CN113595986B - A smart contract interception method and device based on a smart contract firewall framework - Google Patents

Abstract

The invention discloses an intelligent contract intercepting method and device based on an intelligent contract firewall framework, wherein the method comprises the following steps: deploying a first firewall contract, a first interception rule base and a protected contract on the blockchain; the first interception rule base comprises a first rule contract; receiving and responding to a calling request sent by a user side, and returning a judgment result to a first firewall contract when the judgment result that the transaction information result is reasonable is obtained; and sending the transaction request to a protected contract, so that the protected contract performs transaction with the user side according to the transaction request, and returning a transaction result to the first firewall contract and the first rule contract, so that the first rule contract detects the transaction result, and intercepts the transaction when the transaction condition is not met. The embodiment of the invention can intercept the malicious transaction behaviors in time by monitoring the firewall contract in real time, thereby effectively avoiding the loss caused by the malicious transaction behaviors.

Description

A smart contract interception method and device based on a smart contract firewall framework

technical field

The invention relates to the field of computer technology, in particular to a smart contract interception method and device based on a smart contract firewall framework.

Background technique

The emergence of smart contracts marks the official entry of blockchain technology into the 2.0 era, which also means that blockchain also has a system that can perform a series of operations by itself without direct human intervention, and smart contracts are exactly this system carrier. However, there has always been a problem with smart contract blockchains since their inception: most smart contract blockchains are difficult to upgrade and maintain after the smart contracts are deployed on the chain, and Ethereum does not even provide an official smart contract upgrade path. Therefore, once a smart contract with vulnerabilities is put on the chain, its maintenance cost is high, and it is easy to be repeatedly attacked by hackers, which will cause heavy losses to the contract deployer. At present, the technologies to deal with smart contract security mainly include smart contract firewall and smart contract security audit technology. The smart contract firewall provides real-time protection for smart contracts, prevents unauthorized transactions by adding another layer of protection to smart contracts, and can customize the configuration of black and white lists according to the actual needs of the project, strictly filtering attackers and malicious users, and protecting the platform Fairness and asset security. Smart contract security audit technology is one of the core businesses of professional blockchain companies such as SlowMist Technology, Paidun Technology, and Zero Time Technology. This technology is a third-party audit of the smart contract before the chain code is put on the chain. There are matching with feature codes, automatic audit technology based on morphological verification, symbol execution and symbol abstraction, and manual audit technology.

The existing smart contract interception method is to upgrade the security of the smart contract before going to the chain, which is mainly used for the discovery and repair of chain code vulnerabilities. The smart contract firewall implements the control of chain code calls and prevents unauthorized access through the deployment of firewall codes. However, the existing smart contract interception methods cannot detect and intercept malicious transactions initiated for smart contract vulnerabilities in time.

Contents of the invention

The present invention provides a smart contract interception method and device based on a smart contract firewall framework to solve the technical problem that the existing smart contract interception method cannot detect malicious transactions initiated for smart contract loopholes in time and intercept them.

An embodiment of the present invention provides a smart contract interception method based on a smart contract firewall framework, including:

Deploy the first firewall contract, the first interception rule base and the protected contract on the block chain; the first interception rule base includes the first rule contract;

receiving and responding to the call request sent by the client, and sending the transaction information in the transaction request sent by the client to the first rule contract, so that the first rule contract can judge the rationality of the transaction information, and returning the judgment result to the first firewall contract when the judgment result of reasonableness is passed;

Receive and respond to the judgment result, and send the transaction request to the protected contract, make the protected contract conduct a transaction with the client according to the transaction request, and return the transaction result after the transaction is completed to said first firewall contract;

Receive the transaction result sent by the protected contract, and send the transaction result to the first rule contract, so that the first rule contract detects the transaction result according to the rules in its own contract, if the detection result If the transaction result does not meet the transaction condition, then return the detection result to the first firewall contract;

The transaction is intercepted according to the detection result, and the interception result is returned to the client.

Further, the interception method also includes:

Deploying a second rule contract in the first interception rule base;

By modifying the calling status parameter of the first firewall contract, the first rule contract is replaced with the second rule contract.

Further, the interception method also includes:

Deploying a second interception rule base and a second firewall contract on the block chain;

Destroy the first firewall contract, call the rule contract in the second interception rule base through the second firewall contract, and protect the protected contract with the rule contract in the second interception rule base.

Further, there is a many-to-many relationship among the firewall contract, the rule contract and the protected contract.

Further, the interception method also includes:

When the protected contract is subjected to an unknown new type of attack, the abnormal parameters in the protected contract are used as a sample to perform a fuzz test to obtain reinforcement rules for dealing with the new type of attack.

Further, the fuzzy test is performed on the abnormal parameters in the protected contract as a sample to obtain the reinforcement rules for dealing with the new type of attack, specifically:

After the new type of attack occurs, determine the abnormal parameters that cause the abnormal state when the protected contract is attacked, perform random mutation processing on the abnormal parameters to obtain the abnormal abnormal parameters, and fuzz the abnormal abnormal parameters multiple times Tests get hardened rules.

Further, after performing random mutation processing on the abnormal parameters, the abnormal abnormal parameters are obtained, and multiple fuzzy tests are performed on the abnormal abnormal parameters to obtain reinforcement rules, specifically:

The abnormal parameter of the mutation is used as the input item of each fuzz test, and the protected contract under attack is used as the carrier of each fuzz test to carry out the fuzz test, and the output item of the fuzz test obtained is attacked The control flow of the protected contract of ;

After multiple fuzzing tests, multiple sets of the abnormal mutation parameters and the input-output pairs of the control flow are performed, and the high-frequency code blocks of the input-output pairs are screened out by performing frequent item mining on the input-output pairs. Analyzing the high-frequency code blocks obtains reinforcement rules for dealing with the new type of attack.

Another embodiment of the present invention provides a smart contract interception device based on a smart contract firewall framework, including:

A deployment module, configured to deploy a first firewall contract, a first interception rule base, and a protected contract on the block chain; the first interception rule base includes a first rule contract;

The transaction information sending module is used to receive and respond to the call request sent by the client, and send the transaction information in the transaction request sent by the client to the first rule contract, so that the first rule matches the transaction judge the rationality of the information, and return the judgment result to the first firewall contract when the judgment result is reasonable;

A transaction request sending module, configured to receive and respond to the judgment result, and send the transaction request to the protected contract, so that the protected contract conducts a transaction with the client according to the transaction request, and After the transaction is completed, the transaction result is returned to the first firewall contract;

The transaction result sending module is used to receive the transaction result sent by the protected contract, and send the transaction result to the first rule contract, so that the first rule contract can process the transaction according to the rules in its own contract. The results are detected, and if the detection result is that the transaction result does not meet the transaction conditions, the detection result is returned to the first firewall contract;

The transaction interception module is configured to intercept the transaction according to the detection result, and return the interception result to the client.

Another embodiment of the present invention provides a computer-readable storage medium, the computer-readable storage medium includes a stored computer program, wherein, when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute As mentioned above, the smart contract interception method based on the smart contract firewall framework.

The embodiment of the present invention monitors each transaction of the protected contract in real time by establishing a firewall contract and an interception rule library on the blockchain. Once a malicious transaction is found in the protected contract, the transaction can be intercepted in time through the firewall contract. In this way, losses caused by malicious trading behaviors can be effectively avoided.

Further, the embodiment of the present invention realizes the protection of the protected contract through the separation of the firewall contract and the interception rule. When the user wants to change the protection rule or service provider, he only needs to change the calling parameters of the firewall contract or directly replace the new firewall The contract can be realized, which not only makes the protection service for the protected contract more comprehensive and flexible, but also effectively reduces the maintenance cost and difficulty of smart contracts.

Description of drawings

Fig. 1 is a schematic flow diagram of a smart contract interception method based on a smart contract firewall framework provided by an embodiment of the present invention;

Fig. 2 is a schematic diagram of the smart contract firewall architecture provided by the embodiment of the present invention;

Fig. 3 is a schematic diagram of the change of call relationship between contracts when the rule contract is replaced provided by the embodiment of the present invention;

Fig. 4 is a schematic diagram of the change in the call relationship between contracts when the interception rule library is replaced according to the embodiment of the present invention;

Fig. 5 is another schematic flowchart of a smart contract interception method based on a smart contract firewall framework provided by an embodiment of the present invention;

Fig. 6 is a flow chart of program code operation provided by the embodiment of the present invention;

Fig. 7 is a schematic structural diagram of a smart contract interception device based on a smart contract firewall framework provided by an embodiment of the present invention.

Detailed ways

The following will clearly and completely describe the technical solutions in the embodiments of the application with reference to the drawings in the embodiments of the application. Apparently, the described embodiments are only some of the embodiments of the application, not all of them. Based on the embodiments in this application, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the scope of protection of this application.

In the description of the present application, it should be understood that the terms "first" and "second" are used for description purposes only, and cannot be interpreted as indicating or implying relative importance or implicitly indicating the quantity of indicated technical features. Thus, a feature defined as "first" and "second" may explicitly or implicitly include one or more of these features. In the description of the present application, unless otherwise specified, "plurality" means two or more.

In the description of this application, it should be noted that unless otherwise specified and limited, the terms "installation", "connection", and "connection" should be understood in a broad sense, for example, it can be a fixed connection or a detachable connection. Connected, or integrally connected; it can be mechanically connected or electrically connected; it can be directly connected or indirectly connected through an intermediary, and it can be the internal communication of two components. Those of ordinary skill in the art can understand the specific meanings of the above terms in this application in specific situations.

Referring to Figures 1-6, in the first embodiment of the present invention, a smart contract interception method based on the smart contract firewall framework shown in Figure 1 is provided, including:

S1. Deploy the first firewall contract, the first interception rule base and the protected contract on the blockchain; the first interception rule base includes the first rule contract;

S2. Receive and respond to the call request sent by the client, and send the transaction information in the transaction request sent by the client to the first rule contract, so that the first rule can judge the rationality of the transaction information, and when the rationality is passed When the judgment result is determined, the judgment result is returned to the first firewall contract;

Optionally, the transaction information includes the information of the transaction initiator and transaction parameters, and the rationality judgment includes authority judgment and pre-execution result judgment. When the judgment result of the rationality of the transaction information is not passed, the firewall contract intercepts the transaction.

S3. Receive and respond to the judgment result, and send the transaction request to the protected contract, so that the protected contract conducts a transaction with the client according to the transaction request, and returns the transaction result to the first firewall contract after the transaction is completed;

S4. Receive the transaction result sent by the protected contract, and send the transaction result to the first rule contract, so that the first rule contract can detect the transaction result according to the rules in its own contract. If the detection result is that the transaction result does not meet the transaction conditions, then return the detection result to the first firewall contract;

S5. Intercept the transaction according to the detection result, and return the interception result to the client.

In the embodiment of the present invention, the rule contract is essentially a smart contract that needs to be deployed on the blockchain, which contains a variety of protection rules and interception rules for smart contract transactions. The firewall interception rules can be formally described as follows:

f(p1,p2,...)

Among them, pi is a transaction parameter, and f is a function operation on the transaction parameter, which can be a piece of code.

The interception rule base is a collection of rule contracts. In actual application scenarios, it is embodied as many smart contracts that have been deployed on the chain and written transaction filtering protection rules.

In the embodiment of the present invention, the firewall contract is essentially a contract protection agent, and the firewall contract is the entry of the interception rule base, and acts as a connection between the interception rule base and the protected contract. Please refer to FIG. 2 , which is a schematic diagram of a smart contract firewall architecture provided by an embodiment of the present invention.

In the embodiment of the present invention, the first firewall contract, the first interception rule base and the protected contract are deployed on the block chain; the first interception rule base includes the first rule contract, and the first firewall contract is used to connect the interception rule base and the protected contract , each transaction of the protected contract is monitored in real time through the first firewall. Once a malicious transaction is found in the protected contract, the transaction can be intercepted in time through the firewall contract, thereby effectively avoiding losses caused by malicious transactions.

As a specific implementation of the embodiment of the present invention, the interception method also includes:

Deploy the second rule contract in the first interception rule base;

By modifying the call status parameter of the first firewall contract, the first rule contract is replaced with the second rule contract.

In the embodiment of the present invention, the firewall contract is essentially a contract protection agent, and the firewall contract is the entry of the interception rule base, and acts as a connection between the interception rule base and the protected contract.

Please refer to FIG. 3 , when the rule contract needs to be replaced to protect the protection contract, the embodiment of the present invention can complete the replacement of the rule contract by modifying the calling state parameters of the firewall contract. Please continue to refer to Figure 3. The first rule contract, the second rule contract, the firewall contract and the protected contract are deployed on the blockchain. Before the interception rules are replaced, the interception protection rules of the protected contract are determined by the first rule contract. When it is necessary to replace the interception rule with the content of the second rule contract, the embodiment of the present invention can complete the replacement of the interception rule by modifying the call state parameter of the firewall contract from the first rule contract to the second rule contract, and replace the second contract The interception rules of the latter protected contract are determined by the second rule contract.

In the embodiment of the present invention, the rule contract and the protected contract are connected through the first firewall contract. When the user needs to replace the protection service, the replacement of the rule contract can be realized conveniently by modifying the call state parameters of the first firewall contract, which can not only effectively improve the protection Efficiency, and the replacement of the rule contract is only realized by modifying the call state parameters, which can effectively reduce the maintenance cost and difficulty of the smart contract.

As a specific implementation of the embodiment of the present invention, the interception method also includes:

Deploy the second interception rule base and the second firewall contract on the blockchain;

Destroy the first firewall contract, call the rule contract in the second interception rule base through the second firewall contract, and use the rule contract in the second interception rule base to protect the protected contract.

Optionally, in actual application scenarios, different interception rule bases are generally maintained by different service providers. Please refer to FIG. 4 , when the user wants to replace the interception rule library that provides protection rule standards for the protected contract, the embodiment of the present invention is implemented by replacing the firewall proxy contract. In Figure 4, the first interception rule base, the second interception rule base, the first firewall contract and the protected contract have been deployed on the blockchain. Determined by one of the rule contracts in the first interception rule base. In a specific implementation manner, the interception rule may be determined by multiple rule contracts.

Optionally, when the user wants to replace the interception rule with a certain rule contract in the second interception rule base, because the types or attributes of the external interfaces provided by different interception rule bases may be inconsistent, it cannot be directly changed by changing the firewall contract. Call the state parameter to complete the replacement of the service. In the embodiment of the present invention, a second firewall contract is redeployed to call the rule contract in the second interception rule base, so as to realize the replacement of the interception rule. At this time, the protected contract no longer needs the first interception rule base to provide the interception rule service, and the embodiment of the present invention directly destroys the first firewall contract, so as to reduce the memory space of the system and improve the interception efficiency of the system. The first rule contract can continue to be deployed on the blockchain and wait to be called again by other firewall contracts. After the above operations are completed, the protection service is provided to the protected contract through the second firewall contract, and the interception rule is determined by one of the rule contracts in the second interception rule base. In a specific implementation manner, the interception rule may be determined by multiple rule contracts.

In the embodiment of the present invention, the rule contract and the protected contract are connected through the first firewall contract, and the first firewall contract is used as the protection provider to provide protection services for the protected contract. When the user needs to change the protection provider, the first firewall contract is destroyed. And by deploying the second firewall contract on the block chain, and using the second firewall contract to call the rule contract in the second interception rule base, and protecting the protected contract with the rule contract in the second interception rule base, not only can Quickly replace the protection provider, making the protection service for the protected contract more comprehensive and flexible, and can effectively reduce the maintenance cost and difficulty of smart contracts.

As a specific implementation manner of the embodiment of the present invention, there is a many-to-many relationship among the firewall contract, the rule contract and the protected contract.

Exemplarily, the firewall contract can protect only one protected contract, or protect multiple protected contracts at the same time. At the same time, the firewall contract can also call a rule contract or call multiple rule contracts at the same time. The rule contract, firewall contract and There can be a many-to-many relationship between protected contracts. The many-to-many relationship between the firewall contract, the rule contract and the protected contract in the embodiment of the present invention can effectively improve the efficiency of interception and improve the difficulty of smart contract deployment, maintenance and upgrade.

As a specific implementation of the embodiment of the present invention, the interception method also includes:

When the protected contract is attacked by an unknown new type, the abnormal parameters in the protected contract are used as a sample for fuzzing to obtain reinforcement rules for dealing with the new type of attack.

In the embodiment of the present invention, the fuzzy test is carried out using the abnormal parameters in the protected contract under attack as a sample, and the hardening rules for dealing with new types of attacks are generated in a targeted manner, which can effectively improve the effectiveness of the hardening rules.

As a specific implementation of the embodiment of the present invention, the abnormal parameters in the protected contract are used as samples for fuzz testing to obtain reinforcement rules for dealing with new types of attacks, specifically:

After the new type of attack occurs, determine the abnormal parameters that lead to the abnormal state when the protected contract is attacked, perform random mutation processing on the abnormal parameters to obtain the abnormal abnormal parameters, and perform multiple fuzzy tests on the abnormal abnormal parameters to obtain the reinforcement rules.

As a specific implementation of the embodiment of the present invention, the abnormal parameters are randomly mutated to obtain the abnormal parameters, and the abnormal parameters are subjected to multiple fuzzy tests to obtain the reinforcement rules, specifically:

The abnormal parameters of mutation are used as the input items of each fuzz test, and the protected contract under attack is used as the carrier of each fuzz test for fuzz testing, and the output item of the fuzz test is the control flow of the protected contract under attack;

After multiple fuzz tests, there are many sets of abnormal parameters of mutation and input-output pairs of control flow. By mining the frequent items of the input-output pairs, the high-frequency code blocks of the input-output pairs are screened out, and the high-frequency code blocks are obtained by analyzing the high-frequency code blocks. Hardening rules for new types of attacks.

Exemplarily, in the embodiment of the present invention, variation refers to a process of generating new parameters based on the original parameters using a specific method. Parameter mutation methods include addition, subtraction and replacement of random numbers, bitwise or random flip, XOR and inversion, sensitive boundary value replacement and other methods. The data flow is: the code that has been run from the beginning to the end during the operation of the smart contract, that is, the running path of the code program. Please refer to Figure 6, if the parameter i is 0, the running path of the code program is A->B->D, and its data flow is the code running on the way. Fuzz testing is: A method of discovering software vulnerabilities by providing unexpected output to the target system and monitoring abnormal results. The main process of a fuzz test is as follows: First, randomly mutate the transaction or call parameters that trigger the abnormal state of the smart contract, and then use these mutated parameters as input parameters to call the smart contract that was originally attacked. Record the code that is run as a stream output.

Mining frequent items in the embodiment of the present invention is essentially a process of establishing a mapping from call parameters to code blocks. The embodiment of the present invention can obtain input and output pairs of multiple sets of mutated transaction parameters and code control flow through fuzzy testing, and then establishes Frequent itemsets to determine the mapping between transaction parameters and code blocks. Exemplarily, the algorithm used for mining frequent items in the embodiment of the present invention is the Apriori algorithm. The Apriori algorithm is an algorithm based on association rule mining. As a criterion for judging frequent itemsets in the embodiment of the present invention. The goal of the Apriori algorithm is to find the largest frequent set of K items. In the embodiment of the present invention, the association rule is in the form of an implication of X→Y, wherein X and Y are respectively called the antecedent (or left-hand-side, LHS) and the successor (consequent or right-hand-side, LHS) of the association rule. RHS). Association rule XY has support and trust. The support degree is the probability that the commodities included in the LHS in the former item of the rule and the RHS in the latter item of the rule appear at the same time, which can be understood as the number of transactions of LHS and RHS commodities/the total number of transactions. In the embodiment of the present invention, the frequent itemsets are generated, and its goal is to find all itemsets that meet the minimum support threshold, and these itemsets are called frequent itemsets (frequent itemsets).

In a specific implementation manner, the algorithm steps used for frequent mining in the embodiment of the present invention are:

Input: data set D, support threshold α;

Output: the largest frequent k-itemset;

S10. Scan the entire data set to obtain all the data that have appeared, as a candidate frequent 1-itemset, where k=1, and the frequent 0-itemset is an empty set;

S20. Mining frequent k-itemsets;

a. scan the data to calculate the support of candidate frequent k-itemsets;

b. Remove the data set whose support degree is lower than the threshold in the candidate frequent k-itemset, and obtain the frequent k-itemset; if the obtained frequent k-itemset is empty, directly return the set of frequent k-1 itemset as the algorithm result, and the algorithm ends ; If the obtained frequent k-itemset has only one item, then directly return the set of frequent k-itemset as the algorithm result, and the algorithm ends;

c. Based on frequent k-itemsets, continuously generate candidate frequent k+1-itemsets.

S30, set k=k+1, and jump to step S20.

In a specific implementation manner, the following three input-output pairs exist in the input-output pairs obtained through the fuzzy test in the embodiment of the present invention: {A, {a, b}}, {B, {b, c}}, {C, {b}}, where A, B, and C are three different new input parameter values after random mutation of the same transaction parameter W, and a, b, and c are three code statements in the smart contract under attack . Through observation, it is found that whether W is changed to A, B or C, the code statement b will run, and then an itemset {W,b} will be obtained, that is, when the parameter W changes, the b statement has a certain probability of running at the same time, and W and b There is a certain probability that there is a connection between them. However, when the parameter W is changed multiple times in the embodiment of the present invention, the statement b runs with a high probability. The embodiment of the present invention establishes the frequent itemset {W, b} through the Apriori algorithm, and calculates its support degree. As long as the set supports degree is greater than input a not too large threshold α and not greater than a larger threshold β, the implementation of the present invention considers that various variations of parameter W have a direct impact on whether b operates.

In the embodiment of the present invention, after the protected contract is attacked by a new type, the abnormal parameters in the protected contract after being attacked are used as a sample to perform fuzzy testing to obtain the input-output pair, and the high-frequency code blocks of the input-output pair are screened out through frequent item mining , that is, the suspicious code that produces an abnormal state. Analyzing the suspicious code can effectively obtain the reinforcement rules for this new type of attack, thereby effectively providing protection for the protected contract.

Please refer to FIG. 5 , which is another schematic flowchart of smart contract interception based on the smart contract firewall framework provided by the embodiment of the present invention.

Implementing the embodiment of the present invention has the following beneficial effects:

The embodiment of the present invention monitors each transaction of the protected contract in real time by establishing a firewall contract and an interception rule library on the blockchain. Once a malicious transaction is found in the protected contract, the transaction can be intercepted in time through the firewall contract. In this way, losses caused by malicious transactions can be effectively avoided; the embodiment of the invention realizes the protection of the protected contract through the separation of the firewall contract and the interception rules. When the user wants to change the protection rules or service providers, he only needs to change the firewall contract call parameters or directly replace the new firewall contract, which can not only make the protection service for the protected contract more comprehensive and flexible, but also effectively reduce the maintenance cost and difficulty of the smart contract; the embodiment of the present invention takes the attacked The abnormal parameters in the protection contract are used as samples for fuzz testing, and targeted generation of hardening rules to deal with new attacks can effectively improve the effectiveness of the hardening rules.

Referring to Fig. 7, another embodiment of the present invention provides a smart contract interception device based on a smart contract firewall framework, including:

The deployment module 10 is used to deploy the first firewall contract, the first interception rule base and the protected contract on the block chain; the first interception rule base includes the first rule contract;

The transaction information request sending module 20 is used to receive and respond to the call request sent by the client, and send the transaction information in the transaction request sent by the client to the first rule contract, so that the first rule can judge the rationality of the transaction information , and return the judgment result to the first firewall contract when the judgment result of reasonableness is passed;

Optionally, the transaction information includes the information of the transaction initiator and transaction parameters, and the rationality judgment includes authority judgment and pre-execution result judgment. When the judgment result of the rationality of the transaction information is not passed, the firewall contract intercepts the transaction.

The transaction request sending module 30 is used to receive and respond to the judgment result, and send the transaction request to the protected contract, so that the protected contract can conduct a transaction with the client according to the transaction request, and return the transaction result to the first firewall after the transaction is completed contract;

The transaction result sending module 40 is used to receive the transaction result sent by the protected contract, and send the transaction result to the first rule contract, so that the first rule contract can detect the transaction result according to the rules in its own contract. If the detection result is a transaction If the result does not meet the transaction conditions, the detection result will be returned to the first firewall contract;

The transaction interception module 50 is configured to intercept the transaction according to the detection result, and return the interception result to the client.

In the embodiment of the present invention, the rule contract is essentially a smart contract that needs to be deployed on the blockchain, which contains a variety of protection rules and interception rules for smart contract transactions. The firewall interception rules can be formally described as follows:

f(p1,p2,...)

Among them, pi is a transaction parameter, and f is a function operation on the transaction parameter, which can be a piece of code.

The interception rule base is a collection of rule contracts. In actual application scenarios, it is embodied as many smart contracts that have been deployed on the chain and written transaction filtering protection rules.

In the embodiment of the present invention, the firewall contract is essentially a contract protection agent, and the firewall contract is the entry of the interception rule base, and acts as a connection between the interception rule base and the protected contract. Please refer to FIG. 2 , which is a schematic diagram of a smart contract firewall architecture provided by an embodiment of the present invention.

In the embodiment of the present invention, the first firewall contract, the first interception rule base and the protected contract are deployed on the block chain; the first interception rule base includes the first rule contract, and the first firewall contract is used to connect the interception rule base and the protected contract , each transaction of the protected contract is monitored in real time through the first firewall. Once a malicious transaction is found in the protected contract, the transaction can be intercepted in time through the firewall contract, thereby effectively avoiding losses caused by malicious transactions.

As a specific implementation of the embodiment of the present invention, the interception method also includes:

Deploy the second rule contract in the first interception rule base;

By modifying the call status parameter of the first firewall contract, the first rule contract is replaced with the second rule contract.

In the embodiment of the present invention, the firewall contract is essentially a contract protection agent, and the firewall contract is the entry of the interception rule base, and acts as a connection between the interception rule base and the protected contract.

Please refer to FIG. 3 , when the rule contract needs to be replaced to protect the protection contract, the embodiment of the present invention can complete the replacement of the rule contract by modifying the calling state parameters of the firewall contract. Please continue to refer to Figure 3. The first rule contract, the second rule contract, the firewall contract and the protected contract are deployed on the blockchain. Before the interception rules are replaced, the interception protection rules of the protected contract are determined by the first rule contract. When it is necessary to replace the interception rule with the content of the second rule contract, the embodiment of the present invention can complete the replacement of the interception rule by modifying the call state parameter of the firewall contract from the first rule contract to the second rule contract, and replace the second contract The interception rules of the latter protected contract are determined by the second rule contract.

In the embodiment of the present invention, the rule contract and the protected contract are connected through the first firewall contract. When the user needs to replace the protection service, the replacement of the rule contract can be realized conveniently by modifying the call state parameters of the first firewall contract, which can not only effectively improve the protection Efficiency, and the replacement of the rule contract is only realized by modifying the call state parameters, which can effectively reduce the maintenance cost and difficulty of the smart contract.

As a specific implementation of the embodiment of the present invention, the interception device also includes a rule contract calling module, which is used for:

Deploy the second interception rule base and the second firewall contract on the blockchain;

Destroy the first firewall contract, call the rule contract in the second interception rule base through the second firewall contract, and use the rule contract in the second interception rule base to protect the protected contract.

Optionally, in actual application scenarios, different interception rule bases are generally maintained by different service providers. Please refer to FIG. 4 , when the user wants to replace the interception rule library that provides protection rule standards for the protected contract, the embodiment of the present invention is implemented by replacing the firewall proxy contract. In Figure 4, the first interception rule base, the second interception rule base, the first firewall contract and the protected contract have been deployed on the blockchain. Determined by one of the rule contracts in the first interception rule base. In a specific implementation manner, the interception rule may be determined by multiple rule contracts.

Optionally, when the user wants to replace the interception rule with a certain rule contract in the second interception rule base, because the types or attributes of the external interfaces provided by different interception rule bases may be inconsistent, it cannot be directly changed by changing the firewall contract. Call the state parameter to complete the replacement of the service. In the embodiment of the present invention, a second firewall contract is redeployed to call the rule contract in the second interception rule base, so as to realize the replacement of the interception rule. At this time, the protected contract no longer needs the first interception rule base to provide the interception rule service, and the embodiment of the present invention directly destroys the first firewall contract, so as to reduce the memory space of the system and improve the interception efficiency of the system. The first rule contract can continue to be deployed on the blockchain and wait to be called again by other firewall contracts. After the above operations are completed, the protection service is provided to the protected contract through the second firewall contract, and the interception rule is determined by one of the rule contracts in the second interception rule base. In a specific implementation manner, the interception rule may be determined by multiple rule contracts.

In the embodiment of the present invention, the rule contract and the protected contract are connected through the first firewall contract, and the first firewall contract is used as the protection provider to provide protection services for the protected contract. When the user needs to change the protection provider, the first firewall contract is destroyed. And by deploying the second firewall contract on the block chain, and using the second firewall contract to call the rule contract in the second interception rule base, and protecting the protected contract with the rule contract in the second interception rule base, not only can Quickly replace the protection provider, making the protection service for the protected contract more comprehensive and flexible, and can effectively reduce the maintenance cost and difficulty of smart contracts.

As a specific implementation manner of the embodiment of the present invention, there is a many-to-many relationship among the firewall contract, the rule contract and the protected contract.

Exemplarily, the firewall contract can protect only one protected contract, or protect multiple protected contracts at the same time. At the same time, the firewall contract can also call a rule contract or call multiple rule contracts at the same time. The rule contract, firewall contract and There can be a many-to-many relationship between protected contracts. The many-to-many relationship between the firewall contract, the rule contract and the protected contract in the embodiment of the present invention can effectively improve the efficiency of interception and improve the difficulty of smart contract deployment, maintenance and upgrade.

As a specific implementation of the embodiment of the present invention, the intercepting device also includes a fuzzing module for:

When the protected contract is attacked by an unknown new type, the abnormal parameters in the protected contract are used as a sample for fuzzing to obtain reinforcement rules for dealing with the new type of attack.

In the embodiment of the present invention, the fuzzy test is carried out using the abnormal parameters in the protected contract under attack as a sample, and the hardening rules for dealing with new types of attacks are generated in a targeted manner, which can effectively improve the effectiveness of the hardening rules.

As a specific implementation of the embodiment of the present invention, the fuzzing test module is specifically used for:

After the new type of attack occurs, determine the abnormal parameters that lead to the abnormal state when the protected contract is attacked, perform random mutation processing on the abnormal parameters to obtain the abnormal abnormal parameters, and perform multiple fuzzy tests on the abnormal abnormal parameters to obtain the reinforcement rules.

As a specific implementation of the embodiment of the present invention, the abnormal parameters are randomly mutated to obtain the abnormal parameters, and the abnormal parameters are subjected to multiple fuzzy tests to obtain the reinforcement rules, specifically:

The abnormal parameters of mutation are used as the input items of each fuzz test, and the protected contract under attack is used as the carrier of each fuzz test for fuzz testing, and the output item of the fuzz test is the control flow of the protected contract under attack;

After multiple fuzz tests, there are many sets of abnormal parameters of mutation and input-output pairs of control flow. By mining the frequent items of the input-output pairs, the high-frequency code blocks of the input-output pairs are screened out, and the high-frequency code blocks are obtained by analyzing the high-frequency code blocks. Hardening rules for new types of attacks.

Exemplarily, in the embodiment of the present invention, variation refers to a process of generating new parameters based on the original parameters using a specific method. Parameter mutation methods include addition, subtraction and replacement of random numbers, bitwise or random flip, XOR and inversion, sensitive boundary value replacement and other methods. The data flow is: the code that has been run from the beginning to the end during the operation of the smart contract, that is, the running path of the code program. Please refer to Figure 6, if the parameter i is 0, the running path of the code program is A->B->D, and its data flow is the code running on the way. Fuzz testing is: A method of discovering software vulnerabilities by providing unexpected output to the target system and monitoring abnormal results. The main process of a fuzz test is as follows: First, randomly mutate the transaction or call parameters that trigger the abnormal state of the smart contract, and then use these mutated parameters as input parameters to call the smart contract that was originally attacked. Record the code that is run as a stream output.

Mining frequent items in the embodiment of the present invention is essentially a process of establishing a mapping from call parameters to code blocks. The embodiment of the present invention can obtain input and output pairs of multiple sets of mutated transaction parameters and code control flow through fuzzy testing, and then establishes Frequent itemsets to determine the mapping between transaction parameters and code blocks. Exemplarily, the algorithm used for mining frequent items in the embodiment of the present invention is the Apriori algorithm. The Apriori algorithm is an algorithm based on association rule mining. As a criterion for judging frequent itemsets in the embodiment of the present invention. The goal of the Apriori algorithm is to find the largest frequent set of K items. In the embodiment of the present invention, the association rule is in the form of an implication of X→Y, wherein X and Y are respectively called the antecedent (or left-hand-side, LHS) and the successor (consequent or right-hand-side, LHS) of the association rule. RHS). Association rule XY has support and trust. The support degree is the probability that the commodities included in the LHS in the former item of the rule and the RHS in the latter item of the rule appear at the same time, which can be understood as the number of transactions of LHS and RHS commodities/the total number of transactions. In the embodiment of the present invention, the frequent itemsets are generated, and its goal is to find all itemsets that meet the minimum support threshold, and these itemsets are called frequent itemsets (frequent itemsets).

In a specific implementation manner, the algorithm steps used for frequent mining in the embodiment of the present invention are:

Input: data set D, support threshold α;

Output: the largest frequent k-itemset;

S10. Scan the entire data set to obtain all the data that have appeared, as a candidate frequent 1-itemset, where k=1, and the frequent 0-itemset is an empty set;

S20. Mining frequent k-itemsets;

a. scan the data to calculate the support of candidate frequent k-itemsets;

b. Remove the data set whose support degree is lower than the threshold in the candidate frequent k-itemset, and obtain the frequent k-itemset; if the obtained frequent k-itemset is empty, directly return the set of frequent k-1 itemset as the algorithm result, and the algorithm ends ; If the obtained frequent k-itemset has only one item, then directly return the set of frequent k-itemset as the algorithm result, and the algorithm ends;

c. Based on frequent k-itemsets, continuously generate candidate frequent k+1-itemsets.

S30, set k=k+1, and jump to S20.

In a specific implementation manner, the following three input-output pairs exist in the input-output pairs obtained through the fuzzy test in the embodiment of the present invention: {A, {a, b}}, {B, {b, c}}, {C, {b}}, where A, B, and C are three different new input parameter values after random mutation of the same transaction parameter W, and a, b, and c are three code statements in the smart contract under attack . Through observation, it is found that whether W is changed to A, B or C, the code statement b will run, and then an itemset {W,b} will be obtained, that is, when the parameter W changes, the b statement has a certain probability of running at the same time, and W and b There is a certain probability that there is a connection between them. However, when the parameter W is changed multiple times in the embodiment of the present invention, the statement b runs with a high probability. The embodiment of the present invention establishes the frequent itemset {W, b} through the Apriori algorithm, and calculates its support degree. As long as the set supports degree is greater than input a not too large threshold α and not greater than a larger threshold β, the implementation of the present invention considers that various variations of parameter W have a direct impact on whether b operates.

In the embodiment of the present invention, after the protected contract is attacked by a new type, the abnormal parameters in the protected contract after being attacked are used as a sample to perform fuzzy testing to obtain the input-output pair, and the high-frequency code blocks of the input-output pair are screened out through frequent item mining , that is, the suspicious code that produces an abnormal state. Analyzing the suspicious code can effectively obtain the reinforcement rules for this new type of attack, thereby effectively providing protection for the protected contract.

Implementing the embodiment of the present invention has the following beneficial effects:

The embodiment of the present invention monitors each transaction of the protected contract in real time by establishing a firewall contract and an interception rule library on the blockchain. Once a malicious transaction is found in the protected contract, the transaction can be intercepted in time through the firewall contract. In this way, losses caused by malicious transactions can be effectively avoided; the embodiment of the invention realizes the protection of the protected contract through the separation of the firewall contract and the interception rules. When the user wants to change the protection rules or service providers, he only needs to change the firewall contract call parameters or directly replace the new firewall contract, which can not only make the protection service for the protected contract more comprehensive and flexible, but also effectively reduce the maintenance cost and difficulty of the smart contract; the embodiment of the present invention takes the attacked The abnormal parameters in the protection contract are used as samples for fuzz testing, and targeted generation of hardening rules to deal with new attacks can effectively improve the effectiveness of the hardening rules.

Another embodiment of the present invention provides a computer-readable storage medium, the computer-readable storage medium includes a stored computer program, wherein, when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the smart contract-based Smart contract interception method for firewall framework.

The above description is a preferred embodiment of the present invention, and it should be pointed out that for those skilled in the art, without departing from the principle of the present invention, some improvements and modifications can also be made, and these improvements and modifications are also considered Be the protection scope of the present invention.

Claims (9)

1. A smart contract interception method based on smart contract firewall framework, characterized in that, comprising: Deploy the first firewall contract, the first interception rule base and the protected contract on the block chain; the first interception rule base includes the first rule contract; receiving and responding to the call request sent by the client, and sending the transaction information in the transaction request sent by the client to the first rule contract, so that the first rule contract can judge the rationality of the transaction information, and returning the judgment result to the first firewall contract when the judgment result of reasonableness is passed; Receive and respond to the judgment result, and send the transaction request to the protected contract, make the protected contract conduct a transaction with the client according to the transaction request, and return the transaction result after the transaction is completed to said first firewall contract; Receive the transaction result sent by the protected contract, and send the transaction result to the first rule contract, so that the first rule contract detects the transaction result according to the rules in its own contract, if the detection result If the transaction result does not meet the transaction condition, then return the detection result to the first firewall contract; The transaction is intercepted according to the detection result, and the interception result is returned to the client. 2. The smart contract interception method based on the smart contract firewall framework as claimed in claim 1, further comprising: Deploying a second rule contract in the first interception rule base; By modifying the calling status parameter of the first firewall contract, the first rule contract is replaced with the second rule contract. 3. The smart contract interception method based on the smart contract firewall framework as claimed in claim 1, further comprising: Deploying a second interception rule base and a second firewall contract on the block chain; Destroy the first firewall contract, call the rule contract in the second interception rule base through the second firewall contract, and protect the protected contract with the rule contract in the second interception rule base. 4. The smart contract interception method based on the smart contract firewall framework according to claim 1, wherein the firewall contract, the rule contract and the protected contract are in a many-to-many relationship. 5. The smart contract interception method based on the smart contract firewall framework as claimed in claim 1, further comprising: When the protected contract is subjected to an unknown new type of attack, the abnormal parameters in the protected contract are used as a sample to perform a fuzz test to obtain reinforcement rules for dealing with the new type of attack. 6. The smart contract interception method based on the smart contract firewall framework as claimed in claim 5, wherein the fuzzy test is carried out using the abnormal parameters in the protected contract as a sample to obtain a method for dealing with the new type of attack The reinforcement rules for are as follows: After the new type of attack occurs, determine the abnormal parameters that cause the abnormal state when the protected contract is attacked, perform random mutation processing on the abnormal parameters to obtain the abnormal abnormal parameters, and fuzz the abnormal abnormal parameters multiple times Tests get hardened rules. 7. The smart contract interception method based on the smart contract firewall framework as claimed in claim 5, wherein said abnormal parameter is randomly mutated to obtain a mutated abnormal parameter, and said mutated abnormal parameter is performed multiple times The fuzzing test gets hardened rules, specifically: The abnormal parameter of the mutation is used as the input item of each fuzz test, and the protected contract under attack is used as the carrier of each fuzz test to carry out the fuzz test, and the output item of the fuzz test obtained is attacked The control flow of the protected contract of ; After multiple fuzzing tests, multiple sets of the abnormal mutation parameters and the input-output pairs of the control flow are performed, and the high-frequency code blocks of the input-output pairs are screened out by performing frequent item mining on the input-output pairs. Analyzing the high-frequency code blocks obtains reinforcement rules for dealing with the new type of attack. 8. A smart contract interception device based on a smart contract firewall framework, characterized in that it includes: A deployment module, configured to deploy a first firewall contract, a first interception rule base, and a protected contract on the block chain; the first interception rule base includes a first rule contract; The transaction information sending module is used to receive and respond to the call request sent by the client, and send the transaction information in the transaction request sent by the client to the first rule contract, so that the first rule matches the transaction judge the rationality of the information, and return the judgment result to the first firewall contract when the judgment result is reasonable; A transaction request sending module, configured to receive and respond to the judgment result, and send the transaction request to the protected contract, so that the protected contract conducts a transaction with the client according to the transaction request, and when the transaction is completed Then return the transaction result to the first firewall contract; The transaction result sending module is used to receive the transaction result sent by the protected contract, and send the transaction result to the first rule contract, so that the first rule contract can process the transaction according to the rules in its own contract. The results are detected, and if the detection result is that the transaction result does not meet the transaction conditions, the detection result is returned to the first firewall contract; The transaction interception module is configured to intercept the transaction according to the detection result, and return the interception result to the client. 9. A computer-readable storage medium, characterized in that the computer-readable storage medium includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute The smart contract interception method based on the smart contract firewall framework described in any one of 1 to 7.

Images