Common data query methods, devices, equipment and media

Abstract

The application provides a common data query method and device, equipment and medium. Including: determining a to-be-queried object and a query type of the to-be-queried object; sending a query request to a data storage party and obtaining public key data and second encrypted identification data sent by the data storage party, the query request carrying the query type; encrypting identification data of the to-be-queried object by using the public key data to obtain first encrypted identification data; if the first encrypted identification data and the second encrypted identification data are the same, determining that the to-be-queried object is common data of the data query party and the data storage party; determining a first data key according to the to-be-queried object; sending a data transmission request to the data storage party and obtaining target query data sent by the data storage party, the target query data being query data processed by the data storage party according to a second data key; decrypting the target query data according to the first data key to obtain query data; and protecting the common data.

Description

Technical Field

[0001] This application relates to the field of data query, and more particularly to a common data query method, apparatus, device, and medium. Background Technology

[0002] In many scenarios, data sharing is necessary among different data owners. For example, telecom operators may jointly query the number of phone cards registered under a customer's name, or multiple banks and financial institutions may jointly query the number of bank cards and loan records under a customer's name. However, data is vulnerable to risks such as data breaches and unauthorized transactions during the data flow process.

[0003] There are two main ways to implement multi-party joint queries: aggregate data from multiple parties and then query it through an interface; or query plaintext / ciphertext data through an interface.

[0004] However, existing data query methods suffer from poor data query security. Summary of the Invention

[0005] This application provides a common data query method, apparatus, device, and medium to solve the problem of poor data query results in existing data query methods.

[0006] Firstly, this application provides a public data query method, applied to a data query party, the method comprising:

[0007] Determine the object to be queried and the query type for that object;

[0008] Send a query request to the data storage provider and obtain the public key data and the second encrypted identifier data sent by the data storage provider. The query request carries the query type.

[0009] The identifier data of the object to be queried is encrypted using public key data to obtain the first encrypted identifier data;

[0010] If the first encrypted identifier data and the second encrypted identifier data are the same, then the object to be queried is determined to be shared data between the data queryer and the data storage provider.

[0011] Determine the first data key based on the object to be queried;

[0012] Send a data transmission request to the data storage provider and obtain the target query data sent by the data storage provider. The target query data is the query data that the data storage provider has encrypted using the second data key.

[0013] The target query data is decrypted using the first data key to obtain the query data.

[0014] In this embodiment of the application, public key data is used to encrypt the identifier data of the object to be queried to obtain first encrypted identifier data, including:

[0015] Determine a random number;

[0016] Calculate the hash of the identifier data of the object to be queried to obtain the initial identifier data hash value;

[0017] The hash value of the identifier data is determined based on the random number and the hash value of the initial identifier data;

[0018] The hash value of the identifier data is encrypted using the public key data to generate the public key encrypted identifier data hash value, which is then sent to the data storage provider.

[0019] Obtain the hash value of the identifier data after decrypting the private key sent by the data storage provider. The hash value of the identifier data after decrypting the private key is the data obtained by the data storage provider after decrypting the hash value of the identifier data encrypted with the public key based on the private key data.

[0020] Remove the random number from the hash value of the identifier data after decryption of the private key to obtain the first encrypted identifier data.

[0021] In this embodiment of the application, determining the first data key based on the object to be queried includes:

[0022] Based on the shared query object and the digital signature algorithm, generate the first data signature;

[0023] Send a signature verification request to the data storage provider and obtain the second data signature sent by the data storage provider;

[0024] Compare the first data signature and the second data signature;

[0025] If the first data signature and the second data signature match, a key confirmation request is sent to the data storage provider.

[0026] Obtain the key sent by the data storage provider to confirm permission;

[0027] The permission is determined based on the key, and the first data key is determined.

[0028] In this embodiment of the application, determining the first data key based on the key to grant permission includes:

[0029] Determine the preset DH key exchange algorithm;

[0030] Based on the key, permission is determined, and a preset DH key exchange algorithm is used to generate the first data key.

[0031] Secondly, this application provides a public data query method, applied to a data storage provider, the method comprising:

[0032] Obtain the query request sent by the data querying party, which carries the query type of the object to be queried;

[0033] Generate public and private key data based on the query request, and send the public key data to the data query party;

[0034] Based on the query type, determine the target object to be queried;

[0035] Based on the private key data and the identifier data of the target object to be queried, a second encrypted identifier data is generated and sent to the data querying party;

[0036] The second data key is determined based on the signature verification request sent by the data querying party;

[0037] The query data corresponding to the signature verification request is encrypted using the second data key to obtain the target query data.

[0038] Based on the data transmission request sent by the data query party, the target query data is sent to the data query party.

[0039] In this embodiment of the application, a second encrypted identifier is generated based on the private key data and the identifier data of the target object to be queried, and then sent to the data querying party, including:

[0040] Hash the identifier data of the target query object to obtain the hash value of the identifier data of the target query object;

[0041] The hash value of the identifier data is encrypted using the private key data to obtain the second encrypted identifier data, which is then sent to the data query party.

[0042] In this embodiment of the application, determining the second data key based on the signature verification request sent by the data querying party includes:

[0043] Obtain the signature verification request sent by the data query party;

[0044] Based on the signature verification request and digital signature algorithm, a second data signature is generated and sent to the data query party;

[0045] Obtain the key confirmation request sent by the data query party, and send key confirmation permission to the data query party;

[0046] The second data key is generated according to the DH key exchange algorithm.

[0047] Thirdly, this application provides a shared data query device, applied to a data query party, the device comprising:

[0048] The type determination module is used to determine the object to be queried and the query type of the object to be queried.

[0049] The data acquisition module is used to send a query request to the data storage provider and obtain the public key data and the second encrypted identifier data sent by the data storage provider. The query request carries the query type.

[0050] The data encryption module is used to encrypt the identifier data of the object to be queried using public key data to obtain the first encrypted identifier data;

[0051] The data determination module is used to determine that the object to be queried is shared data between the data queryer and the data storage provider if the first encrypted identifier data and the second encrypted identifier data are the same.

[0052] The key determination module is used to determine the first data key based on the object to be queried;

[0053] The request sending module is used to send a data transmission request to the data storage provider and obtain the target query data sent by the data storage provider. The target query data is the query data that the data storage provider has encrypted according to the second data key.

[0054] The data decryption module is used to decrypt the target query data based on the first data key to obtain the query data.

[0055] Fourthly, this application provides a shared data query device, applied to a data storage provider, the device comprising:

[0056] The request retrieval module is used to retrieve query requests sent by the data querying party. The query request carries the query type of the object to be queried.

[0057] The data generation module is used to generate public key data and private key data according to the query request, and send the public key data to the data query party;

[0058] The object determination module is used to determine the target object to be queried based on the query type.

[0059] The identifier generation module is used to generate second encrypted identifier data based on the private key data and the identifier data of the target object to be queried, and send it to the data query party;

[0060] The key determination module is used to determine the second data key based on the signature verification request sent by the data query party;

[0061] The data encryption module is used to encrypt the query data corresponding to the signature verification request according to the second data key to obtain the target query data;

[0062] The data sending module is used to send the target query data to the data query party based on the data transmission request sent by the data query party.

[0063] Fifthly, this application provides an apparatus, including: a processor, and a memory communicatively connected to the processor;

[0064] The memory stores the instructions that the computer executes;

[0065] The processor executes computer execution instructions stored in memory to implement the method of this application.

[0066] In a sixth aspect, this application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the method of this application.

[0067] The shared data query method, apparatus, device, and medium provided in this application determine the object to be queried and the query type of the object; send a query request to the data storage provider and obtain public key data and second encrypted identifier data sent by the data storage provider, wherein the query request carries the query type; encrypt the identifier data of the object to be queried using the public key data to obtain first encrypted identifier data; if the first encrypted identifier data and the second encrypted identifier data are the same, then the object to be queried is determined to be shared data of the data query provider and the data storage provider; determine a first data key based on the object to be queried; send a data transmission request to the data storage provider and obtain target query data sent by the data storage provider, wherein the target query data is query data encrypted by the data storage provider according to the second data key; and decrypt the target query data according to the first data key to obtain the query data.

[0068] In this way, the public key data sent by the data storage provider can be used to encrypt the identification data of the customer to be queried, and then compared with the second encrypted identification data generated by the data storage provider. Based on the comparison result, it can be determined that the data of the object to be queried is a dataset shared by both parties, and the encrypted data of the object to be queried sent by the data storage provider can be obtained. This enables data querying and encrypted transmission of shared objects. Under the premise of protecting the privacy of customer data, customer information can be queried and data statistics can be performed. This protects the unique customer information of the party, prevents the disclosure of non-existent customer data information to the other party, and prevents the data of shared customers from being attacked and obtained by others during transmission. Attached Figure Description

[0069] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0070] Figure 1 A flowchart illustrating a public data query method provided in an embodiment of this application;

[0071] Figure 2A flowchart illustrating another public data query method provided in this application embodiment;

[0072] Figure 3 This application provides an illustration of a shared data query method.

[0073] Figure 4 This is a schematic diagram of the structure of a shared data query device provided in an embodiment of this application;

[0074] Figure 5 A schematic diagram of another shared data query device provided in this application embodiment;

[0075] Figure 6 This is a structural block diagram of an apparatus for executing a public data query method according to an embodiment of this application.

[0076] The accompanying drawings have illustrated specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art by referring to specific embodiments. Detailed Implementation

[0077] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0078] The query type is the data type and data range of the data to be queried for the object to be queried. This allows the data storage provider to determine the range of data to be queried based on the query type carried in the query request, and then query the user data within that range to determine the data to be queried that the data querying party needs.

[0079] Public key data and private key data are key data used to encrypt and decrypt data, enabling secure data transmission.

[0080] The identification data is the identity identifier of the object to be queried, used to identify the object to be queried, and can be the object's ID number or mobile phone number.

[0081] A hash value is the data value obtained by hashing data. A hash function is a function that can map an input of any size to a hash value of a fixed size. This fixed-length string is similar to generating a digital "fingerprint" for the transmitted data. Therefore, hash functions can be used to ensure the integrity of transmitted data and whether the data has been modified during transmission.

[0082] Digital signature algorithms are used to ensure the authentication of both parties during key negotiation, effectively preventing malicious attacks.

[0083] The DH key exchange algorithm can create a communication key for both parties in an insecure channel. The two parties can use this key to encrypt and decrypt messages and ensure the security of communication. The key generated by the DH key exchange algorithm can ensure the security of data during transmission.

[0084] In existing technologies, during multi-party joint queries, we often face the problem of whether the other party already possesses the data we are looking for. If not, the other party may obtain our unique customer information through our query input, leading to data leakage and loss of value. Furthermore, we need to pay attention to the security of data transmission, how to encrypt the data, and how to transmit and store the encryption and decryption keys to protect data security to the greatest extent possible.

[0085] To address the aforementioned issues, this application provides a shared data query method. This method, while protecting customer privacy, identifies customer data shared by both the querying party and the data storage party. It enables querying customer information and performing data statistics, protecting the unique customer information of the querying party and preventing its leakage. It also reduces invalid customer queries by filtering out non-existent customers, thus reducing the number of queries and improving query efficiency. Furthermore, it ensures data security by encrypting data transmission through a key exchange algorithm.

[0086] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0087] Figure 1 This is a flowchart illustrating a shared data query method provided in an embodiment of this application, applied to a data querying party. For example... Figure 1 As shown, this public data query method may include the following steps:

[0088] S110. Determine the object to be queried and the query type of the object to be queried.

[0089] It should be noted that the query objects and various types of user data / information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by both the querying party and the queried party. Furthermore, the collection, use and processing of related data must comply with relevant laws, regulations and standards, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0090] Based on this, the data querying party determines the object to be queried and the corresponding query type, so that the data storage party can determine the corresponding type of data to be queried and send it to the data querying party according to the query type. For example, if the data querying party needs to query the customer's financial loan information at the data storage party, the query type is financial loan type. The data storage party determines its own customer data in terms of financial loans based on this query type, so as to determine the data to be queried for the object to be queried.

[0091] S120. Send a query request to the data storage provider and obtain the public key data and the second encrypted identifier data sent by the data storage provider. The query request carries the query type.

[0092] The query request carries a query type, which enables the data storage provider to determine the type of data to store based on the query type, so as to subsequently determine the query data for the object to be queried.

[0093] The second encrypted identifier data is identifier data sent by the data storage provider and encrypted with a key. It is used to determine whether the object to be queried is a shared data object of the data query provider and the data storage provider.

[0094] Based on this, by sending a query request to the data storage provider, the public key data and the second encrypted identifier data sent by the data storage provider can be obtained, so that the subsequent data query provider can determine whether the object to be queried is a shared data object based on the public key data and the second encrypted identifier data.

[0095] S130. The public key data is used to encrypt the identifier data of the object to be queried to obtain the first encrypted identifier data.

[0096] Based on this, the public key data sent by the data storage provider is used to encrypt the identification data of the object to be queried. This allows the system to determine whether the object to be queried is a shared data object based on the first encrypted identification data. At the same time, it protects the identification data of the object to be queried and prevents the user data of the data querying party from being exposed to the data storage provider.

[0097] S140. If the first encrypted identifier data and the second encrypted identifier data are the same, then the object to be queried is determined to be the common data of the data queryer and the data storageer.

[0098] Based on this, by comparing the first encrypted identifier data and the second encrypted identifier data, if the comparison result is that the first encrypted identifier data and the second encrypted identifier data are the same, it indicates that the identifier data used for encryption is the same, and it can be determined that the query object corresponding to the identifier data is a user shared by the data query party and the data storage party, and the user's data is shared by both parties.

[0099] S150. Determine the first data key based on the object to be queried.

[0100] The first data key is used to decrypt subsequent query data transmitted by the data storage provider.

[0101] Based on this, the object to be queried is identified as a shared data object through the first encrypted identifier data and the second encrypted identifier data. The data storage provider can transmit the query data of the object to be queried to the data query provider. The data key can be used to ensure the security of the transmission of the query data and prevent the data from being leaked during the transmission process. Therefore, by determining the first data key, the data query provider can decrypt the query data in the future.

[0102] S160. Send a data transmission request to the data storage provider and obtain the target query data sent by the data storage provider. The target query data is the query data encrypted by the data storage provider according to the second data key.

[0103] Among them, the data transmission request is a request used to instruct the data storage provider to send the data of the object to be queried to the data query provider.

[0104] Based on this, the data querying party obtains the target query data of the object to be queried by sending a data transmission request to the data storage party.

[0105] S170. Decrypt the target query data according to the first data key to obtain the query data.

[0106] Based on this, the data querying party obtains the target query data and decrypts the target query data according to the first data key to obtain the query data of the object to be queried.

[0107] Based on the above embodiments, this application further provides a feasible implementation of S130, specifically, encrypting the identifier data of the object to be queried using public key data to obtain first encrypted identifier data, including:

[0108] Determine a random number;

[0109] Calculate the hash of the identifier data of the object to be queried to obtain the initial identifier data hash value;

[0110] The hash value of the identifier data is determined based on the random number and the hash value of the initial identifier data;

[0111] The hash value of the identifier data is encrypted using the public key data to generate the public key encrypted identifier data hash value, which is then sent to the data storage provider.

[0112] Obtain the hash value of the identifier data after decrypting the private key sent by the data storage provider. The hash value of the identifier data after decrypting the private key is the data obtained by the data storage provider after decrypting the hash value of the identifier data encrypted with the public key based on the private key data.

[0113] Remove the random number from the hash value of the identifier data after decryption of the private key to obtain the first encrypted identifier data.

[0114] Based on this, by using public key data, private key data, hash functions, and identification data shared by both parties, the shared data of the data query party and the data storage party can be filtered and determined, so as to identify the object to be queried as a shared object.

[0115] In some implementations, determining that the object to be queried is a shared object can be done by filtering the shared customer set based on the RSA algorithm, assuming that the ID number or mobile phone number is a unique customer ID, for the security of institution A (data storage provider) and institution B (data query provider). An example of the intersection process is as follows:

[0116] Institution A (data storage provider) generates a public-private key pair e and d based on the difficult problem of large integer factorization, and sends the public key to Institution B (data query provider);

[0117] Organization B hashes its customer ID and then multiplies it by an encrypted random number to obtain the result. Sent to organization A;

[0118] After receiving it, Agency A... Decryption yields H(x) i ) d ·r i Send it to organization B; simultaneously hash your private key and raise it to the power of d (encrypting the private key), then output the result H(y). i ) d Send to Organization B;

[0119] Organization B calculates H(x) i ) d ·r i / r i That is, H(x) i ) d Later with H(y) i ) d If the two are the same, it means that the customer IDs used for secure intersection are equal, and the customer can be identified as a shared customer of both parties.

[0120] The difficulty of factoring large integers makes a 1024-bit RSA key hard to decrypt, thus ensuring security during the intersection process. Here, a 2048-bit key is used, further increasing the difficulty of decryption.

[0121] Based on the above embodiments, this application further provides a feasible implementation of S150, specifically, determining a first data key according to the object to be queried, including:

[0122] Based on the shared query object and the digital signature algorithm, generate the first data signature;

[0123] Send a signature verification request to the data storage provider and obtain the second data signature sent by the data storage provider;

[0124] Compare the first data signature and the second data signature;

[0125] If the first data signature and the second data signature match, a key confirmation request is sent to the data storage provider.

[0126] Obtain the key sent by the data storage provider to confirm permission;

[0127] The permission is determined based on the key, and the first data key is determined.

[0128] The data signature is used to verify the identities of both communicating parties, thereby ensuring the data security of the subsequent key negotiation process and effectively preventing data leakage caused by malicious attacks. If the first data signature and the second data signature match, it indicates that the identities of both parties have been verified and subsequent communication can proceed.

[0129] A signature verification request indicates that the object to be queried is a shared storage object of both the data queryer and the data storage provider, so that both parties can perform digital signature verification to securely verify each other's identities and subsequently determine the key.

[0130] The key confirmation request indicates that the identities of the data queryer and the data storage provider have been verified, so that both parties can subsequently determine the key for transmitting data.

[0131] The key determination permission signifies that the data storage provider and the data query provider can begin determining the transmission key.

[0132] Based on this, according to the shared query object and digital signature algorithm, both parties generate digital signatures. By comparing their respective digital signatures, the security of each other's identities is determined, so as to subsequently determine the data key. In this feasible implementation, it should be noted that determining the first data key based on the key authorization includes:

[0133] Determine the preset DH key exchange algorithm;

[0134] Based on the key, permission is determined, and a preset DH key exchange algorithm is used to generate the first data key.

[0135] Based on this, the identities of both parties are verified through digital signatures, and a data key is generated according to the DH key exchange algorithm so that the query data can be encrypted and transmitted according to the data key. Therefore, the data querying party generates a first data key, and H is used to decrypt the target query data according to the first data key.

[0136] In some implementations, the first data key can be determined using a digital signature algorithm and a Diffie-Hellman key exchange algorithm. The digital signature algorithm can be a key generation algorithm (SGen) that outputs a public-private key pair (spk, ssk). The ssk needs to be kept secret, while the spk can be made public. The signature algorithm (Sign) takes the private key ssk and the data to be signed (data) as input and outputs a signature (Sigma). The verification algorithm (Verify) takes the public key spk and the signature (Sigma) as input; it outputs 1 if verification is successful, and 0 otherwise. The combination of the signature algorithm and the key exchange algorithm effectively prevents man-in-the-middle attacks. During key exchange, both parties run the signature algorithm to sign their own public key spk. Upon receiving information, the signature is first verified; if the signature is correct, key exchange continues.

[0137] The DH key exchange algorithm process may include:

[0138] Organization A (data storage provider) first gives organization B (data query provider) a plaintext shared parameter P and G, which can be recognized by anyone;

[0139] Organization A generates a random number A (organization A's private key) and does not tell A to anyone, including organization B;

[0140] Organization B generates a random number B (organization B's private key) and does not tell B to anyone, including organization A;

[0141] Organization A encrypts G and P using its private key A to obtain the value G. A modP is transmitted to mechanism B.

[0142] Institution B uses its private key B to access the information G sent by Institution A to Institution B. A Encrypting modP yields (G) A modP) B modP = G A×B mod P = S.

[0143] Similarly, organization B encrypts G and P using its private key B to obtain the value G. B modP is transmitted to mechanism A.

[0144] Institution A uses its private key A to access the information G sent by Institution B to Institution B. B Encrypting modP yields (G) B modP) A modP = G B×A modP = G A×B mod P = S.

[0145] Based on this, Institution A and Institution B obtained their agreed public key S, as well as their respective private keys A and B; where P must be a very large prime number to ensure that private keys A and B cannot be guessed by third-party attackers.

[0146] In this embodiment, in order to determine the shared data and ensure data security during data transmission, the data querying party determines the first encrypted identifier data through the public key data sent by the data storage party, and compares it with the second encrypted identifier data sent by the data storage party, thereby determining the shared query object. The data key ensures the data security of the query data during transmission, ensuring that each query is valid and avoiding empty queries; and preventing the leakage of key information by query input.

[0147] Figure 2 This is a flowchart illustrating another public data query method provided in an embodiment of this application, applied to a data storage provider. For example... Figure 2 As shown, this public data query method may include the following steps:

[0148] S210. Obtain the query request sent by the data querying party, which carries the query type of the object to be queried.

[0149] Based on this, by obtaining query requests carrying query types, user data under that type can be determined subsequently.

[0150] S220. Generate public key data and private key data according to the query request, and send the public key data to the data query party.

[0151] Based on this, public key data and private key data are generated, and the public key data is sent to the data query party so that the data query party can obtain the first encrypted identifier data based on the public key data, and the data storage party can obtain the second encrypted identifier data based on the private key data.

[0152] S230. Determine the target object to be queried based on the query type.

[0153] The target object to be queried is the storage object under this query type. The data storage provider determines the storage object of this type as the target object to be queried based on the query type.

[0154] Based on this, by identifying the target object to be queried, a second encrypted identifier is generated based on the identifier data of the target object to be queried. This allows the data querying party to identify the target object shared by both parties by comparing the first encrypted identifier data and the second encrypted identifier data.

[0155] S240. Based on the private key data and the identifier data of the target object to be queried, generate second encrypted identifier data and send it to the data querying party.

[0156] Based on this, by determining the second encrypted identifier data and sending it to the data query party, the data query party can compare the first encrypted identifier data and the second encrypted identifier data, and determine the target query object corresponding to the second encrypted identifier data that matches the first encrypted identifier data as the query object that the data query party needs to query, so that the query data corresponding to the query object can be transmitted subsequently. S250, Determine the second data key according to the signature verification request sent by the data query party.

[0157] The second data key is used by the data storage provider to encrypt the query data of the object to be queried, thereby ensuring the data security of the query data during transmission.

[0158] Based on this, a second data key is determined through the signature verification request sent by the data querying party, so that the query data can be encrypted subsequently using the second data key. S260: The query data corresponding to the signature verification request is encrypted using the second data key to obtain the target query data.

[0159] Based on this, the query data is encrypted using a second data key to obtain the target query data, so that customer information is not stolen during transmission.

[0160] S270. Based on the data transmission request sent by the data query party, send the target query data to the data query party.

[0161] Based on this, the encrypted target query data is sent to the data query party according to the data transmission request.

[0162] Based on the above embodiments, this application further provides a feasible implementation of S240, specifically,

[0163] Based on the private key data and the identifier data of the target object to be queried, a second encrypted identifier data is generated and sent to the data querying party, including:

[0164] Hash the identifier data of the target query object to obtain the hash value of the identifier data of the target query object;

[0165] The hash value of the identifier data is encrypted using the private key data to obtain the second encrypted identifier data, which is then sent to the data query party.

[0166] Based on this, the identifier data is hashed using a hash function and encrypted using the private key data to obtain the second encrypted identifier data, which is then sent to the data query party so that the data query party can compare the first encrypted identifier data and the second encrypted identifier data.

[0167] Based on the above embodiments, this application further provides a feasible implementation of S250, specifically,

[0168] Based on the signature verification request sent by the data querying party, the second data key is determined, including:

[0169] Obtain the signature verification request sent by the data query party;

[0170] Based on the signature verification request and digital signature algorithm, a second data signature is generated and sent to the data query party;

[0171] Obtain the key confirmation request sent by the data query party, and send key confirmation permission to the data query party;

[0172] The second data key is generated according to the DH key exchange algorithm.

[0173] Based on this, the data storage provider obtains a key determination request and sends the key determination permission to the data query provider. The provider then determines the transmission key according to the DH key exchange algorithm to obtain the second data key, which is used to encrypt the query data in the future.

[0174] Figure 3 This diagram illustrates an application scenario for a shared data query method provided in an embodiment of this application. In such... Figure 3In the application scenario shown, organization B is the data query party, while organizations A and C are the data storage parties. Organization B locally filters key customers to define the scope of the query. Using the secure intersection component of the privacy computing platform, it matches its customer data with the data of other organizations A and C to identify shared customers, filtering out its unique customers to obtain a shared customer set. Through digital signature algorithms and the DH key exchange algorithm, all participants negotiate a common key without revealing the key itself. This key is used to encrypt sensitive information later. After obtaining the shared customer set, it can query information about these customers of organizations A and C through the provided interface. During the query process, the negotiated key is used to encrypt critical information, ensuring that customer information is not stolen during transmission. In this embodiment, the data storage provider generates public and private key data based on the query request sent by the data query provider, and sends the public key data to the data query provider. Based on the query type in the query request, it determines the target object to be queried for that type, and encrypts the identifier data of the target object to be queried using the private key data to obtain second encrypted data, which is then sent to the data query provider. Based on the signature verification request sent by the data query provider, it generates a second digital signature and sends it to the data query provider. Based on the key determination request sent by the data query provider, it sends a key determination permission to the data query provider and generates a second data key. This second data key is used to encrypt the query data to obtain the target encrypted data, which is then sent to the data query provider. This achieves the filtering of the shared customer set, effectively avoiding invalid customer queries and preventing the leakage of the provider's unique customer information. It protects the provider's unique customer information and improves query efficiency. Simultaneously, a communication key can be created for both parties under an insecure channel, which can be used by both parties to encrypt and decrypt messages, ensuring that data is not leaked during transmission.

[0175] Figure 4 This is a schematic diagram of the structure of a shared data query device 400 provided in an embodiment of this application, as shown below. Figure 4 As shown, the shared data query device 400 includes: a type determination module 410, a data acquisition module 420, a data encryption module 430, a data determination module 440, a key determination module 450, a request sending module 460, and a data decryption module 470.

[0176] Type determination module 410 is used to determine the object to be queried and the query type of the object to be queried.

[0177] The data acquisition module 420 is used to send a query request to the data storage provider and acquire the public key data and the second encrypted identifier data sent by the data storage provider. The query request carries the query type.

[0178] Data encryption module 430 is used to encrypt the identifier data of the object to be queried using public key data to obtain the first encrypted identifier data;

[0179] The data determination module 440 is used to determine that the object to be queried is the common data of the data query party and the data storage party if the first encrypted identifier data and the second encrypted identifier data are the same.

[0180] The key determination module 450 is used to determine the first data key based on the object to be queried;

[0181] The request sending module 460 is used to send a data transmission request to the data storage provider and obtain the target query data sent by the data storage provider. The target query data is the query data that the data storage provider has encrypted according to the second data key.

[0182] The data decryption module 470 is used to decrypt the target query data according to the first data key to obtain the query data.

[0183] In this embodiment of the application, the data encryption module 430 can also be specifically used for:

[0184] Determine a random number;

[0185] Calculate the hash of the identifier data of the object to be queried to obtain the initial identifier data hash value;

[0186] The hash value of the identifier data is determined based on the random number and the hash value of the initial identifier data;

[0187] The hash value of the identifier data is encrypted using the public key data to generate the public key encrypted identifier data hash value, which is then sent to the data storage provider.

[0188] Obtain the hash value of the identifier data after decrypting the private key sent by the data storage provider. The hash value of the identifier data after decrypting the private key is the data obtained by the data storage provider after decrypting the hash value of the identifier data encrypted with the public key based on the private key data.

[0189] Remove the random number from the hash value of the identifier data after decryption of the private key to obtain the first encrypted identifier data.

[0190] In this embodiment of the application, the key determination module 450 can also be specifically used for:

[0191] Based on the shared query object and the digital signature algorithm, generate the first data signature;

[0192] Send a signature verification request to the data storage provider and obtain the second data signature sent by the data storage provider;

[0193] Compare the first data signature and the second data signature;

[0194] If the first data signature and the second data signature match, a key confirmation request is sent to the data storage provider.

[0195] Obtain the key sent by the data storage provider to confirm permission;

[0196] The permission is determined based on the key, and the first data key is determined.

[0197] In this embodiment of the application, the key determination module 450 can also be specifically used for:

[0198] Determine the preset DH key exchange algorithm;

[0199] Based on the key, permission is determined, and a preset DH key exchange algorithm is used to generate the first data key.

[0200] Figure 5 A schematic diagram of another shared data query device 500 provided in this application embodiment is shown below. Figure 5 As shown, the shared data query device 500 includes: a request acquisition module 510, a data generation module 520, an object determination module 530, an identifier generation module 540, a key determination module 550, a data encryption module 560, and a data sending module 570.

[0201] The request retrieval module 510 is used to retrieve the query request sent by the data query party, and the query request carries the query type of the object to be queried;

[0202] The data generation module 520 is used to generate public key data and private key data according to the query request, and send the public key data to the data query party;

[0203] The object determination module 530 is used to determine the target object to be queried based on the query type;

[0204] The identifier generation module 540 is used to generate second encrypted identifier data based on the private key data and the identifier data of the target object to be queried, and send it to the data query party;

[0205] The key determination module 550 is used to determine the second data key based on the signature verification request sent by the data query party;

[0206] Data encryption module 560 is used to encrypt the query data corresponding to the signature verification request according to the second data key to obtain the target query data;

[0207] The data sending module 570 is used to send the target query data to the data query party according to the data transmission request sent by the data query party.

[0208] In this embodiment of the application, the identifier generation module 540 can also be specifically used for:

[0209] Hash the identifier data of the target query object to obtain the hash value of the identifier data of the target query object;

[0210] The hash value of the identifier data is encrypted using the private key data to obtain the second encrypted identifier data, which is then sent to the data query party.

[0211] In this embodiment of the application, the identifier generation module 540 can also be specifically used for:

[0212] Obtain the signature verification request sent by the data query party;

[0213] Based on the signature verification request and digital signature algorithm, a second data signature is generated and sent to the data query party;

[0214] Obtain the key confirmation request sent by the data query party, and send key confirmation permission to the data query party;

[0215] The second data key is generated according to the DH key exchange algorithm.

[0216] Figure 6 This is a schematic diagram of the device provided in an embodiment of this application. Figure 6 As shown, the device 600 includes:

[0217] The device 600 may include a processor 601 with one or more processing cores, a memory 602 with one or more computer-readable storage media, a communication component 603, and other components. The processor 601, memory 602, and communication component 603 are connected via a bus 604.

[0218] In the specific implementation process, at least one processor 601 executes computer execution instructions stored in memory 602, causing at least one processor 601 to execute the message processing method described above.

[0219] The specific implementation process of processor 601 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0220] In the above Figure 6In the illustrated embodiments, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in this application can be directly manifested as being executed by a hardware processor, or executed by a combination of hardware and software modules within the processor.

[0221] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device.

[0222] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0223] In some embodiments, a computer program product is also provided, including a computer program or instructions that, when executed by a processor, implement the steps in any of the above-described common data query methods.

[0224] For details on the implementation of each of the above operations, please refer to the previous examples, which will not be repeated here.

[0225] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be performed by instructions, or by instructions controlling related hardware. These instructions can be stored in a computer-readable storage medium and loaded and executed by a processor.

[0226] Therefore, embodiments of this application provide a computer-readable storage medium storing a plurality of computer-executable instructions, which can be loaded by a processor to execute the steps in any of the public data query methods provided in embodiments of this application.

[0227] The storage medium may include: read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0228] According to one aspect of this application, a computer program product or computer program is provided, the computer program product or computer program including computer instructions stored in a computer-readable storage medium.

[0229] Since the instructions stored in the storage medium can execute the steps in any of the public data query methods provided in the embodiments of this application, the beneficial effects that any of the public data query methods provided in the embodiments of this application can achieve can be realized. For details, please refer to the previous embodiments, which will not be repeated here.

[0230] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.

[0231] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A method for querying shared data, characterized in that, The method applied to a data query side comprises: determining a to-be-queried object and a query type of the to-be-queried object; sending a query request to a data storage side, and obtaining public key data and second encrypted identification data sent by the data storage side, the query request carrying the query type; encrypting identification data of the to-be-queried object by using the public key data to obtain first encrypted identification data; if the first encrypted identification data and the second encrypted identification data are the same, determining that the to-be-queried object is common data of the data query side and the data storage side; determining a first data key according to the to-be-queried object; sending a data transmission request to the data storage side, and obtaining target query data sent by the data storage side, the target query data being query data processed by the data storage side according to a second data key; decrypting the target query data according to the first data key to obtain the query data; the step of encrypting the identification data of the to-be-queried object by using the public key data to obtain the first encrypted identification data comprises: determining a random number; hashing the identification data of the to-be-queried object to obtain an initial identification data hash value; determining an identification data hash value according to the random number and the initial identification data hash value; encrypting the identification data hash value according to the public key data to generate the identification data hash value encrypted by the public key, and sending the identification data hash value to the data storage side; obtaining the identification data hash value decrypted by a private key sent by the data storage side, the identification data hash value decrypted by the private key being data obtained by the data storage side by decrypting the identification data hash value encrypted by the public key according to private key data; eliminating the random number in the identification data hash value decrypted by the private key to obtain the first encrypted identification data.

2. The method of claim 1, wherein, the step of determining the first data key according to the to-be-queried object comprises: generating a first data signature according to a common to-be-queried object and a digital signature algorithm; sending a signature verification request to the data storage side, and obtaining a second data signature sent by the data storage side; comparing the first data signature and the second data signature; if the first data signature and the second data signature are consistent, sending a key determination request to the data storage side; obtaining a key determination permission sent by the data storage side; determining the first data key according to the key determination permission.

3. The method of claim 2, wherein, the step of determining the first data key according to the key determination permission comprises: determining a preset DH key exchange algorithm; generating the first data key according to the key determination permission and the preset DH key exchange algorithm.

4. A data query method, characterized by, The method applied to a data storage side comprises: obtaining a query request sent by a data query side, the query request carrying a query type of a to-be-queried object; generating public key data and private key data according to the query request, and sending the public key data to the data query side; determining a target to-be-queried object according to the query type; According to the private key data, the identification data of the target object to be queried, second encrypted identification data is generated and sent to the data query party; According to the signature verification request sent by the data query party, a second data key is determined; According to the second data key, the query data corresponding to the signature verification request is encrypted to obtain target query data; According to the data transmission request sent by the data query party, the target query data is sent to the data query party; According to the private key data, the identification data of the target object to be queried, second encrypted identification data is generated and sent to the data query party, including: Hashing the identification data of the target object to be queried to obtain the identification data hash value of the target object to be queried; According to the private key data, the identification data hash value is encrypted to obtain the second encrypted identification data and send it to the data query party.

5. The method of claim 4, wherein, According to the signature verification request sent by the data query party, a second data key is determined, including: Obtain the signature verification request sent by the data query party; According to the signature verification request, a second data signature is generated and sent to the data query party according to the digital signature algorithm; Obtain the key determination request sent by the data query party, and send the key determination permission to the data query party; According to the DH key exchange algorithm, the second data key is generated.

6. A shared data query apparatus, characterized by comprising: Applied to the data query party, the device comprises: Type determination module, for determining the object to be queried and the query type of the object to be queried; Data acquisition module, for sending a query request to the data storage party, and obtaining the public key data and the second encrypted identification data sent by the data storage party, the query request carrying the query type; Data encryption module, for encrypting the identification data of the object to be queried using the public key data to obtain first encrypted identification data; Data determination module, for determining that the object to be queried is common data of the data query party and the data storage party if the first encrypted identification data and the second encrypted identification data are the same; Key determination module, for determining a first data key according to the object to be queried; Request sending module, for sending a data transmission request to the data storage party, and obtaining target query data sent by the data storage party, the target query data being query data encrypted by the data storage party according to a second data key; Data decryption module, for decrypting the target query data according to the first data key to obtain the query data; The data encryption module is specifically used for: Determining a random number; Hashing the identification data of the object to be queried to obtain an initial identification data hash value; According to the random number and the initial identification data hash value, an identification data hash value is determined; According to the public key data, the identification data hash value is encrypted to generate the identification data hash value encrypted by the public key, and sent to the data storage party; Obtain the identification data hash value after private key decryption sent by the data storage party, wherein the identification data hash value after private key decryption is obtained by the data storage party from the identification data hash value after public key encryption of the private key data. Eliminate the random number in the identification data hash value after private key decryption to obtain the first encrypted identification data.

7. A data query apparatus, characterized by comprising: The device is applied to a data storage party and includes: A request obtaining module, configured to obtain a query request sent by a data query party, wherein the query request carries a query type of an object to be queried; A data generating module, configured to generate public key data and private key data according to the query request and send the public key data to the data query party; An object determining module, configured to determine a target object to be queried according to the query type; An identification generating module, configured to generate second encrypted identification data according to the private key data and identification data of the target object to be queried and send the second encrypted identification data to the data query party; A key determining module, configured to determine a second data key according to a signature verification request sent by the data query party; A data encrypting module, configured to encrypt query data corresponding to the signature verification request according to the second data key to obtain target query data; A data sending module, configured to send the target query data to the data query party according to a data transmission request sent by the data query party. The identification generating module is specifically configured to hash the identification data of the target object to be queried to obtain an identification data hash value of the target object to be queried, encrypt the identification data hash value according to the private key data to obtain the second encrypted identification data, and send the second encrypted identification data to the data query party.

8. An electronic device, comprising: One or more processors; Memory; One or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs are configured to execute the method in any one of claims 1 to 5. The computer readable storage medium stores computer execution instructions, and the computer execution instructions can be called and executed by the processor to execute the method in any one of claims 1 to 5.

9. A computer-readable storage medium, characterized in that, ​

Images