Data query method and related equipment

Abstract

The invention provides a data query method and related equipment, which can be used in the field of data processing. The method comprises the following steps: acquiring a first identifier of target data requested to be queried by a query request, and acquiring a first session key between a query end and a data end; encrypting the first identifier by using the first session key to obtain a second identifier; in response to each piece of historical query data in a storage area of the query end including first data associated with the second identifier, outputting the first data as target data, the historical query data being used for indicating data corresponding to an encrypted data identifier acquired by a coordination end from a data end, and the data corresponding to the encrypted data identifier being used for indicating the coordination end; the encrypted data identifier is obtained by encrypting the identifier of the data by the query end based on the first session key. According to the method and the device, the advantages of high query data security of the query end and high data query efficiency of the query end are considered.

Description

Technical Field

[0001] The present application relates to the field of data processing, and in particular to a data query method and related equipment. Background Art

[0002] In the information sharing framework, multiple data terminals with data are connected to the coordination terminal for communication, and the query terminal obtains the required data from the data terminal through the coordination terminal.

[0003] In the exemplary technology, when the query end needs to obtain data, it initiates a query request to the coordination end. The coordination end obtains data from the data end based on the query request and returns it to the query end, completing the data query.

[0004] When the query end is in the process of acquiring data, the coordination end can determine the identifier of the query end from the query request, thereby inferring the application scenario in which the query end uses the data. The security of the query end's query data is low. Summary of the invention

[0005] The present application provides a data query method and related equipment, which solves the problem of low security of querying data at the query end.

[0006] In a first aspect, the present application provides a data query method, which is applied to a query end, and the data query method includes:

[0007] Obtaining a first identifier of target data requested by the query request, and obtaining a first session key between the query end and the data end;

[0008] Encrypting the first identifier using the first session key to obtain a second identifier;

[0009] In response to the first data associated with the second identifier included in each historical query data in the storage area of ​​the query end, the first data is output as the target data, wherein the historical query data is used to indicate the data corresponding to the encrypted data identifier obtained by the coordination end from the data end, and the encrypted data identifier is obtained by the query end encrypting the data identifier based on the first session key.

[0010] In some embodiments, after the first identification is encrypted using the first session key to obtain the second identification, the method further includes:

[0011] In response to the storage area not storing data associated with the second identifier, acquiring a second session key between the query end and the coordination end;

[0012] Encrypting the second identifier according to the second session key to obtain a third identifier, generating a first data acquisition request according to the third identifier, and sending the first data acquisition request to the coordination end;

[0013] Receive and output second data associated with the second identifier sent by the coordination end, and store the second identifier and the second data in the storage area.

[0014] In some embodiments, outputting the first data as target data includes:

[0015] Acquire a first valid parameter associated with the first data;

[0016] Generate a valid verification request for the first data according to the first valid parameter, and send the valid verification request to the coordination end;

[0017] Receiving a verification result fed back by the coordination end based on the valid verification request;

[0018] In response to the verification result indicating that the first data is within a validity period, the first data is output as target data.

[0019] In some embodiments, after receiving the verification result fed back by the coordination end based on the valid verification request, the method further includes:

[0020] In response to the verification result indicating that the first data is not within the validity period, obtaining a second session key between the query end and the coordination end;

[0021] Encrypting the second identifier according to the second session key to obtain a fourth identifier, generating a second data acquisition request according to the fourth identifier, and sending the second data acquisition request to the coordination end;

[0022] Receive third data associated with the second identifier and second valid parameters corresponding to the third data fed back by the coordination end;

[0023] The first data is replaced with the third data in the storage area, and the third data is output, and the second identifier, the third data and the second valid parameter are associated and stored in the storage area.

[0024] In some embodiments, the step of encrypting the first identifier using the first session key to obtain the second identifier includes:

[0025] Obtaining a salt value negotiated between the query end and the data end;

[0026] The first session key is used to encrypt the first identifier to which the salt value is added, so as to obtain the second identifier.

[0027] In some embodiments, obtaining the salt value negotiated between the query end and the data end includes:

[0028] Acquire a set value, and generate a negotiation request according to the first session key and the set value;

[0029] Based on the coordination end, sending the negotiation request to the data end;

[0030] Receiving a response message fed back by the data end based on the coordination end;

[0031] In response to the response message containing the consent information of the data end, the set value is stored as the salt value.

[0032] In some embodiments, the obtaining of the first session key between the query end and the data end includes:

[0033] Generate a plurality of first random numbers, and generate a first parameter according to each of the first random numbers;

[0034] Based on the coordination end, sending the first parameter and part of the first random number to the data end;

[0035] Based on the coordination end, receiving a second parameter sent by the data end, the second random number is generated by the data end, and the second parameter is determined by the data end based on the generated second random number and the part of the first random number;

[0036] Generate a first target value according to the first parameter and the second parameter, and obtain a second target value generated by the data end, where the second target value is generated by the data end based on the first parameter and the second parameter;

[0037] In response to the first target value matching the second target value, a first session key is generated based on the first target value and the second target value.

[0038] In some embodiments, the data query method further includes:

[0039] Receiving a data deletion instruction from the coordinating end;

[0040] Parsing the data deletion instruction to obtain a fifth identifier;

[0041] The fifth identifier and data associated with the fifth identifier are deleted in the storage area, where the data associated with the fifth identifier is used to indicate data updated by the data terminal.

[0042] In a second aspect, the present application provides a data query method, which is applied to a coordination end, and the data query method includes:

[0043] receiving a first data acquisition request sent by a query end, and parsing the first data acquisition request to obtain a third identifier, wherein the query end sends the first data acquisition request when the target data is not stored in the query end;

[0044] Acquire a second session key between the query end and the coordination end, and decrypt the third identifier according to the second session key to obtain a second identifier;

[0045] In response to the fact that each historical query data in the storage area of ​​the coordination end includes the second identifier associated data, the data associated with the second identifier is sent to the query end, and the historical query data is used to indicate the data corresponding to the encrypted data identifier obtained by the coordination end from the data end, and the encrypted data identifier is obtained by encrypting the data identifier by the query end.

[0046] In some embodiments, after decrypting the third identifier according to the second session key to obtain the second identifier, the method further includes:

[0047] In response to the storage area not storing the data associated with the second identifier, acquiring a third session key between the coordination end and the data end;

[0048] encrypting the second identifier according to the third session key to obtain a sixth identifier, and generating a third data acquisition request according to the sixth identifier;

[0049] Sending the third data acquisition request to the data end;

[0050] Receive the data associated with the second identifier fed back by the data end, and send the data associated with the second identifier to the query end.

[0051] In some embodiments, the data query method further includes:

[0052] Receiving a valid verification request sent by the query end, wherein the query end sends the valid verification request in the case where the query end stores the target data;

[0053] Parsing the valid verification request to obtain a first valid parameter;

[0054] Determining whether the first valid parameter is stored in the storage area to obtain a verification result, wherein the first valid parameter is stored in the storage area and the first data corresponding to the first valid parameter is within a validity period;

[0055] The verification result is sent to the query end.

[0056] In some embodiments, after sending the verification result to the query end, the method further includes:

[0057] receiving a second data acquisition request sent by the query end, wherein the verification result indicates that the storage area does not store the first valid parameter, and the query end sends the second data acquisition request;

[0058] Parsing the second data acquisition request to obtain a fourth identifier, and decrypting the fourth identifier according to the second session key to obtain a second identifier;

[0059] Acquire, in the storage area, third data associated with the second identifier and a second valid parameter corresponding to the third data;

[0060] The third data and the second valid parameter are sent to the query end.

[0061] In some embodiments, the data query method further includes:

[0062] receiving data update information sent by the data terminal, and parsing the data update information to obtain a fifth identifier and data associated with the fifth identifier;

[0063] Generate a third valid parameter associated with the fifth identifier, and generate a data deletion instruction according to the fifth identifier;

[0064] According to the third valid parameter and the data associated with the fifth identifier, the data in the storage area is updated, and the data deletion instruction is sent to the query end.

[0065] In a third aspect, the present application provides a data query method, which is applied to a data terminal, and the data query method includes:

[0066] receiving a third data acquisition request sent by the coordination end, and parsing the third data acquisition request to obtain a sixth identifier, wherein the coordination end does not store the data required to be queried by the query end, and the coordination end sends the third data acquisition request to the data end;

[0067] Acquire a third session key between the coordination end and the data end, and decrypt the sixth identifier according to the third session key to obtain a second identifier, where the second identifier is generated by the query end;

[0068] Acquire a first session key between the data end and the query end, and use the first session key to decrypt the second identifier to obtain a first identifier of the query data required by the query end;

[0069] The target data associated with the first identifier is acquired, and the second identifier and the target data are sent to the coordination end, so that the coordination end sends the second identifier and the target data to the query end.

[0070] In some embodiments, the obtaining a first session key between the data end and the query end includes:

[0071] receiving a plurality of first random numbers and a first parameter sent by the coordinating end, wherein the plurality of first random numbers are first random numbers of part of the first random numbers generated by the querying end, and the first parameter is generated by the querying end based on all the first random numbers;

[0072] Generate a second random number, and generate a second parameter according to the plurality of first random numbers and the second random number;

[0073] Sending the second parameter to the query end based on the coordination end, and obtaining a first target value generated by the query end based on the first parameter and the second parameter;

[0074] generating a second target value according to the first parameter and the second parameter;

[0075] In response to the first target value matching the second target value, a first session key between the query end and the data end is generated according to the first target value and the second target value, wherein the second identifier is encrypted by the query end based on the first session key.

[0076] In some embodiments, the using the first session key to decrypt the second identifier to obtain the first identifier of the query data required by the query end includes:

[0077] Obtaining a salt value negotiated between the data end and the query end;

[0078] Decrypting the second identifier using the first session key to obtain an intermediate identifier;

[0079] The salt value is removed from the intermediate identifier to obtain the first identifier of the query data required by the query end.

[0080] In some embodiments, the obtaining the salt value negotiated between the data end and the query end includes:

[0081] Receiving a negotiation request sent by the coordinating end, and parsing the negotiation request to obtain a set value and a target session key, wherein the negotiation request is generated by the querying end based on the first session key and the set value;

[0082] In response to the target session key being the first session key, generating consent information according to the set value;

[0083] The consent information is sent to the query end in the form of the response message through the coordination end, and the set value is stored as the salt value.

[0084] In some embodiments, the data query method further includes:

[0085] In response to the data associated with the fifth identifier being updated, generating data update information according to the fifth identifier and the updated data;

[0086] The data update information is sent to the coordination end.

[0087] In a fourth aspect, the present application provides a query end, including:

[0088] A first acquisition module, used to acquire a first identifier of target data requested by the query request, and to acquire a first session key between the query end and the data end;

[0089] an encryption module, configured to encrypt the first identifier by using the first session key to obtain a second identifier;

[0090] An output module is used to respond to the first data associated with the second identifier in each historical query data in the storage area of ​​the query end, and output the first data as target data, wherein the historical query data is used to indicate the data corresponding to the encrypted data identifier obtained by the coordination end from the data end, and the encrypted data identifier is obtained by the query end encrypting the data identifier based on the first session key.

[0091] In a fifth aspect, the present application provides a coordination terminal, including:

[0092] A first receiving module is used to receive a first data acquisition request sent by a query end, and parse the first data acquisition request to obtain a third identifier, wherein the query end sends the first data acquisition request when the target data is not stored in the query end;

[0093] A second acquisition module, used for acquiring a second session key between the query end and the coordination end, and decrypting the third identifier according to the second session key to obtain a second identifier;

[0094] A sending module is used to respond to each historical query data in the storage area of ​​the coordination end, which includes the second identifier associated data, and send the data associated with the second identifier to the query end, wherein the historical query data is used to indicate the data corresponding to the encrypted data identifier obtained by the coordination end from the data end, and the encrypted data identifier is obtained by encrypting the data identifier by the query end.

[0095] In a sixth aspect, the present application provides a data terminal, including:

[0096] A second receiving module is used to receive a third data acquisition request sent by the coordination end, and parse the third data acquisition request to obtain a sixth identifier, wherein the coordination end does not store the data required to be queried by the query end, and the coordination end sends the third data acquisition request to the data end;

[0097] a third acquisition module, configured to acquire a third session key between the coordination end and the data end, and decrypt the sixth identifier according to the third session key to obtain a second identifier, where the second identifier is generated by the query end;

[0098] a fourth acquisition module, configured to acquire a first session key between the data end and the query end, and use the first session key to decrypt the second identifier to obtain a first identifier of the query data required by the query end;

[0099] The fifth acquisition module is used to acquire the target data associated with the first identifier, and send the second identifier and the target data to the coordination end, so that the coordination end sends the second identifier and the target data to the query end.

[0100] In a seventh aspect, the present application provides an electronic device, comprising: a processor, and a memory and a communication interface communicatively connected to the processor;

[0101] The communication interface is used to communicate with other communication devices;

[0102] The memory is used to store computer-executable instructions;

[0103] The processor is used to execute the computer-executable instructions stored in the memory to implement the data query method provided in the first aspect.

[0104] In an eighth aspect, the present application provides a computer-readable storage medium, which stores computer execution instructions. When the computer execution instructions are executed by a processor, the data query method provided in the first aspect, the second aspect or the third aspect is implemented.

[0105] In a ninth aspect, the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the data query method provided in the first aspect, the second aspect, or the third aspect.

[0106] The data query method and related equipment provided by the present application, when the query end needs to query data, the session key between the query end and the data end is used to encrypt the first identifier of the data to be queried to obtain the second identifier, and then obtain the target data associated with the second identifier from each historical query data in the storage area, and the historical query data is the data associated with the encrypted data identifier obtained by the coordination end from the data end, and the encrypted data identifier is obtained by the query end using the session key encryption, so that the coordination end cannot know the identifier of the data required by the query end, thereby improving the security of the query data of the query end. In addition, the query end obtains the required query data from the historical query data in its own storage area, without having to obtain data from the data end through the coordination end, which reduces the data query time and takes into account the advantages of high query data security of the query end and high data query efficiency of the query end. BRIEF DESCRIPTION OF THE DRAWINGS

[0107] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0108] Figure 1 The following is a schematic diagram of the steps of the data query method provided in the query end embodiment of the present application. Figure 1 ;

[0109] Figure 2 The following is a schematic diagram of the steps of the data query method provided in the query end embodiment of the present application. Figure 2 ;

[0110] Figure 3 The interactive process involved in the embodiment of this application Figure 1 ;

[0111] Figure 4 The interactive process involved in the embodiment of this application Figure 2 ;

[0112] Figure 5 The following is a schematic diagram of the steps of the data query method provided in the query end embodiment of the present application. Figure 3 ;

[0113] Figure 6 The following is a schematic diagram of the steps of the data query method provided in the query end embodiment of the present application. Figure 4 ;

[0114] Figure 7 The following is a schematic diagram of the steps of the data query method provided in the query end embodiment of the present application. Figure 5 ;

[0115] Figure 8 The interactive process involved in the embodiment of this application Figure 3 ;

[0116] Fig. 9 The following is a schematic diagram of the steps of the data query method provided in the query end embodiment of the present application. Figure 6 ;

[0117] Fig.10 The interactive process involved in the embodiment of this application Figure 4 ;

[0118] Fig.11 The following is a schematic diagram of the steps of the data query method provided in the coordination end embodiment of this application. Figure 1 ;

[0119] Fig.12 The following is a schematic diagram of the steps of the data query method provided in the data end embodiment of this application. Figure 1 ;

[0120] Fig.13 A schematic diagram of a program module of a query terminal provided in an embodiment of the present application;

[0121] Fig.14 A schematic diagram of a program module of a coordination terminal provided in an embodiment of the present application;

[0122] Fig.15 A schematic diagram of a program module of a data terminal provided in an embodiment of the present application;

[0123] Fig.16 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application.

[0124] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0125] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application. In addition, although the disclosure in the present application is introduced according to one or several exemplary examples, it should be understood that each aspect of these disclosures can also constitute a complete implementation method separately.

[0126] It should be noted that the brief description of terms in this application is only for the convenience of understanding the embodiments described below, and is not intended to limit the embodiments of this application. Unless otherwise specified, these terms should be understood according to their common and usual meanings.

[0127] In addition, the terms "include" and "have" and any variations thereof are intended to cover but not exclude inclusion, for example, a product or device comprising a list of components is not necessarily limited to those components expressly listed but may include other components not expressly listed or inherent to such products or devices.

[0128] The term "module" used in the embodiments of the present application refers to any known or later developed hardware, software, firmware, artificial intelligence, fuzzy logic, or a combination of hardware and / or software code that can perform the functions associated with the element.

[0129] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0130] In the information sharing framework, multiple data terminals with data are connected to the coordination terminal for communication, and the query terminal obtains the required data from the data terminal through the coordination terminal.

[0131] In the exemplary technology, when the query end needs to obtain data, it initiates a query request to the coordination end. The coordination end obtains data from the data end based on the query request and returns it to the query end, completing the data query.

[0132] The inventor of this application has found that in some private scenarios such as credit risk, the query end needs to protect the identifier of the required query data. For example, when querying the number of Zhang San's financial cards, credit rating, etc., Zhang San is the identifier. When the query end is acquiring data, the coordination end can determine the identifier that the query end needs to query from the query request, thereby deriving the application scenario in which the query end uses the data, and the query end has low security in querying data.

[0133] In addition, the coordination end is connected to multiple data ends in communication. When performing data query, the coordination end obtains data from multiple data ends, summarizes the data to obtain data results, and then feeds the data results back to the query end. This query method results in a long data query process and a large amount of calculation, which makes the data query time too long and the data query efficiency low.

[0134] In addition, during the data query process, since multiple data terminals are involved in data calculation, when network fluctuations or reduced computing efficiency occur at a certain data terminal, the efficiency of querying data will also be reduced.

[0135] The inventor of the present application therefore thought that when the query end needs to query data, the session key between the query end and the data end is used to encrypt the first identifier of the data to be queried to obtain the second identifier, and then obtain the target data associated with the second identifier from each historical query data in the storage area. The historical query data is the data associated with the encrypted data identifier obtained by the coordination end from the data end. The encrypted data identifier is obtained by the query end using the session key encryption, so that the coordination end cannot know the identifier of the data required by the query end, thereby improving the security of the query data of the query end. In addition, the query end obtains the required query data from the historical query data in its own storage area, without having to obtain data from the data end through the coordination end, which reduces the data query time and takes into account the advantages of high query data security of the query end and high data query efficiency of the query end.

[0136] The technical solutions shown in the present application are described in detail below through embodiments. It should be noted that the following embodiments can exist independently or in combination with each other, and the same or similar contents will not be described repeatedly in different embodiments.

[0137] Reference Figure 1 , Figure 1 The following is a flow chart of a data query method applied to a query end provided in an embodiment of the present application. Figure 1 , data query methods include:

[0138] Step S101, obtaining a first identifier of target data requested by a query request, and obtaining a first session key between a query end and a data end.

[0139] In this embodiment, the execution subject is the query end, which can be a terminal loaded with a query, such as a user's mobile phone, computer or tablet; the query end can also be a client with a query function.

[0140] In some risk application scenarios, users can query data through the query terminal. Risk application scenarios include transaction scenarios and credit risk scenarios. Transaction scenarios refer to scenarios where two parties conduct transactions. At this time, the user party can query the merchant party's historical transaction information to determine the merchant party's score in historical transactions; credit risk scenarios can be to review the user of resource replacement, that is, to query whether the user's credit score is less than the threshold. If the credit score is less than the threshold, the risk of recovering the money after the user performs resource replacement is greater.

[0141] The user can initiate a query request at the query end. The query request contains the identifier of the target data to be queried, which is defined as the first identifier. Exemplarily, the user needs to query the risk data of Zhang XX, Zhang XX is the first identifier, and the risk data of Zhang XX is the target data. Furthermore, the identifier of the target data can be desensitized to obtain the first identifier. Exemplarily, the identifier of the target data can be a mobile phone number. The digits in the middle part of the mobile phone number are replaced with "*", and the first three digits and the last four digits of the mobile phone number are kept unchanged to obtain the first identifier.

[0142] In order to prevent the coordination end from obtaining the first identifier of the query data required by the query end, the query end and the data end negotiate a session key, which is defined as a first session key. Exemplarily, the query end can exchange data with the data end to determine the first session key between the query end and the data end.

[0143] Step S102: Use the first session key to encrypt the first identifier to obtain the second identifier.

[0144] After obtaining the first session key, the device encrypts the first identifier using the first session key to obtain the second identifier, which is the encrypted data identifier. Exemplarily, the first session key is a symmetric key that can be used for data encryption and decryption.

[0145] Step S103, in response to each historical query data in the storage area of ​​the query end, including the first data associated with the second identifier, the first data is output as the target data, wherein the historical query data is used to indicate the data corresponding to the encrypted data identifier obtained by the coordination end from the data end, and the encrypted data identifier is obtained by encrypting the data identifier by the query end based on the first session key.

[0146] In this embodiment, the query end is configured with a storage area, which is a secure storage area that can only be accessed by the query end and not allowed to be accessed by external devices. The storage area stores multiple historical query data, and each historical query data is associated with a corresponding encrypted data identifier. The storage area can be a data cache area configured by the query end.

[0147] Exemplarily, the query end encrypts the identifier of the data to be queried to obtain an encrypted data identifier, the query end sends the encrypted data identifier to the coordination end, the coordination end sends the encrypted data identifier to the data end, the data end decrypts the encrypted data identifier to obtain the identifier of the data, and queries the data associated with the identifier of the data, the data end sends the queried data and the encrypted data identifier to the coordination end, the coordination end sends the queried data and the encrypted data identifier to the query end, the query end stores the queried data as historical query data, and associates the historical query data with the encrypted data identifier and stores it in a storage area.

[0148] The query end queries whether there is data associated with the second identifier in the storage area, that is, determines whether each historical query data in the storage area contains the first data associated with the second identifier. If each historical query data contains the first data, it can be determined that the data queried by the query end this time is cached data. There is no need to obtain data from the coordination end and the data end. The query end outputs the first data as the target data, thereby completing the data query.

[0149] In this embodiment, when the query end needs to query data, the session key between the query end and the data end is used to encrypt the first identifier of the data to be queried to obtain the second identifier, and then the target data associated with the second identifier is obtained from each historical query data in the storage area. The historical query data is the data associated with the encrypted data identifier obtained by the coordination end from the data end. The encrypted data identifier is obtained by the query end using the session key encryption, so that the coordination end cannot know the identifier of the data required by the query end, thereby improving the security of the query data of the query end. In addition, the query end obtains the required query data from the historical query data in its own storage area, without having to obtain data from the data end through the coordination end, thereby reducing the data query time and taking into account the advantages of high query data security of the query end and high data query efficiency of the query end.

[0150] Reference Figure 2 , Figure 2 The process diagram of the data query method of the query end of this application is as follows Figure 2 ,based on Figure 1 In the embodiment shown, after step S102, the following steps are further included:

[0151] Step S201: in response to the storage area not storing data associated with the second identifier, obtaining a second session key between the query end and the coordination end.

[0152] Step S202: encrypt the second identifier according to the second session key to obtain a third identifier, generate a first data acquisition request according to the third identifier, and send the first data acquisition request to the coordination end.

[0153] In this embodiment, when the storage area of ​​the query end does not store the data associated with the second identifier, the query end may acquire the data through the coordination end.

[0154] Exemplarily, a session key is negotiated between the query end and the coordination end, and the session key is defined as the second session key S2. The query end encrypts the second identifier based on the second session key to obtain a third identifier. For example, the third identifier = encrypted ID + SID, the encrypted ID is the second identifier, and the SID is S2, that is, the second identifier and the second session key are concatenated to obtain the third identifier.

[0155] It should be noted that the session key negotiated between the query end and the coordination end may be sent by the coordination end, that is, the coordination end sets a session key. For example, the coordination end may encrypt its own device identifier to obtain a session key, and the coordination end determines it as the second session key, and then sends the second session key to the query end, and the query end saves the second session key. In addition, the query end may set a session key, determine it as the second session key, and then send the second session key to the coordination end, and the coordination end saves the second session key.

[0156] After obtaining the third identifier, the query end generates a data acquisition request based on the third identifier, the data acquisition request is defined as a first data acquisition request, and the first data acquisition request is used to acquire data associated with the second identifier. The query end sends the first data acquisition request to the coordination end.

[0157] Step S203: receiving and outputting second data associated with the second identifier sent by the coordination end, and storing the second identifier and the second data in a storage area.

[0158] The storage area of ​​the coordination end stores a plurality of historical query data, and each historical query data is stored in association with an encrypted data identifier.

[0159] Exemplarily, the query end encrypts the identifier of the data to be queried to obtain an encrypted data identifier, encrypts the encrypted data identifier based on the second session key to obtain a secondary encrypted data identifier 1, and sends the secondary encrypted data identifier 1 to the coordination end.

[0160] The coordination end decrypts the secondary encrypted data identifier 1 based on the second session key to obtain the encrypted data identifier, and then uses the third session key between the coordination end and the data end to encrypt the encrypted data identifier to obtain the secondary encrypted data identifier 2. The coordination end sends the secondary encrypted data identifier 2 to the data end;

[0161] The data end decrypts the secondary encrypted data identifier 2 based on the third session key to obtain the encrypted data identifier, and then uses the first session key to decrypt the encrypted data identifier to obtain the target identifier of the data that the query end needs to query, and obtains the data associated with the target identifier. The data end then sends the data associated with the target identifier and the encrypted data identifier to the coordination end;

[0162] The coordination end stores the data associated with the target identifier as historical query data, and associates the historical query data with the target identifier in the storage area.

[0163] In one example, when each historical query data in the storage area of ​​the coordination end includes the second data associated with the second identifier, it can be determined that the data currently queried by the query end is previously queried, and the coordination end sends the second data associated with the second identifier to the query end, and the query end receives and outputs the second data associated with the second identifier sent by the coordination end, and stores the second identifier and the second data in the storage area of ​​the query end. Specifically, refer to Figure 3 As shown in the interaction diagram, the process of the query end obtaining the data associated with the second identifier is as follows:

[0164] 301. The query end obtains a first identifier of the data to be queried;

[0165] 302. The query end uses the first session key S1 to encrypt the first identifier to obtain a second identifier;

[0166] 303. The query end detects whether its own storage area stores data associated with the second identifier;

[0167] 304. When the storage area does not store data associated with the second identifier, the query end uses the second session key S2 to encrypt the second identifier to obtain a third identifier;

[0168] 305. The query end sends a first data acquisition request to the coordination end, where the first data acquisition request carries a third identifier;

[0169] 306. The coordinating end uses the second session key S2 to decrypt the third identifier to obtain the second identifier.

[0170] 307. The coordination end obtains data associated with the second identifier;

[0171] 308. The coordination end sends the data associated with the second identifier to the data end.

[0172] In another example, when the data associated with the second identifier is not stored in the storage area, the coordination end encrypts the second identifier based on the third session key S3 between the coordination end and the data end to obtain a sixth identifier; the coordination end generates a third data acquisition request based on the sixth identifier, and then sends the third data acquisition request to the data end; the data end decrypts the sixth identifier based on the third session key S3 to obtain the second identifier, and the data end then decrypts the second identifier using the first session key S1 to obtain the first identifier; the data end sends the data M associated with the first identifier to the coordination end, and the coordination end stores the second identifier and the data M in association in the storage area, and then sends the data to the query end, the query end stores the data M in association with the second identifier, and the query end then outputs the data M.

[0173] It should be noted that the session key negotiated between the data terminal and the coordination terminal may be sent by the coordination terminal, that is, the coordination terminal sets a session key, determines it as the third session key, and then sends the third session key to the data terminal, and the data terminal saves the third session key. In addition, the data terminal may set a session key, determine it as the third session key, and then send the third session key to the coordination terminal, and the coordination terminal saves the third session key. The second session key is different from the third session key.

[0174] Specifically, refer to Figure 4 As shown in the interaction diagram, the process of the query end obtaining the data associated with the second identifier is as follows:

[0175] 401. The query end obtains the first identifier of the data to be queried;

[0176] 402. The query end uses the first session key S1 to encrypt the first identifier to obtain a second identifier;

[0177] 403. The query end detects whether its own storage area stores data associated with the second identifier;

[0178] 404. When the storage area does not store data associated with the second identifier, the query end encrypts the second identifier using the second session key S2 to obtain a third identifier;

[0179] 405. The query end sends a first data acquisition request to the coordination end, where the first data acquisition request carries a third identifier;

[0180] 406. The coordinating end uses the second session key S2 to decrypt the third identifier to obtain the second identifier.

[0181] 407. The storage area of ​​the coordination end does not store data associated with the second identifier, and the second identifier is encrypted using the third session key S3 to obtain a sixth identifier;

[0182] 408. The coordination end sends the third data acquisition request (carrying the sixth identifier) ​​to the data end;

[0183] 409. The data end uses the third session key S3 to decrypt the sixth identifier to obtain the second identifier.

[0184] 410. The data end uses a session key S1 to decrypt the sixth identifier to obtain the first identifier;

[0185] 411. The data end sends the data N associated with the first identifier to the coordination end;

[0186] 412. The coordination end associates the data N with the second identifier and stores it in the storage area;

[0187] 413. The coordinating end sends the data N to the querying end.

[0188] The coordination end sends the second data associated with the second identifier to the query end, and the query end outputs the second data and stores the second identifier and the second data in the storage area.

[0189] In this embodiment, when the storage area of ​​the query end does not store the data associated with the second identifier, the data associated with the second identifier is obtained through the coordination end to ensure that the query end can query the data and ensure the data query effect of the query end.

[0190] Reference Figure 5 , Figure 5 The process diagram of the data query method of the query end of this application is as follows Figure 3 ,based on Figure 1 or Figure 2 In the illustrated embodiment, step S103 includes:

[0191] Step S501: Acquire a first valid parameter associated with first data.

[0192] In this embodiment, the structure of the historical query data cached in the storage area of ​​the query end is as follows:

[0193]

[0194] Among them, the encrypted identifier refers to the identifier obtained by encrypting the data identifier by the query end using the first session key, the query business data refers to the historical query data, the row data identifier refers to the identifier of the row data of the query business data, the query business scenario identifier refers to the scenario identifier of the query business, and the valid parameters are generated by the coordination end, and the valid parameters are used by the coordination end to verify whether the historical query data is valid.

[0195] Exemplarily, the data structure of the cached data in the storage area of ​​the coordination end is consistent with the above table. The coordination end randomly generates a value and determines the target field based on the row data identifier, encryption identifier, query business scenario identifier, hit result, data end list identifier and value, that is, the row data identifier, encryption identifier, query business scenario identifier, hit result, data end list identifier and value are concatenated to obtain the target field. The coordination end calculates the hash value of the target field and uses the hash value as a valid parameter. When the query end obtains data from the coordination end again, the coordination end sends the data and the corresponding valid parameters to the query end, so that the query end stores the valid parameters, data and encryption identifier in association in the storage area.

[0196] After the data end updates the data, it will notify the coordination end to synchronize the corresponding data. The coordination end generates corresponding valid parameters for the synchronized updated data and replaces the valid parameters associated with the synchronized updated data with the regenerated valid parameters. However, the coordination end may not immediately send the synchronized updated data and the regenerated valid parameters to the query end, which means that the data obtained by the query end in its own storage area may be unupdated data.

[0197] In this regard, the query end obtains a valid parameter associated with the first data in the storage area, and the valid parameter is defined as a first valid parameter.

[0198] Step S502: Generate a valid verification request for the first data according to the first valid parameter, and send the valid verification request to the coordination end.

[0199] The query end generates a valid verification request for the first data based on the first valid parameter, and then sends the valid verification request to the coordination end. After receiving the valid verification request, the coordination end parses the valid verification request to obtain the first valid parameter, and determines whether the first valid parameter is stored in the storage area to obtain the verification result. Exemplarily, when the storage area of ​​the coordination end stores the first valid parameter, the verification result is that the first data is within the validity period; when the storage area of ​​the coordination end does not store the first valid parameter, it can be determined that the first data stored in the query end is not within the validity period, that is, the first data is invalid, and the verification result is that the first data is not within the validity period, or the first data is invalid. The coordination end sends the verification result to the query end.

[0200] Step S503: receiving the verification result fed back by the coordination end based on the valid verification request.

[0201] Step S504: in response to the verification result indicating that the first data is within the validity period, outputting the first data as target data.

[0202] The query end receives the verification result fed back by the coordination end based on the valid verification request, and if the verification result indicates that the first data is within the validity period, the first data is output as the target data.

[0203] When the verification result indicates that the first data is not within the validity period, it can be determined that the first data is invalid. The query end stores the first data, and the first data is transmitted from the coordination end to the query end, so the coordination end stores the updated first data. In this regard, the query end obtains the second session key between the coordination end and itself, encrypts the second identifier based on the second session key to obtain the fourth identifier, generates a second data acquisition request based on the fourth identifier, and then sends the second data acquisition request to the coordination end; the coordination end parses the second data acquisition request to obtain the fourth identifier, uses the second session key to decrypt the fourth identifier to obtain the second identifier, and then obtains the third data associated with the second identifier and the second valid parameter corresponding to the third data from the coordination end, and the coordination end sends the third data and the second valid parameter to the query end.

[0204] After receiving the third data and the second valid parameter feedback from the coordination end, the query end replaces the first data with the third data in the storage area, outputs the third data, and associates the second identifier, the third data and the second valid parameter and stores them in the storage area. After the second valid parameter is stored, the original first valid parameter is deleted.

[0205] In this embodiment, after the query end obtains the first data associated with the second identifier, the coordination end verifies the validity of the first data to ensure that the query end obtains the latest data.

[0206] Reference Figure 6 , Figure 6 The process diagram of the data query method of the query end of this application is as follows Figure 4 ,based on Figure 1 , Figure 2 or Figure 5 In the illustrated embodiment, step S102 includes:

[0207] Step S601, obtaining the salt value negotiated between the query end and the data end.

[0208] In this embodiment, for further encryption, the identifier is encrypted by a salt value negotiated between the query end and the data end. The salt value refers to a parameter field negotiated between the query end and the data end for encryption. The salt value negotiated between the query end and the data end means that both the query end and the data end recognize the salt value, and both ends encrypt with the salt value.

[0209] Exemplarily, the query end obtains a set value, which can be an arbitrary value. The query end generates a negotiation request based on the first session key and the set value, and sends the negotiation request to the coordination end, which sends the negotiation request to the data end, that is, the query end sends the negotiation request to the data end based on the coordination end. The data end parses the negotiation request to obtain the session key and negotiation request sent by the query end. If the sent session key is the first session key between the data end and the query end, the data end agrees to use the set value as a salt value and stores the salt value, and the data end sends the consent information to the coordination end in the form of a response message, and the coordination end sends the response message to the query end. After the query end receives the response message of the feedback of the play segment, if the response message contains the consent information of the data end, the set value is stored as the salt value.

[0210] The query end obtains the salt value n negotiated by both ends, and adds the salt value n to the first identifier. The first identifier after adding the salt value is: salt value n+ID, where ID is the first identifier.

[0211] Step S602: Use the first session key to encrypt the first identifier with the salt value added to obtain a second identifier.

[0212] After obtaining the first identifier with the salt value added, the query end encrypts the first identifier with the salt value added to obtain the second identifier.

[0213] It should be noted that when a salt value is added to the second identifier, after the data end obtains the second identifier, it decrypts the second identifier using the first session key to obtain the first identifier with the added salt value, and then uses the salt value stored in itself to delete the salt value added in the first identifier to obtain the first identifier, and then uses the first identifier to obtain the data that the query end needs to query.

[0214] In addition, when the query end sends the first data acquisition request, the second identifier in the query end is obtained by encrypting the salt value + the first identifier.

[0215] In this embodiment, the query end increases the security of the identifier of the data that the query end needs to query by adding a salt value to the first identifier, thereby preventing the coordination end from obtaining the identifier of the data that the query end needs to query.

[0216] Reference Figure 7 , Figure 7 The process diagram of the data query method of the query end of this application is as follows Figure 5 ,based on Figure 1 , Figure 2 , Figure 5 or Figure 6 In the illustrated embodiment, step S101 includes:

[0217] Step S701: Generate multiple first random numbers, and generate a first parameter according to each of the first random numbers.

[0218] In this embodiment, the query end and the data end generate a first session key. Exemplarily, the data end generates a plurality of random numbers, each of which is defined as a first random number, and generates a first parameter based on each first random number.

[0219] For example, the device generates three first random numbers x, g, and p, then the first parameter M=g x mod p.

[0220] Step S702: Based on the coordination end, the first parameter and part of the first random number are sent to the data end.

[0221] The query end sends part of the first random number and the first parameter to the data end. For example, the query end sends two first random numbers g and p to the coordination end, and the coordination end sends g and p to the data end. The query end sends the first parameter M to the coordination end, and the coordination end sends M to the data end.

[0222] It should be noted that the query end sends a session key generation request to the data end through the coordination end, and the session key generation request carries a part of the first random number and the first parameter.

[0223] After the data end obtains part of the first random number and the first parameter, it generates a second random number, for example, a second random number y. The query end generates a second parameter based on part of the first random number and the second random number. Exemplarily, the data end receives the first random number g and the first random number p, then the second parameter N = g y mod p. The data end sends the second parameter N to the query end through the coordination end.

[0224] Step S703: Based on the coordination end, a second parameter sent by the data end is received, the second random number is generated by the data end, and the second parameter is determined by the data end based on the generated second random number and part of the first random number.

[0225] Step S704, generating a first target value according to the first parameter and the second parameter, and obtaining a second target value generated by the data end, where the second target value is generated by the data end based on the first parameter and the second parameter.

[0226] After the query end receives the second parameter sent by the data end based on the coordination end, the query end determines the target value through the first parameter and the second parameter, and the target value is defined as the first target value. For example, the first target value K1=N M mod p.

[0227] After obtaining the first target value, the query end obtains the second target value generated by the data end, and the second target value is generated by the data end based on the first parameter and the second parameter. Exemplarily, the query end stores a calculation formula for the target value, and the second target value generated by the data end can be derived by replacing the position of the independent variable in the calculation formula. Exemplarily, the second target value K2=M N mod p. Similarly, after the data end generates the second target value, the data end stores a calculation formula of the target value, and the first target value is obtained by replacing the position of the independent variable in the calculation formula.

[0228] Step S705 , in response to the first target value matching the second target value, generating a first session key according to the first target value and the second target value.

[0229] When the first target value is equal to the second target value, the first target value and the second target value are matched, a trust root exists between the data end and the query end, and both the data end and the query end generate a first session key through the first target value K1 and the second target value K2.

[0230] Reference Figure 8 The interactive diagram briefly describes the process of generating session keys on the query side and the data side, as follows:

[0231] 801. The query end generates random numbers x, g, and p;

[0232] 802. The query end generates a first parameter M based on x, g, and p;

[0233] 803. The query end sends g, p, and M to the coordination end;

[0234] 804. The coordinator sends g, p, and M to the data terminal.

[0235] 805. The data end generates a random number y;

[0236] 806. The data end generates a second parameter N through y, g, and p;

[0237] 807. The data end sends N to the coordination end;

[0238] 808. The coordinator sends N to the query end.

[0239] 809. The query end obtains K1 based on M, N and p;

[0240] 810. The data end obtains K2 based on M, N and p.

[0241] In this embodiment, during the process of generating session keys between the query end and the data end, the coordination end cannot obtain the first target value generated by the query end and the second target value generated by the data end, so that the coordination end cannot crack the first session key between the query end and the data end, thereby improving the privacy and security of the original data of the query end and the data end.

[0242] Reference Fig. 9 , Fig. 9 The process diagram of the data query method of the query end of this application is as follows Figure 6 ,based on Figure 1 , Figure 2 , Figure 5 , Figure 6 or Figure 7 In the embodiment shown, the data query method further includes:

[0243] Step S901: Receive a data deletion instruction from the coordination end.

[0244] In this embodiment, the query end deletes invalid data, which is not the latest data on the data end, and the query end deletes invalid data when the data end has updated the data.

[0245] Exemplarily, after the data end detects that the data associated with the fifth identifier is updated, it will first notify the coordination end to update the data associated with the fifth identifier. Specifically, after the data end completes the data update, since the identifier of the data before the update and the identifier of the data after the update are unchanged, the data end obtains the identifier of the data, and uses the first session key to encrypt the representation to obtain the fifth identifier. The data end generates data update information based on the fifth identifier and the updated data. The data end then sends the data update information to the coordination end.

[0246] Furthermore, the data end can query from the data query record whether the coordination end has obtained the data associated with the fifth identifier from the data end. If the coordination end has previously obtained the data associated with the fifth identifier from the data end, it can be determined that the data associated with the fifth identifier is stored in the coordination end, and the coordination end needs to update the data synchronously, and the data end sends the data update information to the coordination end. If the coordination end is not detected to have obtained the data associated with the fifth identifier, the coordination end does not store the data associated with the fifth identifier, and the data end does not need to send the data update information to the coordination end.

[0247] In addition, the coordination end initiates a query to the data end during an idle time period to query whether the historical query data in the storage area has been updated. Exemplarily, the coordination end sends the encrypted data identifiers of the historical query data in its own storage area to the data end to query whether the data associated with each encrypted data identifier has been updated in the data end. It is understandable that when the data end detects that the data associated with the fifth identifier has been updated and receives the query request sent by the coordination end, data update information is generated based on the fifth identifier and the updated data.

[0248] The coordination end receives the data update information from the data end, and parses the data update information to obtain the fifth identifier and the data associated with the fifth identifier. The data associated with the fifth identifier obtained through analysis has changed, so it is necessary to regenerate the third valid parameter associated with the fifth identifier, and the coordination end then generates a data deletion instruction based on the fifth identifier. The coordination end updates the data in the storage area based on the third valid parameter and the data associated with the fifth identifier. Exemplarily, the coordination end finds the original data and the original valid parameters associated with the fifth identifier in the storage area, replaces the original data with the data associated with the fifth identifier obtained through analysis, and replaces the original valid parameters with the third valid parameters, thereby completing the data update. The coordination end sends the data deletion instruction to the query end.

[0249] Step S902: parse the data deletion instruction to obtain a fifth identifier.

[0250] After receiving the data deletion instruction, the query end parses the data deletion instruction to obtain the fifth identifier.

[0251] Step S903: Delete the fifth identifier and the data associated with the fifth identifier in the storage area, where the data associated with the fifth identifier is used to indicate data updated by the data end.

[0252] After obtaining the fifth identifier, the query end deletes the fifth identifier and the data associated with the fifth identifier in the storage area of ​​the query end, and also needs to delete the valid parameters associated with the fifth identifier. It can be understood that the data associated with the fifth identifier stored in the query end refers to the data updated by the data end.

[0253] It should be noted that, for ease of description, steps S901 to S903 are placed after step S103, but data deletion at the query end can occur at any time, that is, steps S901 to S903 can be at any position in steps S101 to S103.

[0254] Reference Fig.10 , Fig.10 This is a schematic diagram of the interactive process involved in data update on the data side. The following is a brief description of the data update method, as follows:

[0255] 1001. The data end updates data Q0 to obtain Q1;

[0256] 1002. The data end sends data update information to the coordination end, where the data update information carries the encrypted data identifier G and Q1.

[0257] 1003. The coordinator generates a valid parameter A in the storage area based on Q1 and the encrypted data identifier G;

[0258] 1004. The coordinator replaces Q0 in the storage area with Q1, and replaces the valid parameter B associated with Q0 in the storage area with the valid parameter A;

[0259] 1005. The coordination end generates a data deletion instruction based on the encrypted data identifier G;

[0260] 1006. The coordination end sends a data deletion instruction to the query end;

[0261] 1007. The query end deletes Q0 and valid parameter B in the storage area.

[0262] In this embodiment, after the data end updates the data, it notifies the coordination end to synchronize and update the data, and the coordination end notifies the query end to delete the data, so as to prevent the query end from obtaining invalid query data in its own storage area.

[0263] Reference Fig.11 , Fig.11 This is a schematic diagram of the data query method of the coordination end of this application Figure 1 , data query methods include:

[0264] Step S1101, receiving a first data acquisition request sent by a query end, and parsing the first data acquisition request to obtain a third identifier, wherein the query end sends the first data acquisition request when the target data is not stored in the query end.

[0265] Step S1102: Acquire a second session key between the query end and the coordination end, and decrypt the third identifier according to the second session key to obtain the second identifier.

[0266] Step S1103, in response to each historical query data in the storage area of ​​the coordination end, which contains second identifier associated data, the data associated with the second identifier is sent to the query end, and the historical query data is used to indicate the data corresponding to the encrypted data identifier obtained by the coordination end from the data end, and the encrypted data identifier is obtained by encrypting the data identifier by the query end.

[0267] In this embodiment, the execution subject is the coordination end. When the query end does not find the data associated with the second identifier in its own storage area, it sends a first data acquisition request to the coordination end. The coordination end parses the first data acquisition request to obtain the third identifier, decrypts the third identifier based on the second session key to obtain the second identifier, and when the various historical query data in the storage area of ​​the coordination end contain the data associated with the second identifier, the data associated with the second identifier is sent to the query end.

[0268] The detailed description of the query end initiating the first data request, the process of the coordination end decrypting the third identifier, and the detailed description of obtaining the data associated with the second identifier are specifically referred to the embodiment of the query end side, and will not be repeated here.

[0269] In this embodiment, when the storage area of ​​the query end does not contain the data associated with the second identifier, the data associated with the second identifier is obtained from each historical query data in the storage area of ​​the coordination end. The historical query data is the data associated with the encrypted data identifier obtained by the coordination end from the data end. The encrypted data identifier is encrypted by the query end using a session key, so that the coordination end cannot know the identifier of the data required by the query end, thereby improving the security of the query data of the query end. In addition, the query end obtains the required query data from the historical query data in the storage area of ​​the coordination end, without having to obtain data from the data end through the coordination end, thereby reducing the data query time and taking into account the advantages of high query data security of the query end and high data query efficiency of the query end.

[0270] In one embodiment, after decrypting the third identifier according to the second session key to obtain the second identifier, the method further includes:

[0271] In response to the storage area not storing data associated with the second identifier, acquiring a third session key between the coordination end and the data end;

[0272] Encrypting the second identifier according to the third session key to obtain a sixth identifier, and generating a third data acquisition request according to the sixth identifier;

[0273] Sending a third data acquisition request to the data terminal;

[0274] The data associated with the second identifier fed back by the data end is received, and the data associated with the second identifier is sent to the query end.

[0275] In this embodiment, when the storage area of ​​the coordination end does not store the data associated with the second identifier, the data associated with the second identifier is obtained from the data end. The detailed process of the coordination end obtaining the data associated with the second identifier from the data end is specifically referred to the relevant description on the query end side and will not be repeated here.

[0276] In one embodiment, the data query method of the coordination end further includes:

[0277] Receiving a valid verification request sent by the query end, wherein the query end sends the valid verification request in the case where the query end stores the target data;

[0278] Parsing the valid verification request to obtain the first valid parameter;

[0279] Determine whether a first valid parameter is stored in the storage area to obtain a verification result, wherein the first valid parameter is stored in the storage area and the first data corresponding to the first valid parameter is within a validity period;

[0280] Send the verification result to the query end.

[0281] In this embodiment, the coordination end verifies the validity of the first data obtained by the query end to prevent the query end from obtaining invalid query data. The process of verifying the validity of the first data by the coordination end is specifically referred to the relevant description of the query end, which will not be repeated here.

[0282] In one embodiment, after sending the verification result to the query end, the method further includes:

[0283] receiving a second data acquisition request sent by the query end, wherein the verification result indicates that the storage area does not store the first valid parameter, and the query end sends the second data acquisition request;

[0284] Parsing the second data acquisition request to obtain a fourth identifier, and decrypting the fourth identifier according to the second session key to obtain a second identifier;

[0285] Acquire, in the storage area, third data associated with the second identifier and a second valid parameter corresponding to the third data;

[0286] The third data and the second valid parameter are sent to the query end.

[0287] In this embodiment, when the first data obtained by the query end is not within the validity period, the coordination end sends the valid data and the corresponding valid parameters to the query end to ensure that the query end obtains valid data. The detailed process of the coordination end sending the valid data and the corresponding valid parameters to the query end is specifically referred to the relevant description of the query end side, which will not be repeated here.

[0288] In one embodiment, the data query method on the coordination end side further includes:

[0289] receiving data update information sent by the data terminal, and parsing the data update information to obtain the fifth identifier and data associated with the fifth identifier;

[0290] Generate a third valid parameter associated with the fifth identifier, and generate a data deletion instruction according to the fifth identifier;

[0291] According to the data associated with the third valid parameter and the fifth identifier, the data in the storage area is updated, and a data deletion instruction is sent to the query end.

[0292] In this embodiment, when the data on the data end is updated, the data on the coordination end will also be updated synchronously, and the coordination end will notify the query end to delete the data to prevent the query end from obtaining invalid query data.

[0293] For the detailed process of data update on the coordination side, updated data, generation of valid parameters, and data deletion instructions, please refer to the relevant instructions on the query side and will not be repeated here.

[0294] Reference Fig.12 , Fig.12 This is a flowchart of the data query method of the data terminal of this application. Figure 1 , data query methods include:

[0295] Step S1201, receiving a third data acquisition request sent by the coordination end, and parsing the third data acquisition request to obtain a sixth identifier, wherein the coordination end does not store the data required to be queried by the query end, and the coordination end sends the third data acquisition request to the data end.

[0296] Step S1202, obtaining a third session key between the coordination end and the data end, and decrypting the sixth identifier according to the third session key to obtain a second identifier, where the second identifier is generated by the query end.

[0297] Step S1203, obtaining a first session key between the data end and the query end, and using the first session key to decrypt the second identifier to obtain the first identifier of the query data required by the query end.

[0298] Step S1204, obtaining the target data associated with the first identifier, and sending the second identifier and the target data to the coordination end, so that the coordination end sends the second identifier and the target data to the query end.

[0299] In this embodiment, the execution subject is the data end. If the data to be queried is not stored in the storage area of ​​the query end, and the data to be queried by the query end is not stored in the storage area of ​​the coordination end, the coordination end sends a third data acquisition request to the data end, and the data end obtains the sixth identifier based on the third data acquisition request, decrypts the third identifier using the third session key to obtain the second identifier, and then decrypts the second identifier using the first session key to obtain the first identifier, and sends the data associated with the first identifier to the coordination end, and the coordination end then sends the data associated with the first identifier to the query end to complete the data query of the query end.

[0300] The decryption of the sixth identifier, the decryption of the second identifier, and the acquisition of the data associated with the first identifier by the data end are specifically described in the embodiment of the query end side, and will not be repeated here.

[0301] In this embodiment, the data end sends the data required by the query end to the query end through the coordination end, ensuring that the query end obtains the required query data. In addition, since the coordination end obtains the second identifier encrypted by the query end, the coordination end cannot know the identifier of the data required by the query end, thereby improving the security of the query data of the query end.

[0302] In one embodiment, obtaining a first session key between a data end and a query end includes:

[0303] receiving a plurality of first random numbers and a first parameter sent by the coordinating end, where the plurality of first random numbers are some of the first random numbers generated by the querying end, and the first parameter is generated by the querying end based on all the first random numbers;

[0304] Generate a second random number, and generate a second parameter according to the plurality of first random numbers and the second random number;

[0305] Sending the second parameter to the query end based on the coordination end, and obtaining a first target value generated by the query end based on the first parameter and the second parameter;

[0306] Generate a second target value according to the first parameter and the second parameter;

[0307] In response to the first target value matching the second target value, a first session key between the query end and the data end is generated according to the first target value and the second target value, wherein the second identifier is encrypted by the query end based on the first session key.

[0308] In this embodiment, the process of generating the first session key in the data end is specifically described in the embodiment in the query end side, and will not be described in detail here.

[0309] In this embodiment, the data end and the query end jointly generate a first session key to exchange data through the first session key, thereby preventing the coordination end from obtaining private data and improving the security of data on the query end and the data end.

[0310] In one embodiment, the second identifier is decrypted using the first session key to obtain the first identifier of the query data required by the query end, including:

[0311] Get the salt value negotiated between the data end and the query end;

[0312] Decrypting the second identifier using the first session key to obtain an intermediate identifier;

[0313] The salt value is removed from the intermediate identifier to obtain the first identifier of the query data required by the query end.

[0314] In this embodiment, the data end decrypts the second identifier by using the salt value and the first session key. For the related description of the decryption, please refer to the description of the embodiment in the query end side, which will not be repeated here.

[0315] In this embodiment, the data end decrypts the second identifier using the salt value and the first session key, ensuring that the query end obtains accurate query data.

[0316] In one embodiment, obtaining a salt value negotiated between a data end and a query end includes:

[0317] Receiving a negotiation request sent by the coordinating end, and parsing the negotiation request to obtain a set value and a target session key, wherein the negotiation request is generated by the querying end based on the first session key and the set value;

[0318] In response to the target session key being the first session key, generating consent information according to a set value;

[0319] Through the coordination end, the consent information is sent to the query end in the form of a response message, and the set value is stored as a salt value.

[0320] In this embodiment, the process of negotiating the salt value between the data end and the query end is specifically referred to the relevant description of the embodiment on the query end side, and will not be repeated here.

[0321] In this embodiment, the data end negotiates the salt value with the query end to ensure that the salt value of the data end is the same as the salt value of the query end, thereby ensuring that the query end obtains accurate query data from the data end.

[0322] In one embodiment, the data query method of the data end further includes:

[0323] In response to the data associated with the fifth identifier being updated, generating data update information according to the fifth identifier and the updated data;

[0324] Send data update information to the coordinator.

[0325] In this embodiment, the data update process of the data end is specifically described with reference to the description of the embodiment on the query end side, and will not be described in detail here.

[0326] In this embodiment, after the data in the data end is updated, the coordination end is notified to synchronize the data, and the coordination end will notify the query end to delete the corresponding data to prevent the query end from obtaining invalid query data.

[0327] Based on the contents described in the above embodiments, a query terminal is also provided in the embodiments of the present application. Fig.13 , Fig.13 This is a schematic diagram of a program module of a query terminal provided in an embodiment of the present application. In some implementations, the query terminal 1300 includes:

[0328] A first acquisition module 1310 is used to acquire a first identifier of target data requested by the query request, and acquire a first session key between the query end and the data end;

[0329] The encryption module 1320 is used to encrypt the first identifier using the first session key to obtain the second identifier;

[0330] The output module 1330 is used to respond to the first data associated with the second identifier in each historical query data in the storage area of ​​the query end, and output the first data as the target data, wherein the historical query data is used to indicate the data corresponding to the encrypted data identifier obtained by the coordination end from the data end, and the encrypted data identifier is obtained by encrypting the data identifier by the query end based on the first session key.

[0331] In some embodiments, the query end 1300 is specifically used for:

[0332] In response to the storage area not storing data associated with the second identifier, acquiring a second session key between the query end and the coordination end;

[0333] Encrypting the second identifier according to the second session key to obtain a third identifier, generating a first data acquisition request according to the third identifier, and sending the first data acquisition request to the coordination end;

[0334] The second data associated with the second identifier sent by the coordination end is received and output, and the second identifier and the second data are stored in the storage area.

[0335] In some embodiments, the query end 1300 is specifically used for:

[0336] Obtaining a first valid parameter associated with a first data;

[0337] Generate a valid verification request for the first data according to the first valid parameter, and send the valid verification request to the coordination end;

[0338] Receive verification results fed back by the coordinator based on the valid verification request;

[0339] In response to the verification result indicating that the first data is within the validity period, the first data is output as the target data.

[0340] In some embodiments, the query end 1300 is specifically used for:

[0341] In response to the verification result indicating that the first data is not within the validity period, obtaining a second session key between the query end and the coordination end;

[0342] Encrypting the second identifier according to the second session key to obtain a fourth identifier, generating a second data acquisition request according to the fourth identifier, and sending the second data acquisition request to the coordination end;

[0343] Receive third data associated with the second identifier fed back by the coordination end and a second valid parameter corresponding to the third data;

[0344] The first data is replaced with the third data in the storage area, and the third data is output, and the second identifier, the third data and the second valid parameter are associated and stored in the storage area.

[0345] In some embodiments, the query end 1300 is specifically used for:

[0346] Get the salt value negotiated between the query end and the data end;

[0347] The first session key is used to encrypt the first identifier with the salt value added thereto to obtain a second identifier.

[0348] In some embodiments, the query end 1300 is specifically used for:

[0349] Acquire a set value, and generate a negotiation request according to the first session key and the set value;

[0350] Based on the coordination end, a negotiation request is sent to the data end;

[0351] Based on the response message fed back by the data end received by the coordination end;

[0352] In response to the consent information of the data end included in the response message, the set value is stored as the salt value.

[0353] In some embodiments, the query end 1300 is specifically used for:

[0354] Generate a plurality of first random numbers, and generate a first parameter according to each of the first random numbers;

[0355] Based on the coordination end, the first parameter and part of the first random number are sent to the data end;

[0356] Based on the coordination end, receiving a second parameter sent by the data end, the second random number is generated by the data end, and the second parameter is determined by the data end based on the generated second random number and part of the first random number;

[0357] Generate a first target value according to the first parameter and the second parameter, and obtain a second target value generated by the data end, where the second target value is generated by the data end based on the first parameter and the second parameter;

[0358] In response to the first target value matching the second target value, a first session key is generated based on the first target value and the second target value.

[0359] In some embodiments, the query end 1300 is specifically used for:

[0360] Receive data deletion instructions from the coordination end;

[0361] Parsing the data deletion instruction to obtain a fifth identifier;

[0362] The fifth identifier and data associated with the fifth identifier are deleted in the storage area, where the data associated with the fifth identifier is used to indicate data updated by the data end.

[0363] It should be noted that the various steps in the data query method executed by the query end refer to the above embodiment for details and will not be described in detail here.

[0364] Based on the contents described in the above embodiments, a coordination terminal is also provided in the embodiments of the present application. Fig.14 , Fig.14 This is a schematic diagram of a program module of a coordination terminal provided in an embodiment of the present application. In some implementations, the coordination terminal 1400 includes:

[0365] The first receiving module 1410 is used to receive a first data acquisition request sent by the query end, and parse the first data acquisition request to obtain a third identifier, wherein the query end sends the first data acquisition request when the target data is not stored in the query end;

[0366] The second acquisition module 1420 is used to acquire a second session key between the query end and the coordination end, and decrypt the third identifier according to the second session key to obtain the second identifier;

[0367] Sending module 1430 is used to respond to each historical query data in the storage area of ​​the coordination end, which contains second identifier associated data, and send the data associated with the second identifier to the query end. The historical query data is used to indicate the data corresponding to the encrypted data identifier obtained by the coordination end from the data end. The encrypted data identifier is obtained by encrypting the data identifier by the query end.

[0368] In some embodiments, the coordination end 1400 is specifically used for:

[0369] In response to the storage area not storing data associated with the second identifier, acquiring a third session key between the coordination end and the data end;

[0370] Encrypting the second identifier according to the third session key to obtain a sixth identifier, and generating a third data acquisition request according to the sixth identifier;

[0371] Sending a third data acquisition request to the data terminal;

[0372] The data associated with the second identifier fed back by the data end is received, and the data associated with the second identifier is sent to the query end.

[0373] In some embodiments, the coordination end 1400 is specifically used for:

[0374] Receiving a valid verification request sent by the query end, wherein the query end sends the valid verification request in the case where the query end stores the target data;

[0375] Parsing the valid verification request to obtain the first valid parameter;

[0376] Determine whether a first valid parameter is stored in the storage area to obtain a verification result, wherein the first valid parameter is stored in the storage area and the first data corresponding to the first valid parameter is within a validity period;

[0377] Send the verification result to the query end.

[0378] In some embodiments, the coordination end 1400 is specifically used for:

[0379] receiving a second data acquisition request sent by the query end, wherein the verification result indicates that the storage area does not store the first valid parameter, and the query end sends the second data acquisition request;

[0380] Parsing the second data acquisition request to obtain a fourth identifier, and decrypting the fourth identifier according to the second session key to obtain a second identifier;

[0381] Acquire, in the storage area, third data associated with the second identifier and a second valid parameter corresponding to the third data;

[0382] The third data and the second valid parameter are sent to the query end.

[0383] In some embodiments, the coordination end 1400 is specifically used for:

[0384] receiving data update information sent by the data terminal, and parsing the data update information to obtain the fifth identifier and data associated with the fifth identifier;

[0385] Generate a third valid parameter associated with the fifth identifier, and generate a data deletion instruction according to the fifth identifier;

[0386] According to the data associated with the third valid parameter and the fifth identifier, the data in the storage area is updated, and a data deletion instruction is sent to the query end.

[0387] It should be noted that the various steps in the data query method executed by the coordination end are specifically referred to the above embodiment, and will not be described in detail here.

[0388] Based on the contents described in the above embodiments, a data terminal is also provided in the embodiments of the present application. Fig.15 , Fig.15 This is a schematic diagram of a program module of a data terminal provided in an embodiment of the present application. In some implementations, the data terminal 1500 includes:

[0389] The second receiving module 1510 is used to receive a third data acquisition request sent by the coordination end, and parse the third data acquisition request to obtain a sixth identifier, wherein the coordination end does not store the data required to be queried by the query end, and the coordination end sends the third data acquisition request to the data end;

[0390] A third acquisition module 1520, configured to acquire a third session key between the coordination end and the data end, and decrypt the sixth identifier according to the third session key to obtain a second identifier, where the second identifier is generated by the query end;

[0391] The fourth acquisition module 1530 is used to acquire the first session key between the data end and the query end, and use the first session key to decrypt the second identifier to obtain the first identifier of the query data required by the query end;

[0392] The fifth acquisition module 1540 is used to acquire the target data associated with the first identifier, and send the second identifier and the target data to the coordination end, so that the coordination end sends the second identifier and the target data to the query end.

[0393] In some embodiments, the data terminal 1500 is specifically used for:

[0394] receiving a plurality of first random numbers and a first parameter sent by the coordinating end, where the plurality of first random numbers are some of the first random numbers generated by the querying end, and the first parameter is generated by the querying end based on all the first random numbers;

[0395] Generate a second random number, and generate a second parameter according to the plurality of first random numbers and the second random number;

[0396] Sending the second parameter to the query end based on the coordination end, and obtaining a first target value generated by the query end based on the first parameter and the second parameter;

[0397] Generate a second target value according to the first parameter and the second parameter;

[0398] In response to the first target value matching the second target value, a first session key between the query end and the data end is generated according to the first target value and the second target value, wherein the second identifier is encrypted by the query end based on the first session key.

[0399] In some embodiments, the data terminal 1500 is specifically used for:

[0400] Get the salt value negotiated between the data end and the query end;

[0401] Decrypting the second identifier using the first session key to obtain an intermediate identifier;

[0402] The salt value is removed from the intermediate identifier to obtain the first identifier of the query data required by the query end.

[0403] In some embodiments, the data terminal 1500 is specifically used for:

[0404] Receiving a negotiation request sent by the coordinating end, and parsing the negotiation request to obtain a set value and a target session key, wherein the negotiation request is generated by the querying end based on the first session key and the set value;

[0405] In response to the target session key being the first session key, generating consent information according to a set value;

[0406] Through the coordination end, the consent information is sent to the query end in the form of a response message, and the set value is stored as a salt value.

[0407] In some embodiments, the data terminal 1500 is specifically used for:

[0408] In response to the data associated with the fifth identifier being updated, generating data update information according to the fifth identifier and the updated data;

[0409] Send data update information to the coordinator.

[0410] It should be noted that the various steps in the data query method executed by the data end refer to the above embodiment for details and will not be described in detail here.

[0411] Furthermore, based on the contents described in the above embodiments, an electronic device is also provided in an embodiment of the present application, which includes at least one processor, and a communication interface and a memory connected to the processor; wherein the communication interface is used to communicate with other communication devices, and the memory stores computer execution instructions; the above at least one processor executes the computer execution instructions stored in the memory to implement each step in the data query method described in the above embodiments.

[0412] In order to better understand the embodiments of the present application, refer to Fig.16 , Fig.16 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application.

[0413] like Fig.16 As shown, the electronic device 1600 of this embodiment includes: a processor 1601, a memory 1602, and a communication interface 1604; wherein:

[0414] Memory 1602, used to store computer-executable instructions;

[0415] The communication interface 1604 is used to communicate with other communication devices;

[0416] The processor 1601 is used to execute the computer-executable instructions stored in the memory to implement the various steps in the query optimization method described in the above embodiment.

[0417] Optionally, the memory 1602 may be independent or integrated with the processor 1601 .

[0418] When the memory 1602 is independently provided, the device further includes a bus 1603 for connecting the memory 1602 , the communication interface 1604 and the processor 1601 .

[0419] An embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, each step in the data query method described in the above embodiment is implemented.

[0420] An embodiment of the present application provides a computer program product, including a computer program. When the computer program is executed by a processor, the computer program implements the various steps in the data query method described in the above embodiment.

[0421] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules is only a logical function division, and there may be other division methods in actual implementation, such as multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules, which can be electrical, mechanical or other forms.

[0422] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0423] In addition, each functional module in each embodiment of the present application can be integrated into one processing unit, or each module can exist physically separately, or two or more modules can be integrated into one unit. The above-mentioned module-composed unit can be implemented in the form of hardware or in the form of hardware plus software functional units.

[0424] The above-mentioned integrated module implemented in the form of a software function module can be stored in a computer-readable storage medium. The above-mentioned software function module is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to perform some steps of the methods of various embodiments of the present application.

[0425] It should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the application may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0426] The memory may include high-speed memory, and may also include non-volatile storage, such as at least one disk memory, and may also be a USB flash drive, a mobile hard disk, a read-only memory, a magnetic disk or an optical disk, etc.

[0427] The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.

[0428] The storage medium may be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory, electrically erasable programmable read-only memory, erasable programmable read-only memory, programmable read-only memory, read-only memory, magnetic memory, flash memory, magnetic disk or optical disk. The storage medium may be any available medium that can be accessed by a general or special purpose computer.

[0429] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A data query method, characterized in that: Applied to the query end, the data query method includes: Obtaining a first identifier of target data requested by the query request, and obtaining a first session key between the query end and the data end; Encrypting the first identifier using the first session key to obtain a second identifier; In response to the first data associated with the second identifier included in each historical query data in the storage area of ​​the query end, the first data is output as the target data, wherein the historical query data is used to indicate the data corresponding to the encrypted data identifier obtained by the coordination end from the data end, and the encrypted data identifier is obtained by the query end encrypting the data identifier based on the first session key.

2. The query method according to claim 1, characterized in that: After the first session key is used to encrypt the first identifier to obtain the second identifier, the method further includes: In response to the storage area not storing data associated with the second identifier, acquiring a second session key between the query end and the coordination end; Encrypting the second identifier according to the second session key to obtain a third identifier, generating a first data acquisition request according to the third identifier, and sending the first data acquisition request to the coordination end; Receive and output second data associated with the second identifier sent by the coordination end, and store the second identifier and the second data in the storage area.

3. The data query method according to claim 1, characterized in that: The step of outputting the first data as target data includes: Acquire a first valid parameter associated with the first data; Generate a valid verification request for the first data according to the first valid parameter, and send the valid verification request to the coordination end; Receiving a verification result fed back by the coordination end based on the valid verification request; In response to the verification result indicating that the first data is within a validity period, the first data is output as target data.

4. The data query method according to claim 3, characterized in that: After receiving the verification result fed back by the coordination end based on the valid verification request, the method further includes: In response to the verification result indicating that the first data is not within the validity period, obtaining a second session key between the query end and the coordination end; Encrypting the second identifier according to the second session key to obtain a fourth identifier, generating a second data acquisition request according to the fourth identifier, and sending the second data acquisition request to the coordination end; Receive third data associated with the second identifier and second valid parameters corresponding to the third data fed back by the coordination end; The first data is replaced with the third data in the storage area, and the third data is output, and the second identifier, the third data and the second valid parameter are associated and stored in the storage area.

5. The data query method according to claim 1, characterized in that: The step of using the first session key to encrypt the first identifier to obtain the second identifier includes: Obtaining a salt value negotiated between the query end and the data end; The first session key is used to encrypt the first identifier to which the salt value is added, so as to obtain the second identifier.

6. The data query method according to claim 5, characterized in that: The obtaining of the salt value negotiated between the query end and the data end includes: Acquire a set value, and generate a negotiation request according to the first session key and the set value; Based on the coordination end, sending the negotiation request to the data end; Receiving a response message fed back by the data end based on the coordination end; In response to the response message containing the consent information of the data end, the set value is stored as the salt value.

7. The data query method according to claim 1, characterized in that: The obtaining of the first session key between the query end and the data end includes: Generate a plurality of first random numbers, and generate a first parameter according to each of the first random numbers; Based on the coordination end, sending the first parameter and part of the first random number to the data end; Based on the coordination end, receiving a second parameter sent by the data end, the second random number is generated by the data end, and the second parameter is determined by the data end based on the generated second random number and the part of the first random number; Generate a first target value according to the first parameter and the second parameter, and obtain a second target value generated by the data end, where the second target value is generated by the data end based on the first parameter and the second parameter; In response to the first target value matching the second target value, a first session key is generated based on the first target value and the second target value.

8. The data query method according to any one of claims 1 to 7, characterized in that: The data query method further includes: Receiving a data deletion instruction from the coordinating end; Parsing the data deletion instruction to obtain a fifth identifier; The fifth identifier and data associated with the fifth identifier are deleted in the storage area, where the data associated with the fifth identifier is used to indicate data updated by the data terminal.

9. A data query method, characterized in that: Applied to the coordination end, the data query method includes: receiving a first data acquisition request sent by a query end, and parsing the first data acquisition request to obtain a third identifier, wherein the query end sends the first data acquisition request when the target data is not stored in the query end; Acquire a second session key between the query end and the coordination end, and decrypt the third identifier according to the second session key to obtain a second identifier; In response to the fact that each historical query data in the storage area of ​​the coordination end includes the second identifier associated data, the data associated with the second identifier is sent to the query end, and the historical query data is used to indicate the data corresponding to the encrypted data identifier obtained by the coordination end from the data end, and the encrypted data identifier is obtained by encrypting the data identifier by the query end.

10. The data query method according to claim 9, characterized in that: After decrypting the third identifier according to the second session key to obtain the second identifier, the method further includes: In response to the storage area not storing the data associated with the second identifier, acquiring a third session key between the coordination end and the data end; encrypting the second identifier according to the third session key to obtain a sixth identifier, and generating a third data acquisition request according to the sixth identifier; Sending the third data acquisition request to the data end; Receive the data associated with the second identifier fed back by the data end, and send the data associated with the second identifier to the query end.

11. The data query method according to claim 9, characterized in that: The data query method further includes: receiving a valid verification request sent by the query end, wherein the query end sends the valid verification request in the case where the query end stores the target data; Parsing the valid verification request to obtain a first valid parameter; Determining whether the first valid parameter is stored in the storage area to obtain a verification result, wherein the first valid parameter is stored in the storage area and the first data corresponding to the first valid parameter is within a validity period; The verification result is sent to the query end.

12. The data query method according to claim 11, characterized in that: After sending the verification result to the query end, the method further includes: receiving a second data acquisition request sent by the query end, wherein the verification result indicates that the storage area does not store the first valid parameter, and the query end sends the second data acquisition request; Parsing the second data acquisition request to obtain a fourth identifier, and decrypting the fourth identifier according to the second session key to obtain a second identifier; Acquire, in the storage area, third data associated with the second identifier and a second valid parameter corresponding to the third data; The third data and the second valid parameter are sent to the query end.

13. The data query method according to claim 9, characterized in that: The data query method further includes: receiving data update information sent by the data terminal, and parsing the data update information to obtain a fifth identifier and data associated with the fifth identifier; Generate a third valid parameter associated with the fifth identifier, and generate a data deletion instruction according to the fifth identifier; According to the third valid parameter and the data associated with the fifth identifier, the data in the storage area is updated, and the data deletion instruction is sent to the query end.

14. A data query method, characterized in that: Applied to the data end, the data query method includes: receiving a third data acquisition request sent by the coordination end, and parsing the third data acquisition request to obtain a sixth identifier, wherein the coordination end does not store the data required to be queried by the query end, and the coordination end sends the third data acquisition request to the data end; Acquire a third session key between the coordination end and the data end, and decrypt the sixth identifier according to the third session key to obtain a second identifier, where the second identifier is generated by the query end; Acquire a first session key between the data end and the query end, and use the first session key to decrypt the second identifier to obtain a first identifier of the query data required by the query end; The target data associated with the first identifier is acquired, and the second identifier and the target data are sent to the coordination end, so that the coordination end sends the second identifier and the target data to the query end.

15. The data query method according to claim 14, characterized in that: The obtaining of a first session key between the data end and the query end includes: receiving a plurality of first random numbers and a first parameter sent by the coordinating end, wherein the plurality of first random numbers are first random numbers of part of the first random numbers generated by the querying end, and the first parameter is generated by the querying end based on all the first random numbers; Generate a second random number, and generate a second parameter according to the plurality of first random numbers and the second random number; Sending the second parameter to the query end based on the coordination end, and obtaining a first target value generated by the query end based on the first parameter and the second parameter; generating a second target value according to the first parameter and the second parameter; In response to the first target value matching the second target value, a first session key between the query end and the data end is generated according to the first target value and the second target value, wherein the second identifier is encrypted by the query end based on the first session key.

16. The data query method according to claim 14, characterized in that: The step of using the first session key to decrypt the second identifier to obtain the first identifier of the query data required by the query end includes: Obtaining a salt value negotiated between the data end and the query end; Decrypting the second identifier using the first session key to obtain an intermediate identifier; The salt value is removed from the intermediate identifier to obtain the first identifier of the query data required by the query end.

17. The data query method according to claim 16, characterized in that: The obtaining of the salt value negotiated between the data end and the query end includes: Receiving a negotiation request sent by the coordinating end, and parsing the negotiation request to obtain a set value and a target session key, wherein the negotiation request is generated by the querying end based on the first session key and the set value; In response to the target session key being the first session key, generating consent information according to the set value; The consent information is sent to the query end in the form of the response message through the coordination end, and the set value is stored as the salt value.

18. The data query method according to claim 14, characterized in that: The data query method further includes: In response to the data associated with the fifth identifier being updated, generating data update information according to the fifth identifier and the updated data; The data update information is sent to the coordination end.

19. A query terminal, characterized in that: include: A first acquisition module, used to acquire a first identifier of target data requested by the query request, and to acquire a first session key between the query end and the data end; an encryption module, configured to encrypt the first identifier by using the first session key to obtain a second identifier; An output module is used to respond to the first data associated with the second identifier in each historical query data in the storage area of ​​the query end, and output the first data as target data, wherein the historical query data is used to indicate the data corresponding to the encrypted data identifier obtained by the coordination end from the data end, and the encrypted data identifier is obtained by the query end encrypting the data identifier based on the first session key.

20. A coordination terminal, characterized in that: include: A first receiving module is used to receive a first data acquisition request sent by a query end, and parse the first data acquisition request to obtain a third identifier, wherein the query end sends the first data acquisition request when the target data is not stored in the query end; A second acquisition module, used for acquiring a second session key between the query end and the coordination end, and decrypting the third identifier according to the second session key to obtain a second identifier; A sending module is used to respond to each historical query data in the storage area of ​​the coordination end, which includes the second identifier associated data, and send the data associated with the second identifier to the query end, wherein the historical query data is used to indicate the data corresponding to the encrypted data identifier obtained by the coordination end from the data end, and the encrypted data identifier is obtained by encrypting the data identifier by the query end.

21. A data terminal, characterized in that: include: A second receiving module is used to receive a third data acquisition request sent by the coordination end, and parse the third data acquisition request to obtain a sixth identifier, wherein the coordination end does not store the data required to be queried by the query end, and the coordination end sends the third data acquisition request to the data end; a third acquisition module, configured to acquire a third session key between the coordination end and the data end, and decrypt the sixth identifier according to the third session key to obtain a second identifier, where the second identifier is generated by the query end; a fourth acquisition module, configured to acquire a first session key between the data end and the query end, and use the first session key to decrypt the second identifier to obtain a first identifier of the query data required by the query end; The fifth acquisition module is used to acquire the target data associated with the first identifier, and send the second identifier and the target data to the coordination end, so that the coordination end sends the second identifier and the target data to the query end.

22. An electronic device, characterized in that: include: A processor, and a memory and a communication interface communicatively connected to the processor; The communication interface is used to communicate with other communication devices; The memory is used to store computer-executable instructions; The processor is used to execute the computer-executable instructions stored in the memory to implement the data query method according to any one of claims 1 to 18.

23. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, the data query method according to any one of claims 1 to 18 is implemented.

24. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the data query method according to any one of claims 1 to 18 is implemented.

Images