Data query method and apparatus

Abstract

This specification provides one or more embodiments of a data query method and apparatus. The method, applied to a blockchain system, may include: storing metadata of encrypted data; the encrypted data is obtained by encrypting the target data using the public key of the owner of the target data, and the encrypted data is maintained in an off-chain data system; obtaining the ciphertext of the owner's private key and associating the ciphertext with the metadata; the ciphertext is obtained by the owner encrypting the owner's private key using the queryer's public key, provided that a queryer is allowed to query the target data; upon receiving a query transaction requesting the queryer to query the target data, returning response information to the queryer based on the associated ciphertext and the metadata, so that the queryer can obtain the target data based on the response information.

Description

Technical Field

[0001] This specification relates to the field of blockchain technology in one or more embodiments, and particularly to a data query method and apparatus. Background Technology

[0002] Blockchain technology (also known as distributed ledger technology) is a decentralized distributed database technology with many characteristics such as decentralization, transparency, immutability, and trustworthiness, making it suitable for many application scenarios with high requirements for data reliability.

[0003] Given the aforementioned advantages of blockchain technology, and the increasing importance users place on their privacy, a large amount of data is being stored in blockchain systems to ensure data security. Summary of the Invention

[0004] In view of the above, one or more embodiments of this specification provide a data query method and apparatus.

[0005] To achieve the above objectives, one or more embodiments of this specification provide the following technical solutions:

[0006] According to a first aspect of one or more embodiments of this specification, a data query system is proposed, comprising: a querying party for target data, an owner of the target data, an off-chain data system, and a blockchain system; the off-chain data system maintains encrypted data obtained by encrypting the target data using the owner's public key; the blockchain system maintains metadata of the encrypted data.

[0007] The owner, while allowing the querying party to query the target data, encrypts the owner's private key based on the querying party's public key to obtain the private key ciphertext;

[0008] The blockchain system acquires the private key ciphertext and associates the acquired private key ciphertext with the maintained metadata for notarization; and, upon receiving a query transaction from the querying party requesting to query the target data, returns response information to the querying party based on the associated notarized private key ciphertext and the metadata.

[0009] The querying party obtains the target data based on the response information; wherein, the target data obtained based on the response information is obtained by decrypting the encrypted data using the owner's private key, the owner's private key is obtained by decrypting the private key ciphertext using the querying party's querying private key, and the encrypted data is obtained based on the metadata.

[0010] According to a second aspect of one or more embodiments of this specification, a data query method is proposed for use in a blockchain system, comprising:

[0011] The metadata of the encrypted data is stored; the encrypted data is obtained by encrypting the target data based on the public key of the owner of the target data, and the encrypted data is maintained in an off-chain data system;

[0012] Obtain the private key ciphertext of the owner's private key from the owner, and associate the private key ciphertext with the metadata for notarization; the private key ciphertext is obtained by the owner encrypting the owner's private key based on the queryer's public key, provided that the queryer is allowed to query the target data.

[0013] Upon receiving a query transaction requesting the querying party to retrieve the target data, a response is returned to the querying party based on the associated notarized private key ciphertext and the metadata, so that the querying party can obtain the target data based on the response;

[0014] Specifically, the target data obtained based on the response information is obtained by decrypting the encrypted data using the private key of the owner party; the private key of the owner party is obtained by decrypting the private key ciphertext using the private key of the querying party; and the encrypted data is obtained based on the metadata.

[0015] According to a third aspect of one or more embodiments of this specification, a data query method is proposed, applied to a data query platform, comprising:

[0016] In response to the private key ciphertext provided by the owner of the target data, provided that the querying party is allowed to query the target data, the private key ciphertext is provided to the blockchain system, so that the blockchain system can associate and store the private key ciphertext with the maintained metadata; wherein, the metadata is the metadata of encrypted data stored in the off-chain data system, the encrypted data is obtained by encrypting the target data based on the owner's owner's public key, and the private key ciphertext is obtained by encrypting the owner's owner's private key based on the querying party's querying public key;

[0017] In response to the query request from the querying party to query the target data, a query transaction for the target data is initiated to the blockchain system, instructing the blockchain system to return the associated stored private key ciphertext and the metadata;

[0018] Based on the received metadata, the encrypted data is obtained from the off-chain data system, and the obtained encrypted data and the received private key ciphertext are returned to the querying party, so that the querying party can decrypt the obtained private key ciphertext based on its own maintained querying party private key, and decrypt the obtained encrypted data based on the decrypted private key of all parties to obtain the target data.

[0019] According to a fourth aspect of one or more embodiments of this specification, a data query apparatus is provided for use in a blockchain system, comprising:

[0020] The notarization unit notifies the metadata of the encrypted data; the encrypted data is obtained by encrypting the target data based on the public key of the owner of the target data, and the encrypted data is maintained in the off-chain data system;

[0021] The acquisition unit acquires the private key ciphertext of the owner's private key and associates the private key ciphertext with the metadata for storage; the private key ciphertext is obtained by the owner encrypting the owner's private key based on the queryer's public key, provided that the queryer is allowed to query the target data.

[0022] The return unit, upon receiving a query transaction requesting the query party to query the target data, returns response information to the query party based on the associated notarized private key ciphertext and the metadata, so that the query party can obtain the target data based on the response information;

[0023] Specifically, the target data obtained based on the response information is obtained by decrypting the encrypted data using the private key of the owner party; the private key of the owner party is obtained by decrypting the private key ciphertext using the private key of the querying party; and the encrypted data is obtained based on the metadata.

[0024] According to a fifth aspect of one or more embodiments of this specification, a data query apparatus is provided for use in a data query platform, comprising:

[0025] A providing unit, in response to the private key ciphertext provided by the owner of the target data under the condition that the querying party is allowed to query the target data, provides the private key ciphertext to the blockchain system, so that the blockchain system can associate and store the private key ciphertext with the maintained metadata; wherein, the metadata is the metadata of encrypted data stored in the off-chain data system, the encrypted data is obtained by encrypting the target data based on the owner's owner's public key, and the private key ciphertext is obtained by encrypting the owner's owner's private key based on the querying party's querying public key;

[0026] The initiating unit, in response to the querying party's request to query the target data, initiates a query transaction for the target data to the blockchain system, instructing the blockchain system to return the associated stored private key ciphertext and the metadata;

[0027] The return unit retrieves the encrypted data from the off-chain data system based on the received metadata, and returns the retrieved encrypted data and the received private key ciphertext to the querying party, so that the querying party can decrypt the retrieved private key ciphertext based on its own maintained querying party private key, and decrypt the retrieved encrypted data based on the decrypted private key of all parties to obtain the target data.

[0028] According to a sixth aspect of one or more embodiments of this specification, an electronic device is provided, comprising:

[0029] processor;

[0030] Memory used to store processor-executable instructions;

[0031] The processor implements the method described in the second or third aspect by running the executable instructions.

[0032] According to a seventh aspect of one or more embodiments of this specification, a computer-readable storage medium is provided that stores computer instructions thereon, which, when executed by a processor, implement the steps of the method as described in the second or third aspect. Attached Figure Description

[0033] Figure 1 This is a schematic diagram of a data query system provided in an exemplary embodiment.

[0034] Figure 2 This is a flowchart of a data query method provided in an exemplary embodiment.

[0035] Figure 3 This is a flowchart of another data query method provided in an exemplary embodiment.

[0036] Figure 4 This is an interactive diagram of a data uploading method provided in an exemplary embodiment.

[0037] Figure 5 This is an interactive diagram of a data authorization method provided in an exemplary embodiment.

[0038] Figure 6 This is an interactive diagram of a data query method provided in an exemplary embodiment.

[0039] Figure 7 This is a schematic diagram of the structure of a device provided in an exemplary embodiment.

[0040] Figure 8 This is a block diagram of a data query device provided in an exemplary embodiment.

[0041] Figure 9 This is a block diagram of another data query apparatus provided in an exemplary embodiment. Detailed Implementation

[0042] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with one or more embodiments of this specification. Rather, they are merely examples of apparatuses and methods consistent with some aspects of one or more embodiments of this specification as detailed in the appended claims.

[0043] It should be noted that the steps of the corresponding methods are not necessarily performed in the order shown and described in this specification in other embodiments. In some other embodiments, the methods may include more or fewer steps than described in this specification. Furthermore, a single step described in this specification may be broken down into multiple steps in other embodiments; and multiple steps described in this specification may be combined into a single step in other embodiments.

[0044] In the field of blockchain technology, if a user requests to query on-chain data stored in the blockchain system, authorization from the data owner is required first. Upon receiving a query request, the blockchain system verifies the authorization to determine whether the data owner permits the requester to access the data, or in other words, whether the requester has obtained authorization from the data owner. Only if the requester has obtained authorization will the relevant data be returned to them.

[0045] It's easy to see that in traditional blockchain technology, authorization verification is performed by the blockchain system. The reason the blockchain system can perform authorization verification is that it stores the original data on the chain; each blockchain node keeps a copy of the data. This ensures that each stage of "authorization verification—data query—data return" is controllable and trustworthy for the blockchain system.

[0046] However, as the amount of on-chain data grows increasingly massive, engineers have proposed a solution to store the raw data off-chain. In this solution, the blockchain system can bind the raw data stored off-chain using only a unique identifier, such as a "hash value," that corresponds to the raw data. Under this premise, if the raw data stored off-chain is tampered with, it will inevitably fail to match the hash value stored on-chain. This effectively ensures the immutability of the data while significantly reducing the storage resource consumption of the blockchain system.

[0047] It's clear that after storing the raw on-chain data off-chain, operations such as data querying and data return are no longer controlled by the blockchain system. If, as in traditional blockchain technology, the blockchain system still performs the "authorization verification" operation, it inevitably leads to a disconnect between "authorization verification" and "data querying and return." Off-chain data querying and return operations are unreliable to the blockchain system. In this situation, even if the blockchain system determines that the authorization verification is successful, there may still be problems such as "the data actually returned off-chain is not the data needed by the querying party" or "the data actually retrieved off-chain is not returned to the party that initiated the query request." In other words, the related technology suffers from the problem of unreliable data query operations.

[0048] It is evident that there is currently no data query method applicable to the blockchain storage solution of "storing the original data on the chain off-chain".

[0049] In view of this, this specification proposes a data query system that can avoid the problem in related technologies where the authorization verification and data return operations are separated, resulting in unreliable returned data query operations.

[0050] Figure 1 This is a schematic diagram illustrating a data query system as an exemplary embodiment of this specification. Figure 1 As shown, the data query system includes: a querying party 11 for the target data, an owner 12 for the target data, an off-chain data system 13, and a blockchain system 14; the off-chain data system 13 maintains encrypted data obtained by encrypting the target data using the owner's public key of the owner 12; the blockchain system 14 maintains metadata of the encrypted data.

[0051] All party 12, while allowing the querying party 11 to query the target data, encrypts the private key of all party 12 based on the querying party 11's querying party public key to obtain the private key ciphertext;

[0052] Blockchain system 14 obtains the private key ciphertext and performs associated notarization of the obtained private key ciphertext and the maintained metadata; and, upon receiving a query transaction requesting query of the target data from query party 11, returns response information to query party 11 based on the associated notarized private key ciphertext and the metadata.

[0053] The querying party 11 obtains the target data based on the response information; wherein, the target data obtained based on the response information is obtained by decrypting the encrypted data using the private key of the owner party 12, the private key of the owner party is obtained by decrypting the private key ciphertext using the querying party private key of the querying party 11, and the encrypted data is obtained based on the metadata.

[0054] In this specification, the off-chain data system 13 maintains encrypted data obtained by encrypting it with the public key of the owner 12 of the target data, while the blockchain system 14 can maintain metadata of the encrypted data.

[0055] Based on this, when the querying party 11 needs to query the target data, it can request the owner party 12 to allow it to query the target data. When the owner party 12 allows the querying party 11 to query the target data, it can encrypt the owner party's private key held by the querying party 11 based on the querying party's public key to obtain the private key ciphertext, and provide the private key ciphertext to the blockchain system 14, so that the blockchain system 14 can associate and store the private key ciphertext with the maintained metadata.

[0056] Under this premise, the querying party 11 can initiate a query transaction to the blockchain system 14 to request the query of the target data, instructing the blockchain system to return response information based on the private key ciphertext and metadata of the associated notarized data, and the querying party 11 can obtain the target data based on the response information.

[0057] It should be understood that when owner 12 allows query party 11 to query the target data, it encrypts its own owner's private key using query party 11's query party public key to obtain ciphertext, which query party 11, holding only the query party's private key, can decrypt. Therefore, although this ciphertext does not contain authorization information such as "authorizer, authorized party, or authorized object" as in related technologies, it is equivalent to an authorization credential in related technologies, indicating that owner 12 allows query party 11 to query the target data, since other users besides query party 11 cannot decrypt it.

[0058] Furthermore, since the private key ciphertext is stored in the blockchain system 14, its reliability is guaranteed, thus preventing situations where the querying party 11 is unable to decrypt the data based on its private key due to tampering with the private key ciphertext. It is clear that for the blockchain system 14 in this specification, as long as the private key ciphertext is not tampered with, it can be guaranteed that only the querying party 11 can obtain the plaintext of the target data; that is, the data query operation is trustworthy to the blockchain system 14.

[0059] Secondly, the private key ciphertext and the metadata of the encrypted data are associated and stored in the blockchain system 14, which allows this specification to obtain the encrypted data of the target data from the off-chain data system 13 based on the metadata; on the other hand, after decrypting the private key ciphertext based on the query party's private key of the query party 11, the encrypted data obtained can be decrypted based on the private keys of all parties obtained through decryption to obtain the target data.

[0060] As can be seen, based on the data query system in this specification, although the data query and return operations are performed off-chain, the returned data is encrypted with the public key of all parties, and the private key of all parties used to decrypt the encrypted data can only be obtained by the query party 11's private key. Therefore, it can be guaranteed that only the query party 11 can obtain the plaintext of the target data. This avoids the problem of unreliable data query operations caused by the separation of authorization operations and data return operations when the original data is maintained off-chain in related technologies.

[0061] As described above, the off-chain data system 13 in this specification needs to prioritize obtaining the encrypted data of the target data for its maintenance. For example, the owner 12 of the target data can encrypt the target data using its own maintained owner public key and provide the encrypted data to the off-chain data system 13; alternatively, the owner 12 can provide the target data to a trusted object, which can then encrypt the target data using its owner public key and provide the encrypted data to the off-chain data system 13. Of course, these examples are merely illustrative, and how the off-chain data system 13 specifically obtains the encrypted data of the target data can be determined by those skilled in the art based on actual needs; this specification does not impose any restrictions on this.

[0062] Similarly, the blockchain system 14 described in this specification needs to obtain metadata of the encrypted data already maintained in the off-chain data system 13. For example, after the off-chain data system 13 notarizes the encrypted data of the target data, it can generate metadata of the encrypted data and provide this metadata to the blockchain system 14 for maintenance. Another example is that after the off-chain data system 13 notarizes the encrypted data of the target data, it can provide the description information of the encrypted data to the owner 12, so that the owner 12 can generate metadata based on the recorded description information of the target data and the received description information, and then provide this metadata to the blockchain system 14. Of course, these examples are merely illustrative; how the blockchain system 14 specifically obtains the metadata of the encrypted data can be determined by those skilled in the art based on actual needs, and this specification does not impose any limitations on this.

[0063] It is worth noting that the metadata of encrypted data refers to the descriptive information of the encrypted data. The specific information included in this metadata can be determined by those skilled in the art based on actual needs. For example, it may include the storage information of the encrypted data in the off-chain data system 13, the identification information of the target data (e.g., a unique identifier maintained on the chain and bound to the original off-chain data, such as a hash value), the attribute information of the target data, etc. This specification does not impose any restrictions on this.

[0064] In this specification, the party 11 that queries the target data can request permission from the owner 12 to query the target data in various ways. For example, the party 11 can request permission from the owner 12 to query the target data through off-chain interaction, such as face-to-face communication or sending messages through a communication application; or, for another example, the party 11 can initiate a permission request for querying the target data to the owner 12 through the blockchain system 14. Of course, the examples here are merely illustrative, and how the party 11 specifically requests permission from the owner 12 to query the target data can be determined by those skilled in the art based on actual needs, and this specification does not impose any restrictions on this.

[0065] In this specification, party 12, upon allowing party 11 to query the target data, can obtain party 11's public key, which is then used to encrypt its own private key to obtain ciphertext. This ciphertext can be provided to blockchain system 14 for maintenance, thereby preventing tampering. After obtaining the ciphertext, blockchain system 14 can associate it with the maintained metadata of the encrypted data for evidence storage, enabling quick retrieval of credentials for obtaining the target data during data queries.

[0066] It should be understood that since the queryer's public key is public, all parties 12 can obtain the queryer's public key from the queryer 11 in various ways. For example, all parties 12 can directly obtain the queryer's public key from the queryer 11; or, for another example, the queryer 11 can pre-declare its public key to the blockchain system so that all parties 12 can obtain the public key from the blockchain system. For instance, the queryer 11 can generate a public key registration request based on its own maintained public key and its unique public key identifier, and send the public key registration request to the blockchain system 14. The blockchain system 14 can then associate and deposit the queryer's public key and its unique public key identifier contained in the request. Based on this, when all parties 12 allow the queryer 11 to query the target data, it can initiate a public key retrieval request to the blockchain system 14 based on the unique public key identifier of the queryer's public key, so that the blockchain system can return the queryer's public key based on the unique public key identifier contained in the request. Of course, this is only illustrative. How party 12 obtains the query party's public key from party 11 can be determined by those skilled in the art based on the actual situation, and this specification does not impose any restrictions on this.

[0067] In this specification, the encrypted private key ciphertext of all parties' private keys and the metadata of encrypted data can be associated and stored in different ways. For example, the blockchain system 14 can store the metadata of encrypted data and the encrypted private key ciphertext in the same storage area, such as in the same block or in the same contract account. Another example is that the blockchain system 14 can associate and store the metadata of encrypted data and the unique identifier of the target data. When the encrypted private key ciphertext is obtained, it can also associate and store the encrypted private key ciphertext and the unique identifier of the target data. Since both the encrypted private key ciphertext and the metadata are associated and stored with the unique identifier of the target data, it is equivalent to associating and storing both. Based on this, when the blockchain system 14 receives a query transaction, it can read the unique identifier of the target data from it, and determine the metadata of the encrypted data and the encrypted private key ciphertext of all parties' private keys from all the associated and stored encrypted private key ciphertexts and hash values ​​based on this unique identifier. Of course, the examples here are only illustrative. How to associate and store the metadata of encrypted data and the encrypted private key ciphertext of all parties' private keys can be determined by those skilled in the art according to actual needs, and this specification does not impose any restrictions on this.

[0068] In this specification, after the private key is encrypted and stored in the blockchain system 14, the querying party 11 can initiate a query transaction to the blockchain system 14 to request the target data in order to obtain the target data.

[0069] In one embodiment, the operation of obtaining the plaintext of the target data based on the encrypted private key and metadata of the associated notarized evidence can be performed by the querying party 11. In other words, when the blockchain system 14 receives a query transaction, it can return the encrypted private key and metadata of the associated notarized evidence as response information to the querying party 11. After receiving the response information, the querying party 11 can, on the one hand, obtain the encrypted data of the target data from the off-chain data system 13 based on the metadata contained in the response information, and on the other hand, decrypt the obtained encrypted private key based on its own maintained querying party private key to obtain the all-party private key of all-party 12. Based on this, the querying party 11 can decrypt the obtained encrypted data based on the decrypted all-party private key to obtain the target data.

[0070] In one embodiment, the blockchain system 14 can return only the private key ciphertext and metadata corresponding to the target data to the querying party, which can then use them to retrieve the target data. For example, as described above, when both the private key ciphertext and metadata are associated with a unique identifier of the target data, the blockchain system 14 can find the private key ciphertext and metadata corresponding to the target data from all maintained private key ciphertexts and metadata by simply adding the unique identifier to the query transaction, and return it to the querying party 11. Of course, besides finding the private key ciphertext and metadata corresponding to the target data based on the unique identifier, other methods can also be used for the search. For example, both can be associated with the account address of owner 12 during notarization. Then, querying party 11 can add owner 12's account address to the query transaction to find the private key ciphertext and metadata corresponding to the target data. Alternatively, both can be stored in the same location, and the location information of that location can be returned to owner 12. Owner 12 can then provide this location information to querying party 11 when allowing querying. Based on this, querying party 11 can add this location information to the query transaction so that blockchain system 14 can find the private key ciphertext and metadata corresponding to the target data based on this location information. Of course, these examples are illustrative. How to specifically find the private key ciphertext and metadata corresponding to the target data from all associated notarized private key ciphertext and metadata can be determined by those skilled in the art according to actual needs, and this specification does not impose any restrictions on this.

[0071] In another embodiment, the blockchain system 14 may also return the private key ciphertext and metadata of all associated evidence stored as response information to the querying party 11. In this case, the querying party 11 can decrypt the obtained private key ciphertext based on the maintained querying party private key. If the decryption of any private key ciphertext yields the private key of all parties 12, the querying party 11 can retrieve encrypted data from the off-chain data system 13 based on the metadata associated with that private key ciphertext. The querying party 11 can then decrypt the retrieved encrypted data using the decrypted private key of all parties to obtain the target data. It should be understood that as long as the querying party private key can successfully decrypt, the private key ciphertext must be encrypted based on the querying party public key. In this specification, all parties 12 encrypts the private key of all parties using the querying party public key. Therefore, as long as decryption is successful, the private key of all parties can be obtained. Based on this, the encrypted data obtained through the corresponding metadata can be decrypted using the decrypted private key of all parties.

[0072] In another embodiment, if the querying party 11 trusts the blockchain system 14, the operation of obtaining the plaintext of the target data based on the associated notarized private key ciphertext and metadata can be performed by the blockchain system 14. In this embodiment, the querying party 11 can add its own maintained querying party private key to the query transaction and provide it to the blockchain system 14. After obtaining the associated notarized private key ciphertext and metadata corresponding to the target data, the blockchain system 14 can, on the one hand, obtain the encrypted data from the off-chain data system 13 based on the obtained metadata; on the other hand, it can read the querying party private key from the query transaction to decrypt the obtained private key ciphertext, obtain all-party private keys, and then decrypt the obtained encrypted data based on all-party private keys to return the decrypted target data as response information to the querying party 11.

[0073] In one embodiment of this invention, as described above, when both the private key ciphertext and metadata are associated with a unique identifier of the target data, the blockchain system 14 can find the private key ciphertext and metadata corresponding to the target data from all maintained private key ciphertexts and metadata simply by adding the unique identifier to the query transaction. In this case, the blockchain system 14 can, on the one hand, decrypt the obtained private key ciphertext based on the query party's private key included in the query transaction to obtain all-party private keys; on the other hand, it can obtain encrypted data from the off-chain data system 13 based on the obtained metadata. Based on this, it can then decrypt the obtained encrypted data using the decrypted all-party private keys to obtain the target data. Similar to the previous embodiment, besides determining the private key ciphertext and metadata corresponding to the target data through the unique identifier of the target data, other methods can also be used for searching, such as account address, storage location information, etc., which will not be elaborated here.

[0074] In another scenario of this embodiment, similar to the previous embodiment, all private key ciphertexts can be decrypted based on the queryer's private key. For example, blockchain system 14 can decrypt all maintained private key ciphertexts based on the query party's private key read from the query transaction, and obtain all party private keys if any private key ciphertext is successfully decrypted. Based on this, it can obtain the metadata associated with that private key ciphertext, and retrieve the encrypted data of the target data from off-chain data system 13 based on the obtained metadata. Under this premise, it can decrypt the obtained encrypted data based on the all party private keys obtained from decrypting any of the aforementioned private key ciphertexts, and then return the decrypted target data to the query party. Alternatively, blockchain system 14 can also obtain all maintained associated private key ciphertexts and metadata, and retrieve multiple encrypted data from off-chain data system 13 based on all obtained metadata. Based on this, it can decrypt the obtained private key ciphertexts based on the query party's private key read from the query transaction, and if any private key ciphertext is successfully decrypted, obtaining all party private keys, it can decrypt the multiple encrypted data based on those all party private keys, and return the target data to the query party 11 if any of the encrypted data is successfully decrypted.

[0075] Of course, the above examples are merely illustrative. How the blockchain system 14 specifically returns a response message to the querying party 11 so that the querying party 11 can obtain the plaintext of the target data can be determined by those skilled in the art based on the actual situation, and this specification does not impose any restrictions on this.

[0076] In this specification, the data query system may also include a data query platform 15. In this case, both the querying party 11 and the owner party 12 can interact with the off-chain data system 13 and the blockchain system 14 through the data query platform 15.

[0077] For example, in a data query system that includes a data query platform 15, owner 12 can encrypt the target data it holds based on its maintained owner public key and provide the encrypted data to the data query platform 15. The data query platform 15 can then provide the received encrypted data to an off-chain data system 13 for storage. After storing the encrypted data, the off-chain data system 13 generates storage information for the encrypted data, which can be used to generate metadata for the encrypted data. Therefore, the data query platform 15 can also be responsible for providing the metadata of the encrypted data to a blockchain system 14 for notarization.

[0078] It is worth noting that the entity executing the generation of metadata for encrypted data can be either the off-chain data system 13 or the data query platform 15. When the entity executing the generation is the off-chain data system 13, it can generate metadata for encrypted data based on the aforementioned storage information after generating the storage information, and then return the metadata to the data query platform 15 for provision to the blockchain system 14. When the entity executing the generation is the data query platform 15, the off-chain data system 13 can directly return the aforementioned storage information to the data query platform 15, so that the data query platform 15 can generate metadata for encrypted data based on the storage information and then provide the metadata to the blockchain system 14 for notarization.

[0079] It should also be noted that the metadata of the encrypted data mentioned above may include other information besides the storage information of the encrypted data. For example, it may also include descriptive information of the target data, such as the unique identifier of the target data and the data type of the target data; or, for example, it may include encryption information of the encrypted data, such as the encryption algorithm and encryption format. Of course, this example is only illustrative, and the specific information included in the metadata can be determined by those skilled in the art according to actual needs, and this specification does not impose any restrictions on it.

[0080] Furthermore, when the data query system includes a data query platform 15, the data query platform 15, in addition to storing encrypted data and its metadata, can also store the ciphertext of the private key of the owner 12. In other words, if the owner 12 obtains the ciphertext of the owner's private key, it can also provide the ciphertext to the data query platform 15. Upon receiving the ciphertext, the data query platform 15 can initiate a ciphertext storage transaction with the blockchain system 14 based on the ciphertext, so that the blockchain system 14 can store the ciphertext.

[0081] Furthermore, when the data query system includes a data query platform 15, the data query platform 15 can also be used to respond to query requests initiated by the querying party 11. For example, the querying party 11 can send a query request for target data to the data query platform 15, and the data query platform 15 can initiate a query transaction for the target data to the blockchain system 14, so that the blockchain system 14 can return a response message based on the associated stored metadata and private key ciphertext, and the data query platform 15 can forward the response message returned by the blockchain system 14 to the querying party 11.

[0082] In the case where the data query system includes a data query platform 15, this specification can also maintain the correspondence between the aforementioned metadata and the private key ciphertext within the data query platform 15. For example, when the data query platform 15 obtains the metadata of encrypted data, it can record the correspondence between the unique identifier of the target data and the hash value of that metadata; and when it receives the private key ciphertext of all parties' private keys, it can record the correspondence between the unique identifier of the target data and the hash value of that private key ciphertext. The blockchain system 14 can then, upon obtaining metadata, associate and store the metadata and its hash value; and upon obtaining the private key ciphertext, associate and store the private key ciphertext and its hash value.

[0083] Under this premise, when the data query platform 15 receives a query request initiated by the querying party 11, it can read the unique identifier of the target data contained in the request, and determine the hash value of the metadata of the encrypted data and the hash value of the private key ciphertext of the private key of the owner based on the read unique identifier. Based on the determined hash value of the metadata and the hash value of the private key ciphertext, it initiates a query transaction for the target data to the blockchain system 14. After receiving the query transaction, the blockchain system 14 can find the private key ciphertext of the encrypted data based on the hash value of the private key ciphertext contained in the transaction, find the metadata of the encrypted data based on the hash value of the metadata contained in the query transaction, and return the found private key ciphertext and metadata to the data query platform 15. After receiving the private key ciphertext and metadata, the data query platform 15 can first obtain encrypted data from the off-chain data system 13 based on the metadata, and then return the obtained encrypted data and the private key ciphertext returned by the blockchain system 14 to the query party 11. This allows the query party 11 to decrypt the received private key ciphertext based on the query party's private key, and further decrypt the received encrypted data based on the decrypted private key of all parties to obtain the target data.

[0084] Of course, the above examples are merely illustrative. In the case where the data query system includes the data query platform 15, the specific interaction method to enable the querying party 11 to obtain the required target data can be determined by those skilled in the art based on actual needs, and this specification does not impose any restrictions on it.

[0085] In this specification, it is worth noting that owner 12 can encrypt all the data it holds based on a unified owner private key, or it can encrypt each piece of data it holds separately based on different owner private keys. For example, when encrypting all data based on a unified owner private key, owner 12 can use its own identity private key as the owner private key to encrypt different data; while when encrypting each piece of data separately based on different owner private keys, it can generate an owner private key uniquely corresponding to any given piece of data when encryption is required, and then encrypt that particular piece of data.

[0086] In other words, the private key used to encrypt the target data in this specification can be either the same as the private key used to encrypt other data, or it can uniquely correspond to the target data.

[0087] Specifically, when all parties 12 need to encrypt target data, they can generate a public-private key pair uniquely corresponding to the target data. This pair is then used to encrypt the target data using all the public keys in that pair, resulting in encrypted target data. Conversely, when encrypting other data different from the target data, they can generate a public-private key pair corresponding to that data. This pair is then used to encrypt the other data using all the public keys in that pair, resulting in encrypted data. Correspondingly, the target data obtained from the response information can be decrypted using the private keys in the corresponding public-private key pair to decrypt the encrypted target data.

[0088] It should be understood that if All Party 12 encrypts all its data using a unified All Party Private Key, then after All Party 12 allows Query Party 11 to query the target data and encrypts All Party Private Key using Query Party 11's Query Party Public Key, Query Party 11 can decrypt all of All Party 12's data using the decrypted All Party Private Key. This is equivalent to All Party 12 exposing its query permissions for all its data to Query Party 11, making precise control over data query permissions impossible. Conversely, if All Party 12 encrypts the corresponding data using an All Party Private Key uniquely corresponding to each piece of data, then after All Party 12 allows Query Party 11 to query the target data and encrypts All Party Private Key uniquely corresponding to the target data using Query Party 11's Query Party Public Key, Query Party 11 can only decrypt the target data using the decrypted All Party Private Key. This allows for precise control over query permissions for each piece of data at the individual data level.

[0089] In addition, the blockchain system in this specification can be deployed based on the traditional architecture of blockchain technology, in which all nodes in the blockchain system are formed by deploying blockchain code on corresponding physical devices, and in most cases, each node corresponds to a physical device; the blockchain system in this specification can also be deployed based on the BaaS (Blockchain as a Service) architecture in blockchain technology, in which all nodes in the blockchain system are formed by deploying blockchain code on virtual machines implemented in the cloud through cloud services, and blockchain nodes do not need to correspond to corresponding physical devices one by one.

[0090] As can be seen from the above technical solution, although this specification encrypts and stores the original on-chain data in an off-chain data system, the blockchain system maintains metadata about the encrypted data stored in the off-chain data system, as well as the ciphertext of the private key obtained by encrypting the owner's private key based on the queryer's public key when allowing a querying party to query the encrypted data. Based on this, the querying party can, on the one hand, retrieve the encrypted data from the off-chain data system based on the metadata maintained in the blockchain system; on the other hand, it can decrypt the ciphertext of the private key based on the queryer's private key, and then decrypt the retrieved encrypted data using the decrypted owner's private key to obtain the plaintext of the data to be queried.

[0091] It should be understood that since all parties encrypt the "owner's private key used to decrypt encrypted data" based on the querying party's public key, only the querying party can decrypt the encrypted data stored off-chain to obtain the plaintext of the corresponding data. Therefore, although this specification does not verify query permissions through "authorization credentials indicating the authorizing party, authorized object, and authorized party" as in related technologies, it still prevents users other than the authorized querying party from obtaining the target data requested by the querying party.

[0092] Furthermore, since the metadata used to obtain encrypted data from the off-chain data system, as well as the ciphertext of the private key obtained by encrypting all parties' private keys based on the query party's public key, are both stored in the blockchain system, this specification ensures that the metadata and ciphertext themselves are not tampered with, thereby guaranteeing the reliability of the process of obtaining the target data plaintext based on this metadata and ciphertext. It is easy to understand that storing the metadata and ciphertext used to obtain the target data plaintext in the blockchain system is equivalent to the blockchain system indirectly controlling the data return operation during the data query process, ensuring the reliability of the entire data query process. In other words, this specification avoids the problem of unreliable data query operations caused by the separation of authorization operations and data return operations in related technologies.

[0093] Furthermore, this specification allows for the allocation of unique public-private key pairs to different data for encryption and decryption. Based on this, the ciphertext obtained by the owner using the queryer's public key and stored in the blockchain system, after being decrypted by the queried party, can only be used to retrieve the plaintext of a single piece of data. Therefore, in this scenario, precise authorization of query permissions for individual data can be achieved.

[0094] Based on the aforementioned data query system, this specification also discloses a data query method. In this method, most operational procedures, such as how to encrypt data, how to generate metadata for encrypted data, and how the querying party obtains the plaintext of the encrypted data, are consistent with the data query system described above. Related content can be found in the data query system described above and will not be repeated below.

[0095] Figure 2 This is a flowchart illustrating a data query method as an exemplary embodiment of this specification. The method is applied to a blockchain system, such as... Figure 2 As shown, the method may include the following steps:

[0096] Step 202: Store the metadata of the encrypted data; the encrypted data is obtained by encrypting the target data based on the public key of the owner of the target data, and the encrypted data is maintained in the off-chain data system.

[0097] As mentioned above, after the target data is encrypted using the public key of the owner of the target data, the encrypted data can be provided to the off-chain data system for maintenance, while the metadata of the encrypted data can be provided to the blockchain system for storage.

[0098] Step 204: Obtain the private key ciphertext of the owner's private key and associate the private key ciphertext with the metadata for evidence storage; the private key ciphertext is obtained by the owner encrypting the owner's private key based on the queryer's queryer's public key, provided that the queryer is allowed to query the target data.

[0099] As mentioned above, a querying party can request permission from all parties to query target data in various ways. For example, the querying party can request permission through off-chain interactions, such as face-to-face communication or sending messages via messaging applications. Alternatively, the querying party can initiate a permission request for querying target data to all parties through the blockchain system. Once the all parties grant permission, they can encrypt their private key using the querying party's public key to obtain a ciphertext private key. The blockchain system can then retrieve this ciphertext and associate it with the maintained metadata for storage.

[0100] As mentioned above, since the queryer's public key is public, all parties can obtain it through various methods. For example, they can obtain the queryer's public key directly from the queryer; or, for another example, the queryer's public key can be pre-registered with the blockchain system so that all parties can obtain it from the blockchain system. For instance, the queryer can generate a public key registration transaction based on its own maintained public key and its unique public key identifier, and send it to the blockchain system. The blockchain system can then respond to this public key registration transaction by associating and storing the queryer's public key and the unique public key identifier contained in the transaction. Under this premise, when all parties allow the queryer to query target data, they can initiate a public key retrieval transaction for the queryer's public key with the blockchain system. The blockchain system can then respond to this public key retrieval transaction by returning the queryer's public key to all parties based on the unique public key identifier contained in the transaction.

[0101] Step 206: Upon receiving a query transaction requesting the target data from the querying party, a response is returned to the querying party based on the associated stored private key ciphertext and the metadata, so that the querying party can obtain the target data based on the response information; wherein, the target data obtained based on the response information is obtained by decrypting the encrypted data using the owner's private key, the owner's private key is obtained by decrypting the private key ciphertext using the querying party's querying party private key, and the encrypted data is obtained based on the metadata.

[0102] As described above, after the private key ciphertext is stored in the blockchain system, the querying party can initiate a query transaction to request the target data from the blockchain system in order to obtain the target data. Upon receiving the query transaction, the blockchain system can return a response message to the querying party based on the associated stored private key ciphertext and metadata, allowing the querying party to obtain the target data based on the response message.

[0103] As described above, the operation of retrieving the plaintext of the target data based on the encrypted private key and metadata stored in the associated database can be performed by the querying party. In this case, the blockchain system can return the encrypted private key and metadata stored in the associated database as response information to the querying party, so that the querying party can retrieve the encrypted data from the off-chain data system based on the obtained metadata, decrypt the obtained encrypted private key based on its own maintained querying party private key, and then decrypt the obtained encrypted data based on the decrypted private key of all parties to obtain the target data.

[0104] As mentioned above, when the querying party trusts the blockchain system, the operation of retrieving the plaintext of the target data based on the encrypted private key and metadata of the associated notarized data can also be performed by the blockchain system. In this case, after obtaining the encrypted private key and metadata of the associated notarized data, the blockchain system can retrieve the encrypted data from the off-chain data system based on the obtained metadata, and decrypt the obtained encrypted private key based on the querying party's private key read from the query transaction to obtain the all-party private key. Based on this, the blockchain system can decrypt the obtained encrypted data based on the all-party private key, and return the decrypted target data as a response information to the querying party.

[0105] As mentioned above, a blockchain system can associate and store the ciphertext of all parties' private keys and the metadata of encrypted data in different ways. For example, on the one hand, the blockchain system can associate and store the unique identifier of the target data with the metadata of the encrypted data; on the other hand, it can associate and store the ciphertext of all parties' private keys with the unique identifier of the target data. In other words, the metadata of encrypted data and the ciphertext of all parties' private keys can be associated and stored based on the unique identifier of the target data. Under this premise, when the blockchain system receives a query transaction, it can read the unique identifier of the target data contained in the query transaction, and determine the metadata of the encrypted data and the ciphertext of all parties' private keys from all the associated and stored ciphertext and metadata based on this unique identifier.

[0106] As mentioned above, all parties can encrypt all the data they hold based on a unified owner's private key, or they can encrypt each piece of data separately based on different owner's private keys. For example, when encrypting all data based on a unified owner's private key, the owner can use their own identity private key as the owner's private key to encrypt different pieces of data; while when encrypting each piece of data separately based on different owner's private keys, a unique owner's private key can be generated for each piece of data when encryption is required.

[0107] In other words, the private key used to encrypt the target data in this specification can either be the same as the private key used to encrypt other data, or it can uniquely correspond to the target data. In the case where it uniquely corresponds to the target data, the blockchain system can also store this encrypted data as evidence when it obtains encrypted data that is distinct from the target data. This encrypted data is obtained by encrypting the other data using the private key that uniquely corresponds to the other data.

[0108] As can be seen from the above technical solution, since the metadata of the encrypted data maintained off-chain and the ciphertext of the private key used to decrypt the encrypted data are linked and stored by the blockchain system, the reliability of the two credentials used to obtain the target data is guaranteed. Furthermore, the ciphertext of the private key is obtained by encrypting the querying party's public key, ensuring that only the querying party, having obtained query permission from the owner, can decrypt the owner's private key and thus obtain the target data. Therefore, even if the data return operation in this specification is not directly controlled by the blockchain system, the reliability of the data query operation can still be guaranteed, avoiding the problem of unreliable data query operations caused by the separation of data return operations and authorization verification operations in related technologies.

[0109] In addition to the data query method described above, this specification also discloses another data query method. This method is applied to the data query platform included in the data query system described above. In this method, most of the operations, such as how to encrypt data, how to generate metadata for encrypted data, and how the querying party obtains the plaintext of encrypted data, are consistent with the data query system described above. Related content can be referred to the data query system described above and will not be repeated below.

[0110] Figure 3 This is a flowchart illustrating another data query method as an exemplary embodiment of this specification. The method is applied to a data query platform. Figure 3 As shown, the method may include the following steps:

[0111] Step 302: In response to the private key ciphertext provided by the owner of the target data while allowing the querying party to query the target data, the private key ciphertext is provided to the blockchain system so that the blockchain system can associate and store the private key ciphertext with the maintained metadata; wherein, the metadata is the metadata of encrypted data stored in the off-chain data system, the encrypted data is obtained by encrypting the target data based on the owner's owner's public key, and the private key ciphertext is obtained by encrypting the owner's owner's private key based on the querying party's querying party's public key.

[0112] As described above, since this method is applied to a data query platform, the target data, after being encrypted using the public key of the owner of the target data, can be preferentially provided to the data query platform. The data query platform then provides the encrypted data to the off-chain data system for maintenance. Furthermore, the metadata of the encrypted data can also be provided by the data query platform to the blockchain system for notarization.

[0113] As described above, the owner of the target data, provided that the querying party is allowed to access the target data, can encrypt its own private key based on the querying party's public key to obtain a ciphertext private key, and then provide this ciphertext to the data query platform. Upon receiving the ciphertext, the data query platform can then provide it to the blockchain system, whereby the blockchain system associates and stores the received ciphertext with the maintained metadata. This metadata refers to the metadata of encrypted data stored in the off-chain data system, and this encrypted data is obtained by encrypting the target data using the owner's public key.

[0114] As mentioned above, all parties can obtain the queryer's public key in various ways. For example, in response to a queryer's public key registration request generated based on the queryer's public key and its unique identifier, the data query platform can provide the queryer's public key and unique identifier contained in the public key registration request to the blockchain system. The blockchain system can then associate and store the queryer's public key and unique identifier. Based on this, all parties can obtain the queryer's public key from the blockchain system based on the unique identifier, which can be used to encrypt their private key to obtain the aforementioned ciphertext.

[0115] Step 304: In response to the query request from the querying party to query the target data, initiate a query transaction for the target data to the blockchain system, instructing the blockchain system to return the associated stored private key ciphertext and the metadata.

[0116] As described above, blockchain systems can associate and store the ciphertext of the private keys of all parties and the metadata of encrypted data in different ways. For example, since this method is applied to a data query platform, the platform can maintain a correspondence between the unique identifier of the target data, the hash value of the aforementioned metadata, and the hash value of the ciphertext of the private keys of all parties. In other words, this method can associate and store the metadata of encrypted data and the ciphertext of the private keys of all parties using the unique identifier of the target data as a link. Under this premise, when the data query platform receives a query request from a querying party to retrieve the target data, it can read the unique identifier of the target data contained in the query request, determine the hash value of the metadata and the hash value of the ciphertext of the private keys contained in the aforementioned correspondence based on the unique identifier, and initiate a query transaction for the target data to the blockchain system based on the determined hash values ​​of the metadata and the ciphertext of the private keys, instructing the blockchain system to return the associated and stored ciphertext of the private keys and metadata based on the hash value contained in the query transaction.

[0117] Step 306: Obtain the encrypted data from the off-chain data system based on the received metadata, and return the obtained encrypted data and the received private key ciphertext to the querying party, so that the querying party can decrypt the obtained private key ciphertext based on its own maintained querying party private key, and decrypt the obtained encrypted data based on the decrypted private key of all parties to obtain the target data.

[0118] As described above, after receiving the metadata and ciphertext of the private key returned by the blockchain system, the data query platform can retrieve the encrypted data of the target data from the off-chain data system based on the metadata, and return the retrieved encrypted data and the ciphertext of the private key returned by the blockchain system to the querying party. Based on this, the querying party can decrypt the retrieved ciphertext of the private key using its own private key, and then decrypt the retrieved encrypted data using the decrypted private key to obtain the target data.

[0119] As can be seen from the above technical solution, this method introduces a data query platform, enabling all parties involved in the data query operation—the blockchain system, off-chain data system, owner, and querying party—to complete the data query operation simply by interacting with the data query platform. It should be understood that since all parties only interact with the data query platform, all steps of the data query operation, such as metadata storage, private key encryption storage, encrypted data storage, and query transaction initiation, can be uniformly managed solely based on the data query platform. Therefore, this specification further improves the controllability of data query operations by introducing a data query platform.

[0120] As can be seen from the above introduction, the technical solution of this specification can be roughly divided into three stages: the data on-chain stage, the data authorization stage, and the data return stage.

[0121] The following section will provide a detailed explanation of the technical solution in this manual, using the example of User 2 requesting to query data X belonging to User 1.

[0122] Figure 4 This is an interaction diagram illustrating an exemplary embodiment of a data uplink method described in this specification. (See diagram for example.) Figure 4 As shown, the method may include the following steps:

[0123] Step 401: User 1 generates an encrypted public-private key pair A for data X.

[0124] In this embodiment, when user 1 needs to upload data X to the blockchain, they can generate a unique public-private key pair A corresponding to data X for encrypted storage of data X. For example, the public-private key pair A can be generated based on the unique identifier "X" of data X and user 1's identity key. How to generate the public-private key pair A can be determined by those skilled in the art according to actual needs, and this embodiment does not impose any restrictions on this.

[0125] It is worth noting that in each step of this embodiment, "user 1" refers to user 1 and the device he holds. It does not mean that user 1 can perform the steps in this method on his own without the aid of the device. Rather, it can be understood that user 1 performs each step in this method through the device he holds.

[0126] Step 402: User 1 encrypts data X using the public key a in A based on the public and private keys of encryption.

[0127] In this embodiment, after generating the encryption public-private key pair A, user 1 can encrypt data X based on the encryption public key a contained therein to obtain encrypted data X'.

[0128] Step 403: User 1 generates a data on-chain request based on the obtained encrypted data X' and the unique identifier "X" of data X.

[0129] In this embodiment, after obtaining encrypted data X', user 1 can generate a data upload request based on encrypted data X' and the unique identifier "X" of data X, and send the generated data upload request to the data query platform.

[0130] Step 404: User 1 sends a data upload request to the data query platform.

[0131] Step 405: The data query platform generates an encrypted data storage request based on the encrypted data X'.

[0132] In this embodiment, after receiving a data upload request, the data query platform can read the encrypted data X' and the unique identifier of data X contained therein, generate an encrypted data storage request based on the read encrypted data X', and send the generated encrypted data storage request to the off-chain data system so that the off-chain data system can store the encrypted data X'.

[0133] Step 406: The data query platform sends the encrypted data notarization request to the off-chain data system.

[0134] Step 407: The off-chain data system stores the received encrypted data X'.

[0135] Step 408: The off-chain data system returns the storage information of encrypted data X' to the data query platform.

[0136] In this embodiment, after the off-chain data system completes the storage operation of encrypted data X', it can return the stored information to the data query platform so that the data query platform can generate metadata x of encrypted data X'.

[0137] Step 409: The data query platform generates metadata x of encrypted data X' based on the stored information.

[0138] In this embodiment, metadata x may include: storage information of encrypted data X', hash value of encrypted data X', and related information of data X (such as unique identifier X, type information of data X, etc.).

[0139] Step 410: The correspondence between the unique identifier "X" of the data X stored on the data query platform and the hash value x' of the metadata x.

[0140] In this embodiment, the data query platform can store the correspondence between the unique identifier "X" of data X and the hash value x' of metadata x, so that it can be used to obtain metadata x in subsequent data queries.

[0141] For example, the corresponding relationship table maintained in the data query platform can be shown in Table 1 below:

[0142] Unique identifier of data already on the blockchain The hash value of the metadata of the data that has been put on the blockchain X Hash value x' Y Hash value y' …… ……

[0143] Table 1

[0144] Step 411: The data query platform generates on-chain data transactions based on metadata x and its hash value x'.

[0145] In this embodiment, the data query platform can also generate on-chain data transactions based on metadata x and its hash value x', and send the generated on-chain data transactions to the blockchain system so that the blockchain system can associate and store the metadata x and its hash value x'.

[0146] Step 412: The data query platform sends the data on-chain transaction to the blockchain system.

[0147] Step 413: The blockchain system associates the evidence storage metadata x and its hash value x'.

[0148] Following the examples above, the correspondence between the metadata of the data already on the blockchain and its hash values ​​maintained in the blockchain system can be shown in Table 2 below:

[0149] The hash value of the metadata of the data that has been put on the blockchain Metadata of data already on the blockchain Hash value x' Metadata x Hash value y' Metadata y …… ……

[0150] Table 2

[0151] As can be seen from the above technical solution, this embodiment can store data in encrypted form in an off-chain data system and store the metadata of the encrypted data in the blockchain system. Since this metadata contains unique binding information corresponding to the encrypted data, such as the hash value, it ensures that the encrypted data maintained in the off-chain data system is not tampered with. Therefore, the data on-chain method in this embodiment not only utilizes the immutability of the blockchain system to ensure data reliability but also reduces the consumption of blockchain system storage resources.

[0152] The following section describes the data authorization phase in which User 2 requests User 1 permission to query data X.

[0153] Figure 5 This is an interactive diagram illustrating an exemplary embodiment of a data authorization method described in this specification. Figure 5 As shown, the method may include the following steps:

[0154] Step 501: User 2 generates a public key registration request based on their own encrypted public and private keys and the encrypted public key b in B.

[0155] In this embodiment, user 2 can maintain its own encrypted public-private key pair B, and user 2 can pre-register the encrypted public key b to the blockchain system so that other users can obtain the encrypted public key b from the blockchain system.

[0156] Step 502: User 2 sends the generated public key registration request to the data query platform.

[0157] In this embodiment, the user can provide the encrypted public key b to the data query platform by sending a public key registration request. The data query platform will then generate a public key registration transaction, thereby registering the encrypted public key b to the blockchain system.

[0158] Step 503: The data query platform generates a public key registration transaction based on the encrypted public key b.

[0159] In this embodiment, the data query platform can record the correspondence between the hash value of the encrypted public key b and user 2, so that when other users need to obtain user 2's encrypted public key b, the data query platform can obtain the hash value of user 2's encrypted public key b, and initiate a transaction to the blockchain system to obtain the encrypted public key b based on the hash value.

[0160] Step 504: The data query platform sends the public key registration transaction to the blockchain system.

[0161] Step 505: Register the encrypted public key b included in the blockchain system's public key notarization transaction.

[0162] In this embodiment, the blockchain system can store the correspondence between the encrypted public key b and its hash value so that the encrypted public key b can be returned based on the hash value later.

[0163] Step 506: User 2 generates a query permission acquisition request based on the unique identifier "X" of data X.

[0164] In this embodiment, when user 2 needs to query data X, he / she can directly send a query permission request to user 1 based on the unique identifier "X" of data X, so that user 1 can determine whether to allow user 2 to query data X.

[0165] Step 507: User 2 sends the generated query permission acquisition request to User 1.

[0166] Step 508: User 1 generates a public key retrieval request for User 2, provided that User 2 is allowed to query data X.

[0167] In this embodiment, when user 1 allows user 2 to query data X, user 1 can obtain user 2's encrypted public key b from the blockchain system, and encrypt the encrypted private key a' in A based on the encrypted public and private key b held by user 1.

[0168] Step 509: User 1 sends the generated public key retrieval request to the data query platform.

[0169] Step 510: The data query platform initiates a public key acquisition transaction for user 2 to the blockchain system.

[0170] Step 511: The blockchain system returns the encrypted public key b to the data query platform.

[0171] Step 512: The data query platform returns the encrypted public key b to user 1.

[0172] Step 513: User 1 encrypts the private key a' in the public-private key pair A based on the public key b.

[0173] Step 514: User 1 generates a private key ciphertext storage request based on the encrypted private key ciphertext "a".

[0174] In this embodiment, after user 1 encrypts the private key a' based on the obtained public key b to obtain the private key ciphertext a", the user can store the private key ciphertext a" in the blockchain system.

[0175] In this embodiment, user 1 can generate a private key ciphertext storage request based on the private key ciphertext a”, and send the generated private key ciphertext storage request to the data query platform so that the private key ciphertext a” can be provided to the blockchain system through the data query platform.

[0176] Step 515: User 1 sends a private key encrypted evidence storage request to the data query platform.

[0177] Step 516: The data query platform generates a private key ciphertext storage transaction based on the private key ciphertext "a".

[0178] Step 517: The data query platform sends the private key encrypted transaction to the blockchain system.

[0179] Step 518: The blockchain system associates the private key ciphertext "a" with the metadata "x" for storage.

[0180] In this embodiment, after receiving the private key ciphertext notarization transaction, the blockchain system can associate the private key ciphertext a” with the metadata x for notarization, so that during the data query stage, two acquisition credentials related to data X can be quickly obtained.

[0181] Following the examples above, the correspondence maintained in the blockchain system can be shown in Table 3 below:

[0182] The hash value of the metadata of the data that has been put on the blockchain Metadata of data already on the blockchain Private key ciphertext corresponding to the data already on the blockchain Hash value x' Metadata x Private key ciphertext a” Hash value y' Metadata y Private key ciphertext c” …… …… ……

[0183] Table 3

[0184] It is worth noting that the data query platform can also record the correspondence between the hash value of the private key ciphertext "a" and the unique identifier "X" of data X. This allows a query transaction to be initiated based on the hash value of the private key ciphertext "a" during the data query phase, enabling the blockchain system to find the private key ciphertext "a" based on that hash value. Of course, this example is merely illustrative. Whether the private key ciphertext is found based on the correspondence stored by the data query platform or based on the association between metadata and the private key ciphertext can be determined by those skilled in the art according to actual needs, and this embodiment does not impose any restrictions on this.

[0185] As can be seen from the above technical solution, when allowing a querying party to query target data, the data owner can encrypt their own private key (used for decrypting the target data) based on the querying party's public key, obtaining a private key ciphertext. This ciphertext is then stored in the blockchain system to ensure its integrity. Furthermore, this private key ciphertext is associated with the encrypted target data stored in the off-chain data system, enabling the rapid acquisition of two credentials for querying the target data during the data query phase.

[0186] The following section describes the data query phase for user 2 after obtaining query permissions and retrieving data X.

[0187] Figure 6 This is an interactive diagram illustrating an exemplary embodiment of a data query method described in this specification. (Example:) Figure 6 As shown, the method may include the following steps:

[0188] Step 601: User 2 generates a data query request based on the unique identifier "X" of data X.

[0189] In this embodiment, when user 2 needs to obtain data X, he can initiate a data query request to the data query platform based on the unique identifier "X" of data X, so that the platform can return the information used to obtain data X.

[0190] Step 602: User 2 sends a data query request to the data query platform.

[0191] Step 603: The data query platform uses the unique identifier "X" contained in the data query request to find the hash value x' of the metadata x corresponding to data X.

[0192] Following the example above, after receiving a data query request, the data query platform can find the hash value x' in the correspondence shown in Table 1 based on the unique identifier "X". Based on this, the data query platform can initiate a data query transaction with the blockchain system based on the hash value x'.

[0193] Step 604: The data query platform generates a data query transaction based on the hash value x'.

[0194] Step 605: The data query platform sends the data query transaction to the blockchain system.

[0195] Step 606: The blockchain system searches for metadata x and the private key ciphertext a associated with the metadata based on the hash value x' contained in the data query transaction.

[0196] Following the example above, after receiving a data query transaction, the blockchain system can read the hash value x' contained therein, and based on the hash value x', find the metadata x and the private key ciphertext a” from the correspondence shown in Table 3, and return the metadata x and the private key ciphertext a” to the data query platform.

[0197] Step 607: The blockchain system returns the found metadata x and private key ciphertext a” to the data query platform.

[0198] Step 608: The data query platform generates an encrypted data retrieval request based on metadata x.

[0199] Following the example above, after receiving the metadata x and the private key ciphertext a” returned by the blockchain system, the data query platform can initiate an encrypted data retrieval request to the off-chain data system based on the metadata x to obtain encrypted data X’. For example, the off-chain data system can obtain the encrypted data X’ based on the storage information of the encrypted data X’ contained in the metadata x, and return the encrypted data X’ to the data query platform.

[0200] Step 609: The data query platform sends the encrypted data retrieval request to the off-chain data system.

[0201] Step 610: The off-chain data system searches for encrypted data X' based on metadata x.

[0202] Step 611: The off-chain data system returns the found encrypted data X' to the data query platform.

[0203] Step 612: The data query platform returns the encrypted data X' and the private key ciphertext a" to user 2.

[0204] Following the example above, after obtaining the encrypted data X', the data query platform can return the encrypted data X' and the private key ciphertext a" to the querying party so that the querying party can use them to obtain data X.

[0205] Step 613: The querying party decrypts the ciphertext a” of the private key based on its own maintained encryption private key b’.

[0206] Following the example above, after obtaining encrypted data X' and private key ciphertext a", the querying party can first use its own maintained public and private keys to decrypt the private key b' in b to obtain the private key a' used to encrypt data X. Based on this, the querying party can decrypt encrypted data X' using the private key a' to obtain data X.

[0207] Step 614: The querying party decrypts the encrypted data X' using the encrypted private key a' obtained from the decryption process, and obtains the data X.

[0208] As can be seen from the above technical solution, because this specification associates and stores the metadata of the encrypted data with the ciphertext of the private key used to decrypt the encrypted data in the blockchain system, and this ciphertext is obtained by encrypting the queryer's public key with query permissions, only the queryer can decrypt to obtain the private key of all parties, and then decrypt the encrypted data based on the private key of all parties. Therefore, through the technical solution of this specification, even if the data query operation is not completely controlled by the blockchain system, the reliability of the data query operation can be guaranteed, avoiding the problem of unreliable data query operations caused by the separation of authorization verification and data return operations in related technologies.

[0209] Figure 7 This is a schematic structural diagram of a device provided in an exemplary embodiment. Please refer to... Figure 7At the hardware level, the device includes a processor 702, an internal bus 704, a network interface 706, memory 708, and non-volatile memory 710, and may also include other hardware required for services. One or more embodiments of this specification can be implemented in software, such as the processor 702 reading the corresponding computer program from the non-volatile memory 710 into memory 708 and then running it. Of course, in addition to software implementation, one or more embodiments of this specification do not exclude other implementation methods, such as logic devices or a combination of hardware and software, etc. That is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0210] Please refer to Figure 8 Data query devices can be applied to, for example Figure 7 The device shown implements the technical solution described in this specification. The data query device, applied to a blockchain system, may include:

[0211] The evidence storage unit 801 stores the metadata of the encrypted data; the encrypted data is obtained by encrypting the target data based on the public key of the owner of the target data, and the encrypted data is maintained in the off-chain data system;

[0212] The acquisition unit 802 acquires the private key ciphertext of the owner's private key and associates the private key ciphertext with the metadata for storage; the private key ciphertext is obtained by the owner encrypting the owner's private key based on the queryer's public key, provided that the queryer is allowed to query the target data.

[0213] Return unit 803, upon receiving a query transaction requesting the querying party to query the target data, returns response information to the querying party based on the associated notarized private key ciphertext and the metadata, so that the querying party can obtain the target data based on the response information;

[0214] Specifically, the target data obtained based on the response information is obtained by decrypting the encrypted data using the private key of the owner party; the private key of the owner party is obtained by decrypting the private key ciphertext using the private key of the querying party; and the encrypted data is obtained based on the metadata.

[0215] Optionally, return unit 803 is further used for:

[0216] The private key ciphertext and metadata associated with the evidence are returned to the querying party as response information, so that the querying party can obtain the encrypted data from the off-chain data system based on the metadata, and decrypt the obtained private key ciphertext based on its own maintained querying party private key, and decrypt the obtained encrypted data based on the decrypted private key of all parties to obtain the target data.

[0217] Optionally, return unit 803 is further used for:

[0218] Obtain the private key ciphertext and metadata associated with the evidence storage, and retrieve the encrypted data from the off-chain data system based on the obtained metadata;

[0219] The private key ciphertext is decrypted based on the query party's private key read from the query transaction to obtain the owner's private key. The obtained encrypted data is then decrypted based on the owner's private key, and the decrypted target data is returned to the query party as response information.

[0220] Optional,

[0221] The evidence storage unit 801 is further used to: associate and store the unique identifier of the target data with the metadata;

[0222] The acquisition unit 802 is further used to: associate and store the private key ciphertext with the unique identifier of the target data;

[0223] It also includes: a determining unit 804, which reads the unique identifier of the target data contained in the query transaction, so as to determine the metadata of the encrypted data and the private key ciphertext of the owner's private key from all the private key ciphertext and metadata of all associated evidence maintained based on the unique identifier.

[0224] Optionally, the evidence storage unit 801 is also used for:

[0225] In response to the querying party generating a public key registration transaction based on the querying party's public key and its unique public key identifier, the querying party's public key and the unique public key identifier contained in the public key registration transaction are associated and stored as evidence;

[0226] In response to a public key retrieval transaction initiated by the owner, the querying party's public key is returned to the owner based on the unique identifier of the public key contained in the public key retrieval transaction.

[0227] Optionally, the private key used to encrypt the target data uniquely corresponds to the target data; the evidence storage unit 801 is also used for:

[0228] If encrypted data other than the target data is obtained, the encrypted data is stored as evidence; wherein, the encrypted data is obtained by encryption based on the private key of the owner that uniquely corresponds to the other data.

[0229] Please refer to Figure 9 Data query devices can be applied to, for example Figure 7 The device shown implements the technical solution described in this specification. The data query device, applied to a data query platform, may include:

[0230] The providing unit 901, in response to the private key ciphertext provided by the owner of the target data when allowing the querying party to query the target data, provides the private key ciphertext to the blockchain system so that the blockchain system can associate and store the private key ciphertext with the maintained metadata; wherein, the metadata is the metadata of encrypted data stored in the off-chain data system, the encrypted data is obtained by encrypting the target data based on the owner's owner's public key, and the private key ciphertext is obtained by encrypting the owner's owner's private key based on the querying party's querying party's public key;

[0231] Initiating unit 902, in response to the querying party's request to query the target data, initiates a query transaction for the target data to the blockchain system, instructing the blockchain system to return the associated stored private key ciphertext and the metadata;

[0232] Return unit 903 retrieves the encrypted data from the off-chain data system based on the received metadata, and returns the retrieved encrypted data and the received private key ciphertext to the querying party, so that the querying party can decrypt the retrieved private key ciphertext based on its own maintained querying party private key, and decrypt the retrieved encrypted data based on the decrypted private key of all parties to obtain the target data.

[0233] Optionally, the providing unit 901 is also used for:

[0234] In response to the public key registration request generated by the querying party based on the querying party's public key and its unique public key identifier, the querying party's public key and its unique public key identifier contained in the public key registration request are provided to the blockchain system so that the blockchain system can associate and store the querying party's public key and its unique public key identifier.

[0235] Optionally, the data query platform maintains a correspondence between the unique identifier of the target data, the hash value of the metadata, and the hash value of the private key ciphertext; the initiating unit 902 is further used for:

[0236] The unique identifier of the target data contained in the query request is read to determine the hash value of the metadata and the hash value of the private key ciphertext based on the unique identifier. Based on the determined hash value of the metadata and the hash value of the private key ciphertext, a query transaction for the target data is initiated to the blockchain system to instruct the blockchain system to return the private key ciphertext and the metadata based on the hash value contained in the query transaction.

[0237] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer, which can take the form of a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email sending and receiving device, game console, tablet computer, wearable device, or any combination of these devices.

[0238] In a typical configuration, a computer includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0239] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0240] Computer-readable media, including both permanent and non-permanent, removable and non-removable media, can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, disk storage, quantum memory, graphene-based storage media or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0241] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0242] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0243] The terminology used in one or more embodiments of this specification is for the purpose of describing particular embodiments only and is not intended to limit the scope of one or more embodiments of this specification. The singular forms “a,” “described,” and “the” used in one or more embodiments of this specification and in the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0244] It should be understood that although the terms first, second, third, etc., may be used to describe various information in one or more embodiments of this specification, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, first information may also be referred to as second information without departing from the scope of one or more embodiments of this specification, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "in response to a determination," or "when," or "in the event of a determination."

[0245] The above description is merely a preferred embodiment of one or more embodiments of this specification and is not intended to limit the scope of one or more embodiments of this specification. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of one or more embodiments of this specification should be included within the scope of protection of one or more embodiments of this specification.

Claims

1. A data query system, comprising: The party querying the target data, the owner of the target data, off-chain data systems, and blockchain systems; The off-chain data system maintains encrypted data obtained by encrypting the target data using the public keys of all parties; the blockchain system maintains metadata of the encrypted data. The owner, while allowing the querying party to query the target data, encrypts the owner's private key based on the querying party's public key to obtain the private key ciphertext; The blockchain system obtains the private key ciphertext and associates and stores the obtained private key ciphertext with the maintained metadata. In addition, upon receiving a query transaction requesting the querying party to query the target data, a response is returned to the querying party based on the private key ciphertext and the metadata stored in the associated notarization. The querying party obtains the target data based on the response information; wherein, the target data obtained based on the response information is obtained by decrypting the encrypted data using the owner's private key, the owner's private key is obtained by decrypting the private key ciphertext using the querying party's querying private key, and the encrypted data is obtained based on the metadata.

2. The system according to claim 1, The blockchain system returns response information to the querying party based on the associated stored private key ciphertext and the metadata, including: The private key ciphertext and metadata associated with the evidence will be returned to the querying party as response information. The querying party obtains the target data based on the response information, including: obtaining the encrypted data from the off-chain data system based on the metadata, decrypting the obtained private key ciphertext based on its own maintained querying party private key, and decrypting the obtained encrypted data based on the decrypted private key of all parties to obtain the target data.

3. The system according to claim 2, The blockchain system returns the associated, stored private key ciphertext and metadata as response information to the querying party, including: The private key ciphertext and metadata of all maintained associated evidence will be returned to the querying party as response information; The querying party obtains the target data based on the response information, including: decrypting the obtained private key ciphertext based on the maintained querying party private key; and, in the case of obtaining the all-party private key by decrypting any private key ciphertext, obtaining encrypted data from the off-chain data system based on the metadata associated with the stored evidence of any private key ciphertext; and decrypting the obtained encrypted data based on the decrypted all-party private key to obtain the target data.

4. The system according to claim 1, The blockchain system returns response information to the querying party based on the associated stored private key ciphertext and the metadata, including: Obtain the private key ciphertext and metadata associated with the evidence storage, and retrieve the encrypted data from the off-chain data system based on the obtained metadata; Furthermore, based on the private key of the querying party read from the query transaction, the private key ciphertext is decrypted to obtain the private key of the all parties, and the encrypted data obtained is decrypted based on the private key of the all parties, so as to return the decrypted target data as response information to the querying party; The querying party obtains the target data based on the response information, including: reading the target data from the received response information.

5. The system according to claim 4, The blockchain system decrypts the private key ciphertext based on the query party's private key read from the query transaction to obtain the private key of all parties, including: Based on the query party's private key read from the query transaction, all private key ciphertexts maintained are decrypted, and if any private key ciphertext is successfully decrypted, the private key of all parties is obtained. The blockchain system acquires the private key ciphertext and metadata associated with the evidence storage, and acquires the encrypted data from the off-chain data system based on the acquired metadata, including: acquiring metadata associated with any of the private key ciphertexts for evidence storage, so as to acquire the encrypted data from the off-chain data system based on the acquired metadata; The blockchain system decrypts the encrypted data based on the private key of the owner, and returns the decrypted target data as a response to the querying party, including: decrypting the obtained encrypted data based on the private key of the owner obtained by decrypting the ciphertext of any private key, and returning the decrypted target data to the querying party.

6. In the system according to claim 1, the metadata of the encrypted data maintained in the blockchain system is associated with and stored as a unique identifier of the target data; The blockchain system associates the private key ciphertext with the maintained metadata for notarization, including: associating the private key ciphertext with the unique identifier of the target data for notarization. The blockchain system further includes: reading the unique identifier of the target data contained in the query transaction, so as to determine the metadata of the encrypted data and the private key ciphertext of the owner's private key from all the private key ciphertexts and metadata of all associated evidence maintained based on the unique identifier.

7. The system according to claim 1, The querying party also includes: A public key registration request is generated based on the queryer's public key and its unique identifier, and the generated public key registration request is sent to the blockchain system; The blockchain system further includes: associating and storing the query party's public key and the public key's unique identifier contained in the public key registration request; The "owner" also includes: initiating a public key acquisition request to the blockchain system based on the unique public key identifier, in order to obtain the public key of the querying party returned by the blockchain system based on the unique public key identifier.

8. The system according to claim 1, further comprising: Data query platform; The owner also includes: encrypting the target data held based on the owner's public key, and providing the encrypted data to the data query platform; and, if the private key ciphertext is obtained, providing the private key ciphertext to the data query platform. The data query platform provides the received encrypted data to the off-chain data system for storage, and provides the metadata of the encrypted data to the blockchain system for notarization. The metadata of the encrypted data is generated based on the storage information of the encrypted data in the off-chain data system. The platform also initiates a private key notarization transaction with the blockchain system based on the received private key ciphertext. The data query platform further includes: responding to the querying party's query request to query the target data, initiating a query transaction for the target data to the blockchain system; and receiving the response information returned by the blockchain system for the query transaction, and returning the response information to the querying party.

9. The system according to claim 8, The data query platform also includes: When the metadata is obtained, the correspondence between the unique identifier of the target data and the hash value of the metadata is recorded; In addition, upon receiving the private key ciphertext, the correspondence between the unique identifier of the target data and the hash value of the private key ciphertext is recorded; The blockchain system further includes: associating and storing the metadata and its hash value; The blockchain system associates and stores the obtained private key ciphertext with the maintained metadata, including: associating and storing the private key ciphertext and its hash value.

10. The system according to claim 9, The data query platform initiates a query transaction for the target data into the blockchain system, including: The unique identifier of the target data contained in the query request is read to determine the hash value of the metadata and the hash value of the private key ciphertext based on the unique identifier, and a query transaction for the target data is initiated to the blockchain system based on the determined hash value of the metadata and the hash value of the private key ciphertext. The blockchain system returns response information to the querying party based on the private key ciphertext and the metadata stored in the associated notarization, including: finding the private key ciphertext based on the hash value of the private key ciphertext contained in the query transaction, finding the metadata based on the hash value of the metadata contained in the query transaction, and returning the found private key ciphertext and metadata to the data query platform. The data query platform receives the response information returned by the blockchain system for the query transaction and returns the response information to the querying party, including: receiving metadata returned by the blockchain system, obtaining the encrypted data from the off-chain data system based on the metadata, and using the obtained encrypted data and the private key ciphertext returned by the blockchain system as the response information returned to the querying party; The querying party obtains the target data based on the response information by: decrypting the received private key ciphertext based on the maintained querying party private key, and decrypting the received encrypted data based on the decrypted private key of all parties to obtain the target data.

11. In the system according to claim 1, the private key of all parties used to encrypt the target data uniquely corresponds to the target data; The aforementioned parties also include: Generate a public-private key pair that uniquely corresponds to the target data, and encrypt the target data based on the public keys of all parties in the public-private key pair to obtain the encrypted data; and generate a public-private key pair that corresponds to other data that is different from the target data, and encrypt the other data based on the public keys of all parties in the public-private key pair to obtain the encrypted data of the other data. Specifically, the target data obtained based on the response information is decrypted using the private keys of all parties in the public-private key pair corresponding to the target data.

12. A data query method applied to a blockchain system, comprising: Store the metadata of encrypted data; The encrypted data is obtained by encrypting the target data using the public key of all parties involved in the target data, and the encrypted data is maintained in an off-chain data system. Obtain the private key ciphertext of the owner's private key from the owner, and associate the private key ciphertext with the metadata for notarization; the private key ciphertext is obtained by the owner encrypting the owner's private key based on the queryer's public key, provided that the queryer is allowed to query the target data. Upon receiving a query transaction requesting the querying party to retrieve the target data, a response is returned to the querying party based on the associated notarized private key ciphertext and the metadata, so that the querying party can obtain the target data based on the response; Specifically, the target data obtained based on the response information is obtained by decrypting the encrypted data using the private key of the owner party; the private key of the owner party is obtained by decrypting the private key ciphertext using the private key of the querying party; and the encrypted data is obtained based on the metadata.

13. The method according to claim 12, wherein returning response information to the querying party based on the private key ciphertext and the metadata stored in the association includes: The private key ciphertext and metadata associated with the evidence are returned to the querying party as response information, so that the querying party can obtain the encrypted data from the off-chain data system based on the metadata, and decrypt the obtained private key ciphertext based on its own maintained querying party private key, and decrypt the obtained encrypted data based on the decrypted private key of all parties to obtain the target data.

14. The method according to claim 12, wherein returning response information to the querying party based on the private key ciphertext and the metadata stored in the association includes: Obtain the private key ciphertext and metadata associated with the evidence storage, and retrieve the encrypted data from the off-chain data system based on the obtained metadata; The private key ciphertext is decrypted based on the query party's private key read from the query transaction to obtain the owner's private key. The obtained encrypted data is then decrypted based on the owner's private key, and the decrypted target data is returned to the query party as response information.

15. The method according to claim 12, The method of storing metadata of encrypted data includes: The unique identifier of the target data is associated with and stored as evidence with the metadata. The step of associating the private key ciphertext with the metadata for notarization includes: associating the private key ciphertext with the unique identifier of the target data for notarization. It also includes: reading the unique identifier of the target data contained in the query transaction, so as to determine the metadata of the encrypted data and the private key ciphertext of the owner's private key from all the private key ciphertexts and metadata of the maintained associated evidence based on the unique identifier.

16. The method of claim 12, further comprising: In response to the querying party generating a public key registration transaction based on the querying party's public key and its unique public key identifier, the querying party's public key and the unique public key identifier contained in the public key registration transaction are associated and stored as evidence; In response to a public key retrieval transaction initiated by the owner, the querying party's public key is returned to the owner based on the unique identifier of the public key contained in the public key retrieval transaction.

17. The method according to claim 12, wherein the private key used to encrypt the target data uniquely corresponds to the target data; the method further comprises: If encrypted data other than the target data is obtained, the encrypted data is stored as evidence; wherein, the encrypted data is obtained by encryption based on the private key of the owner that uniquely corresponds to the other data.

18. A data query method, applied to a data query platform, comprising: In response to the private key ciphertext provided by the owner of the target data, provided that the querying party is allowed to query the target data, the private key ciphertext is provided to the blockchain system, so that the blockchain system can associate and store the private key ciphertext with the maintained metadata; wherein, the metadata is the metadata of encrypted data stored in the off-chain data system, the encrypted data is obtained by encrypting the target data based on the owner's owner's public key, and the private key ciphertext is obtained by encrypting the owner's owner's private key based on the querying party's querying public key; In response to the query request from the querying party to query the target data, a query transaction for the target data is initiated to the blockchain system, instructing the blockchain system to return the associated stored private key ciphertext and the metadata; Based on the received metadata, the encrypted data is obtained from the off-chain data system, and the obtained encrypted data and the received private key ciphertext are returned to the querying party, so that the querying party can decrypt the obtained private key ciphertext based on its own maintained querying party private key, and decrypt the obtained encrypted data based on the decrypted private key of all parties to obtain the target data.

19. The method of claim 18, further comprising: In response to the public key registration request generated by the querying party based on the querying party's public key and its unique public key identifier, the querying party's public key and its unique public key identifier contained in the public key registration request are provided to the blockchain system so that the blockchain system can associate and store the querying party's public key and its unique public key identifier.

20. The method according to claim 18, wherein the data query platform maintains a correspondence between the unique identifier of the target data, the hash value of the metadata, and the hash value of the private key ciphertext; initiating a query transaction for the target data to the blockchain system includes: The unique identifier of the target data contained in the query request is read to determine the hash value of the metadata and the hash value of the private key ciphertext based on the unique identifier. Based on the determined hash value of the metadata and the hash value of the private key ciphertext, a query transaction for the target data is initiated to the blockchain system to instruct the blockchain system to return the private key ciphertext and the metadata based on the hash value contained in the query transaction.

21. A data query device, applied to a blockchain system, comprising: The evidence storage unit stores the metadata of the encrypted data. The encrypted data is obtained by encrypting the target data using the public key of all parties involved in the target data, and the encrypted data is maintained in an off-chain data system. The acquisition unit acquires the private key ciphertext of the owner's private key and associates the private key ciphertext with the metadata for storage; the private key ciphertext is obtained by the owner encrypting the owner's private key based on the queryer's public key, provided that the queryer is allowed to query the target data. The return unit, upon receiving a query transaction requesting the query party to query the target data, returns response information to the query party based on the associated notarized private key ciphertext and the metadata, so that the query party can obtain the target data based on the response information; Specifically, the target data obtained based on the response information is obtained by decrypting the encrypted data using the private key of the owner party; the private key of the owner party is obtained by decrypting the private key ciphertext using the private key of the querying party; and the encrypted data is obtained based on the metadata.

22. A data query device, applied to a data query platform, comprising: A providing unit, in response to the private key ciphertext provided by the owner of the target data under the condition that the querying party is allowed to query the target data, provides the private key ciphertext to the blockchain system, so that the blockchain system can associate and store the private key ciphertext with the maintained metadata; wherein, the metadata is the metadata of encrypted data stored in the off-chain data system, the encrypted data is obtained by encrypting the target data based on the owner's owner's public key, and the private key ciphertext is obtained by encrypting the owner's owner's private key based on the querying party's querying public key; The initiating unit, in response to the querying party's request to query the target data, initiates a query transaction for the target data to the blockchain system, instructing the blockchain system to return the associated stored private key ciphertext and the metadata; The return unit retrieves the encrypted data from the off-chain data system based on the received metadata, and returns the retrieved encrypted data and the received private key ciphertext to the querying party, so that the querying party can decrypt the retrieved private key ciphertext based on its own maintained querying party private key, and decrypt the retrieved encrypted data based on the decrypted private key of all parties to obtain the target data.

23. An electronic device, comprising: processor; Memory used to store processor-executable instructions; The processor implements the method as described in any one of claims 12-20 by executing the executable instructions.

24. A computer-readable storage medium having stored thereon computer instructions that, when executed by a processor, implement the steps of the method as claimed in any one of claims 12-20.

Images