target node The license authority owned by the account address corresponding to the public key of the target node. The endorsement determination module 1241 may be configured to determine whether to endorse the target node according to the queried permission. The signing module 1220 may be configured to execute the signing of the public key of the target node by using the trusted node's private key to obtain endorsement data if the endorsement determining module determines to endorse the target node. A step of.

Through the above technical solution of the present disclosure, since the trusted node uses the private key to sign the public key of the target node to obtain endorsement data, the endorsement data is provided to the new node, and therefore, the new node and the target node of the present disclosure The two-way authentication directly utilizes the public and private keys of the blockchain network node account, and does not require a centralized third party to participate in the digital certificate, thereby avoiding the high complexity brought by the digital certificate issuance and realizing the secure access between the nodes of the blockchain network. .

FIG. 14 is a block diagram of an electronic device 1400, according to an exemplary embodiment. As shown in FIG. 14, the electronic device 1400 can include a processor 1401, a memory 1402, a multimedia component 1403, an input/output (I/O) interface 1404, and a communication component 1405.

The processor 1401 is configured to control the overall operation of the electronic device 1400 to complete all or part of the steps of the method for securely accessing the blockchain. The memory 1402 is configured to store various types of data to support operations at the electronic device 1400, such as may include instructions for any application or method operating on the electronic device 1400, and application related data, For example, contact data, sent and received messages, pictures, audio, video, and so on. The memory 1402 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as a static random access memory (SRAM), an electrically erasable programmable read only memory ( Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (Erasable) Programmable Read-Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic memory, flash memory, disk or optical disk. The multimedia component 1403 can include a screen and an audio component. The screen may be, for example, a touch screen, and the audio component is used to output and/or input an audio signal. For example, the audio component can include a microphone for receiving an external audio signal. The received audio signal may be further stored in memory 1402 or transmitted via communication component 1405. The audio component also includes at least one speaker for outputting an audio signal. The I/O interface 1404 provides an interface between the processor 1401 and other interface modules, such as a keyboard, a mouse, a button, and the like. These buttons can be virtual buttons or physical buttons. The communication component 1405 is used for wired or wireless communication between the electronic device 1400 and other devices. Wireless communication, such as Wi-Fi, Bluetooth, Near Field Communication (NFC), 2G, 3G or 4G, or a combination of one or more of them, so the corresponding communication component 1405 can include: Wi-Fi module, Bluetooth module, NFC module.

In an exemplary embodiment, the electronic device 1400 may be configured by one or more application specific integrated circuits (Application Specific) Integrated Circuit (ASIC), Digital Signal Processor (DSP), Digital Signal Processing Device (DSPD), Programmable Logic Device (PLD), field programmable A Field Programmable Gate Array (FPGA), controller, microcontroller, microprocessor or other electronic component implementation for performing the above method of securely accessing a blockchain.

In another exemplary embodiment, there is also provided a computer readable storage medium comprising program instructions, such as a memory 1402 comprising program instructions executable by processor 1401 of electronic device 1400 to perform the secure access described above Blockchain approach.

In addition, the present disclosure also provides a system for securely accessing a blockchain. The system may include at least one new node implemented by the electronic device as described in the above embodiments, at least one new node implemented by the electronic device as described in the above embodiment, at least one electronic device as described in the above embodiment The target node implemented by the device, at least one trusted node implemented by the electronic device as described in the above embodiments. The trusted node implemented by the electronic device as described in the foregoing embodiment, the target node implemented by the electronic device as described in the foregoing embodiment, and the electronic device as described in the foregoing embodiment belong to the same area. Blockchain network.

In summary, the two-way authentication of the new node and the target node of the present disclosure directly utilizes the public and private keys of the blockchain network node account, and does not require a centralized third party to participate in the digital certificate, thereby avoiding the high complexity brought by the digital certificate issuance. Degrees, achieve secure access between nodes in the blockchain network.

The preferred embodiments of the present disclosure have been described in detail above with reference to the accompanying drawings. However, the present disclosure is not limited to the specific details of the above embodiments, and various simple modifications can be made to the technical solutions of the present disclosure within the scope of the technical idea of the present disclosure. These simple variations are all within the scope of the disclosure.

It should be further noted that the specific technical features described in the above specific embodiments may be combined in any suitable manner without contradiction. In order to avoid unnecessary repetition, the present disclosure is applicable to various possibilities. The combination method will not be described separately.

In addition, any combination of various embodiments of the present disclosure may be made as long as it does not deviate from the idea of the present disclosure, and should also be regarded as the disclosure of the present disclosure.

Claims (31)

A method for securely accessing a blockchain, the method being applied to prepare to access or access a new node of a target node in a blockchain network, the method comprising: Determining whether a trusted node preset in the blockchain network is required to endorse the target node; Obtaining endorsement data obtained by the trusted node using the private key to sign the target node public key, if the trusted node is required to endorse the target node; And providing a public key of the new node to the target node, wherein a public key of the new node is used to cause the target node to query the new one in a license permission preset by the blockchain network The license authority owned by the account address corresponding to the public key of the node determines whether the identity authentication of the new node is successful according to the queried permission. Performing signature verification on the endorsement data; If the signature verification is passed, it is determined that the identity authentication of the target node is successful. The method according to claim 1, wherein in the case that the trusted node is required to endorse the target node, acquiring the trusted node to use the private key to perform the target node public key The endorsement data obtained by the signature includes: Sending an IP or domain name and an endorsement determination indication of the trusted node to the target node if the trusted node is required to endorse the target node, the endorsement determination indication is used to make the target node Authorizing, according to the IP address or the domain name of the trusted node, the previously stored endorsement data obtained by the trusted node using the private key to sign the target node public key, where the endorsement data has not expired And sending the endorsement data to the new node, or the endorsement determination indication is used to enable the target node to issue a corresponding endorsement request to the trusted node, and obtain endorsement data from the trusted node, Transmitting the endorsement data to the new node; Receiving endorsement data sent by the target node for the endorsement determination indication; or, Sending an endorsement request to the trusted node if the trusted node is required to endorse the target node; Receiving endorsement data that the trusted node requests feedback for the endorsement. The method of claim 2, wherein the method further comprises: Generating communication encrypted data, wherein the communication encrypted data is used by the new node and the target node to perform encrypted communication with each other using the communication encrypted data after identity authentication is passed; Encrypting the communication encrypted data; And transmitting the encrypted communication encrypted data to the target node together with the endorsement determination indication when the endorsement determination indication is sent to the target node. The method according to claim 3, wherein said communication encrypted data comprises: a communication encryption symmetric key, or a communication encryption random number. The method of claim 1 further comprising: Receiving a random challenge code from the target node; Signing the random challenge code using the new node's own private key; Sending the signed random challenge code to the target node. An apparatus for securely accessing a blockchain, wherein the apparatus is configured to prepare to access or access a new node of a target node in a blockchain network, the apparatus comprising: a determining module, configured to determine whether a trusted node preset in the blockchain network is required to endorse the target node; The endorsement obtaining module is configured to acquire, when the trusted node is required to endorse the target node, the endorsement data obtained by the trusted node by using the private key to sign the target node public key; a public key providing module configured to provide a public key of the new node to the target node, wherein a public key of the new node is used to enable a license of the target node to be preset in the blockchain network Querying, in the permission, the permission permission of the account address corresponding to the public key of the new node, and determining whether the identity authentication of the new node is successful according to the obtained permission permission; The target identity authentication module is configured to perform signature verification on the endorsement data, and if the signature verification is passed, determine that the identity authentication of the target node is successful. The apparatus according to claim 6, wherein the endorsement acquisition module comprises: a first request sending submodule configured to send an IP or domain name and an endorsement determination indication of the trusted node to the target node if the trusted node is required to endorse the target node, The endorsement determination indication is used for causing the target node to locally query, according to the IP address or the domain name of the trusted node, the pre-stored endorsement data obtained by the trusted node using the private key to sign the target node public key. Sending the endorsement data to the new node if the endorsement data has not expired, or the endorsement determination indication is used to cause the target node to issue a corresponding endorsement request to the trusted node, Obtaining endorsement data from the trusted node, and transmitting the endorsement data to the new node; The first endorsement receiving submodule is configured to receive endorsement data sent by the target node for the endorsement determination indication; or, The endorsement acquisition module includes: a second request sending submodule configured to send an endorsement request to the trusted node if the trusted node is required to endorse the target node; The second endorsement receiving submodule is configured to receive endorsement data that the trusted node requests feedback for the endorsement. The device according to claim 7, wherein the device further comprises: a communication encrypted data generating module configured to generate communication encrypted data, wherein the communication encrypted data is used by the new node and the target node to perform encrypted communication with each other using the communication encrypted data after identity authentication is passed; a communication encrypted data encryption module configured to encrypt the communication encrypted data; The communication encrypted data transmitting module is configured to, when transmitting the endorsement determination instruction to the target node, transmit the encrypted communication encrypted data together with the endorsement determination indication to the target node. The apparatus according to claim 8, wherein said communication encrypted data comprises: a communication encryption symmetric key, or a communication encryption random number. The device according to claim 6, wherein the device further comprises: a challenge code receiving module configured to receive a random challenge code from the target node; a challenge code signature module configured to sign the random challenge code using the new node's own private key; The challenge code sending module is configured to send the signed random challenge code to the target node. A method for securely accessing a blockchain, the method being applied to a target node in a blockchain network, the method comprising: Acquiring the public key of the new node in response to receiving an access or access request issued by the new node; Querying, in the permission permission preset by the blockchain network, a license right owned by an account address corresponding to the public key of the new node; Determine whether the identity authentication of the new node is successful according to the queried permission. The method of claim 11 wherein the method further comprises: Receiving an IP or domain name and an endorsement determination indication of the trusted node sent by the new node; Receiving, according to the receipt of the endorsement determination indication, the pre-stored endorsement data corresponding to the IP or the domain name, wherein the endorsement data is used by the trusted node to use the private key to the target node public key Signature is obtained; In the case where the endorsement data has not expired, the endorsement data is transmitted to the new node. The method of claim 11 wherein the method further comprises: Receiving an IP or domain name and an endorsement determination indication of the trusted node sent by the new node; And sending an endorsement request to the trusted node corresponding to the IP or the domain name according to the receiving the endorsement determination instruction, wherein the endorsement request is used to enable the trusted node to acquire the public key of the target node, using the The trusted node's own private key signs the public key of the target node to obtain endorsement data; Obtaining the endorsement data from the trusted node; Transmitting the endorsement data to the new node. An apparatus for securely accessing a blockchain, wherein the apparatus is disposed at a target node in a blockchain network, the apparatus comprising: a new node public key obtaining module configured to acquire a public key of the new node in response to receiving an access or access request issued by the new node; The new node permission query module is configured to query, in the permission permission preset by the blockchain network, the permission permission owned by the account address corresponding to the public key of the new node; The new node identity authentication module is configured to determine whether the identity authentication of the new node is successful according to the queried permission. The device according to claim 14, wherein the device further comprises: The endorsement indication obtaining module is configured to receive an IP or domain name and an endorsement determination indication of the trusted node sent by the new node; The endorsement data query module is configured to, according to the receipt of the endorsement determination indication, locally query the pre-stored endorsement data corresponding to the IP or the domain name, wherein the endorsement data is used by the trusted node. The key is obtained by signing the target node public key; The endorsement sends a first module configured to send the endorsement data to the new node if the endorsement data has not expired. The device according to claim 14, wherein the device further comprises: The endorsement indication obtaining module is configured to receive an IP or domain name and an endorsement determination indication of the trusted node sent by the new node; The endorsement request sending module is configured to issue an endorsement request to the trusted node corresponding to the IP or the domain name according to the received endorsement determination indication, wherein the endorsement request is used to enable the trusted node to obtain the target a public key of the node, using the trusted node's own private key to sign the public key of the target node to obtain endorsement data; An endorsement data receiving module configured to obtain the endorsement data from the trusted node; The endorsement sends a second module configured to send the endorsement data to the new node. A method for securely accessing a blockchain, the method being applied to a trusted node preset in a blockchain network, the method comprising: Responding to the new node preparing to access the target node in the blockchain network requires the trusted node to endorse the target node to obtain the public key of the target node; Using the trusted node's own private key to sign the public key of the target node to obtain endorsement data; Providing the endorsement data to the new node, so that the new node performs signature verification on the endorsement data, and if the new node signature verification passes, the new node determines that the identity authentication of the target node is successful. . The method according to claim 17, wherein the responding to preparing a new node of the target node in the blockchain network requires the trusted node to endorse the target node, and obtaining the public key of the target node comprises: Acquiring a public key of the target node in response to receiving an endorsement request sent by the target node, wherein the endorsement request is an IP or a domain name of the trusted node sent by the target node according to the received new node And the endorsement confirmation instructions are issued accordingly; The providing the endorsement data to the new node includes: Transmitting the endorsement data to the target node, and the endorsement data is sent to the new node via the target node. The method according to claim 17, wherein the responding to preparing a new node of the target node in the blockchain network requires the trusted node to endorse the target node, and obtaining the public key of the target node comprises: Acquiring a public key of the target node in response to receiving an endorsement request from the new node to the target node; The providing the endorsement data to the new node includes: The endorsement data is sent directly to the new node. The method according to claim 18, wherein after the receiving the endorsement request sent by the target node, the method further comprises: Querying, in the permission permission preset by the blockchain network, a license right owned by an account address corresponding to the public key of the target node; Determining whether to endorse the target node according to the queried permission; In the case of determining to endorse the target node, the step of using the trusted node's own private key to sign the public key of the target node to obtain endorsement data is entered. An apparatus for securely accessing a blockchain, wherein the device is configured with a trusted node preset in a blockchain network, and the device includes: a target public key obtaining module configured to: in response to preparing a new node of the target node in the blockchain network, requiring the trusted node to endorse the target node to acquire a public key of the target node; a signing module configured to use the trusted node's own private key to sign the public key of the target node to obtain endorsement data; An endorsement providing module configured to provide the endorsement data to the new node to cause the new node to perform signature verification on the endorsement data, and if the new node signature verification passes, determine the target node Identity authentication is successful. The apparatus according to claim 21, wherein the target public key obtaining module is configured to acquire a public key of the target node in response to receiving an endorsement request sent by the target node, wherein the endorsement The request is sent by the target node according to the IP or domain name of the trusted node sent by the new node and the endorsement determination indication; The endorsement providing module is configured to send the endorsement data to the target node, and the endorsement data is sent to the new node via the target node. The apparatus according to claim 21, wherein the target public key obtaining module is configured to acquire a public key of the target node in response to receiving an endorsement request for the target node from a new node; The endorsement providing module is configured to send the endorsement data directly to the new node. The device of claim 22, wherein the device further comprises: The target authority querying module is configured to, after receiving the endorsement request sent by the target node, query the permission permission of the account address corresponding to the public key of the target node in the permission permission preset by the blockchain network ; The endorsement determining module is configured to determine whether to endorse the target node according to the queried permission permission; The signing module is configured to perform, when the endorsement determining module determines to endorse the target node, performing the step of using the trusted node's own private key to sign the public key of the target node to obtain endorsement data. . A computer readable storage medium, comprising: one or more programs, the one or more programs for performing the method of any one of claims 1 to 5. . An electronic device, comprising: The computer readable storage medium of claim 25; One or more processors for executing a program in the computer readable storage medium. A computer readable storage medium, comprising: one or more programs, the one or more programs for performing the method of any one of claims 11 to 13 . An electronic device, comprising: The computer readable storage medium of claim 27; One or more processors for executing a program in the computer readable storage medium. A computer readable storage medium, comprising: one or more programs, the one or more programs for performing the method of any one of claims 17 to 20 . An electronic device, comprising: The computer readable storage medium of claim 29; One or more processors for executing a program in the computer readable storage medium. A system for securely accessing a blockchain, the system comprising: At least one new node implemented by the electronic device of claim 26; At least one target node implemented by the electronic device of claim 28; At least one trusted node implemented by the electronic device of claim 30; The trusted node implemented by the electronic device of claim 26, the target node implemented by the electronic device of claim 28, and the electronic device of claim 30 belong to the same block. Chain network.