Data query method and device, equipment, medium and program product

Abstract

The present invention provides a data query method, apparatus, device, medium and program product wherein the method executed by a service device comprises: obtaining a first query request sent by a first device, the first query request comprising first address information of first data stored on a second device and being used for requesting to obtain the first data on the second device; according to the first address information, an address mapping relation between the first ciphertext data and second ciphertext data is inquired, second address information, corresponding to the first data, in the second ciphertext data is determined, and the second ciphertext data is data obtained after the first ciphertext data changes the arrangement order and is subjected to encryption processing; sending a second query request to a second device, wherein the second query request comprises second address information; receiving second data sent by a second device, the second data being a ciphertext value sequence corresponding to the first data; and sending the second data to the first equipment. According to the embodiment of the invention, the data query efficiency is improved on the premise of ensuring high security.

Description

Technical Field

[0001] This invention relates to the field of data query technology, and in particular to a data query method, apparatus, device, medium, and program product. Background Technology

[0002] Current anonymity query solutions primarily utilize secure multi-party computation (MPC) technologies to design query algorithms or protocols, such as homomorphic encryption, unintended transmission, secret sharing, and differential privacy. These solutions are practical for specific business scenarios (e.g., LAN environments with server-side data volumes less than a million records). However, existing solutions suffer from severe performance bottlenecks in scenarios with commonly occurring server-side massive data volumes (e.g., billions of records) and client-side limited network bandwidth (e.g., mobile network scenarios). This is especially true under conditions requiring million-level indistinguishability security. Under this security premise, even if a client queries only one record, the server must transmit at least a million encrypted records to the client. Consequently, the performance of anonymity queries often lags behind plaintext queries by 1-3 orders of magnitude. For example, in the CAICT's performance evaluation scenario of 1-to-100 million-record million-level indistinguishability anonymity queries, the average query response time for all evaluated vendors was 3 minutes and 26 seconds, with the shortest response time being 3 seconds; the average network communication consumption was approximately 1GB. Even the best algorithms still cannot meet the conditions for implementation. Therefore, how to improve the efficiency of anonymous queries to the level of plaintext queries while ensuring the security of anonymous queries is the biggest pain point in the industry. Summary of the Invention

[0003] The purpose of this invention is to provide a data query method, apparatus, device, medium, and program product to solve the problem of low query efficiency while satisfying the security of anonymous query.

[0004] To address the aforementioned technical problems, embodiments of the present invention provide a data query method, executed by a service device, the method comprising:

[0005] Obtain a first query request sent by a first device, wherein the first query request is used to request the acquisition of first data on a second device, and the first query request includes first address information of the first data stored on the second device;

[0006] Based on the first address information, the address mapping relationship between the first ciphertext data and the second ciphertext data is queried to determine the second address information corresponding to the first data in the second ciphertext data; wherein, the first ciphertext data is data obtained by the second device after encrypting the stored database, and the second ciphertext data is data obtained by the service device after changing the order of the first ciphertext data and performing encryption processing;

[0007] Send a second query request to the second device, the second query request being used to request the first data, and the second query request including the second address information;

[0008] Receive second data sent by the second device, wherein the second data is a sequence of ciphertext values ​​corresponding to the first data;

[0009] Send the second data to the first device.

[0010] Optionally, before obtaining the first query request sent by the first device, the method further includes:

[0011] Obtain the first encrypted data sent by the second device;

[0012] The order of each element in the first ciphertext data is shuffled to obtain the third ciphertext data;

[0013] By encrypting each element in the third ciphertext data by adding noise, the second ciphertext data and the address mapping relationship between the first ciphertext data and the second ciphertext data are obtained.

[0014] Optionally, before sending the second data to the first device, the method further includes:

[0015] The noise is removed from the second data.

[0016] This invention also provides a data query method, executed by a first device, the method comprising:

[0017] Send a first query request to the service device, the query request being used to request the acquisition of first data on the second device, and the query request including the first address information of the first data stored on the second device;

[0018] The service device sends second data; wherein the second data is a sequence of ciphertext values ​​corresponding to the first data obtained by the service device from the second device according to the second address information, the second address information is obtained by the service device according to the address mapping relationship between the first ciphertext data and the second ciphertext data, the first ciphertext data is data obtained by the second device after encrypting the stored database, and the second ciphertext data is data obtained by the service device after changing the order of the first ciphertext data and encrypting it.

[0019] The second data is encrypted based on the key information of the second device to obtain encrypted data;

[0020] Send a decryption request to the second device, the decryption request including the encrypted data;

[0021] Obtain the decrypted data returned by the second device after decrypting the encrypted data according to the decryption request;

[0022] The decrypted data is decrypted to obtain the first data.

[0023] Optionally, before sending the first query request to the service device, the method further includes:

[0024] Obtain the hash function used by the second device to generate the first ciphertext data and the key information;

[0025] Based on the hash function, the first address information corresponding to the first data in the first ciphertext data is determined.

[0026] Optionally, before obtaining the hash function used by the second device to generate the first ciphertext data and the key information, the method further includes:

[0027] Send an authentication request to the second device, the authentication request including the device information of the first device and the scope of the query service requested;

[0028] The device receives an authentication result sent by the second device, wherein the authentication result is either a first authentication result or a second authentication result, wherein the first authentication result is used to indicate that the first device has the right to query data, and the second authentication result is used to indicate that the first device does not have the right to query data.

[0029] The step of obtaining the hash function used by the second device to generate the first ciphertext data and the key information includes:

[0030] Upon receiving the first authentication result, the hash function used by the second device to generate the first ciphertext data and the key information are obtained.

[0031] Optionally, the first address information includes:

[0032] The target query address and m obfuscated query addresses, wherein the target query address is the address corresponding to the first data;

[0033] The obfuscated query address is generated based on the target query address, and the format of the obfuscated query address is the same as that of the target query address, where m is an integer greater than or equal to 0.

[0034] Optionally, the second data is encrypted based on the key information of the second device to obtain encrypted data, including:

[0035] The required first ciphertext is obtained from the second data based on the first address information;

[0036] The first ciphertext is processed using the homomorphic addition method to obtain the second ciphertext;

[0037] Based on the key information, any random number is encrypted to obtain the third ciphertext;

[0038] The second ciphertext and the third ciphertext are homomorphically added to obtain encrypted data.

[0039] This invention also provides a data query method, executed by a second device, the method comprising:

[0040] The service device sends a second query request, which is used to request the acquisition of first data. The second query request includes second address information corresponding to the first data in the second encrypted data. The second address information is obtained by the service device by querying the address mapping relationship between the first encrypted data and the second encrypted data based on the first address information. The first address information is the address information corresponding to the first data in the first encrypted data.

[0041] According to the second query request, the second data corresponding to the second address information in the second ciphertext data is obtained by querying, wherein the second data is the ciphertext value sequence corresponding to the first data;

[0042] Send the second data to the service device;

[0043] Obtain a decryption request sent by a first device, the decryption request including encrypted data after the first device encrypts the second data according to the key information;

[0044] The encrypted data is decrypted based on the key information to obtain the decrypted data;

[0045] The decrypted data is sent to the first device.

[0046] Optionally, before obtaining the second query request sent by the service device, the method includes:

[0047] The data in the database is fragmented and encrypted according to the hash function and the key information to generate the first ciphertext data;

[0048] Send the first encrypted data to the service device;

[0049] The service device receives second encrypted data sent by the service device, wherein the second encrypted data is encrypted and transformed by the service device based on the first encrypted data.

[0050] Optionally, the data in the database is fragmented and encrypted according to the hash function and the key information to generate first ciphertext data, including:

[0051] The data in the database is divided into multiple data buckets according to the first hash function. Each data bucket includes multiple data keys and the data value corresponding to the key.

[0052] Based on n second hash functions, each key and value in the data bucket is divided into n fragments to generate a plaintext array corresponding to each data bucket.

[0053] Each plaintext array is encrypted using the key information to generate the first ciphertext data.

[0054] Optionally, before obtaining the second query request sent by the service device, the method includes:

[0055] Obtain the authentication request sent by the first device, the authentication request including the device information of the first device and the requested query service scope;

[0056] The first device is approved according to the authentication request, and an approval result is obtained;

[0057] If the approval result is passed, the query permissions of the first device are adjusted according to the scope of the requested query service and a first authentication result is generated. The first authentication result is used to indicate that the first device has the right to query data.

[0058] If the approval result is not approved, a second authentication result is generated, which indicates that the first device does not have the right to query data.

[0059] Send the first authentication result or the second authentication result to the first device.

[0060] Optionally, after generating the first authentication result, the method further includes:

[0061] Send the hash function that generated the first ciphertext data and the key information to the first device.

[0062] Optionally, the first authentication result includes an authentication code, which indicates that the first device has the right to query data; the second query request includes the authentication code.

[0063] The decryption request includes the authentication code;

[0064] The step of querying and obtaining the second data corresponding to the second address information in the second encrypted data according to the second query request includes:

[0065] After the authentication code is successfully authenticated, the second data corresponding to the second address information in the second encrypted data is obtained according to the second query request;

[0066] The step of decrypting the encrypted data based on the key information to obtain decrypted data includes:

[0067] After the authentication code is successfully authenticated, the encrypted data is decrypted based on the key information to obtain the decrypted data.

[0068] This invention also provides a service device, including a transceiver and a processor, wherein,

[0069] The transceiver is used to acquire a first query request sent by a first device. The first query request is used to request the acquisition of first data on a second device, and the first query request includes first address information of the first data stored on the second device.

[0070] The processor is configured to query the address mapping relationship between the first ciphertext data and the second ciphertext data based on the first address information, and determine the second address information corresponding to the first data in the second ciphertext data; wherein, the first ciphertext data is data obtained by the second device after encrypting the stored database, and the second ciphertext data is data obtained by the service device after changing the order of the first ciphertext data and performing encryption processing.

[0071] The transceiver is also used for:

[0072] Send a second query request to the second device, the second query request being used to request the first data, and the second query request including the second address information;

[0073] Receive the second data sent by the second device, wherein the second data is a sequence of ciphertext values ​​corresponding to the first data;

[0074] Send the second data to the first device.

[0075] This invention also provides a first device, including a transceiver and a processor, wherein,

[0076] The transceiver is used for:

[0077] Send a first query request to the service device, the query request being used to request the acquisition of first data on the second device, and the query request including the first address information of the first data stored on the second device;

[0078] The service device sends second data; wherein the second data is a sequence of ciphertext values ​​corresponding to the first data obtained by the service device from the second device according to the second address information, the second address information is obtained by the service device according to the address mapping relationship between the first ciphertext data and the second ciphertext data, the first ciphertext data is data obtained by the second device after encrypting the stored database, and the second ciphertext data is data obtained by the service device after changing the order of the first ciphertext data and encrypting it.

[0079] The processor is configured to encrypt the second data according to the key information of the second device to obtain encrypted data;

[0080] The transceiver is also used for:

[0081] Send a decryption request to the second device, the decryption request including the encrypted data;

[0082] Obtain the decrypted data returned by the second device after decrypting the encrypted data according to the decryption request;

[0083] The processor is further configured to decrypt the decrypted data to obtain the first data.

[0084] This invention also provides a second device, including a transceiver and a processor, wherein,

[0085] The transceiver is used to acquire a second query request sent by the service device. The second query request is used to request the acquisition of first data, and the second query request includes second address information corresponding to the first data in the second encrypted data. The second address information is obtained by the service device by querying the address mapping relationship between the first encrypted data and the second encrypted data based on the first address information. The first address information is the address information corresponding to the first data in the first encrypted data.

[0086] The processor is configured to query and obtain the second data corresponding to the second address information in the second ciphertext data according to the second query request, wherein the second data is the ciphertext value sequence corresponding to the first data;

[0087] The transceiver is also used to send second data to the service device;

[0088] The transceiver is further configured to acquire a decryption request sent by the first device, the decryption request including encrypted data after the first device has encrypted the second data according to the key information;

[0089] The processor is further configured to decrypt the encrypted data based on the key information to obtain decrypted data;

[0090] The transceiver is also used to send the decrypted data to the first device.

[0091] This invention also provides a data query device, applied to a service device, comprising:

[0092] The first acquisition module is used to acquire a first query request sent by the first device. The first query request is used to request the acquisition of first data on the second device, and the first query request includes the first address information of the first data stored on the second device.

[0093] The first query module is used to query the address mapping relationship between the first encrypted data and the second encrypted data based on the first address information, and determine the second address information corresponding to the first data in the second encrypted data; wherein, the first encrypted data is data obtained by the second device after encrypting the stored database, and the second encrypted data is data obtained by the service device after changing the order of the first encrypted data and encrypting it;

[0094] The first sending module is used to send a second query request to the second device, the second query request being used to request the acquisition of the first data, and the second query request including the second address information;

[0095] The first receiving module is configured to receive second data sent by the second device, wherein the second data is a sequence of ciphertext values ​​corresponding to the first data;

[0096] The second sending module is used to send the second data to the first device.

[0097] This invention also provides a data query device, applied to a first device, comprising:

[0098] The third sending module is used to send a first query request to the service device. The query request is used to request the acquisition of first data on the second device, and the query request includes the first address information of the first data stored on the second device.

[0099] The second acquisition module is used to acquire the second data sent by the service device; wherein, the second data is the sequence of ciphertext values ​​corresponding to the first data obtained by the service device from the second device according to the second address information, the second address information is obtained by the service device according to the address mapping relationship between the first ciphertext data and the second ciphertext data, the first ciphertext data is the data obtained by the second device after encrypting the stored database, and the second ciphertext data is the data after the service device changes the order of the first ciphertext data and performs encryption processing;

[0100] The first encryption module is used to encrypt the second data according to the key information of the second device to obtain encrypted data;

[0101] The fourth sending module is used to send a decryption request to the second device, the decryption request including the encrypted data;

[0102] The third acquisition module is used to acquire the decrypted data returned by the second device after decrypting the encrypted data according to the decryption request;

[0103] The first decryption module is used to decrypt the decrypted data to obtain the first data.

[0104] This invention also provides a data query device, applied to a second device, comprising:

[0105] The fourth acquisition module is used to acquire a second query request sent by the service device. The second query request is used to request the acquisition of first data, and the second query request includes second address information corresponding to the first data in the second encrypted data. The second address information is obtained by the service device according to the first address information to query the address mapping relationship between the first encrypted data and the second encrypted data. The first address information is the address information corresponding to the first data in the first encrypted data.

[0106] The second query module is used to query and obtain the second data corresponding to the second address information in the second ciphertext data according to the second query request, wherein the second data is the ciphertext value sequence corresponding to the first data;

[0107] The fifth sending module is used to send second data to the service device;

[0108] The fifth acquisition module is used to acquire a decryption request sent by the first device, the decryption request including encrypted data after the first device encrypts the second data according to the key information;

[0109] The second decryption module is used to decrypt the encrypted data according to the key information to obtain decrypted data;

[0110] The sixth sending module is used to send the decrypted data to the first device.

[0111] This invention also provides a network device, including: a processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the data query method as described in any of the preceding embodiments.

[0112] This invention also provides a readable storage medium, comprising: a program stored on the readable storage medium, wherein when the program is executed by a processor, it implements the steps of the data query method as described in any of the preceding claims.

[0113] This invention also provides a computer program product, including computer instructions, which, when executed by a processor, implement the steps of the data query method as described in any of the preceding embodiments.

[0114] At least one of the above technical solutions of the present invention has the following beneficial effects:

[0115] The above scheme provides a data query method, which is executed by a first device, a second device, and a service device, wherein the service device acts as an agent for interaction between the first device and the second device.

[0116] Before performing a data query, the second device first encrypts the data in the database to generate first ciphertext data. Then, the proxy device changes the order of the first ciphertext data and encrypts it to generate second ciphertext data, and records the address mapping relationship between the first ciphertext data and the second ciphertext data.

[0117] To ensure data security and indistinguishability during data queries, the first device sends a query request to the second device through a service device. Specifically, the first device sends a first query request containing the first address information corresponding to the requested first data in the first encrypted data. The service device converts the first address information into the corresponding second address information in the second encrypted data based on address mapping, and then sends a second query request (carrying the second address information) to the second device based on this second address information. The service device receives the second data (the encrypted value sequence corresponding to the first data) from the second device and then sends the second data back to the first device. During this process, the service device converts the first address information corresponding to the first encrypted data into the corresponding second address information in the second encrypted data before sending it to the second device. This prevents the second device from deducing the information the first device needs to query based on the second address information, ensuring 100% indistinguishability and achieving highly secure anonymous data querying. Furthermore, the first device first determines the first address information corresponding to the requested first data in the first encrypted data locally before sending the first query request (carrying the first address information), directly retrieving the corresponding data and reducing the interaction of a large amount of irrelevant information, thus greatly improving query efficiency.

[0118] Since the second data obtained by the first device is a sequence of ciphertext values ​​corresponding to the first data, the first data cannot be directly obtained. A decryption request needs to be sent to the second device, which will then decrypt the data and return the first data, allowing the user to directly obtain the required information. This reduces a large amount of irrelevant information and improves query efficiency. In addition, before the first device sends the decryption request to the second device, in order to prevent the second device from knowing the actual information queried by the first device and the first data, the second data is encrypted to generate encrypted data. This encrypted data is then sent in the decryption request, ensuring 100% indistinguishability and achieving highly secure anonymous data querying. Attached Figure Description

[0119] Figure 1 This is a flowchart of the data query method performed by the service device in an embodiment of the present invention;

[0120] Figure 2 This describes the process of generating the second encrypted data according to an embodiment of the present invention;

[0121] Figure 3 This is a flowchart of the data query method executed by the first device in an embodiment of the present invention;

[0122] Figure 4 This is a flowchart of the data query method performed by the second device in an embodiment of the present invention;

[0123] Figure 5This embodiment of the invention describes the process of fragmenting and encrypting each key in the set of keys in the data bucket.

[0124] Figure 6 A flowchart of a data query method provided in an embodiment of the present invention;

[0125] Figure 7 This is a schematic diagram of the structure of the service device in an embodiment of the present invention;

[0126] Figure 8 This is a schematic diagram of the structure of the first device in an embodiment of the present invention;

[0127] Figure 9 This is a schematic diagram of the structure of the second device in an embodiment of the present invention;

[0128] Figure 10 This is a schematic diagram of the data query device applied to the service equipment in an embodiment of the present invention;

[0129] Figure 11 This is a schematic diagram of the data query device of the service equipment in an embodiment of the present invention;

[0130] Figure 12 This is a schematic diagram of the data query device of the service equipment in an embodiment of the present invention. Detailed Implementation

[0131] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0132] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0133] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and the number of objects is not limited; for example, a first object can be one or more. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0134] It is worth noting that the technologies described in this application are not limited to Long Term Evolution (LTE) / LTE-Advanced (LTE-A) systems, but can also be used in other wireless communication systems, such as Code Division Multiple Access (CDMA), Time Division Multiple Access (TDMA), Frequency Division Multiple Access (FDMA), Orthogonal Frequency Division Multiple Access (OFDMA), Single-carrier Frequency-Division Multiple Access (SC-FDMA), and other systems. The terms "system" and "network" in this application are often used interchangeably, and the described technologies can be used not only in the systems and radio technologies mentioned above, but also in other systems and radio technologies. The following description describes New Radio (NR) systems for illustrative purposes, and NR terminology is used in most of the following description; however, these technologies can also be applied to applications beyond NR systems, such as 6th Generation (6G) communication systems.

[0135] This invention provides a data query system, which includes a first device, a second device, and a service device. The first device acts as the querying party that needs to query data, the second device acts as the data storage party, and the service device acts as the agent for interaction between the first device and the second device. Based on this data query system, this invention proposes a data query method.

[0136] like Figure 1 As shown, this embodiment of the invention provides a data query method, executed by a service device, the method comprising:

[0137] Step S101: Obtain a first query request sent by the first device. The first query request is used to request the acquisition of first data on the second device, and the first query request includes the first address information of the first data stored on the second device.

[0138] In step S101, when the first device queries data from the second device, to prevent the second device from knowing the first data that the first device wants to query, thereby causing data leakage and affecting data security, the service device first obtains the first query request sent by the first device. Furthermore, the first query request directly includes the first address information of the first data requested by the first device stored on the second device, which allows for quick and effective retrieval of relevant information about the first data, reduces the interaction of a large amount of irrelevant information, and greatly improves query efficiency.

[0139] Step S102: Based on the first address information, query the address mapping relationship between the first ciphertext data and the second ciphertext data, and determine the second address information corresponding to the first data in the second ciphertext data; wherein, the first ciphertext data is data obtained by the second device after encrypting the stored database, and the second ciphertext data is data obtained by the service device after changing the order of the first ciphertext data and performing encryption processing.

[0140] In step S102, in order to prevent the second device from deducing the first data that the first device wants to query based on the first address information, the service device converts the first address information into the second address information according to the address mapping relationship between the first encrypted data and the second encrypted data. If the first address information is a logical query address, then the second address information is a physical query address; if the first address information is a physical query address, then the second address information is a logical query address.

[0141] In addition, it should be noted that before performing a data query, the service device needs to obtain the address mapping relationship between the first ciphertext data and the second ciphertext data. That is, the service device first obtains the first ciphertext data encrypted by the second device, and then changes the order of the first ciphertext data and performs encryption processing to obtain the second ciphertext data and the address mapping relationship.

[0142] Step S103: Send a second query request to the second device. The second query request is used to request the first data and includes the second address information.

[0143] Step S104: Receive second data sent by the second device, wherein the second data is a sequence of ciphertext values ​​corresponding to the first data;

[0144] In step S104, in order to prevent the service device from knowing the specific content of the first data, thereby causing data leakage and affecting data security, the service device obtains not the first data, but the ciphertext value sequence corresponding to the first data.

[0145] Step S105: Send the second data to the first device.

[0146] In this embodiment of the invention, a data query method based on a data query system is proposed. To prevent data leakage caused by direct interaction between the first and second devices and to avoid affecting data security, the first and second devices interact through a service device. During the query process, the service device converts the first address information in the first query request into second address information according to the address mapping relationship, and then requests the first data from the second device based on the second address information. Since the second device does not know the data information corresponding to each position in the second encrypted data, the second device does not know the content that the first device wants to query throughout the entire process. Finally, the service device receives the second data (the encrypted value sequence corresponding to the first data) sent by the second device after the query. Because the second data is encrypted, the service device also cannot know the specific content of the first data, ensuring 100% indistinguishability and achieving highly secure anonymous data query. At the same time, the first query request directly includes the first address information of the first data requested by the first device stored on the second device, which can quickly and effectively retrieve the first data, reduce the interaction of a large amount of irrelevant information, and greatly improve query efficiency.

[0147] Optionally, before obtaining the first query request sent by the first device, the method further includes:

[0148] Obtain the first encrypted data sent by the second device;

[0149] The order of each element in the first ciphertext data is shuffled to obtain the third ciphertext data;

[0150] By encrypting each element in the third ciphertext data by adding noise, the second ciphertext data and the address mapping relationship between the first ciphertext data and the second ciphertext data are obtained.

[0151] In this embodiment of the invention, the first ciphertext data, the second ciphertext data, and the third ciphertext data are all in matrix form. After obtaining the first ciphertext data from the second device, the service device first shuffles each element in the first ciphertext data to generate the third ciphertext data, and records the address mapping relationship between the element addresses in the first ciphertext data and the element addresses in the third ciphertext data. Then, it adds noise to each element in the third ciphertext data for encryption to obtain the second ciphertext data, and returns the second ciphertext data to the second device. The purpose of adding noise is to prevent the second device from knowing the mapping relationship between the first ciphertext data and the second ciphertext data based on the comparison of ciphertext values. Figure 2 For example, the process from the first ciphertext data M0 to the third ciphertext data M1, and then to the second ciphertext data M2 is explained, where r1, r2, r3, and r4 are used to represent noise.

[0152] Optionally, before sending the second data to the first device, the method further includes:

[0153] The noise is removed from the second data.

[0154] In this embodiment of the invention, since the second ciphertext data is obtained by adding noise to the first ciphertext data, the second data obtained by querying the second ciphertext data according to the second address information is also noisy. This makes it easier for the first device to decrypt the second data. Therefore, the second data needs to be decrypted first before being sent to the first device.

[0155] like Figure 3 As shown, this embodiment of the invention also provides a data query method, executed by a first device, the method comprising:

[0156] Step S301: Send a first query request to the service device. The query request is used to request the acquisition of first data on the second device, and the query request includes the first address information of the first data stored on the second device.

[0157] In step S301, when the first device queries data from the second device, to prevent the second device from knowing the first data that the first device is querying, thereby causing data leakage and affecting data security, the first device queries the second device through a service device, that is, it sends a first query request to the service device. Furthermore, the first query request directly includes the first address information of the first data requested by the first device, which is stored on the second device. This allows for quick and effective retrieval of relevant information about the first data, reduces the interaction of a large amount of irrelevant information, and greatly improves query efficiency.

[0158] It should be noted that the number of times the first device can query data from the second device is limited.

[0159] Step S302: Obtain the second data sent by the service device; wherein, the second data is the ciphertext value sequence corresponding to the first data obtained by the service device from the second device according to the second address information, the second address information is obtained by the service device according to the address mapping relationship between the first ciphertext data and the second ciphertext data, the first ciphertext data is the data obtained by the second device after encrypting the stored database, and the second ciphertext data is the data after the service device changes the order of the first ciphertext data and performs encryption processing;

[0160] In step S302, in order to avoid data leakage and affect data security, the service device cannot obtain the content of the first data. Therefore, the service device can only obtain the second data, and the first device also obtains the second data from the service device.

[0161] Furthermore, it should be noted that the first encrypted data is encrypted by the second device. To prevent the second device from deducing the content the first device wants to query based on the first address information, the service device converts the first address information into the second address information based on the address mapping relationship between the first and second encrypted data. The second data is obtained by the second device from the second encrypted data based on the second address information. If the first address information is a logical query address, then the second address information is a physical query address; if the first address information is a physical query address, then the second address information is a logical query address.

[0162] Step S303: Encrypt the second data according to the key information of the second device to obtain encrypted data;

[0163] In step S303, although the first device obtains the second data, the second data is encrypted and the first data cannot be directly extracted from it. Only the second data knows the private key corresponding to the second data, so a decryption request needs to be sent to the second device. However, if the second device directly decrypts the second data, then the second device will know the specific content of the first data that the first device wants to query. In order to avoid data leakage and affect data security, after receiving the second data, the first device first encrypts the second data again according to the public key in the key information of the second device to generate encrypted data. This ensures that even after the second device decrypts the encrypted data, it will not be able to know the specific content of the first data, thus guaranteeing 100% indistinguishability and realizing highly secure anonymous data query.

[0164] Step S304: Send a decryption request to the second device, the decryption request including the encrypted data;

[0165] In step S304, it should be noted that the number of times the first device sends a decryption request to the second device is limited.

[0166] Step S305: Obtain the decrypted data returned by the second device after decrypting the encrypted data according to the decryption request;

[0167] Step S306: Decrypt the decrypted data to obtain the first data.

[0168] In this embodiment of the invention, a data query method based on a data query system is proposed, mainly divided into two aspects: data query (steps S301-S302) and data decryption (steps S303-S306). To prevent data leakage caused by direct interaction between the first and second devices and to avoid affecting data security, in terms of data query, the first device queries the second device through a service device, and the second device returns the second data (the ciphertext value sequence corresponding to the first data) to the first device. In terms of data decryption, to prevent the second device from knowing the specific content of the first data, the first device first encrypts the second data according to the public key in the key information to generate encrypted data, and then requests the second device to decrypt the encrypted data. After obtaining the decrypted data sent by the second device, the first device decrypts the information just encrypted by the first device to obtain the final first data, ensuring 100% indistinguishability and realizing highly secure anonymous data query. Meanwhile, the first query request directly includes the first address information of the first data requested by the first device and stored on the second device, which can quickly and effectively retrieve the first data. The decryption request is also used to directly obtain relevant information about the first data, both of which reduce the interaction of a large amount of irrelevant information and greatly improve query efficiency.

[0169] Optionally, before sending the first query request to the service device, the method further includes:

[0170] Obtain the hash function used by the second device to generate the first ciphertext data and the key information;

[0171] Based on the hash function, the first address information corresponding to the first data in the first ciphertext data is determined.

[0172] In this embodiment of the invention, before sending the first query request, the first address information of the first data to be queried is determined first. This reduces the interaction of irrelevant information and improves query efficiency during subsequent queries. Specifically, the process involves obtaining the hash function and key information used by the second device to generate the first encrypted data. The key information is used to encrypt the second data in step S303, and the hash function is used to obtain the first address information. For example, if the first device wants to query the first data whose key is the value corresponding to the ID document of the user of the first device, the hash function can determine the first address information corresponding to this first data in the first encrypted data.

[0173] Optionally, before obtaining the hash function used by the second device to generate the first ciphertext data and the key information, the method further includes:

[0174] Send an authentication request to the second device, the authentication request including the device information of the first device and the scope of the query service requested;

[0175] The device receives an authentication result sent by the second device, wherein the authentication result is either a first authentication result or a second authentication result, wherein the first authentication result is used to indicate that the first device has the right to query data, and the second authentication result is used to indicate that the first device does not have the right to query data.

[0176] The step of obtaining the hash function used by the second device to generate the first ciphertext data and the key information includes:

[0177] Upon receiving the first authentication result, the hash function used by the second device to generate the first ciphertext data and the key information are obtained.

[0178] In this embodiment of the invention, the hash function and key information corresponding to the first encrypted data are not obtained arbitrarily. They can only be obtained if the first device has the right to query the data from the second device. Therefore, the first device needs to send an authentication request to the second device first. The device information includes, but is not limited to, the user ID. The authentication request also includes, but is not limited to, the number of queries (i.e., the number of times the second data is returned or the number of times the first query request is sent) and the number of decryptions (i.e., the number of times the decrypted data is returned or the number of times the decryption request is sent). Only after receiving the first authentication result can the hash function and key information in the second device be obtained. The first authentication result also includes an authentication code, which is used to indicate that the first device has the right to query the data.

[0179] Optionally, the first address information includes:

[0180] The target query address and m obfuscated query addresses, wherein the target query address is the address corresponding to the first data;

[0181] The obfuscated query address is generated based on the target query address, and the format of the obfuscated query address is the same as that of the target query address, where m is an integer greater than or equal to 0.

[0182] In this embodiment of the invention, in order to further improve the security of anonymous data query, the first address information includes not only the target query address corresponding to the first data, but also m obfuscated query addresses, wherein m can be selected from 0 to 10 according to different security requirements.

[0183] Optionally, the second data is encrypted based on the key information of the second device to obtain encrypted data, including:

[0184] The required first ciphertext is obtained from the second data based on the first address information;

[0185] The first ciphertext is processed using the homomorphic addition method to obtain the second ciphertext;

[0186] Based on the key information, any random number is encrypted to obtain the third ciphertext;

[0187] The second ciphertext and the third ciphertext are homomorphically added to obtain encrypted data.

[0188] In this embodiment of the invention, since the second data is the ciphertext sequence of the first data, the homomorphic encryption value corresponding to the first ciphertext (i.e., the first data) is extracted from the ciphertext sequence according to the first address information. Then, the first ciphertext is homomorphically added to obtain the second ciphertext (i.e., the encryption value corresponding to the first data). For example, the first address information is the fragment addresses (B1, S1), (B1, S2), and (B1, S3), where B1 is the bucket number, and S1, S2, and S3 are the fragment addresses in bucket B1. Then, the first ciphertext is the homomorphic encryption value corresponding to (B1, S1), (B1, S2), and (B1, S3) respectively, and the second ciphertext is the sum of the homomorphic encryption values ​​of the three fragments.

[0189] To prevent the second device from knowing the specific content of the first data that the first device wants to query, thus causing data leakage and affecting data security, the first device selects a random number R, encrypts the random number R according to the public key in the key information of the second device, and obtains a third ciphertext. Finally, the second ciphertext and the third ciphertext are homomorphically added to obtain encrypted data.

[0190] Optionally, the decrypted data is decrypted to obtain the first data, including:

[0191] In this embodiment of the invention, the first data is obtained by subtracting a random number R from the decrypted data. Specifically, after subtracting the random number R from the decrypted data to obtain the decrypted value, if the key value corresponding to the decrypted value is the same as the key value used for querying by the first device, then the decrypted value is determined to be the first data; if the key value corresponding to the decrypted value is different from the key value used for querying by the first device, it indicates that the data provider does not have any records related to the key value used for querying by the first device.

[0192] like Figure 4 As shown, this embodiment of the invention also provides a data query method, executed by a second device, the method comprising:

[0193] Step S401: Obtain a second query request sent by the service device. The second query request is used to request the acquisition of first data, and the second query request includes second address information corresponding to the first data in the second encrypted data. The second address information is obtained by the service device according to the first address information to query the address mapping relationship between the first encrypted data and the second encrypted data. The first address information is the address information corresponding to the first data in the first encrypted data.

[0194] In step S401, the second query request is sent by the service device based on the first query request sent by the first device. The second query request includes second address information. Since the second encrypted data is encrypted by the service device, the second device cannot know the specific content of the second encrypted data, nor does it know the address mapping relationship between the first and second encrypted data. Therefore, the second device cannot deduce the specific content of the first data that the first device wants to query based on the second address information, effectively preventing data leakage and ensuring data security. Specifically, if the first address information is a logical query address, then the second address information is a physical query address; conversely, if the first address information is a physical query address, then the second address information is a logical query address.

[0195] Step S402: According to the second query request, query and obtain the second data corresponding to the second address information in the second ciphertext data, wherein the second data is the ciphertext value sequence corresponding to the first data;

[0196] In step S402, since the second address information directly corresponds to the relevant information of the first data in the second ciphertext data, the second device can directly obtain the information by querying based on the second address information, which reduces the interaction of a large amount of irrelevant information and greatly improves the query efficiency.

[0197] Step S403: Send the second data to the service device;

[0198] In step S403, in order to prevent the service device from knowing the specific content of the first data, thereby causing data leakage and affecting data security, the second device sends the second data, namely the ciphertext value sequence corresponding to the first data, to the service device.

[0199] Step S404: Obtain the decryption request sent by the first device, the decryption request including the encrypted data after the first device encrypts the second data according to the key information;

[0200] In step S404, since the second data is encrypted and only the second device has the private key for decryption, it will receive a decryption request sent by the first device. However, if the second device directly decrypts the second data, then the second device will know the specific content of the first data that the first device wants to query. In order to avoid data leakage and affect data security, the data requested for decryption in the decryption request is the encrypted data after the first device encrypts the second data.

[0201] Step S405: Decrypt the encrypted data according to the key information to obtain decrypted data;

[0202] In step S405, the encrypted data is decrypted using the private key in the key information to obtain the decrypted data. The second device cannot deduce the content of the first data based on the decrypted data, thus ensuring 100% indistinguishability and achieving highly secure data anonymity query.

[0203] Step S406: Send the decrypted data to the first device.

[0204] In this embodiment of the invention, a data query method based on a data query system is proposed, mainly divided into two aspects: data query (steps S401-S403) and data decryption (steps S404-S406). To prevent data leakage caused by direct interaction between the first and second devices and to avoid affecting data security, in terms of data query, the second device performs data query based on the second address information sent by the service device, obtains and returns the second data (the ciphertext value sequence corresponding to the first data) to the service device. The second address information is obtained by the service device mapping the first address information sent by the first device for querying the first data according to the address mapping relationship. In terms of data decryption, to prevent the second device from knowing the specific content of the first data, the second device decrypts the encrypted data sent by the first device, obtains and sends the decrypted data to the first device. The encrypted data is obtained by the first device encrypting the second data, ensuring 100% indistinguishability and realizing highly secure anonymous data query. Meanwhile, the second address information is the address corresponding to the first data in the second ciphertext data, which can quickly and effectively find the first data. The encrypted data is also the data corresponding to the first data, which can be directly decrypted. This reduces the interaction of a large amount of irrelevant information and greatly improves the query efficiency.

[0205] Optionally, before obtaining the second query request sent by the service device, the method includes:

[0206] The data in the database is fragmented and encrypted according to the hash function and the key information to generate the first ciphertext data;

[0207] Send the first encrypted data to the service device;

[0208] The service device receives second encrypted data sent by the service device, wherein the second encrypted data is encrypted and transformed by the service device based on the first encrypted data.

[0209] In this embodiment of the invention, before receiving the second query request, the second device generates homomorphically encrypted key information (public key and private key), and segments and encrypts the data in the database according to the hash function and the public key in the key information to generate the first ciphertext data. This can decouple query performance from the amount of data in the database and improve query efficiency.

[0210] Generally, both the first and second ciphertext data are in matrix form.

[0211] Optionally, the data in the database is fragmented and encrypted according to the hash function and the key information to generate first ciphertext data, including:

[0212] The data in the database is divided into multiple data buckets according to the first hash function. Each data bucket includes multiple data keys and the data value corresponding to the key.

[0213] Based on n second hash functions, each key and value in the data bucket is divided into n fragments to generate a plaintext array corresponding to each data bucket.

[0214] Each plaintext array is encrypted using the key information to generate the first ciphertext data.

[0215] In this embodiment of the invention, firstly, according to the first hash function, the data records of the plaintext data key in the database are divided into multiple data buckets. Then, the values ​​corresponding to the key are also divided into the corresponding data buckets. The key includes, but is not limited to, ID card number, mobile phone number, etc. Then, for each element (including key and corresponding value) in each data bucket, an Exclusive OR Filter (XOR Filter) is used to construct a plaintext array. That is, according to n second hash functions, each element in the data bucket is divided into n fragments to generate a plaintext array. Finally, according to the public key in the key information, the elements in the plaintext array of each data bucket are encrypted to generate a homomorphic ciphertext array for each data bucket. The homomorphic ciphertext arrays of all data buckets constitute the first ciphertext data. That is, the first row of the first ciphertext data is the homomorphic ciphertext array of data bucket 0, the second row is the homomorphic ciphertext array of data bucket 1, and so on. Figure 5 The process of dividing each key in the set of keys in a data bucket into 3 shards and encrypting them is provided for reference. The process of dividing the value is similar and will not be elaborated here.

[0216] Optionally, before obtaining the second query request sent by the service device, the method includes:

[0217] Obtain the authentication request sent by the first device, the authentication request including the device information of the first device and the requested query service scope;

[0218] The first device is approved according to the authentication request, and an approval result is obtained;

[0219] If the approval result is passed, the query permissions of the first device are adjusted according to the scope of the requested query service and a first authentication result is generated. The first authentication result is used to indicate that the first device has the right to query data.

[0220] If the approval result is not approved, a second authentication result is generated, which indicates that the first device does not have the right to query data.

[0221] Send the first authentication result or the second authentication result to the first device.

[0222] In this embodiment of the invention, an authentication request sent by the first device is reviewed to determine whether the first device has the right to query data. The device information includes, but is not limited to, ID information.

[0223] Optionally, the authentication request may also include the number of queries and the number of decryptions;

[0224] The method further includes:

[0225] Upon generating the first authentication result, record the number of queries and the number of decryptions;

[0226] After sending the second data to the service device, the method further includes:

[0227] The number of queries is reduced by one;

[0228] After sending the decrypted data to the first device, the method further includes:

[0229] The number of decryption attempts is reduced by one.

[0230] In this embodiment of the invention, for the first device, each time data is queried, the query count is reduced by one until the query count is reduced to 0. Similarly, each time data is decrypted, the decryption count is reduced by one until the decryption count is reduced to 0.

[0231] Optionally, after generating the first authentication result, the method further includes:

[0232] Send the hash function that generated the first ciphertext data and the key information to the first device.

[0233] In this embodiment of the invention, after generating the first authentication result, in order to facilitate the first device to query data more efficiently and accurately, a hash function and key information for generating the first ciphertext data are sent to the first device, so that the first device can confirm the address information corresponding to the data to be queried in the first ciphertext data before querying the data.

[0234] Optionally, the first authentication result includes an authentication code, which indicates that the first device has the right to query data;

[0235] The second query request includes the authentication code;

[0236] The decryption request includes the authentication code;

[0237] The step of querying and obtaining the second data corresponding to the second address information in the second encrypted data according to the second query request includes:

[0238] After the authentication code is successfully authenticated, the second data corresponding to the second address information in the second encrypted data is obtained according to the second query request;

[0239] The step of decrypting the encrypted data based on the key information to obtain decrypted data includes:

[0240] After the authentication code is successfully authenticated, the encrypted data is decrypted based on the key information to obtain the decrypted data.

[0241] In this embodiment of the invention, the first authentication result includes an authentication code. When the first device requests to query and decrypt data from the second device, it carries the authentication code. The second device will only start querying and / or decrypting data after the authentication code is successfully authenticated, thus ensuring the security of data query.

[0242] The method of the present invention will be described below through specific embodiments:

[0243] In Example 1, the process of data preprocessing by the service device and the second device to generate the first ciphertext data and the second ciphertext data is as follows:

[0244] The first step is for the second device to generate homomorphically encrypted key information;

[0245] The second step involves the second device dividing the data in the database into multiple data buckets based on the first hash function.

[0246] The third step involves the second device using n second hash functions to divide each element in each data bucket into n fragments, generating a plaintext array.

[0247] Fourth, the second device uses the public key in the key information to encrypt each element in the plaintext array to generate a homomorphic ciphertext array for each data bucket. Based on the homomorphic ciphertext arrays of all data buckets, the first ciphertext data is constructed.

[0248] Fifth step: The second device sends the first encrypted data to the service device;

[0249] The sixth step is for the service device to shuffle the first ciphertext data to generate the third ciphertext data, then add noise to each element in the third ciphertext data to generate the second ciphertext data, and record the address mapping relationship between the first ciphertext data and the second ciphertext data.

[0250] Step 7: The service device sends the second encrypted data to the second device.

[0251] In this embodiment of the invention, the first encrypted data sent by the second device to the service device is secretly shared and homomorphically encrypted. The service device cannot decrypt it without the homomorphically encrypted private key, so the privacy of the second device cannot be known by the service device. When the service device sends the second encrypted data to the second device, the address mapping relationship between the first and second encrypted data and the added noise are known only to the service device. Therefore, the second device cannot deduce the first address information for the first encrypted data from the second address information for the second encrypted data, and thus cannot infer access to a specific plaintext data, resulting in very high security.

[0252] Example 2: The process of the second device authenticating the first device is as follows:

[0253] The first step is for the first device to send an authentication request to the second device. The authentication request includes, but is not limited to, the ID, the scope of the requested query service, the number of queries, and the number of decryption attempts.

[0254] The second step is for the second device to review the authentication request. If it approves the first device's query, it generates a first authentication result and adjusts the first device's query permissions according to the scope of the query service. If it does not approve the first device's query, it generates a second authentication result.

[0255] The third step is for the second device to send either the first authentication result or the second authentication result to the first device.

[0256] Example 3, as Figure 6 As shown in Embodiment 1 and Embodiment 2, the process by which the first device queries data from the second device through the service device is as follows:

[0257] Step S601: If the first device has the right to query data from the second device, the first device obtains the hash function and key information of the first encrypted data generated by the second device.

[0258] In step S602, the first device determines the first data it wants to query and obtains, and obtains the first address information corresponding to the first data in the first encrypted data according to the hash function. For example, the first data that the first device wants to query and obtain is the value corresponding to the ID of the user of the first device as the key value, and the first address information is the address of the value in the first encrypted data.

[0259] Step S603: The first device sends a first query request to the service device, the first query request including first address information;

[0260] Step S604: The service device maps the first address information to the second address information in the second ciphertext data according to the address mapping relationship between the first ciphertext data and the second ciphertext data.

[0261] Step S605: The service device sends a second query request to the second device, the second query request including the second address information;

[0262] Step S606: The second device queries the second ciphertext data according to the second address information in the second query request to obtain the ciphertext value sequence of the second data, which is the first data, and at the same time, the query count of the first device is decremented by one.

[0263] Step S607: The second device sends the second data to the service device;

[0264] Step S608: The service device removes noise from the second data, which is added when the service device generates the second encrypted data;

[0265] Step S609: The service device sends the noise-removed second data to the first device;

[0266] In step S610, the first device encrypts the second data according to the public key in the key information to generate encrypted data;

[0267] Step S611: The first device sends a decryption request to the second device, the decryption request including encrypted data;

[0268] In step S612, the second device decrypts the encrypted data using the private key in the key information to obtain the decrypted data.

[0269] Step S613: The second device sends decrypted data to the first device;

[0270] In step S614, the first device decrypts the decrypted data to obtain the first data.

[0271] In this embodiment of the invention, regarding data security, not only is the security of anonymous data query guaranteed, but also 100% indistinguishability is ensured, while existing anonymous query schemes can only achieve a maximum indistinguishability of one million (for data exceeding one hundred million). Regarding query efficiency, during the data query phase, the first device only needs to perform one query interaction with the service device, and then one decryption interaction with the second device to complete an anonymous query. Compared to the fastest existing anonymous query scheme, the performance can be improved by one to two orders of magnitude. Furthermore, a ciphertext storage mode based on data bucketing, intra-bucket sharding, and overlaying homomorphic encryption (for the generation of the first ciphertext data in the second device) is proposed. Under this mode, a query for any single piece of data can be mapped to a query for the three shard addresses of a certain bucket, thereby decoupling the anonymous query performance from the data volume. That is, regardless of whether the data volume is 1 million, 100 million, or 10 billion, the performance of a single anonymous query using this query mode can be maintained within a few hundred milliseconds, essentially achieving the performance of a plaintext query.

[0272] like Figure 7 As shown, this embodiment of the invention also provides a service device 700, including a transceiver 710 and a processor 720, wherein,

[0273] The transceiver 710 is used to obtain a first query request sent by the first device. The first query request is used to request to obtain first data on the second device, and the first query request includes first address information of the first data stored on the second device.

[0274] The processor 720 is configured to query the address mapping relationship between the first ciphertext data and the second ciphertext data based on the first address information, and determine the second address information corresponding to the first data in the second ciphertext data; wherein, the first ciphertext data is data obtained by the second device after encrypting the stored database, and the second ciphertext data is data obtained by the service device after changing the order of the first ciphertext data and performing encryption processing.

[0275] The transceiver 710 is also used for:

[0276] Send a second query request to the second device, the second query request being used to request the first data, and the second query request including the second address information;

[0277] Receive the second data sent by the second device, wherein the second data is a sequence of ciphertext values ​​corresponding to the first data;

[0278] Send the second data to the first device.

[0279] Optionally, the transceiver 710 is further configured to:

[0280] Obtain the first encrypted data sent by the second device;

[0281] The processor 720 is also used for:

[0282] The order of each element in the first ciphertext data is shuffled to obtain the third ciphertext data;

[0283] By encrypting each element in the third ciphertext data by adding noise, the second ciphertext data and the address mapping relationship between the first ciphertext data and the second ciphertext data are obtained.

[0284] Optionally, the processor 720 is further configured to:

[0285] The noise is removed from the second data.

[0286] like Figure 8 As shown, this embodiment of the invention also provides a first device 800, including a transceiver 810 and a processor 820, wherein,

[0287] The transceiver 810 is used for:

[0288] Send a first query request to the service device, the query request being used to request the acquisition of first data on the second device, and the query request including the first address information of the first data stored on the second device;

[0289] The service device sends second data; wherein the second data is a sequence of ciphertext values ​​corresponding to the first data obtained by the service device from the second device according to the second address information, the second address information is obtained by the service device according to the address mapping relationship between the first ciphertext data and the second ciphertext data, the first ciphertext data is data obtained by the second device after encrypting the stored database, and the second ciphertext data is data obtained by the service device after changing the order of the first ciphertext data and encrypting it.

[0290] The processor 820 is used to encrypt the second data according to the key information of the second device to obtain encrypted data;

[0291] The transceiver 810 is also used for:

[0292] Send a decryption request to the second device, the decryption request including the encrypted data;

[0293] Obtain the decrypted data returned by the second device after decrypting the encrypted data according to the decryption request;

[0294] The processor 820 is further configured to decrypt the decrypted data to obtain the first data.

[0295] Optionally, the transceiver 810 is further configured to:

[0296] Obtain the hash function used by the second device to generate the first ciphertext data and the key information;

[0297] The processor 820 is also used for:

[0298] Based on the hash function, the first address information corresponding to the first data in the first ciphertext data is determined.

[0299] Optionally, the transceiver 810 is further configured to:

[0300] Send an authentication request to the second device, the authentication request including the device information of the first device and the scope of the query service requested;

[0301] The device receives an authentication result sent by the second device, wherein the authentication result is either a first authentication result or a second authentication result, wherein the first authentication result is used to indicate that the first device has the right to query data, and the second authentication result is used to indicate that the first device does not have the right to query data.

[0302] Upon receiving the first authentication result, the hash function used by the second device to generate the first ciphertext data and the key information are obtained.

[0303] Optionally, the first address information generated in the processor 820 includes:

[0304] The target query address and m obfuscated query addresses, wherein the target query address is the address corresponding to the first data;

[0305] The obfuscated query address is generated based on the target query address, and the format of the obfuscated query address is the same as that of the target query address, where m is an integer greater than or equal to 0.

[0306] Optionally, the processor 820 is further configured to:

[0307] The required first ciphertext is obtained from the second data based on the first address information;

[0308] The first ciphertext is processed using the homomorphic addition method to obtain the second ciphertext;

[0309] Based on the key information, any random number is encrypted to obtain the third ciphertext;

[0310] The second ciphertext and the third ciphertext are homomorphically added to obtain encrypted data.

[0311] like Figure 9 As shown, this embodiment of the invention also provides a second device 900, including a transceiver 910 and a processor 920, wherein,

[0312] The transceiver 910 is used to acquire a second query request sent by the service device. The second query request is used to request the acquisition of first data, and the second query request includes second address information corresponding to the first data in the second encrypted data. The second address information is obtained by the service device by querying the address mapping relationship between the first encrypted data and the second encrypted data based on the first address information. The first address information is the address information corresponding to the first data in the first encrypted data.

[0313] The processor 920 is configured to query and obtain the second data corresponding to the second address information in the second ciphertext data according to the second query request, wherein the second data is the ciphertext value sequence corresponding to the first data;

[0314] The transceiver 910 is also used to send second data to the service device;

[0315] The transceiver 910 is also used to acquire a decryption request sent by the first device, the decryption request including encrypted data after the first device encrypts the second data according to the key information;

[0316] The processor 920 is further configured to decrypt the encrypted data based on the key information to obtain decrypted data;

[0317] The transceiver 910 is also used to send the decrypted data to the first device.

[0318] Optionally, the processor 920 is further configured to:

[0319] The data in the database is fragmented and encrypted according to the hash function and the key information to generate the first ciphertext data;

[0320] The transceiver 910 is also used for:

[0321] Send the first encrypted data to the service device;

[0322] The service device receives second encrypted data sent by the service device, wherein the second encrypted data is encrypted and transformed by the service device based on the first encrypted data.

[0323] Optionally, the processor 920 is further configured to:

[0324] The data in the database is divided into multiple data buckets according to the first hash function. Each data bucket includes multiple data keys and the data value corresponding to the key.

[0325] Based on n second hash functions, each key and value in the data bucket is divided into n fragments to generate a plaintext array corresponding to each data bucket.

[0326] Each plaintext array is encrypted using the key information to generate the first ciphertext data.

[0327] Optionally, the transceiver 910 is further configured to:

[0328] Obtain the authentication request sent by the first device, the authentication request including the device information of the first device and the requested query service scope;

[0329] The processor 920 is also used for:

[0330] The first device is approved according to the authentication request, and an approval result is obtained;

[0331] If the approval result is passed, the query permissions of the first device are adjusted according to the scope of the requested query service and a first authentication result is generated. The first authentication result is used to indicate that the first device has the right to query data.

[0332] If the approval result is not approved, a second authentication result is generated, which indicates that the first device does not have the right to query data.

[0333] The transceiver 910 is also used to send the first authentication result or the second authentication result to the first device.

[0334] Optionally, the transceiver 910 is further configured to:

[0335] Send the hash function that generated the first ciphertext data and the key information to the first device.

[0336] Optionally, the first authentication result generated by the processor 920 includes an authentication code, which indicates that the first device has the right to query data;

[0337] The second query request obtained by the transceiver 910 includes the authentication code; the decryption request includes the authentication code;

[0338] The processor 920 is also used for:

[0339] After the authentication code is successfully authenticated, the second data corresponding to the second address information in the second encrypted data is obtained according to the second query request;

[0340] After the authentication code is successfully authenticated, the encrypted data is decrypted based on the key information to obtain the decrypted data.

[0341] like Figure 10 As shown, this embodiment of the invention also provides a data query device, applied to a service device, comprising:

[0342] The first acquisition module 1001 is used to acquire a first query request sent by the first device. The first query request is used to request the acquisition of first data on the second device, and the first query request includes the first address information of the first data stored on the second device.

[0343] The first query module 1002 is used to query the address mapping relationship between the first encrypted data and the second encrypted data based on the first address information, and determine the second address information corresponding to the first data in the second encrypted data; wherein, the first encrypted data is data obtained by the second device after encrypting the stored database, and the second encrypted data is data obtained by the service device after changing the order of the first encrypted data and performing encryption processing.

[0344] The first sending module 1003 is used to send a second query request to the second device. The second query request is used to request the acquisition of the first data, and the second query request includes the second address information.

[0345] The first receiving module 1004 is used to receive the second data sent by the second device, wherein the second data is a sequence of ciphertext values ​​corresponding to the first data;

[0346] The second sending module 1005 is used to send the second data to the first device.

[0347] Optionally, the device further includes:

[0348] The sixth acquisition module is used to acquire the first encrypted data sent by the second device;

[0349] The first conversion module is used to shuffle the order of each element in the first ciphertext data to obtain the third ciphertext data;

[0350] The second encryption module is used to encrypt each element in the third ciphertext data by adding noise, thereby obtaining the second ciphertext data and the address mapping relationship between the first ciphertext data and the second ciphertext data.

[0351] Optionally, the device further includes:

[0352] The third decryption module is used to remove the noise from the second data.

[0353] It should be noted that the embodiments of this device are devices corresponding to the embodiments of the above methods. All implementations in the embodiments of the above methods are applicable to the embodiments of this device and can achieve the same technical effect.

[0354] like Figure 11 As shown, this embodiment of the invention also provides a data query device, applied to a first device, comprising:

[0355] The third sending module 1101 is used to send a first query request to the service device. The query request is used to request to obtain first data on the second device, and the query request includes the first address information of the first data stored on the second device.

[0356] The second acquisition module 1102 is used to acquire the second data sent by the service device; wherein, the second data is the sequence of ciphertext values ​​corresponding to the first data obtained by the service device from the second device according to the second address information, the second address information is obtained by the service device according to the address mapping relationship between the first ciphertext data and the second ciphertext data, the first ciphertext data is the data obtained by the second device after encrypting the stored database, and the second ciphertext data is the data after the service device changes the order of the first ciphertext data and performs encryption processing;

[0357] The first encryption module 1103 is used to encrypt the second data according to the key information of the second device to obtain encrypted data;

[0358] The fourth sending module 1104 is used to send a decryption request to the second device, the decryption request including the encrypted data;

[0359] The third acquisition module 1105 is used to acquire the decrypted data returned by the second device after decrypting the encrypted data according to the decryption request;

[0360] The first decryption module 1106 is used to decrypt the decrypted data to obtain the first data.

[0361] Optionally, the device further includes:

[0362] The seventh acquisition module is used to acquire the hash function used by the second device to generate the first ciphertext data and the key information;

[0363] The first determining module is used to determine the first address information corresponding to the first data in the first ciphertext data according to the hash function.

[0364] Optionally, the device further includes:

[0365] The seventh sending module is used to send an authentication request to the second device, the authentication request including the device information of the first device and the requested query service scope;

[0366] The second receiving module is used to receive the authentication result sent by the second device. The authentication result is either a first authentication result or a second authentication result. The first authentication result is used to indicate that the first device has the right to query data, and the second authentication result is used to indicate that the first device does not have the right to query data.

[0367] The seventh acquisition module includes:

[0368] The first acquisition unit is configured to, upon receiving the first authentication result, acquire the hash function used by the second device to generate the first ciphertext data and the key information.

[0369] Optionally, the first address information in the third sending module 1101 includes:

[0370] The target query address and m obfuscated query addresses, wherein the target query address is the address corresponding to the first data;

[0371] The obfuscated query address is generated based on the target query address, and the format of the obfuscated query address is the same as that of the target query address, where m is an integer greater than or equal to 0.

[0372] Optionally, the first encryption module 1103 includes:

[0373] The second acquisition unit is used to acquire the required first ciphertext from the second data based on the first address information;

[0374] The first computing unit is used to process the first ciphertext according to the homomorphic addition method to obtain the second ciphertext;

[0375] The first encryption unit is used to encrypt any random number based on the key information to obtain the third ciphertext;

[0376] The second computing unit is used to perform homomorphic addition on the second ciphertext and the third ciphertext to obtain encrypted data.

[0377] It should be noted that the embodiments of this device are devices corresponding to the embodiments of the above methods. All implementations in the embodiments of the above methods are applicable to the embodiments of this device and can achieve the same technical effect.

[0378] like Figure 12 As shown, this embodiment of the invention also provides a data query device, applied to a second device, comprising:

[0379] The fourth acquisition module 1201 is used to acquire a second query request sent by the service device. The second query request is used to request the acquisition of first data, and the second query request includes second address information corresponding to the first data in the second encrypted data. The second address information is obtained by the service device according to the first address information to query the address mapping relationship between the first encrypted data and the second encrypted data. The first address information is the address information corresponding to the first data in the first encrypted data.

[0380] The second query module 1202 is used to query and obtain the second data corresponding to the second address information in the second ciphertext data according to the second query request, wherein the second data is the ciphertext value sequence corresponding to the first data;

[0381] The fifth sending module 1203 is used to send second data to the service device;

[0382] The fifth acquisition module 1204 is used to acquire a decryption request sent by the first device, the decryption request including encrypted data after the first device encrypts the second data according to the key information;

[0383] The second decryption module 1205 is used to decrypt the encrypted data according to the key information to obtain decrypted data;

[0384] The sixth sending module 1206 is used to send the decrypted data to the first device.

[0385] Optionally, the device further includes:

[0386] The first generation module is used to fragment and encrypt the data in the database according to the hash function and the key information to generate the first ciphertext data.

[0387] The eighth sending module is used to send the first encrypted data to the service device;

[0388] The third receiving module is used to receive the second encrypted data sent by the service device, wherein the second encrypted data is encrypted and converted by the service device based on the first encrypted data.

[0389] Optionally, the first generation module includes:

[0390] The first partitioning unit is used to divide the data in the database into multiple data buckets according to the first hash function. Each data bucket includes multiple data keys and data values ​​corresponding to the keys.

[0391] The second partitioning unit is used to divide each key and value in the data bucket into n fragments according to n second hash functions, and generate a plaintext array corresponding to each data bucket.

[0392] The second encryption unit is used to encrypt each of the plaintext arrays using key information to generate first ciphertext data.

[0393] Optionally, the device further includes:

[0394] The eighth acquisition module is used to acquire the authentication request sent by the first device, the authentication request including the device information of the first device and the scope of the service to be queried;

[0395] The first approval module is used to approve the first device according to the authentication request and obtain the approval result;

[0396] The second generation module is used to adjust the query permissions of the first device and generate a first authentication result according to the scope of the application query service when the approval result is approved. The first authentication result is used to indicate that the first device has the right to query data.

[0397] The third generation module is used to generate a second authentication result if the approval result is not approved. The second authentication result is used to indicate that the first device does not have the right to query data.

[0398] The ninth sending module is used to send the first authentication result or the second authentication result to the first device.

[0399] Optionally, the device further includes:

[0400] The tenth sending module is used to send the hash function that generates the first ciphertext data and the key information to the first device.

[0401] Optionally, the first authentication result in the second generation module includes an authentication code, which indicates that the first device has the right to query data;

[0402] The second query request acquired by the fourth acquisition module 1201 includes the authentication code;

[0403] The decryption request acquired by the fifth acquisition module 1204 includes the authentication code;

[0404] The second query module 1202 includes:

[0405] The first query unit is used to obtain the second data corresponding to the second address information in the second encrypted data according to the second query request after the authentication code is successfully authenticated;

[0406] The second decryption module 1205 includes:

[0407] The first decryption unit is used to decrypt the encrypted data according to the key information after the authentication code is successfully authenticated, so as to obtain decrypted data.

[0408] It should be noted that the embodiments of this device are devices corresponding to the embodiments of the above methods. All implementations in the embodiments of the above methods are applicable to the embodiments of this device and can achieve the same technical effect.

[0409] This invention also provides a network device, including: a processor, a memory, and a program stored in the memory and executable on the processor. When the program is executed by the processor, it implements the data query method described in any of the preceding claims and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0410] This invention also provides a readable storage medium, comprising: a program stored on the readable storage medium, wherein when the program is executed by a processor, it implements the steps of the data query method described in any of the preceding claims and achieves the same technical effect; to avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc.

[0411] This invention also provides a computer program product, including computer instructions. When the computer instructions are executed by a processor, they implement the steps of the data query method described in any of the preceding claims and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0412] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0413] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A data query method, characterized in that, Performed by the service device, the method includes: Obtain a first query request sent by a first device, wherein the first query request is used to request the acquisition of first data on a second device, and the first query request includes first address information of the first data stored on the second device; Based on the first address information, the address mapping relationship between the first ciphertext data and the second ciphertext data is queried to determine the second address information corresponding to the first data in the second ciphertext data; wherein, the first ciphertext data is data obtained by the second device after encrypting the stored database, and the second ciphertext data is data obtained by the service device after changing the order of the first ciphertext data and performing encryption processing; Send a second query request to the second device, the second query request being used to request the first data, and the second query request including the second address information; Receive second data sent by the second device, wherein the second data is a sequence of ciphertext values ​​corresponding to the first data; Send the second data to the first device.

2. The data query method according to claim 1, characterized in that, Before obtaining the first query request sent by the first device, the method further includes: Obtain the first encrypted data sent by the second device; The order of each element in the first ciphertext data is shuffled to obtain the third ciphertext data; By encrypting each element in the third ciphertext data by adding noise, the second ciphertext data and the address mapping relationship between the first ciphertext data and the second ciphertext data are obtained.

3. The data query method according to claim 2, characterized in that, Before sending the second data to the first device, the method further includes: The noise is removed from the second data.

4. A data query method, characterized in that, Performed by a first device, the method includes: Send a first query request to the service device, the query request being used to request the acquisition of first data on the second device, and the query request including the first address information of the first data stored on the second device; The service device sends second data; wherein the second data is a sequence of ciphertext values ​​corresponding to the first data obtained by the service device from the second device according to the second address information, the second address information is obtained by the service device according to the address mapping relationship between the first ciphertext data and the second ciphertext data, the first ciphertext data is data obtained by the second device after encrypting the stored database, and the second ciphertext data is data obtained by the service device after changing the order of the first ciphertext data and encrypting it. The second data is encrypted based on the key information of the second device to obtain encrypted data; Send a decryption request to the second device, the decryption request including the encrypted data; Obtain the decrypted data returned by the second device after decrypting the encrypted data according to the decryption request; The decrypted data is decrypted to obtain the first data.

5. The data query method according to claim 4, characterized in that, Before sending the first query request to the service device, the method further includes: Obtain the hash function used by the second device to generate the first ciphertext data and the key information; Based on the hash function, the first address information corresponding to the first data in the first ciphertext data is determined.

6. The data query method according to claim 5, characterized in that, Before obtaining the hash function used by the second device to generate the first ciphertext data and the key information, the method further includes: Send an authentication request to the second device, the authentication request including the device information of the first device and the scope of the query service requested; The device receives an authentication result sent by the second device, wherein the authentication result is either a first authentication result or a second authentication result, wherein the first authentication result is used to indicate that the first device has the right to query data, and the second authentication result is used to indicate that the first device does not have the right to query data. The step of obtaining the hash function used by the second device to generate the first ciphertext data and the key information includes: Upon receiving the first authentication result, the hash function used by the second device to generate the first ciphertext data and the key information are obtained.

7. The data query method according to claim 4, characterized in that, The first address information includes: The target query address and m obfuscated query addresses, wherein the target query address is the address corresponding to the first data; The obfuscated query address is generated based on the target query address, and the format of the obfuscated query address is the same as that of the target query address, where m is an integer greater than or equal to 0.

8. The data query method according to claim 4, characterized in that, Based on the key information of the second device, the second data is encrypted to obtain encrypted data, including: The required first ciphertext is obtained from the second data based on the first address information; The first ciphertext is processed using the homomorphic addition method to obtain the second ciphertext; Based on the key information, any random number is encrypted to obtain the third ciphertext; The second ciphertext and the third ciphertext are homomorphically added to obtain encrypted data.

9. A data query method, characterized in that, Performed by a second device, the method includes: The service device sends a second query request, which is used to request the acquisition of first data. The second query request includes second address information corresponding to the first data in the second encrypted data. The second address information is obtained by the service device by querying the address mapping relationship between the first encrypted data and the second encrypted data based on the first address information. The first address information is the address information corresponding to the first data in the first encrypted data. According to the second query request, the second data corresponding to the second address information in the second ciphertext data is obtained by querying, wherein the second data is the ciphertext value sequence corresponding to the first data; Send the second data to the service device; Obtain a decryption request sent by a first device, the decryption request including encrypted data after the first device encrypts the second data according to key information; The encrypted data is decrypted based on the key information to obtain decrypted data; The decrypted data is sent to the first device.

10. The data query method according to claim 9, characterized in that, Before obtaining the second query request sent by the service device, the method includes: The data in the database is fragmented and encrypted according to the hash function and the key information to generate the first ciphertext data; Send the first encrypted data to the service device; The service device receives second encrypted data sent by the service device, wherein the second encrypted data is encrypted and transformed by the service device based on the first encrypted data.

11. The data query method according to claim 10, characterized in that, The data in the database is fragmented and encrypted according to the hash function and the key information to generate the first ciphertext data, including: The data in the database is divided into multiple data buckets according to the first hash function. Each data bucket includes multiple data keys and the data value corresponding to the key. Based on n second hash functions, each key and value in the data bucket is divided into n fragments to generate a plaintext array corresponding to each data bucket. Each plaintext array is encrypted using the key information to generate the first ciphertext data.

12. The data query method according to claim 9, characterized in that, Before obtaining the second query request sent by the service device, the method includes: Obtain the authentication request sent by the first device, the authentication request including the device information of the first device and the requested query service scope; The first device is approved according to the authentication request, and an approval result is obtained; If the approval result is passed, the query permissions of the first device are adjusted according to the scope of the requested query service and a first authentication result is generated. The first authentication result is used to indicate that the first device has the right to query data. If the approval result is not approved, a second authentication result is generated, which indicates that the first device does not have the right to query data. Send the first authentication result or the second authentication result to the first device.

13. The data query method according to claim 12, characterized in that, After generating the first authentication result, the method further includes: Send the hash function that generated the first ciphertext data and the key information to the first device.

14. The data query method according to claim 12, characterized in that, The first authentication result includes an authentication code, which is used to indicate that the first device has the right to query data; The second query request includes the authentication code; The decryption request includes the authentication code; The step of querying and obtaining the second data corresponding to the second address information in the second encrypted data according to the second query request includes: After the authentication code is successfully authenticated, the second data corresponding to the second address information in the second encrypted data is obtained according to the second query request; The step of decrypting the encrypted data based on the key information to obtain decrypted data includes: After the authentication code is successfully authenticated, the encrypted data is decrypted based on the key information to obtain the decrypted data.

15. A service device, characterized in that, Includes transceivers and processors, among which, The transceiver is used to acquire a first query request sent by a first device. The first query request is used to request the acquisition of first data on a second device, and the first query request includes first address information of the first data stored on the second device. The processor is configured to query the address mapping relationship between the first ciphertext data and the second ciphertext data based on the first address information, and determine the second address information corresponding to the first data in the second ciphertext data; wherein, the first ciphertext data is data obtained by the second device after encrypting the stored database, and the second ciphertext data is data obtained by the service device after changing the order of the first ciphertext data and performing encryption processing. The transceiver is also used for: Send a second query request to the second device, the second query request being used to request the first data, and the second query request including the second address information; Receive second data sent by the second device, wherein the second data is a sequence of ciphertext values ​​corresponding to the first data; Send the second data to the first device.

16. A first device, characterized in that, Includes transceivers and processors, among which, The transceiver is used for: Send a first query request to the service device, the query request being used to request the acquisition of first data on the second device, and the query request including the first address information of the first data stored on the second device; The service device sends second data; wherein the second data is a sequence of ciphertext values ​​corresponding to the first data obtained by the service device from the second device according to the second address information, the second address information is obtained by the service device according to the address mapping relationship between the first ciphertext data and the second ciphertext data, the first ciphertext data is data obtained by the second device after encrypting the stored database, and the second ciphertext data is data obtained by the service device after changing the order of the first ciphertext data and encrypting it. The processor is configured to encrypt the second data according to the key information of the second device to obtain encrypted data; The transceiver is also used for: Send a decryption request to the second device, the decryption request including the encrypted data; Obtain the decrypted data returned by the second device after decrypting the encrypted data according to the decryption request; The processor is further configured to decrypt the decrypted data to obtain the first data.

17. A second device, characterized in that, Includes transceivers and processors, among which, The transceiver is used to acquire a second query request sent by the service device. The second query request is used to request the acquisition of first data, and the second query request includes second address information corresponding to the first data in the second encrypted data. The second address information is obtained by the service device by querying the address mapping relationship between the first encrypted data and the second encrypted data based on the first address information. The first address information is the address information corresponding to the first data in the first encrypted data. The processor is configured to query and obtain the second data corresponding to the second address information in the second ciphertext data according to the second query request, wherein the second data is the ciphertext value sequence corresponding to the first data; The transceiver is also used to send second data to the service device; The transceiver is also used to acquire a decryption request sent by the first device, the decryption request including encrypted data after the first device encrypts the second data according to the key information; The processor is further configured to decrypt the encrypted data based on the key information to obtain decrypted data; The transceiver is also used to send the decrypted data to the first device.

18. A data query device, characterized in that, Applied to service equipment, including: The first acquisition module is used to acquire a first query request sent by the first device. The first query request is used to request the acquisition of first data on the second device, and the first query request includes the first address information of the first data stored on the second device. The first query module is used to query the address mapping relationship between the first encrypted data and the second encrypted data based on the first address information, and determine the second address information corresponding to the first data in the second encrypted data; wherein, the first encrypted data is data obtained by the second device after encrypting the stored database, and the second encrypted data is data obtained by the service device after changing the order of the first encrypted data and encrypting it; The first sending module is used to send a second query request to the second device, the second query request being used to request the acquisition of the first data, and the second query request including the second address information; The first receiving module is configured to receive second data sent by the second device, wherein the second data is a sequence of ciphertext values ​​corresponding to the first data; The second sending module is used to send the second data to the first device.

19. A data query device, characterized in that, Applied to the first device, including: The third sending module is used to send a first query request to the service device. The query request is used to request the acquisition of first data on the second device, and the query request includes the first address information of the first data stored on the second device. The second acquisition module is used to acquire the second data sent by the service device; wherein, the second data is the sequence of ciphertext values ​​corresponding to the first data obtained by the service device from the second device according to the second address information, the second address information is obtained by the service device according to the address mapping relationship between the first ciphertext data and the second ciphertext data, the first ciphertext data is the data obtained by the second device after encrypting the stored database, and the second ciphertext data is the data after the service device changes the order of the first ciphertext data and performs encryption processing; The first encryption module is used to encrypt the second data according to the key information of the second device to obtain encrypted data; The fourth sending module is used to send a decryption request to the second device, the decryption request including the encrypted data; The third acquisition module is used to acquire the decrypted data returned by the second device after decrypting the encrypted data according to the decryption request; The first decryption module is used to decrypt the decrypted data to obtain the first data.

20. A data query device, characterized in that, Applied to a second device, including: The fourth acquisition module is used to acquire a second query request sent by the service device. The second query request is used to request the acquisition of first data, and the second query request includes second address information corresponding to the first data in the second encrypted data. The second address information is obtained by the service device according to the first address information to query the address mapping relationship between the first encrypted data and the second encrypted data. The first address information is the address information corresponding to the first data in the first encrypted data. The second query module is used to query and obtain the second data corresponding to the second address information in the second ciphertext data according to the second query request, wherein the second data is the ciphertext value sequence corresponding to the first data; The fifth sending module is used to send second data to the service device; The fifth acquisition module is used to acquire a decryption request sent by the first device, the decryption request including encrypted data after the first device encrypts the second data according to the key information; The second decryption module is used to decrypt the encrypted data according to the key information to obtain decrypted data; The sixth sending module is used to send the decrypted data to the first device.

21. A network device, characterized in that, include: A processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the data query method as described in any one of claims 1 to 3, or the data query method as described in any one of claims 4 to 8, or the data query method as described in any one of claims 9 to 14.

22. A readable storage medium, characterized in that, include: The readable storage medium stores a program that, when executed by a processor, implements the steps of the data query method as described in any one of claims 1 to 3, or the steps of the data query method as described in any one of claims 4 to 8, or the steps of the data query method as described in any one of claims 9 to 14.

23. A computer program product, characterized in that, It includes computer instructions, which, when executed by a processor, implement the steps of the data query method as described in any one of claims 1 to 3, or the steps of the data query method as described in any one of claims 4 to 8, or the steps of the data query method as described in any one of claims 9 to 14.

Images