A method for controlling a data access right, applied to a blockchain network including a first proxy node and at least one second proxy node, wherein the method comprises: receiving, by the first proxy node, a first request message from a request node, wherein the first request message comprises an identity of the request node and an identifier of to-be-accessed data; determining, by the first proxy node, a first ciphertext on a blockchain based on the identifier of the to-be-accessed data, wherein the first ciphertext is generated by encrypting the to-be-accessed data, and determining, based on the identity of the request node, whether the request node has a right to read the first ciphertext; and if the request node has the right to read the first ciphertext, initiating a right verification request for the request node to the at least one second proxy node, and determining, based on a feedback result of the at least one second proxy node, provisioning of the first ciphertext, wherein the determining, based on a feedback result of the at least one second proxy node, provisioning of the first ciphertext comprises: receiving, by the first proxy node, partial keys sent by at least k second proxy nodes, wherein the partial keys are generated and sent by the second proxy nodes after the second proxy nodes verify, based on the identity of the request node, that the request node has the right to read the first ciphertext; recovering, by the first proxy node, the at least k partial keys to generate a conversion key; converting, by the first proxy node, the first ciphertext into a second ciphertext encrypted by a public key of the request node, by using the conversion key and an encryption algorithm; and sending, by the first proxy node, the second ciphertext to the request node. receiving, by the first proxy node, a first request message from a request node, wherein the first request message comprises an identity of the request node and an identifier of to-be-accessed data; determining, by the first proxy node, a first ciphertext on a blockchain based on the identifier of the to-be-accessed data, wherein the first ciphertext is generated by encrypting the to-be-accessed data, and determining, based on the identity of the request node, whether the request node has a right to read the first ciphertext; and if the request node has the right to read the first ciphertext, initiating a right verification request for the request node to the at least one second proxy node, and determining, based on a feedback result of the at least one second proxy node, provisioning of the first ciphertext, wherein the determining, based on a feedback result of the at least one second proxy node, provisioning of the first ciphertext comprises: receiving, by the first proxy node, partial keys sent by at least k second proxy nodes, wherein the partial keys are generated and sent by the second proxy nodes after the second proxy nodes verify, based on the identity of the request node, that the request node has the right to read the first ciphertext; recovering, by the first proxy node, the at least k partial keys to generate a conversion key; converting, by the first proxy node, the first ciphertext into a second ciphertext encrypted by a public key of the request node, by using the conversion key and an encryption algorithm; and sending, by the first proxy node, the second ciphertext to the request node. receiving, by the first proxy node, partial keys sent by at least k second proxy nodes, wherein the partial keys are generated and sent by the second proxy nodes after the second proxy nodes verify, based on the identity of the request node, that the request node has the right to read the first ciphertext; recovering, by the first proxy node, the at least k partial keys to generate a conversion key; converting, by the first proxy node, the first ciphertext into a second ciphertext encrypted by a public key of the request node, by using the conversion key and an encryption algorithm; and sending, by the first proxy node, the second ciphertext to the request node.