Methods and devices for managing access to account in blockchain system
Disclosed herein are methods, devices, and apparatuses, including computer programs stored on computer-readable media for managing access to an account in a blockchain system. One of the methods includes: receiving, from a first account of the blockchain system, a request for accessing a second account of the blockchain system; determining an account level of the first account based on the request; determining an account level of the second account; determining whether the account level of the first account satisfies an account condition based on the account level of the second account; and permitting the request for accessing the second account based on a determination that the account level of the first account satisfies the account condition.
1. A computer-implemented method for managing access to an account in a blockchain system, comprising:
receiving, by a node of the blockchain system, a request from a first account of the blockchain system to access a second account of the blockchain system, wherein the node implements a virtual machine that operates a permission fence and an interface, wherein the first and second
accounts are assigned account levels, and wherein the second account is associated with an
account condition for accessing the second account;
providing, by the node of the blockchain system, the received request to the virtual machine:
receiving, by the virtual machine, the provided request from the node of the blockchain system:
providing, by the virtual machine, the received request to the permission fence:
receiving, by the permission fence, the provided request from the virtual machine:
determining, by the permission fence, an account level of the first account based on the received request;
determining, by the permission fence, an account level of the second account;
determining, by the permission fence, an interface level of the interface based on the received request:
determining, by the permission fence, the account condition associated with the second account:
determining, by the permission fence, whether the account level of the first account satisfies the account condition associated with the second account by determining whether the account level of the first account is higher than or equal to the account level of the second account and whether the account level of the first account is higher than or equal to the interface level of the interface; and
based on a determination, by the permission fence that the account level of the first account satisfies the account condition associated with the second account, authorizing, by the permission fence, access from the first account to the second account by permitting the first account to call a function through the interface.
2. The method of claim 1 , wherein the second account is one of a contract account corresponding to a smart contract or a regular account that does not correspond to a smart contract.
3. The method of claim 2 , wherein the second account is the contract account corresponding to a smart contract, and the smart contract comprises the interface.
4. The method of claim 3 , further comprising:
based on a determination, by the permission fence, that the account level of the first account is not higher than or equal to the interface level of the interface, denying, by the permission fence, a request for accessing the interface of the smart contract.
5. The method of claim 4 , wherein the smart contract comprises a first interface having a first interface level and a second interface having a second interface level, the request for accessing the interface of the smart contract further comprises a first request for accessing the first interface and a second request for accessing the second interface, and the method further comprises at least one of:
based on a determination, by the permission fence, that the account level of the first account is higher than or equal to the account level of the second account and that the account
level of the first account is higher than or equal to the first interface level, authorizing, by the permission fence, the first request access to the first interface of the smart contract; and
based on a determination, by the permission fence, that the account level of the first account is not higher than or equal to the account level of the second account or that the account level of the first account is not higher than or equal to the second interface level, denying, by the permission fence, the second request for accessing the second interface of the smart contract.
6. The method of claim 2 , wherein the account level of the first account comprises a public level, a protected level, or a privileged level; and the account level of the second account comprises the public level, the protected level, or the privileged level.
7. The method of claim 3 , wherein the account level of the first account comprises a public level, a protected level, or a privileged level; the account level of the second account comprises the public level, the protected level, or the privileged level; and the interface level comprises the public level, the protected level, or the privileged level.
8. The method of claim 7 , wherein the account level of the contract account is the public level by default; and the interface level is the public level by default.
9. The method of claim 1 , wherein in determining the account level of the first account based on the received request, the method further comprises: determining, by the permission fence, an identity of the first account based on the request; and determining, by the permission fence, the account level of the first account based on the determined identity.
10. A device for managing access to an account in a blockchain system, the device operating as a node of the blockchain system and comprising: one or more processors; and
one or more computer-readable memories coupled to the one or more processors and having instructions stored thereon that are executable by the one or more processors, wherein the one or more processors are configured to:
receive, by the node of the blockchain system, a request from a first account of the blockchain system to access a second account of the blockchain system, wherein the node implements a virtual machine that operates a permission fence and an interface, wherein the first
and second accounts are assigned account levels, and wherein the second account is associated
with an account condition for accessing the second account;
provide, by the node of the blockchain system, the received request to the virtual machine:
receive, by the virtual machine, the provided request from the node of the blockchain system:
provide, by the virtual machine, the received request to the permission fence:
receive, by the permission fence, the provided request from the virtual machine:
determine, by the permission fence, an account level of the first account based on the received request;
determine, by the permission fence, an account level of the second account; determine, by the permission fence, an interface level of the interface based on the received request:
determine, by the permission fence, the account condition associated with the second account:
determine, by the permission fence, whether the account level of the first account satisfies the account condition associated with the second account by determining whether the account level of the first account is higher than or equal to the account level of the second account and whether the account level of the first account is higher than or equal to the interface level of the interface; and
based on a determination, by the permission fence, that the account level of the first account satisfies the account condition associated with the second account is,
authorize, by the permission fence, access from the first account to the second account by permitting the first account to call a function through the interface.
11. A non-transitory computer-readable medium having stored therein instructions that, when executed by a processor of a device, cause the device to perform a method for managing access to an account in a blockchain system, the device operating as a node of the blockchain system. the method comprising:
receiving, by the node of the blockchain system, a request from a first account of the blockchain system to access a second account of the blockchain system, wherein the node implements a virtual machine that operates a permission fence and an interface, wherein the first
and second accounts are assigned account levels, and wherein the second account is associated
with an account condition for accessing the second account;
providing, by the node of the blockchain system, the received request to the virtual machine:
receiving, by the virtual machine, the provided request from the node of the blockchain system:
providing, by the virtual machine, the received request to the permission fence:
receiving, by the permission fence, the provided request from the virtual machine:
determining, by the permission fence, an account level of the first account based on the received request;
determining, by the permission fence, an account level of the second account;
determining, by the permission fence, an interface level of the interface based on the received request:
determining, by the permission fence, the account condition associated with the second account:
determining, by the permission fence, whether the account level of the first account satisfies the account condition associated with the second account by determining whether the account level of the first account is higher than or equal to the account level of the second account and whether the account level of the first account is higher than or equal to the interface level of the interface; and
based on a determination, by the permission fence, that the account level of the first account satisfies the account condition associated with the second account is,
authorizing, by the permission fence,
access from the first account to the second account by permitting the first account to call a function through the interface.
12. The device of claim 10 , wherein the second account is one of a contract account corresponding to a smart contract or a regular account that does not correspond to a smart contract.
13. The device of claim 12 , wherein the second account is the contract account corresponding to a smart contract, and the smart contract comprises the interface.