Shared data distribution method and electronic device

Abstract

The present application provides a shared data distribution method and electronic device, the method comprising: a first device determines shared data, and determines an authorized service for the shared data, the authorized service being a service that other devices can perform using the shared data; the first device sends the shared data and usage policy information to a second device, wherein the usage policy information is used to indicate the authorized service. Through the method provided by the present application, locally stored shared data can be distributed to other devices, and by using policy information, other devices receiving the shared data can follow the instructions of the usage policy information to use the authorized service. In this way, when a device distributes locally stored shared data to other devices, it can regulate the business scenarios for the use of the shared data by using policy information to avoid abuse of the shared data.

Description

Technical Field

[0001] The present application relates to the field of electronic devices, and in particular to a shared data distribution method and electronic device. Background Art

[0002] In a distributed scenario, there may be a demand for multiple devices to collaboratively use the same data to jointly perform a certain type of business. This data can be called shared data. Exemplarily, these shared data may include: confidential business data, biometric data, and so on. For example: multiple devices can collaboratively complete business demands such as authentication and payment based on the biometric data of the same user. In order to support the above business scenarios, it is sometimes necessary to enter and store the biometric data of the same user in multiple devices, or to distribute and distribute the biometric data of a specific user for joint business use.

[0003] Since some shared data has certain sensitivity, how to ensure the security of shared data when it is distributed to multiple devices is an urgent problem to be solved in this field. Summary of the invention

[0004] The present application provides a shared data distribution method and an electronic device, which are used to distribute shared data to other devices, and by using policy information, enable other devices receiving the shared data to follow the authorized services indicated by the use policy information.

[0005] In the first aspect, the present application provides a shared data distribution method, the method comprising: a first device determines shared data, and determines an authorized service of the shared data, the authorized service being a service that other devices can perform using the shared data; the first device sends the shared data and usage policy information to a second device, wherein the usage policy information is used to indicate the authorized service. Through the above technical solution, the first device can distribute the locally stored shared data to the second device, and according to the usage policy information, the second device receiving the shared data can follow the instructions of the usage policy information to use the authorized service. In this way, when the first device distributes the locally stored shared data to the second device, it can regulate the business scenarios of the shared data use through the usage policy information to avoid the abuse of the shared data. At the same time, the shared data on the second device still follows the authorized service indicated by the usage policy information of the first device, so that the first device can well perform unified management and control of the shared data.

[0006] In a possible implementation manner, the first device determines the shared data, including:

[0007] The first device displays a shared data list in response to a first operation, wherein the first operation is used to trigger the display of the shared data list;

[0008] The first device determines the shared data, which may include the following implementations:

[0009] The first way: the first device receives the shared data selected by the user in the displayed shared data list.

[0010] The second manner: the first device selects the shared data in the displayed shared data list according to the instruction of other devices.

[0011] The third method: the first device selects the shared data in the displayed shared data list according to the set shared data selection rule. Through the above three methods, the user can independently select the shared data, or determine the shared data by receiving instructions from other devices, or determine the shared data after the data is updated according to the set shared data selection rule, or determine the shared data at a set time, or determine the shared data periodically.

[0012] In a possible implementation manner, determining the authorized service of the shared data includes:

[0013] The first device displays the authorized service list in response to a second operation, where the second operation is used to trigger the display of the authorized service list;

[0014] The first device determines the authorized service, which may include the following implementation methods:

[0015] The first way: the first device receives the authorized service selected by the user in the displayed authorized service list.

[0016] The second method: the first device selects the authorized service in the displayed authorized service list according to the instruction of other devices.

[0017] The third method: the first device selects the authorized service in the displayed authorized service list according to the set authorized service selection rule. Through the above three methods, the user can independently select the authorized service, and can also select the authorized service according to the set authorized service selection rule.

[0018] In another possible implementation, determining the authorized service of the shared data includes: the first device displays the first service set and / or the second service set in response to a third operation, the third operation is used to trigger the display of the first service set and / or the second service set; the first device determines the authorized service according to the first service set or the second service set; wherein the first service set includes services that the first device can perform using the shared data; the second service set includes services that the second device can perform using the shared data, and the authorized service is included in the first service set and / or the second service set. In the above manner, it is ensured that the determined authorized service satisfies both the services executable by the first device and the services executable by the second device.

[0019] In a possible implementation, before the first device sends the shared data and the usage policy information to the second device, the method further includes: the first device displays a device list in response to a fourth operation, the fourth operation being used to trigger the display of the device list; the device list includes at least one of the following: device type, shared data type, and transmission signal strength between the first device and the first device;

[0020] The first device determines the second device, which may include the following implementations:

[0021] The first way: the first device determines the device selected by the user in the displayed device list as the second device.

[0022] The second manner: the first device selects the second device in the displayed second device list according to the instruction of other devices.

[0023] The third method: the first device selects the second device in the displayed second device list according to the set second device selection rule. Through the above method, the user can independently select the device to receive the shared data, and determine which second devices to distribute to according to the type of shared data, and can also ensure that the transmission effect between the first device and the second device is good during transmission, and the user experience is good.

[0024] In a possible implementation, before the first device sends the shared data and usage policy information to the second device, the method further includes: the first device performs a security check on the second device and determines that the check passes. In the above manner, it is detected whether the distributed second device is safe, thereby ensuring the security of the shared data.

[0025] In a possible implementation, the first device performs security verification on the second device, including: the first device verifies whether the second device is in a secure environment; or the first device verifies whether the security level of the second device is higher than a set security level; or the first device verifies whether the second device is a secure device. In the above manner, it can be determined whether the first device and the second device are in the same secure environment, or it can be determined whether the security level of the second device is lower than the security level of the first device, or it can be determined whether the second device is a secure device, which can ensure the security of the subsequent transmission of the shared data.

[0026] In a possible implementation manner, the first device sending the shared data and the usage policy information to the second device includes: the first device encrypting the shared data and the usage policy information using an encryption key; and the first device sending the encrypted shared data and the usage policy information to the second device. In the above manner, after the shared data and the usage policy information are encrypted, it can be ensured that only the second device can decrypt the shared data and the usage policy information, thereby ensuring that the first device sends the shared data and the usage policy information to the second device.

[0027] In a possible implementation, the first device sends the shared data to the second device, including: the first device slices the shared data to generate multiple slices; the multiple slices constitute the shared data; the first device encrypts the multiple slices using different encryption levels, and sends the encrypted multiple slices to the second device. In the above manner, the shared data is distributed in the form of slices to improve the security of transmitting the shared data.

[0028] In a possible implementation, the method further includes: during the process of the first device sending the shared data and the usage policy information to the second device, displaying a first interface, wherein the first interface includes the transmission progress of the shared data and the usage policy information. In the above manner, the transmission progress of the shared data and the usage policy information can be displayed on the first device, so that the user can understand the transmission status of the shared data and the usage policy information, thereby improving the user experience.

[0029] In a second aspect, the present application provides a shared data distribution method, the method comprising: a second device receives shared data and first usage policy information sent by a first device; wherein the first usage policy information is used to indicate the authorized services that the second device can perform using the shared data; the second device determines the first authorized service that can use the shared data based on the first usage policy information; and the second device performs the first authorized service based on the shared data.

[0030] In a possible implementation, before the second device receives the shared data and the first usage policy sent by the first device, the second device also includes: the second device authenticates the first device and determines that the authentication is successful; the second device saves the shared data and the usage policy information. The method also includes: the second device saves the received shared data and the first usage policy information. In the above manner, after receiving the shared data and the usage policy information, the security of the shared data stored by the second device can be guaranteed.

[0031] In a possible implementation, the second device executes the first authorized service according to the shared data, including: when the first authorized service includes a distribution permission indication, the second device determines a second authorized service of the shared data, the second authorized service being a service that other devices can execute using the shared data; the second device sends the shared data and second usage policy information to a third device, the second usage policy information being used to indicate the second authorized service.

[0032] By means of the above method, when the authorization service includes a distribution permission indication, the shared data and the second usage policy information can be redistributed to a third device, thereby increasing the distribution flexibility of the shared data and the second usage policy information and improving the user experience.

[0033] In a possible implementation, before the second device sends the shared data and the second usage policy information to the third device, the method further includes: the first device displays a device list in response to a fifth operation, the fifth operation being used to trigger the display of the device list; the device list includes at least one of the following: device type, shared data type, and transmission signal strength between the second device and the second device; the second device determines the third device, which may include the following implementations:

[0034] The first way: the second device determines the device selected by the user in the displayed device list as the third device.

[0035] The second method: the second device selects the third device from the displayed third device list according to the instruction of other devices.

[0036] The third way: the second device selects the third device from the displayed third device list according to the set third device selection rule.

[0037] In this way, users can independently select devices to receive shared data and determine which third devices to distribute the shared data to based on the type of shared data. It can also ensure that when distributing shared data, the shared data is not distributed to other devices that have already been sent.

[0038] In a possible implementation, the second device executes the first authorization service according to the shared data, including: when the first authorization service includes a verification service, the second device obtains the data to be verified input by the user; the second device compares the shared data with the data to be verified; when the second device determines that the shared data matches the data to be verified, it determines that the service verification is successful. Through the above method, when the user uses a service that requires verification, the user can compare the data to be verified input by the user with the shared data stored this time. Only after the comparison is consistent, the verification service can be executed to determine the specificity of the user of the shared data.

[0039] In a possible implementation, the method further includes: the second device displays a second interface during the process of receiving the shared data and the first usage policy information sent by the first device, and the second interface includes the transmission progress of the shared data and the first usage policy information. In the above manner, the transmission progress of the shared data and the usage policy information can be displayed on the second device, so that the user can understand the transmission status of the shared data and the usage policy information, thereby improving the user experience.

[0040] In a third aspect, an embodiment of the present application further provides a shared data distribution system, the system comprising: a first device and a second device;

[0041] The first device is used to: determine shared data and determine an authorized service of the shared data, where the authorized service is a service that other devices can perform using the shared data; send the shared data and usage policy information to the second device, where the usage policy information is used to indicate the authorized service;

[0042] The second device is used to: receive the shared data and the usage policy information sent by the first device; and execute the authorized service using the shared data according to the usage policy information.

[0043] In a fourth aspect, an embodiment of the present application further provides an electronic device, comprising: one or more processors, a memory, and one or more programs; wherein the one or more programs are stored in the memory, and the one or more programs include instructions, and when the instructions are executed by the electronic device, the electronic device executes the first aspect of the embodiment of the present application and any possible design of the first aspect thereof. Technical solutions.

[0044] In a fifth aspect, an embodiment of the present application further provides an electronic device, comprising: one or more processors, a memory, and one or more programs; wherein the one or more programs are stored in the memory, and the one or more programs include instructions, and when the instructions are executed by the electronic device, the electronic device executes the second aspect of the embodiment of the present application and any possible design of the second aspect thereof.

[0045] In a sixth aspect, an embodiment of the present application further provides a chip, which is coupled to a memory in an electronic device to execute the technical solution of the first aspect of the embodiment of the present application and any possible design of the first aspect.

[0046] In the seventh aspect, an embodiment of the present application further provides a chip, which is coupled to a memory in an electronic device to execute the technical solution of the second aspect of the embodiment of the present application and any possible design of the second aspect.

[0047] In the eighth aspect, an embodiment of the present application also provides a computer-readable storage medium, which includes a computer program. When the computer program runs on an electronic device, the electronic device executes the technical solution of the first aspect of the embodiment of the present application and any possible design of the first aspect.

[0048] In the ninth aspect, an embodiment of the present application also provides a computer-readable storage medium, which includes a computer program. When the computer program runs on an electronic device, the electronic device executes the technical solution of the second aspect of the embodiment of the present application and any possible design of the second aspect thereof.

[0049] In the tenth aspect, the embodiments of the present application also provide a computer program product. When the computer program product runs on an electronic device, the electronic device executes the technical solution of the first aspect of the embodiments of the present application and any possible design of the first aspect.

[0050] In the eleventh aspect, the embodiment of the present application also provides a computer program product, which, when running on an electronic device, enables the electronic device to execute the technical solution of the second aspect of the embodiment of the present application and any possible design of the second aspect.

[0051] For each of the above-mentioned aspects from the third to the eleventh aspect and the technical effects that may be achieved by each of the aspects, please refer to the above-mentioned description of the technical effects that can be achieved by various possible schemes in the first and second aspects, and no further details will be given here. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1a A schematic diagram of the architecture of a communication system;

[0053] Figure 1b A schematic diagram of the structure of an electronic device;

[0054] Figure 2 A flow chart of a shared data distribution method;

[0055] Figure 3a A schematic diagram of a user selecting shared data for distribution on an interactive interface of a first device;

[0056] Figure 3b A schematic diagram of a second device sending a request for sharing data to a first device;

[0057] Figure 3c A schematic diagram of setting a timed distribution of shared data for a user on a first device;

[0058] Figure 4a A schematic diagram of a user selecting an authorization service for shared data after entering the shared data;

[0059] Figure 4b A schematic diagram of selecting an authorized service for the shared data after the user selects to share the data;

[0060] Figure 4c A schematic diagram showing that the authorized service determined for the first device exceeds the first service set;

[0061] Figure 5a Determine, for the first device, a schematic diagram of the second device according to the type of the second device and the type of shared data;

[0062] Figure 5b A schematic diagram for a first device to determine a second device among devices within a transmission coverage range;

[0063] Figure 5c A schematic diagram showing a first device prompting the user to move closer to the second device when the second device is out of the transmission range;

[0064] Figure 5d Schematic diagram of various transmission methods;

[0065] Figure 6a A schematic diagram of performing security verification between a first device and a second device;

[0066] Figure 6b A schematic diagram of a first device determining an authorization service for shared data according to a security verification result of a second device;

[0067] Figure 7 A schematic diagram of a state of transmitting shared data to a first device;

[0068] Figure 8 Schematic diagram of the spatial distribution of equipment;

[0069] Figure 9a A schematic diagram of updating locally stored shared data;

[0070] Figure 9b A schematic diagram of another method of updating locally stored shared data;

[0071] Fig.9c A schematic diagram of another method of updating locally stored shared data;

[0072] Fig.10 A schematic diagram of a user requesting a smart speaker to complete a payment transaction;

[0073] Fig.11 A schematic diagram of multiple devices cooperating to perform services based on shared data;

[0074] Fig.12a A schematic diagram of an architecture for distributing facial data from a mobile phone 12A to a tablet 12B;

[0075] Figure 12b A schematic diagram of a process of distributing facial data from a mobile phone 12A to a tablet 12B;

[0076] Fig.13 A schematic diagram of an architecture including multiple devices;

[0077] Fig.14 is a schematic diagram of a shared data distribution system;

[0078] Fig.15 A schematic diagram of a module of a second device in a shared data distribution system;

[0079] Fig.16 A schematic diagram of an electronic device. DETAILED DESCRIPTION

[0080] The present application provides a shared data distribution method and electronic device to solve the problem of shared data distribution security in a communication system. The method and the device are based on the same technical concept. Since the principles of solving the problem by the method and the device are similar, the implementation of the device and the method can refer to each other, and the repeated parts will not be repeated.

[0081] In the solution provided by the present application, a first device in a communication system can send shared data and usage policy information to a second device in the communication system, wherein the usage policy information is used to indicate an authorized service, and the authorized service is a service that other devices can perform using the shared data. For example, the usage policy information can be an identifier of the authorized service or indication information of the authorized service. In this way, the second device can only use the shared data when performing the authorized service, so as to avoid the second device using the shared data when performing other services, resulting in problems such as the shared data being abused and security not being guaranteed.

[0082] Below, some terms in this application are explained to facilitate understanding by those skilled in the art.

[0083] 1) Distributed storage system is to store data in multiple independent devices. Traditional network storage system uses centralized storage server to store all data. Storage server becomes the bottleneck of system performance and the focus of reliability and security, which cannot meet the needs of large-scale storage applications. Distributed network storage system adopts scalable system structure, uses multiple storage servers to share storage load, and uses location server to locate storage information. It not only improves the reliability, availability and access efficiency of the system, but also is easy to expand.

[0084] 2) Shared data refers to data that can be used by multiple devices in a communication system composed of multiple devices. The shared data may include confidential business data, biometric data, etc. For example, the biometric data may be the biological characteristics of the organism (generally referring to a person) itself, which may include voiceprint data, face data, fingerprint data (palmprint data), text signature data, and behavioral characteristic data (keyboard tapping frequency data). The device uses shared data to distinguish biological individuals and complete the confirmation of individual identity.

[0085] 3) Services are transactions that are processed by the device to implement its functions or services. For example, the services may be unlocking services, payment services, AI computing services, various application services, distribution services, etc.

[0086] 4) Multiple refers to two or more.

[0087] 5) "And / or" describes the relationship between the associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects are in an "or" relationship.

[0088] The embodiments of the present application are further described in detail below in conjunction with the accompanying drawings.

[0089] Figure 1a Schematic diagram of a communication system architecture to which the present application embodiment can be applied. Figure 1a As shown, the communication system includes multiple devices (a first device 101, a second device 102 and a third device 103).

[0090] Any of the first device 101, the second device 102, and the third device 103 in the embodiment of the present application may be a mobile phone, a tablet computer, a wearable device (e.g., a watch, a bracelet, a helmet, a headset, etc.), a vehicle-mounted device, an augmented reality (AR) / virtual reality (VR) device, a laptop computer, an ultra-mobile personal computer (UMPC), a netbook, a personal digital assistant (PDA), a smart home device (e.g., a smart TV, a smart speaker, a smart camera, etc.), any available medium that can be accessed, or an electronic device such as a server that includes one or more available media integrated. It is understandable that the embodiment of the present application does not impose any restrictions on the specific type of electronic device.

[0091] The two devices in the system can communicate with each other. For example, the first device 101 and the second device 102 can access the same local area network or different local area networks for communication.

[0092] When the first device 101 and the second device 102 are connected to the same local area network, the first device 101 and the second device 102 establish a wireless connection with the same wireless access point. For example, the first device 101 and the second device 102 are connected to the same wireless fidelity (WI-FI) hotspot. For another example, the first device 101 and the second device 102 can also be connected to the same Bluetooth beacon through the Bluetooth protocol. For another example, the communication connection between the first device 101 and the second device 102 can also be triggered through an NFC authentication tag, and encrypted information is transmitted through the Bluetooth module for identity authentication; after successful authentication, shared data is transmitted in a point-to-point (P2P) manner.

[0093] Specifically, the first device 101 sends the shared data and the usage policy information to the second device 102, so that the second device 102 can determine the authorized services that can be performed using the shared data received this time according to the usage policy information. In addition, if the carried usage policy information contains a distribution permission indication that allows secondary distribution, the second device 102 can also send the shared data and the usage policy information to the third device 103, so that the third device 103 can determine the authorized services that can be performed by the shared data according to the usage policy information.

[0094] It should be noted that Figure 1a There is no limitation on the communication system to which the method provided in the present application is applicable. The method provided in the present application can be applied to various communication systems, such as: distributed storage system, V2X (vehicle to everything, vehicle wireless communication technology) system, V2V (vehicle to vehicle, vehicle-to-vehicle data transmission technology) system, D2D (device to device communication, device-to-device communication) system, etc.

[0095] The following embodiments of the present application are Figure 1b For example, the electronic device shown in FIG. Figure 1a The structure of any electronic device included in the communication system shown is introduced. Among them, those skilled in the art can understand that Figure 1b The electronic device 100 shown is merely an example and does not constitute a limitation on the electronic device, and the electronic device may have more or fewer components than those shown in the figure, may combine two or more components, or may have a different component configuration. Figure 1b The various components shown in the EMBODIMENTS 2000 may be implemented in hardware, software, or a combination of hardware and software, including one or more signal processing and / or application specific integrated circuits.

[0096] Figure 1bThe structural diagram of the electronic device provided in the embodiment of the present application is as follows: the electronic device 100 may include a processor 110, an external memory interface 120, an internal memory 121, a universal serial bus (USB) interface 130, a charging management module 140, a power management module 141, a battery 142, an antenna 1, an antenna 2, a mobile communication module 150, a wireless communication module 160, an audio module 170, a speaker 170A, a receiver 170B, a microphone 170C, an earphone interface 170D, a sensor module 180, a button 190, a motor 191, an indicator 192, a camera 193, a display screen 194, and a subscriber identification module (SIM) card interface 195, etc. The sensor module 180 may include a pressure sensor 180A, a gyroscope sensor 180B, an air pressure sensor 180C, a magnetic sensor 180D, an acceleration sensor 180E, a distance sensor 180F, a proximity light sensor 180G, a fingerprint sensor 180H, a temperature sensor 180J, a touch sensor 180K, an ambient light sensor 180L, a bone conduction sensor 180M, etc.

[0097] Combine the following Figure 1b The various components of the electronic device 100 are described in detail:

[0098] The processor 110 may include one or more processing units. For example, the processor 110 may include an application processor (AP), a modem processor, a graphics processor (GPU), an image signal processor (ISP), a controller, a memory, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural-network processing unit (NPU). Among them, different processing units may be independent devices or integrated into one or more processors. Among them, the controller may be the nerve center and command center of the electronic device 100. The controller may generate an operation control signal according to the instruction opcode and the timing signal to complete the control of fetching and executing instructions.

[0099] In some embodiments, the processor 110 may include one or more interfaces. For example, the interface may include a mobile industry processor interface (MIPI), a general-purpose input / output (GPIO) interface, a subscriber identity module (SIM) interface, and / or a universal serial bus (USB) interface.

[0100] The USB interface 130 is an interface that complies with the USB standard specification, and can be a Mini USB interface, a Micro USB interface, a USB Type C interface, etc. The USB interface 130 can be used to transmit data between the electronic device 100 and peripheral devices. In some embodiments, the USB interface 130 can be used to receive shared data transmitted by other electronic devices.

[0101] The mobile industry processor interface (MIPI) interface can be used to connect the processor 110 with peripheral devices such as the display screen 194 and the camera 193. The MIPI interface includes a camera serial interface (CSI), a display serial interface (DSI), etc. In some embodiments, the processor 110 and the camera 193 communicate through the CSI interface to realize the shared data (face image) acquisition function of the electronic device 100.

[0102] The wireless communication function of the electronic device 100 can be implemented by antenna 1, antenna 2, mobile communication module 150, wireless communication module 160, modulation and demodulation processor and baseband processor. Antenna 1 and antenna 2 are used to transmit and receive electromagnetic wave signals. Each antenna in the electronic device 100 can be used to cover a single or multiple communication frequency bands. Different antennas can also be reused to improve the utilization of the antenna. For example, antenna 1 can be reused as a diversity antenna of a wireless local area network. In some other embodiments, the antenna can be used in combination with a tuning switch.

[0103] The mobile communication module 150 can provide solutions for wireless communications including 2G / 3G / 4G / 5G, etc., applied to the electronic device 100. The mobile communication module 150 may include at least one filter, a switch, a power amplifier, a low noise amplifier (LNA), etc. The mobile communication module 150 can receive electromagnetic waves from the antenna 1, and filter, amplify, and process the received electromagnetic waves, and transmit them to the modulation and demodulation processor for demodulation. The mobile communication module 150 can also amplify the signal modulated by the modulation and demodulation processor, and convert it into electromagnetic waves for radiation through the antenna 1. In some embodiments, at least some functional modules of the mobile communication module 150 can be set in the processor 110.

[0104] The wireless communication module 160 can provide wireless communication solutions including wireless local area networks (WLAN) (such as wireless fidelity (Wi-Fi) networks), bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), infrared (IR), etc., which are applied to the electronic device 100. The wireless communication module 160 can be one or more devices integrating at least one communication processing module. The wireless communication module 160 receives electromagnetic waves via the antenna 2, modulates the electromagnetic wave signal and performs filtering, and sends the processed signal to the processor 110. The wireless communication module 160 can also receive the signal to be sent from the processor 110, modulate the frequency, amplify it, and convert it into electromagnetic waves for radiation through the antenna 2. In some embodiments, the wireless communication module 160 receives electromagnetic waves distributed by other electronic devices through the antenna 2, and converts the electromagnetic wave signal into shared data and stores it in the internal memory 121. The wireless communication module 160 can also convert the shared data in the internal memory 121 into electrical signals, perform frequency modulation and amplification on the electrical signals, and convert them into electromagnetic waves through the antenna 2 to radiate to other devices.

[0105] In some embodiments, the antenna 1 of the electronic device 100 is coupled to the mobile communication module 150, and the antenna 2 is coupled to the wireless communication module 160, so that the electronic device 100 can communicate with the network and other devices through wireless communication technology. The wireless communication technology may include global system for mobile communications (GSM), general packet radio service (GPRS), code division multiple access (CDMA), wideband code division multiple access (WCDMA), time-division code division multiple access (TD-SCDMA), long term evolution (LTE), BT, GNSS, WLAN, NFC, FM, and / or IR technology. The GNSS may include a global positioning system (GPS), a global navigation satellite system (GLONASS), a Beidou navigation satellite system (BDS), a quasi-zenith satellite system (QZSS) and / or a satellite based augmentation system (SBAS).

[0106] It is understandable that the interface connection relationship between the modules illustrated in the embodiment of the present application is only a schematic illustration and does not constitute a structural limitation on the electronic device 100. In other embodiments of the present application, the electronic device 100 may also adopt different interface connection methods in the above embodiments, or a combination of multiple interface connection methods.

[0107] The electronic device 100 implements the display function through a GPU, a display screen 194, and an application processor, etc. The GPU is a microprocessor for image processing, and is connected to the display screen 194 and the application processor.

[0108] The display screen 194 is used to display images, videos, etc. The display screen 194 includes a display panel.

[0109] The electronic device 100 can realize the shooting function, or the function of collecting images, through the ISP, the camera 193, the video codec, the GPU, the display screen 194 and the application processor.

[0110] The ISP is used to process the data fed back by the camera 193. For example, when collecting a face as shared data, the camera 193 opens the shutter, and light is transmitted to the camera photosensitive element through the lens, and the light signal is converted into an electrical signal, and the camera photosensitive element transmits the electrical signal to the ISP for processing.

[0111] The camera 193 is used to capture still images or videos. The object generates an optical image through the lens and projects it onto the photosensitive element. The photosensitive element can be a charge coupled device (CCD) or a complementary metal-oxide-semiconductor (CMOS) phototransistor. The photosensitive element converts the optical signal into an electrical signal, and then passes the electrical signal to the ISP for conversion into a digital image signal. In some embodiments, the electronic device 100 may include 1 or N cameras 193, where N is a positive integer greater than 1.

[0112] The video codec is used to compress or decompress digital video. The electronic device 100 may support one or more video codecs. In some embodiments, the video codec may also be a shared data, and other electronic devices send the video codec to the device as shared data so that the electronic device 100 can play or record a video corresponding to the encoding format of the video codec.

[0113] NPU is a neural network (NN) computing processor. By drawing on the structure of biological neural networks, NPU can realize applications such as intelligent cognition of electronic device 100. In some embodiments, after electronic device 100 acquires an image file through camera 193, NPU can be used to perform face recognition on the image file, or after electronic device 100 acquires an audio file through microphone 170C, NPU can be used to perform voice recognition on the audio file.

[0114] The internal memory 121 can be used to store computer executable program codes, and the executable program codes include instructions. The internal memory 121 may include a program storage area and a data storage area. Among them, the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc. The data storage area may store data created during the use of the electronic device 100, as well as shared data sent by other electronic devices, etc. In addition, the internal memory 121 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, a universal flash storage (UFS), etc. The processor 110 executes various functional applications and data processing of the electronic device 100 by running instructions stored in the internal memory 121, and / or instructions stored in a memory provided in the processor. In some embodiments, the processor 110 distributes the shared data stored in the electronic device 100 to other devices by running instructions stored in the internal memory 121.

[0115] The external memory interface 120 can be used to connect an external memory card, such as a Micro SD card, to expand the storage capacity of the electronic device. The external memory card communicates with the processor 110 through the external memory interface 120 to implement a data storage function. For example, files such as pictures and videos are stored in the external memory card.

[0116] The electronic device 100 can implement audio functions such as audio recording, voiceprint unlocking, etc. through the audio module 170, the speaker 170A, the receiver 170B, the microphone 170C, the headphone jack 170D, and the application processor.

[0117] Among them, the sensor module 180 may include a pressure sensor 180A, a gyroscope sensor 180B, an air pressure sensor 180C, a magnetic sensor 180D, an acceleration sensor 180E, a distance sensor 180F, a proximity light sensor 180G, a fingerprint sensor 180H, a temperature sensor 180J, a touch sensor 180K, an ambient light sensor 180L, a bone conduction sensor 180M, etc.

[0118] The pressure sensor 180A is used to sense the pressure signal and convert the pressure signal into an electrical signal. In some embodiments, the pressure sensor 180A can be set on the display screen 194. When the user performs different gesture operations on the display screen 194, the electronic device 100 detects the touch operation intensity and touch duration according to the pressure sensor 180A. The electronic device 100 can also calculate the touch position according to the detection signal of the pressure sensor 180A. Optionally, different touch positions are used to represent different distribution methods of shared data.

[0119] The acceleration sensor 180E can detect the magnitude of the acceleration of the electronic device 100 in various directions (generally three axes). When the electronic device 100 is stationary, the magnitude and direction of gravity can be detected. It can also be used to identify the posture of the electronic device 100. In some embodiments, the user can perform different ways of sharing data distribution by performing different postures of the handheld electronic device 100.

[0120] The fingerprint sensor 180H is used to collect fingerprints. The electronic device 100 can use the collected fingerprint characteristics to realize fingerprint unlocking, access application locks, fingerprint photography, fingerprint call answering, etc. In some embodiments, the fingerprint sensor can process the collected fingerprint (for example, whether the fingerprint is verified) and send it to the processor 110, and the processor 110 determines whether to store the collected fingerprint as shared data in the internal memory 121 according to the fingerprint processing result. In other embodiments, the fingerprint sensor can also send the collected fingerprint to the processor 110, so that the processor 110 compares the collected fingerprint with the shared data stored in the internal memory 121 to complete fingerprint verification, etc.

[0121] The touch sensor 180K is also called a "touch panel". The touch sensor 180K can be arranged on the display screen 194, and the touch sensor 180K and the display screen 194 form a touch screen. The touch sensor 180K is used to detect a touch operation acting on or near it, and transmit the detected touch operation to the processor 110, so that the processor 110 performs the processing corresponding to the touch operation, and provides visual output or operation feedback related to the touch operation through the display screen 194. In some embodiments, the touch sensor 180K can also be arranged on the surface of the electronic device 100, which is different from the position of the display screen 194, and the specific setting position is not limited.

[0122] The button 190 includes a power button, a volume button, etc. The button 190 may be a mechanical button. It may also be a touch button. The electronic device 100 may receive a button input and generate a button signal input related to the user settings and function control of the electronic device 100. In some embodiments, different button signal inputs correspond to different shared data distribution modes, and the electronic device 100 determines different shared data distribution modes according to receiving different button signals.

[0123] The technical solutions involved in the following embodiments can all be implemented on an electronic device with the above hardware architecture.

[0124] In order to solve the problem that shared data is abused or used for a wider range of purposes when devices in a communication system distribute shared data, the present application provides a shared data distribution method, which can be applied to Figure 1aIn the communication system shown in FIG. 1 , in order to facilitate distinction, in the following embodiments, the device distributing shared data is referred to as the first device, the device receiving shared data is referred to as the second device, and the device receiving the shared data distributed by the second device is referred to as the third device.

[0125] See below Figure 2 The flowchart shown is a detailed description of the shared data distribution method provided in the embodiment of the present application.

[0126] S201: The first device determines shared data.

[0127] The first device displays a shared data list in response to a first operation, wherein the first operation is used to trigger the display of the shared data list;

[0128] Optionally, the first device may determine the shared data in the shared data list in the following manner, but is not limited to:

[0129] Method 1: The first device receives the shared data selected by the user in the displayed shared data list. In some embodiments, the first device can detect a gesture operation of the user on the display screen, so that the first device can select shared data according to the detected gesture operation. For example, when the first device detects a gesture operation of the user selecting shared data, a shared data selection instruction is generated, and the shared data is determined according to the shared data selection instruction.

[0130] For example, Figure 3a A schematic diagram of a user selecting shared data for distribution on the interactive interface of a first device. When the user clicks the "Settings" icon on the first device, the first device enters the settings interface. When the user clicks the "Password, Privacy and Security" option on the first device, the first device enters the password, privacy and security interface. When the user clicks and selects the "Fingerprint Unlock" option on the first device, the first device enters the fingerprint selection interface, where each fingerprint option represents a fingerprint stored in the first device. The user can determine one or more fingerprint options as shared data by pressing, dragging, lifting, clicking, double-clicking, etc. In this example, when the user drags the "left thumb" option to the left on the first device, a selection window pops up, and the selection window displays "Whether to send the fingerprint data corresponding to this fingerprint to other devices", "Yes" or "No". When the user clicks "Yes", the first device determines that the "left thumb" fingerprint data is determined as shared data.

[0131] Method 2: The first device selects the shared data in the displayed shared data list according to the instructions of other devices to determine the shared data. In some embodiments, after receiving the shared data request sent by the second device, the first device determines the shared data according to the shared data information carried in the shared data request. For example, in a communication system, the second device may be a newly deployed device. Therefore, there is no shared data in the second device. At this time, if the user needs to use the shared data on the second device to perform a specific business, the user needs to re-enter the shared data on the second device, which is a cumbersome process. Therefore, the second device can request the shared data from the first device.

[0132] For example, Figure 3b A schematic diagram of a second device sending a request for sharing data to a first device when a user uses a second device to perform a service. When the second device detects that the user needs to enable a fingerprint unlocking service on the second device, and there is no fingerprint data on the second device that can perform the fingerprint unlocking service, a first window will pop up, and the first window will display "Do you need to enable fingerprint unlocking?" "Yes" or "No". When the user clicks "Yes", the second device will then pop up a second window, and the second window will display "Please select a method for recording fingerprints?" "Receive from other devices" or "Record now"; when the user clicks "Record now", the second device will enter the fingerprint recording stage; when the second device clicks "Receive from other devices", the second device will trigger a request to obtain fingerprint data to the first device. After the first device receives the request sent by the second device, it will trigger the collection of the user's fingerprint. After collecting the user's fingerprint, a third window may be displayed, and the third window will display "Do you need to share the fingerprint information of this device with the requesting device?" "Yes" or "No". When the user clicks "Yes", the first device determines that the collected user fingerprint data is shared data and can be sent to the second device as a fingerprint for enabling fingerprint unlocking.

[0133] In other embodiments, after receiving the sharing instruction sent by the control device in the communication system, the first device determines the shared data and the second device (the transmission object / sharing object of the shared data) according to the shared data information and the second device information carried in the sharing instruction. For example, in a smart home system, a mobile phone can be used as a control device. When a user needs to unlock a smart door lock based on a face, the mobile phone can generate a sharing instruction and send it to a smart album. The sharing instruction instructs to send the image in the smart album to the smart door lock, so that the smart album sends the stored image to the smart door lock, so that the smart door lock can be used for face unlocking.

[0134] Method three: the first device selects the shared data in the displayed shared data list according to the set shared data selection rules. In some embodiments, when certain data stored in the first device is constantly updated, the first device can determine that the data is shared data after the data is updated, or determine that the data is shared data at a set time, or periodically determine that the data is shared data. For example, in daily use, the first device needs to collect user voice in real time to optimize the voiceprint data, obtain more accurate voiceprint data to achieve better voice authentication effect. Therefore, the first device can periodically determine the collected user voiceprint data as shared data.

[0135] For example, Figure 3c Schematic diagram of setting the timed distribution of shared data on the first device for the user. After the first device enters the "Password, Privacy and Security" interface, when the user clicks on the "Voice Unlock" option, the first device enters the "Voice Unlock Management" interface, and displays the "Update Management" option and "Collection Frequency Setting" on the "Voice Unlock Management" interface. When the user clicks on the "Collection Frequency Setting" option, the user can set the frequency of collecting voiceprint data on the first device, such as collecting the user's voiceprint data once every minute; and when the user clicks on the "Update Management" option, the first device will pop up a first window, and the first window will display "Do you need to distribute your voiceprint data to other devices regularly?" "Yes" "No", and when the user clicks "Yes" on the first device, the first device will then pop up a second window, and the second window will display "Set Distribution Time" and "Set Distribution Frequency", and the user can enter the time of scheduled distribution after "Set Distribution Time" in the second window, such as 8:00 every day, and enter the frequency of scheduled distribution after "Set Distribution Frequency", such as once a day. In this way, the first device can regularly determine the voiceprint data as shared data and distribute it to other devices at a preset frequency.

[0136] S202: The first device determines an authorized service for sharing data.

[0137] The first device displays a list of authorized services in response to the second operation, and the second operation is used to trigger the display of the list of authorized services; illustratively, the authorized services may include but are not limited to at least one of the following or any combination: unlocking services, payment services, and services for reading and writing certain types of private files and private galleries. In addition, the authorized services may also include: distribution permission indication, and the distribution permission indication may be: whether to allow the second device receiving the shared data to perform secondary distribution, or to select the method in which the second device receiving the shared data performs secondary distribution. For example, if the security level of the second device is low, the first device is set in the distribution permission indication to only allow the second device to distribute shared data to the outside through a physical connection (for example, a cable connection, a data line connection).

[0138] Among them, in order to trace the source of the device and identify the capabilities of the device, the device is often pre-installed with a public key infrastructure certificate (PKI) and identifies the security capabilities or security levels when it leaves the factory. For example, the standards for evaluating the security level of a device may include a rich execution environment (REE), a trusted execution environment (TEE), and a secure element (SE). The above standards are the levels specified in the "Technical Specifications for Trusted Environments for Mobile Terminal Payments". This application is not limited to using the above technical specifications to determine the security level of the device. The "Trusted Computer System Evaluation Index (TCSEC)" and "Information Technology Security Evaluation (CC)" can also be used to set the security level. I will not go into details here.

[0139] Exemplarily, different services can be authorized to devices with different security levels. The above authorization relationship can be defined by the first device or can be the equipment-service standard in the industry. Those skilled in the art should know this and will not be elaborated on here. For example, the first device defines the security level corresponding to the unlocking service as a low security level, that is, the first device can authorize the unlocking service of the second device with a low security level when distributing shared data; the first device defines the payment service as a medium security level, that is, the first device can authorize the payment service of the second device with a medium security level when distributing shared data; the distribution service corresponding to the distribution permission indication corresponds to a high security level, that is, the first device can distribute the service to the second device with a high security level when distributing shared data. In addition, the second device can also determine whether to confirm the authorization service of the shared data based on the security level of the first device.

[0140] In this embodiment, the first device may determine the authorized service for sharing data in the displayed authorized service list in the following manner, but is not limited to:

[0141] Mode 1: The first device receives the authorized service selected by the user in the displayed authorized service list. In some embodiments, the user determines the authorized service of the shared data each time after entering the shared data. Figure 4aAfter entering shared data for the user, a schematic diagram of selecting the authorized service for the shared data. When the user clicks the "Enter New Fingerprint" icon, the fingerprint sensor of the first device collects the user's fingerprint, and after the fingerprint entry is completed, an authorized service interface pops up, displaying "Unlocking Service", "Payment Service" and "Distribution Service". When the first device determines that the user turns on the "Unlocking Service" and "Distribution Service" selection switches, it determines that the authorized services used for the newly entered fingerprint are the unlocking service and the distribution service. Another example Figure 4b As shown, the fingerprint management interface displays "left thumb", "left index finger", "right thumb" and "right index finger". When the user clicks "right index finger", the first window pops up, and the first window displays "unlock service", "payment service" and "distribution service". The user can set the authorization service for the right index finger fingerprint by clicking the "unlock service" switch.

[0142] Method 2: The first device selects the authorized service in the displayed authorized service list according to the set authorized service selection rules. In some embodiments, after acquiring the shared data, the first device automatically determines the authorized service of the shared data. For example, when the first device can collect the keyboard tapping frequency as the shared data, the first device automatically determines the authorized service of the shared data according to the security level of the device. If the security level of the first device is low, the first device determines that the authorized service of the shared data is an unlocking service; or, if the first device can execute a specific service, the first device determines that the authorized service of the shared data is a specific service that can be executed by the device. Specifically, if the first device is a smart door lock, because the smart door lock can execute the unlocking service, the smart door lock automatically determines the authorized service of the shared data as the unlocking service after collecting the shared data.

[0143] In addition, when the first device determines the authorized service of the shared data, the service execution capability of the device and the service execution capability of the second device need to be considered. The first device displays the first service set and / or the second service set in response to the third operation, and the third operation is used to trigger the display of the first service set or the second service set; the first device determines the authorized service according to the first service set and / or the second service set; in some embodiments, when the first device determines the authorized service of the shared data, the first device can set an application service set (hereinafter referred to as the first service set) for the shared data, and the authorized service set is the service executable by the first device. After determining the shared data, the first device can determine the authorized service in the authorized service set of the shared data; or the first device can further determine whether the authorized service is a subset of the first service set after determining the authorized service of the shared data. When it is determined that the authorized service is a subset of the first service set, it is determined that the authorized service of the shared data of the first device is correct, otherwise, the first device needs to re-determine the authorized service of the shared data. Figure 4c Schematic diagram of the authorized service determined for the first device exceeding the first service set. For example, the first service set of the first device only includes the unlocking service. When the user clicks the "right index finger" and clicks the "distribute service" switch in the first window, a second window will pop up to remind the user "The target service set this time exceeds the services that can be executed by this device. It is recommended to reset it!". Since the authorized service exceeds the scope of the first service set, the first device prompts the user to redefine the authorized service of the shared data to ensure the safe use of the shared data. In addition, the first device can also select the authorized service in the displayed authorized service list according to the instructions of other devices.

[0144] In some embodiments, the first device obtains a second service set, and the second service set includes services that the second device can execute; after determining the shared data, the first device can determine the authorized service in the second service set; or, after the first device determines the authorized service of the shared data, it needs to determine whether the authorized service is a subset of the second service set. When it is determined that the authorized service is a subset of the second service set, it is determined that the authorized service of the shared data of the first device is correct, otherwise, the first device needs to re-determine the authorized service of the shared data.

[0145] In some embodiments, the first device may determine the authorized service from the first service set and the second service set in combination with the first service set and the second service set, or, after determining the authorized service for shared data, the first device determines whether the authorized service is a subset of both the first service set and the second service set. When it is determined that the authorized service is a subset of both the first service set and the second service set, it is determined that the authorized service for shared data of the first device is correct. Otherwise, the first device needs to re-determine the authorized service for shared data.

[0146] In addition, when the shared data is determined in the first device through the above method 2, other devices can also carry authorized service information in the shared data request / sharing indication, so that the first device can determine the authorized service of the shared data based on the authorized service information carried in the shared data request / sharing indication.

[0147] S203: The first device performs a security check on the second device.

[0148] It should be noted that step S203 is an optional step. In some embodiments, the first device may directly execute S204 without performing a security check on the second device. In addition, the present application does not limit the time when the first device executes S203. The first device may execute this step after determining the second device or before sending the shared data.

[0149] After the first device passes the security check on the second device, the first device may send the shared data and usage policy information to the second device. Optionally, the first device may perform security check on the second device by, but not limited to, any one or any combination of the following:

[0150] Method 1: The first device verifies whether the second device is in a safe environment;

[0151] Method 2: The first device verifies whether the security level of the second device is higher than the set security level;

[0152] Method three: the first device verifies whether the second device is a safe device.

[0153] The specific steps of the first device performing security verification on the second device are described below and Figure 6a As shown, no further description is given here.

[0154] S204: The first device sends the shared data and usage policy information to the second device, wherein the usage policy information is used to indicate the authorized service.

[0155] In some embodiments, when the first device sends shared data and usage policy information to the second device, it can use an encryption key to encrypt the shared data and the usage policy information so that the second device can decrypt the encrypted shared data and the usage policy information after receiving them.

[0156] In some other embodiments, the first device sends a shared file to the second device, wherein the shared file includes: shared data and usage policy information. The first device encrypts the shared file using an encryption key, so that after receiving the encrypted shared file, the second device decrypts the encrypted shared file using the encryption key to obtain the shared data and usage policy information.

[0157] S205: The second device stores the shared data and the usage policy information.

[0158] Optionally, the second device may receive the shared data and usage policy information sent by the first device in the following manners, but not limited to:

[0159] Method 1: After the second device verifies the identity of the first device, it receives the shared data and usage policy information sent by the first device. In some embodiments, after receiving the shared data and usage policy information sent by the first device, the second device can verify the identity of the first device to determine whether the identity of the first device is legitimate. The device that passes the identity verification will be considered as a reliable first device by the second device. The second device can receive the shared data and usage policy information sent by the first device.

[0160] Method 2: The second device receives the shared data and usage policy information sent by the pre-authorized first device. In some embodiments, the second device can pre-authorize some devices in advance, and the second device can implement pre-authorization by storing a pre-authorized device list or a pre-authorized device ID set. After receiving the shared data and usage policy information sent by the first device, it is determined whether the first device is in the pre-authorized device list or the pre-authorized device ID. If so, the first device will be considered as a reliable device by the second device, and then receive the shared data and usage policy information sent by the first device.

[0161] In some other embodiments, the second device may pre-authorize some manufacturers. For example, the second device may implement pre-authorization by storing the manufacturer's information (such as the manufacturer's name or trademark, etc.), and then after the second device determines that the first device is a device of the pre-authorized manufacturer, the first device will be considered as a reliable device by the second device and receive the shared data and usage policy information sent by the first device.

[0162] After receiving the shared data and usage policy information sent by the first device, the second device may store the shared data and usage policy information. Optionally, the second device may store the shared data and usage policy information in the following manners, but is not limited to:

[0163] Method 1: The second device stores the shared data and usage policy information in different storage units according to the type of shared data. In some embodiments, the shared data may include but is not limited to one or more of fingerprint data, audio data, images (such as face data), or password data. The second device establishes storage units of different data types according to the different types of the shared data, binds the shared data with the usage policy information, and stores the bound shared data of different types in storage units of corresponding types. For example, all fingerprint data is stored in the fingerprint storage unit.

[0164] Method 2: The second device stores the shared data and usage policy information in different storage units according to the type of authorized services in the usage policy information. In some embodiments, the usage policy information corresponding to the shared data includes multiple authorized services, such as: unlocking services, payment services, services for reading and writing certain types of private files and private galleries, distribution permission instructions, etc. The second device establishes storage units of different types of authorized services for the authorized services in the usage policy information, binds the shared data with the usage policy information, and then stores the shared data of the bound different authorized services in the storage units of the corresponding authorized services. For example, the shared data containing the unlocking service is stored in the unlocking service storage unit.

[0165] S206: The second device determines the authorized service of the shared data according to the usage policy information, wherein the usage policy information is used to indicate the authorized service.

[0166] The second device determines the authorized service for using the shared data according to the authorized service indicated in the usage policy information sent together with the shared data.

[0167] In some embodiments, after receiving the shared data and the usage policy information, the second device may bind the shared data with the authorized service indicated in the usage policy information, so that when the second device uses the shared data, it can determine the authorized service that the shared data can execute.

[0168] S207: The second device performs the authorization service according to the shared data.

[0169] Optionally, the second device may perform the authorization service according to the shared data in the following manners, but not limited to:

[0170] Method 1: The second device performs authorized services according to the shared data. In some embodiments, after determining the authorized services of the shared data, the second device can use the shared data to perform certain services by itself and determine whether the performed services are authorized services. When it is determined that the performed services are authorized services, the second device performs the authorized services according to the shared data.

[0171] Method 2: The second device executes the authorized service according to the shared data according to the instructions of other devices. In some embodiments, after receiving the service execution request sent by other devices, the second device determines the service to be executed by the shared data according to the service to be executed information carried in the service execution request, and the second device determines whether the executed service is an authorized service. When it is determined that the executed service is an authorized service, the second device executes the authorized service according to the shared data.

[0172] Mode 3: The second device performs the authorized service based on the shared data according to the user's selection. In some embodiments, the second device can detect the user's gesture operation on the display screen, and the second device determines to perform the authorized service based on the detected gesture operation. For example, when the second device detects the user's gesture operation of selecting shared data, it determines the service to be performed, and when it is determined that the service to be performed is an authorized service, the second device performs the authorized service based on the shared data.

[0173] S2071: The second device sends shared data and usage policy information to the third device according to the authorized service.

[0174] In some embodiments, when the usage policy information sent by the first device to the second device includes a distribution permission indication, the second device may redistribute the shared data and the usage policy information to the third device again. The shared data distribution steps performed from the second device to the third device are based on the same concept as the steps performed in the above steps S201 to S204 and will not be repeated here.

[0175] In some embodiments, the first device may slice the shared data to generate multiple slices of data; the multiple slices of data constitute the shared data; the first device encrypts the multiple slices of data using different encryption levels, and sends the encrypted multiple slices of data to the second device. For example, the facial feature data in the shared data may be composed of multiple slices of data, and the number of slices of data sent by the first device is related to the authorized service of the shared data. If the authorized service in the usage policy information is an unlocking service, the first device may send part of the facial feature data slices to the second device, or encrypt part of the data slices in the facial feature data with a higher encryption level and then send them to the second device, so that the second device can only use the remaining data slices encrypted at a lower level to complete the unlocking service. If the authorized service in the usage policy information is a payment service, the first device needs to send all the slices of facial feature data to the second device before the second device can use all the slices of facial feature data to complete the payment service with a higher security level.

[0176] In some embodiments, before determining the shared data, the first device in the above step S201 may also first determine the second device to receive the shared data.

[0177] The first device displays a device list in response to a fourth operation, wherein the fourth operation is used to trigger the display of the device list; the device list includes at least one of the following: device type, shared data type, and transmission signal strength between the first device and the first device; the first device may determine the device selected by the user in the displayed device list as the second device in the following manner, but is not limited to:

[0178] Method 1: The user determines the second device according to the type of device displayed in the displayed device list and the type of shared data. For example, the first device can determine the second device that receives the shared data according to the type of shared data. Figure 5a As shown, in the "Password, Privacy and Security" interface, after the user clicks the "Voice Unlock" option, the first device enters the voice unlock management interface, and the voice unlock management interface displays "Update Management", "Collection Frequency Setting" and "Distribution Device Selection". After the user clicks the "Distribution Device Selection" option, the first device enters the distribution device list interface. After the user clicks the "Distribution Device Selection" option, the user clicks the selection switch after "Smart Speaker A, Mobile Phone A, Mobile Phone B...", a first window pops up, and the first window displays "Do you select the above devices", "Yes" and "No". After the user clicks "Yes", the first device determines that the devices receiving the voiceprint data are smart speaker B and mobile phone A and mobile phone B.

[0179] Method 2: The user determines the second device based on the transmission signal strength between the second device and the first device displayed in the displayed device list. In some embodiments, the first device determines the second device to receive the shared data based on the transmission coverage of the device. For example, when determining the second device to receive the shared data, the first device determines the second device to receive the shared data from the devices in the transmission coverage. Figure 5b As shown, the distribution device list interface displays devices within the transmission coverage range and devices outside the transmission coverage range, and the transmission mode or "out of range" logo is displayed after different devices. When the user clicks the selection switch after "Smart Speaker A" and "Tablet A" on the first device, "Smart Speaker A" and "Tablet A" are selected as the second devices to receive shared data.

[0180] Alternatively, if the first device chooses to distribute the shared data to the second device outside the transmission range, the first device will prompt the second device that it is not within the transmission coverage range and needs to move closer to the second device. Figure 5c This is a schematic diagram of the first device prompting the user to move closer to the second device when the user selects the second device outside the transmission range on the first device. In the distribution device list interface, when the user clicks on the mobile phone C outside the transmission coverage range of the first device, a first window pops up, which displays a prompt message "This device is not within the transmission range of this device, please try to move closer to the device".

[0181] Alternatively, when the first device determines a second device outside the transmission range, the first device can first determine other devices that receive shared data, and the other devices are within the transmission range of the first device and the second device. The first device first sends the shared data to the other devices, and then sends the shared data to the second device through the other devices.

[0182] In other embodiments, the first device determines the second device that receives the shared data according to the transmission mode of the first device. For example, the first device can send the shared data through multiple transmission modes such as Wi-Fi, Bluetooth, infrared technology, and frequency modulation, and determine the second device under different transmission modes according to the transmission mode. Figure 5d As shown, in the transmission mode interface, multiple transmission modes "WiFi transmission", "Bluetooth transmission", "infrared transmission" and "network transmission" are displayed. When the user clicks "WiFi transmission" on the first device, the WiFi transmission interface is entered, and the user determines the selected device based on the strength of the WiFi signal. When the user clicks "Bluetooth transmission" on the first device, the "mobile phone B" and "tablet A" within the Bluetooth transmission range are selected as the second device to receive the shared data.

[0183] In addition, the first device may also select the second device in the displayed device list according to instructions of other devices; or select the second device in the displayed device list according to a set second device selection rule.

[0184] In the above step S203 of this embodiment, the first device may use Figure 6a The method shown in the figure performs a security check on the second device. Figure 6a , the security verification process is described in detail.

[0185] S601: The first device sends verification request information to the second device.

[0186] The verification request information includes any one or any combination of the following: a challenge value, a registration information value. When the first device performs a security verification on the second device, it can first verify whether the first device and the second device are in the same security environment, or the first device determines whether the security level of the second device is higher than the set security level, or the first device determines whether the second device is a secure device. The following embodiment takes the verification request information carrying a challenge value, and the second device returns a security certificate corresponding to the challenge value as an example.

[0187] S602: The second device receives the verification request information sent by the first device, and the second device generates a security certificate that can prove its own security environment or prove its own security level or prove that it is a secure device according to the challenge value carried in the request information sent by the first device. The above challenge value can be information such as a random number, or can also be encrypted information of other content.

[0188] Optionally, the second device may generate a security proof according to the challenge value in the following manner, but not limited to:

[0189] Method 1: The second device encrypts the challenge value sent by the first device according to the key value in the current security environment (different security environments correspond to different key values), and the encrypted challenge value obtained is the security proof.

[0190] Method 2: The second device generates a digital signature based on the key corresponding to the current security environment and the challenge value using the key. The generated digital signature is a security proof.

[0191] Method 3: Encrypt the challenge value according to the key in the device certificate of the second device to obtain a security certificate. The device certificate includes any one or any combination of the second device's identity number (ID), manufacturer information (such as the manufacturer's name or trademark, etc.), factory time information, version information or model information, and may also include other parameter information of the second device.

[0192] S603: The second device sends the security certificate to the first device, and the first device receives the security certificate from the second device.

[0193] S604: After receiving the security certificate, the first device verifies the security certificate.

[0194] Optionally, the first device determines whether the second device is in the same security environment as the first device; or, the first device determines whether the security level corresponding to the security environment where the second device is located is higher than a set security level, which security level may be higher than the security environment where the first device is located or may be lower than the security environment where the first device is located; or, the first device determines whether the second device is a security device.

[0195] For example, the first device can use the key of the security environment where the second device is located to decrypt the security proof and obtain a challenge value. The first device compares the challenge value with the challenge value carried in the request information sent to the second device to determine whether the two are consistent. If the two are consistent, the first device determines that the first device and the second device are in the same security environment; if the two are inconsistent, the first device determines that the first device and the second device are in different security environments, or the first device further determines the key corresponding to the security level of the second device based on the challenge value carried in the request information, and uses the key corresponding to the security level to determine the security level of the second device, and further determines whether the security level of the second device is higher than the set security level.

[0196] Alternatively, the first device may also use the key of the security environment in which the first device is located to encrypt the challenge value in the request information sent to the second device, and compare the encrypted challenge value with the security proof sent by the second device to determine whether the two are consistent. If the two are consistent, the first device determines that the first device and the second device are in the same security environment; if the two are inconsistent, the first device determines that the first device and the second device are in different security environments. The first device may also use the keys of different security environments to encrypt the challenge value in the request information sent to the second device, and compare it with the security proof sent by the second device to determine the security environment where the second device is located.

[0197] In addition, when the second device sends the security proof to the first device, it can also send the device certificate of the second device to the first device at the same time. For example, in order to ensure security, identity information can be written to the device after the device is produced. For example, in order to ensure security, the manufacturer can test the device, and after the test is passed, the manufacturer of the device or the original equipment manufacturer (OEM) can write the identity information of the device to the device. In this embodiment, the challenge value can be encrypted using the private key in the device certificate, and the encrypted challenge value obtained is the security proof, which is sent to the first device.

[0198] In addition, when the first device determines the authorized service of the shared data, the first device can also determine the authorized service of the shared data based on the security verification result of the second device. For example, if the first device and the second device are in the same security environment, or the security level of the second device is not lower than the security level of the first device, or the second device is determined to be a secure device, the subsequent sending of the shared data can be continued, and the first service set of the first device can be used as the authorized service.

[0199] If the security level of the second device is lower than that of the first device, the first device needs to determine the authorized service for the shared data based on the security level of the second device. For example, if the security level of the second device is lower than that of the first device, but the security level of the second device can meet the security requirements of some services in the first service set, such as unlocking services, the authorized service for the shared data is determined to be the unlocking service; if the security level of the second device is lower than that of the first device, and the security level of the second device cannot meet the first service set, the shared data will not be sent to the second device.

[0200] like Figure 6b As shown, in the distribution device list interface, after the user clicks the option of "Smart Speaker A Security Level (Low)", the user enters the service setting interface. When the user clicks the selection switch of "Payment Service Recommended Security Level (Medium)", a first window pops up, and the first window displays "The security environment of this device does not meet the requirements for setting this service. It is dangerous to continue setting it! Do you need to continue setting it?" "Yes" "No". After the user clicks "Yes", the first device sends the shared data with the payment service set to smart speaker A.

[0201] In the above embodiment, the first device may encrypt the shared data and the usage policy information in the following encryption manner:

[0202] Method 1: The first device and the second device establish an encrypted transmission channel, and use the encryption key in the encrypted transmission channel to transmit the shared data and the usage policy information. In this method 1, after the first device verifies the second device, in order to establish an encrypted transmission channel, the second device will send a device certificate to the first device when sending a security certificate to the first device. Among them, the device certificate includes the first public key and the first private key of the second device. Since the first device has received the device certificate, the first device knows the first public key and the first private key of the second device. The first device determines the second public key and the second private key based on the following key relationship: first private key * second public key = first public key * second private key, and the first device sends the second public key to the second device as a communication key. The second device can obtain the encryption key according to the product of the second public key and the first private key. The encryption key is used for the first device and the second device to encrypt and decrypt the shared data.

[0203] Method 2: The first device and the second device use symmetric encryption to encrypt the shared data and the usage policy information. In this method 2, the same key is used for both encryption and decryption. For the first device, the first key is used to encrypt the shared data, and the second key is used to decrypt the message that receives feedback on whether the transmission of the shared data is successful. For the second device, the second key is used to encrypt the message that sends feedback on whether the transmission is successful to the first device, and the first key is used to decrypt the received shared data. In this way, only one key is involved for each device, which can simplify the authentication process.

[0204] Method three: The first device and the second device use an asymmetric encryption method to encrypt the shared data and the usage policy information. In this method three, a private key can be used for encryption and a public key can be used for decryption. Then for the first device, the shared data is encrypted using the private key of the first device, and the received feedback message of whether the transmission is successful is decrypted using the public key of the second device. The second device encrypts the feedback message of whether the transmission of the shared data is successful using the private key of the second device, and the received shared data is decrypted using the public key of the first device. This involves two keys for each device, a public key and a private key. This method can improve the security of the authentication process.

[0205] In an embodiment of the present application, the first device may periodically send an encryption key, or may send an encryption key each time the distribution of the shared data is triggered, or may send an encryption key when the first device or the second device is started or restarted, etc. The second device can obtain the encryption key sent by the first device each time, and the encryption key obtained each time may be different, that is, a new encryption key can be generated each time it is distributed, which can improve the security of the authentication process. The encryption key can also be called a temporary key, that is, the key is only applicable to the use after the shared data transmission process once. After each shared data transmission of the second device is completed, the encryption key obtained in the last transmission process will no longer be applicable. Therefore, the way the second device stores the encryption key can be cache storage. For example, after the first device sends the shared data, the second device can cache the encryption key obtained in this transmission process; after the second device successfully establishes communication with the first device again, the second device can obtain a new encryption key, and the second device can use the new encryption key in the cache to replace the old encryption key and store it in the cache.

[0206] If the second device receives the encryption key while performing security verification, the second device can immediately perform the shared data transmission process after verifying the security on the first device; if the second device does not receive the encryption key while performing security verification, for example, the first device only periodically establishes a communication connection with the second device, or the first device establishes a communication connection with the second device when starting or restarting, the first device will not immediately perform the encryption key distribution process after establishing a communication connection with the second device, but will perform the encryption key distribution process when the first device needs to distribute the shared data to the second device.

[0207] In addition, during the process of sending the shared data and the usage policy information to the second device, the first device displays a first interface, where the first interface includes the transmission progress of the shared data and the usage policy information. Figure 7Schematic diagram of the status of transmitting shared data to the first device. In the distribution device list, when the user clicks "Smart Speaker A", the first device starts to transmit shared data to Smart Speaker A, and a first window pops up on the first device. The first window displays a prompt "Transmitting to Smart Speaker A..." and displays the transmission progress. When the transmission is completed, a second window pops up and displays "Transmission to Smart Speaker A completed!". When the shared data is transmitted, the user is prompted in the interface of the list of devices to be distributed that the shared data has been transmitted. Alternatively, if the transmission of the second device is interrupted due to network reasons or changes in the transmission scene, the second device can send a prompt to the first device that "the current transmission has been interrupted". Based on the content of the last transmission, the first device resends all unsent shared data to the second device, or resends all shared data that should be transmitted this time to ensure the integrity of the transmitted data.

[0208] In some embodiments, before the second device sends the shared data and the second usage policy information to the third device, the method further includes:

[0209] The second device displays a device list in response to a fifth operation, wherein the fifth operation is used to trigger the display of the device list; the device list includes at least one of the following: device type, shared data type, and transmission signal strength between the second device and the second device;

[0210] The second device determines the device selected by the user in the displayed device list as the third device; or selects the third device in the displayed device list according to the instructions of other devices; or selects the third device in the displayed device list according to the set third device selection rule.

[0211] In addition, the second device may also determine the third device in the device list in the following manner:

[0212] Method 1: The second device determines the third device that receives the shared data and usage policy information according to the coverage range of the device.

[0213] In some embodiments, due to the limitation of device transmission capability, when the first device determines to distribute shared data and usage policy information, it is difficult to distribute to all devices, so the second device is required to distribute to the third devices not covered by the first device. Figure 8 A schematic diagram of the spatial distribution of devices. Users can determine the relative positions of various devices in the room by pre-establishing an indoor map and using spatial scanning and other methods. The first device first distributes the shared data to other second devices, and further expands the distribution coverage of the shared data of the first device through the second device, and distributes the shared data to third devices that cannot be covered by the first device.

[0214] Method 2: The second device determines the third device that receives the shared data and usage policy information according to the relationship between the devices.

[0215] In some embodiments, different devices have different hierarchical relationships, and shared data and usage policy information can only be distributed from high-level devices to low-level devices. For example, mobile phones or tablet devices are high-level devices, and high-level devices can distribute the shared data to all devices at the same level and below; while devices such as smart speakers are mid-level devices, and all devices at the same level and below the smart speakers can distribute the shared data, and it is not allowed to transmit shared data back to high-level devices.

[0216] Optionally, the second device saves the received shared data and the first usage policy information. After receiving shared data of the same user and the same category sent by other devices, the device in this embodiment can use, but is not limited to, the shared data stored in the following manner.

[0217] Method 1: After receiving the shared data sent by other devices, the above device updates the locally stored shared data. Figure 9a As shown, when the second device displays a message window of "Received a fingerprint information sent by mobile phone A, click to view details", when the second device enters the fingerprint management interface after the user clicks the message window, the interface displays the option of "NEW! Left thumb". Because the distribution time of the newly received fingerprint information of the "left thumb" is later than the distribution time of the locally stored fingerprint information of the left thumb, the previously stored fingerprint information of the left thumb can be replaced and updated with the newly received fingerprint information of the left thumb.

[0218] In some other embodiments, the locally stored shared data is updated according to the version of the received shared data. Some shared data is entered locally by the user, and each shared data also has an entry time of the shared data, which can be used as the version of the shared data, such as Figure 9b As shown, various fingerprint options are displayed in the fingerprint management interface, and "entry time..." is displayed after the option. Since the entry time of the newly received "left thumb" is August 2020, and the entry time stored in this device is June 2020, the old version of the left thumb fingerprint information is updated to the new version of the left thumb fingerprint information.

[0219] In some other embodiments, the locally stored shared data is updated according to the security level of the device sending the shared data. Fig.9cAs shown, various fingerprint options are displayed in the fingerprint management interface, and the transmission source of the fingerprint data and the security level of the transmission source are displayed after the option. Because the newly received "left thumb" is distributed from a smart door lock with a low security level, and the "left thumb" stored in this device is entered from this device with a high security level, the fingerprint information of the local left thumb with a high security level will not be updated to the fingerprint information of the left thumb sent by the low security level device.

[0220] Method 2: After receiving the shared data sent by other devices, the above-mentioned device continues to store the newly received shared data.

[0221] In some embodiments, in order to ensure the accuracy of executing the business, the device can also receive and store all the shared data. Since the space occupied by storing shared data is small, even if multiple shared data are stored, it will not take up too much storage space, so all the shared data can be received and stored. In addition, the user can also set a scheduled cleanup of the locally stored shared data, delete the shared data with an earlier storage time in the storage space at a predetermined time, or delete the shared data with a lower verification success rate at a predetermined time.

[0222] In some embodiments, the second device may, but is not limited to, perform the first authorization service according to the shared data in the following manner.

[0223] When the first authorization service includes a verification service, the second device obtains the data to be verified input by the user; the second device compares the shared data with the data to be verified; when the second device determines that the shared data matches the data to be verified, it determines that the service verification is successful.

[0224] Specifically, when the shared data is biometric data, and the first authorization service includes an identity authentication service, the second device may perform the identity authentication service according to the biometric data in the following manner:

[0225] The second device first obtains the biometric data to be verified input by the user, and uses the biometric data to compare with the biometric data to be verified input by the user. If the second device determines that the biometric data matches the biometric data to be verified input by the user, it determines that the identity authentication service is successfully executed.

[0226] For example, if a user requests face unlocking, the second device first obtains the face data input by the user, and then uses the locally stored face data to compare with the face data input by the user collected this time, and then the face unlocking request can be completed. Alternatively, if a user requests face payment, it is determined that the authorized service indicated in the usage policy information bound to the locally stored face data is: unlocking service. Then the second device cannot use the compared face data to complete the payment service.

[0227] In addition, in some embodiments, if the authorized services indicated by the usage policy information do not include the services requested by the user, the user may be prompted to complete the requested services on other devices. Fig.10 As shown, when the second device is a smart speaker, the user sends a voice message to the smart speaker to request to complete the payment service, and the usage policy information bound to the voiceprint data in the smart speaker does not indicate that the authorized service includes the payment service, then the smart speaker can send a voice prompt to the user through the speaker "This device does not have the authority to use the shared data to perform the service, and it is recommended that the user complete the service on other (specified) devices". Alternatively, the smart speaker may not store the voiceprint data. When the user completes the service through voice request, the smart speaker can send a voice prompt to the user through the speaker "The user has not stored the corresponding voiceprint data on the device. It is recommended that the user distribute it from other devices, or enter the voiceprint data on the device". Alternatively, the current security level of the smart speaker does not meet the requirements of the requested service. When the smart speaker is connected to an unknown WiFi, the smart speaker can send a voice prompt to the user through the speaker, "Sending a prompt that the current security level is weak and the service of this type cannot be performed. The user needs to wait until the security environment of the smart speaker meets the requirements before performing the voice message of the service".

[0228] In some embodiments, the second device can also cooperate with other devices to perform services based on shared data. The advantage of this implementation is that even if the security level of other devices is low, since the process of using shared data to perform services is completed in the second device with a higher security level, this method can also ensure that the services are completed in a secure environment.

[0229] Optionally, the second device and other devices may collaborate to perform services based on the shared data in the following manners, but not limited to.

[0230] Method 1: The second device and other devices are pre-bound and cooperate to perform services based on shared data.

[0231] In some embodiments, if the second device can be bound to multiple devices for collecting specific types of data, the bound device can use the shared data in the high-security level device to perform services when collecting the shared data, or multiple devices for collecting specific data types are only bound to the device with the highest security level. For example, the above devices are all bound to the mobile phones used by users on a daily basis to ensure the security of executing services.

[0232] For example, the face data is sent to the smart speaker for storage, but since the smart speaker does not have the function of collecting faces, the face unlocking service cannot be performed in theory. However, other devices for image capture can work with the smart speaker to complete the face unlocking service. For example, the electronic cat's eye on the smart door lock and the smart speaker can be used to work together to complete the face unlocking service. Fig.11 As shown, first, the smart door lock and the smart speaker are bound, so that after the electronic peephole on the smart door lock collects the user's face image, the face image is sent by the electronic peephole to the smart speaker, and the smart speaker compares the face image with the face data stored locally. When the comparison is successful, the smart speaker can control the smart door lock to unlock. In this way, even if the security level of the electronic peephole on the smart door lock is low, the face unlocking service can still be completed safely because the service execution process is completed in the smart speaker with a higher security level.

[0233] Method 2: Other devices select the second device, and the second device cooperates to perform services based on shared data according to the selection request of other devices. Since different devices have different data transmission capabilities, some devices have poor transmission capabilities and it is difficult to cover all devices in the communication system. Therefore, devices with poor transmission capabilities only select the second device that is closest to itself and has the highest security level to cooperate to perform services based on shared data to ensure the efficiency of service completion.

[0234] based on Figure 2 In the embodiment shown in the figure, the present application also provides the following multiple examples of shared data distribution methods, which can be applied to Fig.12a , Fig.13 In the communication system shown in FIG. Figure 12a-Figure 13 Provide specific descriptions for each instance.

[0235] Example 1: This example is applicable to the following scenarios: Fig.12a As shown. The first device is a mobile phone 12A, and the second device is a tablet computer 12B. Figure 12b The method is specifically described with reference to the flowchart shown in FIG.

[0236] S1201: The mobile phone 12A determines the facial data that needs to be distributed to the tablet computer 12B.

[0237] The mobile phone 12A determines the facial data based on the facial data selected by the user, or receives the facial data indicated by other devices, or determines the facial data by itself. The specific method of determining the facial data can be: Figure 3a-3c The method provided in the embodiment shown, therefore, the method of determining facial data can refer to the above embodiment and will not be repeated here.

[0238] S1202: The mobile phone 12A determines the authorization service for the facial data to be distributed to the tablet computer 12B.

[0239] The mobile phone 12A determines the authorized service for the face data distributed to the tablet computer 12B based on the authorized service selection instruction triggered by the user, or the mobile phone 12A automatically determines the authorized service for the face data distributed to the tablet computer 12B. The specific implementation method of determining the authorized service for the face data distributed to the tablet computer 12B can be Figure 4a-4b The method provided in the illustrated embodiment thus determines the authorized service of distributing facial data to the tablet computer 12B, which will not be described in detail here.

[0240] In addition, the mobile phone 12A may be provided with a first service set for the face data, the first service set including services executable by the mobile phone 12A, and the tablet computer 12B may be provided with a second service set for the face data, the second service set including services executable by the tablet computer 12B. When the mobile phone 12A determines the authorized service for the face data distributed to the tablet computer 12B, the mobile phone 12A may determine whether the authorized service for the face data distributed to the tablet computer 12B is correct based on the first service set and / or the second service set.

[0241] In addition, when the mobile phone 12A receives a face data request / sharing instruction sent by other devices, it can also determine the authorized service of the face data distributed to the tablet computer 12B based on the authorized service information carried in the face data request / sharing instruction.

[0242] S1203: The mobile phone 12A performs a security check on the tablet computer 12B.

[0243] S12031: Mobile phone 12A sends a verification request message to tablet computer 12B.

[0244] S12032: Tablet computer 12B receives the verification request information sent by mobile phone 12A. Tablet computer 12B generates a security certificate that can prove its own security environment or its own security level or that it is a security device based on the challenge value carried in the verification request information sent by mobile phone 12A.

[0245] S12033: The tablet computer 12B sends the security certificate to the mobile phone 12A, and the mobile phone 12A receives the security certificate from the tablet computer 12B.

[0246] S12034: After receiving the security certificate, the mobile phone 12A verifies the security certificate to determine whether the tablet computer 12B is in the same security environment as the mobile phone 12A; or the security level corresponding to the security environment where the tablet computer 12B is located, which may be higher than the security environment where the mobile phone 12A is located or may be lower than the security environment where the mobile phone 12A is located; or, determine whether the tablet computer 12B is a security device.

[0247] The specific method for the mobile phone 12A to perform security verification on the tablet computer 12B can be found in steps S601-S604, which will not be repeated here.

[0248] S1204: The mobile phone 12A distributes the facial data and the usage policy information to the tablet computer 12B.

[0249] First, the mobile phone 12A generates the usage policy information according to the authorized service set in step S1202, wherein the usage policy information is used to indicate the authorized service.

[0250] The mobile phone 12A may distribute the encrypted facial data and the usage policy information to the tablet computer 12B, or the mobile phone 12A may distribute the encrypted facial data marked with the usage policy information to the tablet computer 12B. The specific implementation method of sending the facial data and the usage policy information may be the method provided in S203, so the method of determining the sending of the facial data and the usage policy information may refer to the above embodiment, which will not be repeated here.

[0251] In some embodiments, the mobile phone 12A can encrypt the facial data and the usage policy information in the following manner. Optionally, the mobile phone 12A and the tablet computer 12B can establish an encrypted transmission channel, and use the encryption key in the encrypted transmission channel to transmit the facial data and the usage policy information, or the mobile phone 12A and the tablet computer 12B use a symmetric encryption method to encrypt the facial data and the usage policy information, or the mobile phone 12A and the tablet computer 12B use an asymmetric encryption method to encrypt the facial data and the usage policy information. The specific encryption method can be found in the above embodiment, which will not be repeated here.

[0252] S1205: The tablet computer 12B stores the facial data and the usage policy information;

[0253] After receiving the face data and usage policy information sent by the mobile phone 12A, the tablet computer 12B can verify the identity of the mobile phone 12A, or after receiving the face data and usage policy information sent by the mobile phone 12A, the tablet computer 12B determines whether the mobile phone 12A is a pre-authorized device. The specific method of the tablet computer 12B verifying the identity of the mobile phone 12A can refer to the method provided in step S801, which will not be repeated here.

[0254] After receiving the face data and usage policy information sent by the mobile phone 12A, the tablet computer 12B stores the face data and usage policy information;

[0255] The tablet computer 12B stores the face data and the usage policy information in a preset storage space according to the type of the face data, or the tablet computer 12B stores the face data and the usage policy information in a preset storage space according to the type of the usage policy information. The specific manner in which the tablet computer 12B stores the face data and the usage policy information can refer to the manner provided in step S802, which will not be repeated here.

[0256] S1206: The tablet computer 12B determines the authorized service of the facial data according to the usage policy information;

[0257] S1207: Tablet computer 12B performs authorization service according to the facial data.

[0258] The tablet computer 12B may perform authorization services based on the facial data on its own, or the tablet computer 12B may perform authorization services based on the facial data according to instructions from other devices, or the tablet computer 12B may perform authorization services based on the facial data according to user selection.

[0259] Example 2: This application also provides an example of a shared data distribution method. Fig.13 , is a schematic diagram of a communication system, in which the first device is a mobile phone 13A, the second device is a tablet computer 13B and a smart speaker 13C, and the third device is a mobile phone 13D. Since the method of sending the face data and the usage policy information from the mobile phone 13A to the tablet computer 13B and the smart speaker 13C is based on the same concept as the above steps S1201-S1204, it will not be repeated here.

[0260] The following is a specific description of a scenario in which the second device executes a distribution service corresponding to a distribution permission indication.

[0261] Among them, in the usage policy information corresponding to the facial data of the tablet computer 13B, the authorized service indicated by the usage policy information includes a distribution permission indication, and the tablet computer 13B sends the facial data and the usage policy information to the mobile phone 13D based on the distribution permission indication.

[0262] The tablet computer 13B can determine the third device (mobile phone 13D) to receive the facial data based on the transmission capability of the device, or, when the tablet computer 13B chooses to transmit to the mobile phone 13D outside the transmission range, prompt the user to move the tablet computer 13B closer to the mobile phone 13D outside the transmission range; or, the tablet computer 13B chooses to transmit the facial data and the usage policy information to the mobile phone 13D outside the transmission range through other devices.

[0263] However, in the usage policy information corresponding to the facial data of the smart speaker 13C, the authorized service indicated by the usage policy information does not include a distribution permission indication. The smart speaker 13C cannot send the facial data and the usage policy information to the mobile phone 13D, thereby preventing the facial data from being distributed at multiple levels and regulating the devices using the facial data.

[0264] After receiving the facial data and the usage policy information sent by the tablet computer 13B, the mobile phone 13D can store the facial data in the following manner: the mobile phone 13D updates the locally stored facial data based on the facial data received from the tablet computer 13B, wherein the locally stored facial data can be updated in a manner of: updating the locally stored facial data according to the time when the facial data is received, or updating the locally stored facial data according to the security level of the device that sends the facial data.

[0265] In addition, the mobile phone 13D can also continue to store the newly received face data after receiving the face data sent by the tablet computer 13B. The specific method of storing the face data sent by the tablet computer 13B by the mobile phone 13D can be found in Figure 9a-9c The method provided will not be described in detail here.

[0266] In the shared data distribution method provided in the embodiment of the present application, the first device can distribute the locally stored shared data to the second device, and according to the usage policy information, the second device receiving the shared data can follow the instructions of the usage policy information to use the authorized service. In this way, when the first device distributes the locally stored shared data to the second device, it can standardize the business scenarios of the shared data use through the usage policy information to avoid the abuse of the shared data. At the same time, the shared data on the second device still follows the authorized service indicated by the usage policy information of the first device, so that the first device can well perform unified management and control of the shared data.

[0267] Based on the above embodiments, the present application also provides a shared data distribution system. Fig.14 Schematic diagram of a shared data distribution system. The shared data distribution system includes: a first device 1400 and a second device 1410; the first device 1400 is used to: determine the shared data, and determine the authorized service of the shared data, the authorized service is a service that other devices can perform using the shared data; send the shared data and usage policy information to the second device 1410, wherein the usage policy information is used to indicate the authorized service; the second device 1410 is used to: receive the shared data and the usage policy information sent by the first device 1400; perform the authorized service using the shared data according to the usage policy information. The embodiments of the present application can divide the first device 1400 and the second device 1410 into modules according to their functions. For specific division methods, please refer to Fig.14 shown.

[0268] The first device 1400 includes: a first distribution scheduling module 1401, a first authority management module 1402, a first security verification module 1403, a first storage module 1404 and a first communication module 1405. The functions of each module are described below:

[0269] The first distribution scheduling module 1401 is used to determine the shared data and send an instruction to the first authority management module 1402 to determine the authorized service of the shared data; after the first authority management module 1402 determines the authorized service of the shared data, send an instruction to the first security verification module 1403 to perform security verification on the second device 1410; after the first security verification module 1403 passes the security verification of the second device 1410, obtain the shared data from the first storage module 1404 and send the shared data to the first communication module 1405;

[0270] The first rights management module 1402 is configured to determine the authorized service of the shared data after receiving the instruction for determining the authorized service of the shared data sent by the first distribution scheduling module 1401, and determine the usage policy information based on the authorized service;

[0271] The first security verification module 1403 receives the instruction sent by the first distribution scheduling module 1401 to perform security verification on the second device 1410, and performs security verification on the second device 1410;

[0272] The first storage module 1404 is configured to send the shared data to the distribution scheduling module 1401 when the first distribution scheduling module 1401 obtains the shared data;

[0273] The first communication module 1405 is used to send the shared data and the usage policy information to the second device 1410 after receiving the shared data sent by the first distribution scheduling module 1401.

[0274] In some embodiments, the first authority management module 1402 is further used to determine the authorized service of the shared data according to the first service set of the first device 1400 and the second service set of the second device 1410 .

[0275] In some other embodiments, the first security verification module 1403 may perform security verification on the second device 1410 by any one or any combination of the following:

[0276] Verify whether the second device 1410 is in a safe environment;

[0277] Verifying whether the security level of the second device 1410 is higher than a set security level;

[0278] Verify whether the second device 1410 is a secure device. In some embodiments, after determining the shared data, the first distribution scheduling module 1401 is further configured to determine the second device 1410 that receives the shared data.

[0279] The first device 1400 includes: a second distribution scheduling module 1411, a second authority management module 1412, a second security verification module 1413, a second storage module 1414 and a second communication module 1415. The functions of each module are described below:

[0280] The second distribution scheduling module 1411 is used to receive the shared data and the usage policy information sent by the second communication module 1415, send an instruction to verify the identity of the first device 1400 to the second security verification module 1413, and after the verification passes, send the shared data and the usage policy information to the second storage module 1414;

[0281] When it is necessary to use the shared data to execute a service, determine whether the executed service is an authorized service, and if so, call the shared data in the second storage module 1414 to execute the authorized service according to the shared data;

[0282] The second authority management module 1412 is used to bind the shared data with the authorized service in the usage policy information after the second security verification module 1413 passes the verification;

[0283] The second security verification module 1413 is used to verify the identity of the first device 1400;

[0284] The second storage module 1414 is used to store shared data bound to the authorized service;

[0285] The second communication module 1415 receives the shared data and the usage policy information sent by the first device 1400 , and sends the shared data and the usage policy information to the second distribution scheduling module 1411 .

[0286] In addition, when the first device 1400 performs security verification on the second device 1410, some modules in the first device 1400 and the second device 1410 are also used to perform the following steps:

[0287] The first security verification module 1403 is used to send verification request information to the second device 1410 through the first communication module 1405, and receive the security certificate sent by the second communication module 1415 of the second device 1410;

[0288] Among them, the verification request information includes at least one item or any combination: challenge value, registration information value, etc. When the first device 1400 performs security verification on the second device 1410, it can first verify whether the first device 1400 and the second device 1410 are in the same security environment, or the first device 1400 determines the security level of the second device 1410, or the first device 1400 determines whether the second device 1410 is a security device. The following embodiment takes the verification request information carrying a challenge value and the second device 1410 returning a security certificate corresponding to the challenge value as an example: after receiving the security certificate, the first security verification module 1403 verifies the security certificate to determine whether the second device 1410 is in the same security environment as the first device 1400, or determines the security level corresponding to the security environment where the second device 1410 is located, which may be higher than the security environment where the first device 1400 is located or may be lower than the security environment where the first device 1400 is located, or determines whether the second device 1410 is a security device.

[0289] The second security verification module 1413 is used to receive the verification request information sent by the first device 1400 through the first communication module 1405, generate a security certificate that can prove its own security environment or its own security level or prove that it is a security device according to the challenge value carried in the verification request information sent by the first device 1400, and send the security certificate to the first device 1400;

[0290] In addition, when the authorization service includes a verification service, the second device 1410 obtains the data to be verified input by the user;

[0291] See also Fig.15 As shown, the second device 1410 also includes: a verification data acquisition module 1416 and an authentication module 1417 .

[0292] In this embodiment, after receiving and storing the shared data sent by the first device 1400, the second distribution scheduling module 1411 is further used to:

[0293] When the first authorization service includes a verification service, sending an instruction for obtaining verification data input by the user to the verification data obtaining module 1416;

[0294] The verification data acquisition module 1416 is used to obtain the verification data input by the user after receiving the instruction to obtain the verification data input by the user, and obtain the shared data from the second storage module 1414 to compare with the data to be verified, and determine that the user identity verification is successful when it is determined that the shared data matches the data to be verified;

[0295] The authentication module 1417 is configured to receive an identity authentication result, and after determining that the identity authentication is successful, execute the first authorization service according to the shared data.

[0296] Based on the same technical concept, the present application embodiment also provides an electronic device. The electronic device can be Fig.14 The first device 1400 and the second device 1410 in the shared data distribution system shown in FIG. 1 can implement the shared data distribution method provided in the above embodiments and examples, and have Fig.14 The functions of the first device 1400 and the second device 1410 are shown. Fig.16 As shown, the electronic device 1600 includes: a processor 1601 and a memory 1602, and of course, it can also have Figure 1b Each peripheral or internal hardware shown.

[0297] The memory 1602 and other components are interconnected with the processor 1601. Optionally, the processor 1601 and the memory 1602 can be interconnected via a bus; the bus can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.16 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0298] Specifically, the processor 1601 can collect shared data in real time through the camera 1603 of the electronic device 1600. Alternatively, the electronic device 1600 can also distribute shared data with other devices through the transceiver 1604. Optionally, the transceiver 1604 can be a Bluetooth module, a WiFi module, an RF circuit, etc.

[0299] In some embodiments, the electronic device 1600 may further include a display panel 1605, which, when combined with a touch sensor, can determine shared data and a distribution method of shared data according to different gesture operations. Furthermore, the electronic device 1600 may further include an audio circuit 1606, which is used to instruct a user to distribute shared data through voice.

[0300] The processor 1601 is used to implement Figure 2 For the shared data distribution method shown, please refer to the description in the above embodiment for details, which will not be repeated here.

[0301] In one implementation, when the electronic device 1600 is a first device, the processor 1601 is configured to:

[0302] Determine shared data, and determine an authorized service of the shared data, where the authorized service is a service that other devices can perform using the shared data;

[0303] The shared data and usage policy information are sent to the second device, wherein the usage policy information is used to indicate the authorized service.

[0304] In one implementation, when the electronic device 1600 is a second device, the processor 1601 is configured to:

[0305] Receive shared data and first usage policy information sent by a first device; wherein the first usage policy information is used to indicate authorized services that the second device can perform using the shared data.

[0306] Determining, according to the first usage policy information, a first authorized service that can use the shared data;

[0307] The first authorization service is performed according to the shared data.

[0308] The memory 1602 is used to store program instructions and data. Specifically, the program instructions may include program codes, and the program codes include computer operation instructions. The memory 1602 may include random access memory (RAM), and may also include non-volatile memory (non-volatile memory), such as at least one disk memory. The processor 1601 executes the program instructions stored in the memory 1602, and uses the data stored in the memory 1602 to implement the above functions, thereby realizing the shared data distribution method provided in the above embodiment.

[0309] It is understandable that this application Fig.16 The memory 1602 in the memory 1602 may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), and direct RAM bus RAM (DR RAM). It should be noted that the memory of the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0310] Based on the above embodiments, the embodiments of the present application further provide a computer program, which, when executed on a computer, enables the computer to execute the shared data distribution method provided in the above embodiments.

[0311] Based on the above embodiments, the embodiments of the present application further provide a computer storage medium, in which a computer program is stored. When the computer program is executed by a computer, the computer executes the shared data distribution method provided in the above embodiments.

[0312] The storage medium may be any available medium that can be accessed by a computer. For example, but not limited to, a computer-readable medium may include RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer.

[0313] Based on the above embodiments, the embodiments of the present application further provide a chip, which is used to read a computer program stored in a memory to implement the shared data distribution method provided in the above embodiments.

[0314] Based on the above embodiments, an embodiment of the present application provides a computer program product. When the computer program product is run on an electronic device, the shared data distribution method provided in the above embodiments is implemented.

[0315] In summary, the embodiments of the present application provide a shared data distribution method and an electronic device, in which the device can distribute the locally stored shared data to other devices, and by using policy information, enable other devices that receive the shared data to follow the instructions of the policy information to use the authorized services. In this way, when the device distributes the locally stored shared data to other devices, it can standardize the business scenarios for the use of the shared data by using the policy information to avoid the abuse of the shared data. Therefore, through this method, the device can prevent the shared data from being used in unreasonable or unexpected application scenarios, and can better ensure the security of the decentralized storage of shared data. After being distributed, the shared data will not be abused to expand its use. At the same time, the shared data on other devices still follows the authorized services configured by the distribution device, and the device can well manage and control the shared data in a unified manner.

[0316] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0317] The present application is described with reference to the flowchart and / or block diagram of the method, device (system), and computer program product according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the process and / or box in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for implementing the function specified in one process or multiple processes in the flowchart and / or one box or multiple boxes in the block diagram.

[0318] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0319] These computer program instructions may also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0320] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A shared data distribution method, characterized in that: The method comprises: The first device determines the shared data and determines an authorized service of the shared data, where the authorized service is a service that other devices can perform using the shared data, and the shared data is biometric data; The first device sends the shared data and usage policy information to the second device, wherein the usage policy information is used to indicate the authorized service; The first device determines the shared data, including: The first device displays a shared data list in response to a first operation, wherein the first operation is used to trigger the display of the shared data list; The first device receives the shared data selected by the user in the displayed shared data list; or selects the shared data in the displayed shared data list according to instructions of other devices; or selects the shared data in the displayed shared data list according to a set shared data selection rule.

2. The method according to claim 1, characterized in that Determine the authorized business of the shared data, including: The first device displays the authorized service list in response to a second operation, where the second operation is used to trigger the display of the authorized service list; The first device receives the authorized service selected by the user in the displayed authorized service list; or selects the authorized service in the displayed authorized service list according to the instruction of other devices; or selects the authorized service in the displayed authorized service list according to the set authorized service selection rule.

3. The method according to claim 1, characterized in that Determine the authorized business of the shared data, including: The first device displays the first service set and / or the second service set in response to a third operation, where the third operation is used to trigger the display of the first service set and / or the second service set; The first device determines the authorized service according to the first service set or the second service set; The first service set includes services that the first device can perform using the shared data; the second service set includes services that the second device can perform using the shared data, and the authorized services are included in the first service set and / or the second service set.

4. The method according to any one of claims 1 to 3, characterized in that: Before the first device sends the shared data and the usage policy information to the second device, the method further includes: The first device displays a device list in response to a fourth operation, wherein the fourth operation is used to trigger the display of the device list; the displayed device list includes at least one of the following: device type, shared data type, and transmission signal strength between the first device and the first device; The first device determines the device selected by the user in the displayed device list as the second device; or selects the second device in the displayed device list according to the instruction of other devices; or selects the second device in the displayed device list according to the set second device selection rule.

5. The method according to claim 1, characterized in that Before the first device sends the shared data and the usage policy information to the second device, the method further includes: The first device performs a security check on the second device and determines that the check passes.

6. The method according to claim 5, characterized in that The first device performs security verification on the second device, including: The first device verifies whether the second device is in a secure environment; or The first device verifies whether the security level of the second device is higher than a set security level; or The first device verifies whether the second device is a secure device.

7. The method according to claim 1, characterized in that The first device sends the shared data and usage policy information to the second device, including: The first device encrypts the shared data and the usage policy information using an encryption key; The first device sends the encrypted shared data and the usage policy information to the second device.

8. The method according to claim 1, characterized in that The first device sending the shared data to the second device includes: The first device slices the shared data to generate a plurality of slice data; the plurality of slice data constitute the shared data; The first device encrypts the plurality of fragmented data using different encryption levels respectively, and sends the encrypted plurality of fragmented data to the second device.

9. The method according to any one of claims 1-3 and 5-8, characterized in that: The method further comprises: During the process of sending the shared data and the usage policy information to the second device, the first device displays a first interface, where the first interface includes the transmission progress of the shared data and the usage policy information.

10. A shared data distribution method, characterized in that: The method comprises: The first device displays the shared data list in response to a first operation, where the first operation is used to trigger the display of the shared data list; The first device receives the shared data selected by the user in the displayed shared data list; or selects the shared data in the displayed shared data list according to instructions of other devices; or selects the shared data in the displayed shared data list according to a set shared data selection rule; The second device receives the shared data and first usage policy information sent by the first device; wherein the first usage policy information is used to indicate the authorized services that the second device can perform using the shared data, and the shared data is biometric data; The second device determines, according to the first usage policy information, a first authorized service that can use the shared data; The second device performs the first authorization service according to the shared data.

11. The method according to claim 10, characterized in that Before the second device receives the shared data and the first usage policy information sent by the first device, the method further includes: The second device performs identity authentication on the first device and determines that the identity authentication succeeds; The method further comprises: The second device saves the received shared data and the first usage policy information.

12. The method according to claim 11, characterized in that The second device performs the first authorization service according to the shared data, including: When the first authorized service includes a distribution permission indication, the second device determines a second authorized service of the shared data, where the second authorized service is a service that other devices can perform using the shared data; The second device sends the shared data and second usage policy information to the third device, where the second usage policy information is used to indicate the second authorized service.

13. The method according to claim 12, characterized in that Before the second device sends the shared data and the second usage policy information to the third device, the method further includes: The second device displays a device list in response to a fifth operation, wherein the fifth operation is used to trigger the display of the device list; the displayed device list includes at least one of the following: device type, shared data type, and transmission signal strength between the second device and the second device; The second device determines the device selected by the user in the displayed device list as the third device; or selects the third device in the displayed device list according to the instructions of other devices; or selects the third device in the displayed device list according to the set third device selection rule.

14. The method according to any one of claims 10 to 13, characterized in that: The second device performs the first authorization service according to the shared data, including: When the first authorization service includes a verification service, the second device obtains data to be verified input by the user; The second device compares the shared data with the data to be verified; When the second device determines that the shared data matches the data to be verified, it determines that the service verification is successful.

15. The method according to claim 10, characterized in that The method further comprises: During the process of receiving the shared data and the first usage policy information sent by the first device, the second device displays a second interface, where the second interface includes the transmission progress of the shared data and the first usage policy information.

16. An electronic device, characterized in that: The electronic device comprises: One or more processors, a memory, and one or more programs; wherein the one or more programs are stored in the memory, and the one or more programs include instructions, which, when executed by the electronic device, enable the electronic device to execute the method as described in any one of claims 1 to 9, and / or execute the method as described in any one of claims 10 to 15.

17. A shared data distribution system, characterized in that: The system comprises: a first device and a second device; The first device is used to: determine shared data and determine an authorized service of the shared data, where the authorized service is a service that other devices can perform using the shared data, and the shared data is biometric data; send the shared data and usage policy information to the second device, where the usage policy information is used to indicate the authorized service; The first device determines the shared data, including: the first device displays a shared data list in response to a first operation, the first operation being used to trigger the display of the shared data list; the first device receives the shared data selected by a user in the displayed shared data list; or selects the shared data in the displayed shared data list according to an instruction of another device; or selects the shared data in the displayed shared data list according to a set shared data selection rule; The second device is used to: receive the shared data and the usage policy information sent by the first device; and execute the authorized service using the shared data according to the usage policy information.

18. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store a computer program. When the computer program is executed on a computer, the computer is enabled to execute the method according to any one of claims 1 to 9 and / or execute the method according to any one of claims 10 to 15.

Images