Data sharing method, electronic device and computer cluster

Abstract

A data sharing method, electronic device and computer cluster relate to the fields of terminal technology and information security technology. The sharer uses a first device, and the method includes: determining a sharee to whom a cloud platform can provide cloud services; generating an encryption public key according to the identification information of the sharee, and using the encryption public key to encrypt the data to be shared; and sending the encrypted data to be shared to the cloud platform. The sharee uses a second device, and the method includes: obtaining the encrypted data to be shared from the cloud platform, the encrypted data to be shared is encrypted by the sharer's first device using an encryption public key, and the encryption public key is generated by the first device according to the identification information of the sharee; the encrypted data to be shared is decrypted using a locally stored second private key to obtain the data to be shared, and the second private key is generated by the cloud platform using the identity authentication information of the sharee. This solution simplifies the process of users sharing data and improves the security of data sharing.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a data sharing method, electronic device and computer cluster. Background Art

[0002] With the development of cloud services, more and more users are sharing data through cloud disks.

[0003] Currently, when sharing data through cloud disks, the initiator of sharing must first encrypt the data to be shared, generate or set a key, then create an access link to access the data to be shared, and send the access link and key to the recipient. The recipient can obtain and decrypt the data through the link and key.

[0004] The above data sharing methods require that the key be set in advance and notified to the sharee, and then the sharee will decrypt it. However, when there are a large number of sharees, notifying them one by one will make the whole process longer, and there is a risk of key leakage in the process. When the key is leaked, all three parties who know the key can decrypt the data, so the security is poor. Summary of the invention

[0005] In order to solve the above problems, the present application provides a data sharing method, electronic device and computer cluster, which simplifies the process of data sharing for users and improves the security of data sharing.

[0006] In the first aspect, the present application provides a method for data sharing, which is applied to a first device, and the user of the first device is a sharer, and the method includes: determining a sharee to whom a cloud platform can provide cloud services; generating an encryption public key based on the identification information of the sharee, and using the encryption public key to encrypt the data to be shared; and sending the encrypted data to be shared to the cloud platform. Applied to a second device, the user of the first device is a sharee, and the method includes: obtaining the encrypted data to be shared from the cloud platform, the encrypted data to be shared is encrypted by the sharer's first device using the encryption public key, and the encryption public key is generated by the first device according to the sharee's identification information; using a locally stored second private key to decrypt the encrypted data to be shared to obtain the data to be shared, and the second private key is generated by the cloud platform using the identity authentication information of the sharee and sent to the second device.

[0007] Using this solution, after the first device and the second device have registered for the data sharing service on the platform, a private key for decryption is stored locally, so that when the sharer shares data with the sharee, the two do not need to negotiate the key, and the data sharer does not need to actively add the contact information of the sharee and inform the key and download link. It is only necessary to encrypt the shared data according to the known second identification information of the sharee, such as the email address or mobile phone number of the sharee, and upload it to the cloud platform. For the sharee, after obtaining the data, the local second private key can be used for automatic decryption. During the whole process, there is no risk of key leakage due to notifying the sharee of the key, which improves the security of data sharing. In addition, when the number of sharees is large, there is no need to notify each sharee separately in turn, which simplifies the process of data sharing for users.

[0008] In one possible implementation, the first device runs a cloud disk APP, and the cloud platform is used to provide cloud services to the cloud disk APP. Determining the sharees to whom the cloud platform can provide cloud services specifically includes: initiating a registration query for contacts to the cloud platform, the registration query is used to determine the contacts who have registered the cloud disk APP; receiving the query results sent by the cloud platform, the query results indicating the contacts who have registered the cloud disk APP; and selecting sharees from the contacts who have registered the cloud disk APP.

[0009] In one possible implementation, the first device runs a system data sharing service, and the cloud platform is used to provide cloud services for the system data sharing service, and determines the sharees to which the cloud platform can provide cloud services, specifically including: initiating a registration query for contacts to the cloud platform, the registration query is used to determine the contacts registered for the system data sharing service; receiving the query results sent by the cloud platform, the query results indicating the contacts registered for the system data sharing service; and selecting sharees from the contacts registered for the system data sharing service.

[0010] In one possible implementation, a registration query for a contact is initiated to the cloud platform, specifically including: establishing a secure transmission channel between the first device and the security module SE chip of the cloud platform; sending hash information of the contact for registration query to the SE chip through the secure transmission channel, the hash information is generated based on the identification information of the contact for registration query, and the SE chip is used to obtain the query result based on the hash information.

[0011] In one possible implementation, before determining the sharee(s) to whom the cloud platform can provide cloud services, the method also includes: sending identity authentication information carrying the sharer's identification information and the sharer's account information to the cloud platform so that the cloud platform can perform identity authentication; receiving and storing the master public key and the first private key sent by the cloud platform, the first private key being generated by the cloud platform using the sharer's identity authentication information and sent to the first device.

[0012] In a possible implementation, the identification information is an email address or a mobile phone number.

[0013] In a possible implementation, the encrypted data to be shared is sent to a cloud platform, and the method also includes: notifying the sharee through a social platform or instant messaging software, and the social platform or instant messaging software is associated with the cloud platform.

[0014] In the second aspect, the present application provides a method for data sharing, which is applied to a second device, and the user of the second device is the sharee, and the method includes: obtaining encrypted data to be shared from a cloud platform, the encrypted data to be shared is encrypted by the sharer's first device using an encryption public key, and the encryption public key is generated by the first device based on the sharee's identification information; using a locally stored second private key to decrypt the encrypted data to be shared to obtain the data to be shared, and the second private key is generated by the cloud platform using the sharee's identity authentication information and sent to the second device.

[0015] In a possible implementation, before obtaining the encrypted data to be shared from the cloud platform, the method further includes: when the second private key is not stored locally, registering for a data sharing service of the cloud platform to obtain the second private key generated by the cloud platform.

[0016] In one possible implementation, the second device runs a cloud disk APP, and the cloud platform is used to provide cloud services to the cloud disk APP and register for the cloud platform's data sharing service, specifically including: sending identity authentication information carrying the identification information of the sharee and the sharee's cloud disk APP account information to the cloud platform through the cloud disk APP, so that the cloud platform can perform identity authentication; receiving and storing the master public key and the second private key sent by the cloud platform.

[0017] In one possible implementation, the second device runs a system data sharing service, and the cloud platform is used to provide cloud services for the system data sharing service. Registering for the cloud platform's data sharing service specifically includes: sending identity authentication information carrying the sharee's identification information and the sharee's device account information to the cloud platform through the system data sharing service, so that the cloud platform can perform identity authentication; receiving and storing the master public key and the second private key sent by the cloud platform.

[0018] In a possible implementation, the identification information is an email address or a mobile phone number.

[0019] In a third aspect, the present application provides a method for data sharing, which is applied to a cloud platform, and the cloud platform can be a computer cluster. The cloud platform includes an SE chip, which is used to provide identity-based encryption (IBE) services and contact discovery services. The method includes: determining a sharee who can provide cloud services and informing a first device, where the user of the first device is the sharee; using the identity authentication information of the sharee to generate a second private key and sending it to a second device, where the user of the second device is the sharee; receiving and storing the encrypted data to be shared sent by the first device, and providing it to the second device, where the encrypted data to be shared is encrypted by the sharee's first device using an encryption public key, and the encryption public key is generated by the first device based on the identification information of the sharee.

[0020] In one possible implementation, the first device runs a cloud disk APP, and the cloud platform is used to provide cloud services for the cloud disk APP, determine the sharees who can provide cloud services and inform the first device, specifically including: accepting a registration query for contacts initiated by the first device, the registration query is used to determine the contacts registered for the cloud disk APP; performing a registration query for the contacts and sending the query results to the first device, the query results indicating the contacts registered for the cloud disk APP.

[0021] In one possible implementation, the first device runs a system data sharing service, and the cloud platform is used to provide cloud services for the system data sharing service, determine the sharees who can provide cloud services and inform the first device, specifically including: accepting a registration query for contacts initiated by the first device, the registration query is used to determine the contacts who register for the system data sharing service; performing a registration query for the contacts and sending the query results to the first device, the query results indicating the contacts who register for the system data sharing service.

[0022] In one possible implementation, accepting a registration query for a contact initiated by a first device specifically includes: establishing a secure transmission channel between the security module SE chip of the cloud platform and the first device; receiving hash information of the contact for registration query sent by the first device through the secure transmission channel, so that the SE chip obtains the query result based on the hash information, and the hash information is generated based on the identification information of the contact for registration query.

[0023] In one possible implementation, before determining the sharee who can provide cloud services and informing the first device, the method also includes: receiving identity authentication information sent by the first device and carrying the sharer's identification information and the sharer's account information; authenticating the sharer according to the identity authentication information; when the identity authentication is passed, generating a first private key according to the identity authentication information; sending the first private key and the master public key to the first device, the master public key being pre-generated by the cloud platform.

[0024] In one possible implementation, the second device runs a cloud disk APP, and the cloud platform is used to provide cloud services for the cloud disk APP. The second private key is generated by using the identity authentication information of the sharee and sent to the second device, specifically including: receiving the identity authentication information sent by the cloud disk APP that carries the identification information of the sharee and the cloud disk APP account information of the sharee; authenticating the sharee according to the identity authentication information; when the identity authentication is passed, generating a second private key according to the identity authentication information; sending the second private key and the master public key to the second device, and the master public key is pre-generated by the cloud platform.

[0025] In one possible implementation, the second device runs a system data sharing service, and the cloud platform is used to provide cloud services for the system data sharing service. The second private key is generated by using the identity authentication information of the sharee and sent to the second device, specifically including: receiving the identity authentication information sent by the system data sharing service that carries the identification information of the sharee and the device account information of the sharee; authenticating the sharee according to the identity authentication information; when the identity authentication is passed, generating a second private key according to the identity authentication information; sending the second private key and the master public key to the second device, the master public key being pre-generated by the cloud platform.

[0026] In a possible implementation, the identification information is an email address or a mobile phone number.

[0027] In a fourth aspect, the present application also provides an electronic device, which includes a processor, a memory, and a security module SE chip. Among them, the memory stores computer-readable instructions, and the processor executes the computer-readable instructions to execute the method of data sharing. The SE chip is used to store the master public key sent by the cloud platform and the private key corresponding to the electronic device. When the electronic device shares data, the SE chip provides an IBE encryption service for generating the encrypted public key according to the identification information of the sharee, and using the encrypted public key to encrypt the data to be shared. At this time, the electronic device is a first device, and the private key corresponding to the electronic device corresponds to the first private key in the above implementation. When the electronic device needs to decrypt the encrypted data obtained from the cloud, the SE chip provides an IBE encryption service for decrypting the encrypted data to be shared obtained from the cloud platform using the private key corresponding to the electronic device. At this time, the electronic device is a second device, and the private key corresponding to the electronic device corresponds to the second private key in the above implementation.

[0028] The embodiments of the present application do not specifically limit the type of electronic device, and may be, for example, a mobile phone, a tablet computer, a laptop computer, or a desktop computer.

[0029] In a fifth aspect, the present application also provides a computer cluster, that is, a cloud platform. The computer cluster includes at least one computer, and the computer includes a memory, a processor, and a security module SE chip. The memory stores computer-readable instructions, and the processor executes the computer-readable instructions to execute the data sharing method. The SE chip is used to determine the sharee(s) who can be provided with cloud services by the cloud platform, generate a master private key and a master public key, and generate a private key corresponding to the electronic device based on the identity authentication information and the master private key. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 Scenario illustration provided for this application Figure 1 ;

[0031] Figure 2 Scenario illustration provided for this application Figure 2 ;

[0032] Figure 3 A flow chart of a method for a sharer to start a data sharing service provided in an embodiment of the present application;

[0033] Figure 4 A flow chart of a method for sharing data provided by a sharer in an embodiment of the present application;

[0034] Figure 5 A flow chart of a method for enabling a data sharing service by a sharee provided in an embodiment of the present application;

[0035] Figure 6 A flow chart of a method for a sharee to accept data sharing provided in an embodiment of the present application;

[0036] Figure 7 A schematic diagram of the principle of data encryption sharing provided in an embodiment of the present application;

[0037] Figure 8 A flowchart of enabling data sharing service for the system provided in the embodiment of the present application;

[0038] Fig. 9 A flow chart of another method for sharing data provided by an embodiment of the present application;

[0039] Fig.10 A flowchart of another method for a sharee to accept data sharing provided in an embodiment of the present application;

[0040] Fig.11 A schematic diagram of an electronic device provided in an embodiment of the present application;

[0041] Fig.12 A schematic diagram of the software architecture of an electronic device provided in an embodiment of the present application;

[0042] Fig.13 A hardware structure diagram of a cloud platform provided in an embodiment of the present application. DETAILED DESCRIPTION

[0043] In order to enable persons skilled in the art to more clearly understand the solution of the present application, the application scenario of the technical solution of the present application is first described below.

[0044] See also Figure 1 , which is a schematic diagram of the scenario provided by this application Figure 1 .

[0045] Currently, when sharing encrypted data through a cloud disk, the initiator of the sharing first needs to encrypt and generate or set a key for the data to be shared. For example, the user selects encrypted sharing in the file sharing interface, selects encryption as the sharing mode, and then clicks to create a link.

[0046] See also Figure 2 , which is a schematic diagram of the scenario provided by this application Figure 2 .

[0047] At this time, the cloud disk will generate a sharing link and password, and the sharing initiator will send the access link and key to the sharee. The sharee can obtain and decrypt the shared data through the link and key.

[0048] For example, after the sharing initiator clicks on the copy link and password in the file sharing interface, the sharing initiator can copy the information including the link and password automatically generated by the cloud disk APP, and then send it to the corresponding sharee.

[0049] However, in the actual sharing process, when there are a large number of people being shared, they need to be notified one by one, which will make the entire sharing process longer. For example, if you want to share data with some specific contacts in a group chat, if you directly send the link and password to the group chat, it will cause the password to be leaked, and non-shared people in the group chat can also obtain the data. At this time, these specific contacts need to be notified one by one, which makes the entire process longer, and there is also the risk of key leakage during the notification process.

[0050] In summary, in order to solve the above problems, the present application provides a method, device and electronic device for data sharing. When the data sharer shares data with the sharee, the two do not need to negotiate the key, and the data sharer does not need to actively add the contact information of the sharee and inform the key and download link. It is only necessary to encrypt the shared data according to the known second identification information of the sharee and upload it to the cloud platform. For the sharee, after obtaining the data, it can be automatically decrypted. During the whole process, there is no risk of key leakage due to notifying the sharee of the key, which improves the security of data sharing. In addition, when the number of sharees is large, there is no need to notify each sharee separately in turn, which simplifies the process of data sharing for users.

[0051] In order to enable persons skilled in the art to more clearly understand the solution of the present application, the technical solution in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0052] The terms "first", "second", etc. in the description of this application are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features.

[0053] The following is an example of using a mobile phone as an electronic device to implement encrypted data sharing through a cloud disk application (application, APP). The data in the embodiment of the present application may be picture data, document data, video data, audio data or other types of data, which are not specifically limited in the embodiment of the present application. In the following description, the sharer uses the first device and the sharee uses the second device.

[0054] See also Figure 3 , which is a flow chart of a method for a sharer to start a data sharing service provided in an embodiment of the present application.

[0055] The method specifically comprises the following steps:

[0056] S11: Start the cloud disk APP.

[0057] The sharer starts the cloud disk APP on the first device and triggers the data sharing service.

[0058] S12: The first device sends identity authentication information to the cloud platform.

[0059] When the user triggers the data sharing service, the cloud disk APP sends identity authentication information to the cloud platform to request to enable the data sharing service.

[0060] The cloud platform is used to provide IDS services, IBE encryption services, and key storage services.

[0061] Among them, the uniform identity authentication (IDS) service is a service for performing identity authentication on the initiator of the data sharing service, that is, determining whether the user who requests to start the data sharing service is a legitimate user.

[0062] The identity authentication information carries the first identification information of the sharer and the account information of the sharer.

[0063] The first identification information may be one or more of identification information such as an email address or a mobile phone number, and is used to identify the sharer.

[0064] The account information of the first device is the account information of the cloud disk APP registered with the first device.

[0065] In some embodiments, the cloud disk account registered by the user may not be the user's email address or mobile phone number, so the cloud disk APP of the first device needs to send the first identification information carrying the email address or mobile phone number to the cloud platform for identity authentication. In another embodiment, the cloud disk account registered by the user is one of the email address or mobile phone number, such as the email address. At this time, the cloud disk APP of the first device can carry the remaining mobile phone number in the first identification information, or carry both the mobile phone number and the email address in the first identification information, and send it to the cloud platform for unified identity authentication.

[0066] For ease of understanding, various possible implementations of identity authentication information are listed below.

[0067] The account information does not carry any first identification information, but the first identification information carries an email address;

[0068] The account information does not carry any first identification information, and the first identification information carries a mobile phone number;

[0069] The account information does not carry any first identification information, and the first identification information carries an email address and a mobile phone number;

[0070] The account information contains an email address, and the first identification information contains a mobile phone number;

[0071] The account information contains an email address, and the first identification information contains an email address;

[0072] The account information contains the email address, and the first identification information contains the email address and mobile phone number;

[0073] The account information carries the mobile phone number, and the first identification information carries the mobile phone number;

[0074] The account information contains a mobile phone number, and the first identification information contains an email address;

[0075] The account information carries the mobile phone number, and the first identification information carries the email address and mobile phone number.

[0076] It can be understood that the above first identification information is only for illustration. In actual application, the first identification information may also adopt other identification information for identifying the sharer, which will not be elaborated here.

[0077] S13: The IDS service performs identity authentication on the first device.

[0078] After receiving the identity authentication information sent by the first device, the cloud platform activates the IDS service for identity authentication. When the IDS service determines that the user requesting to enable the data sharing service is a legitimate user, it continues to proceed with the subsequent steps, otherwise it returns a notification of identity authentication failure to the user.

[0079] S14: The IDS service sends identity authentication information to the SE chip.

[0080] When the identity authentication of the first device is successfully passed, the IDS service sends the identity authentication information to the IBE encryption service.

[0081] The cloud platform includes a secure element (SE) chip, which is used to implement functions such as data security storage, encryption and decryption operations, etc.

[0082] The SE chip of the cloud platform is used to implement identity-based encryption (IBE) service and contact discovery service.

[0083] IBE refers to the use of identifiers, i.e., mobile phone numbers, email addresses, and other identification information in this application, to generate public keys for encryption and decryption. Compared with traditional public key encryption methods, this encryption method greatly reduces the complexity of the encryption process for users and administrators, and the recipient does not need to prepare special software in advance to receive and read information.

[0084] The IBE service uses a key generation center (KGC) to generate a master private key and a master public key. In some embodiments, the KGC generates a master private key through a random number generator, and the master public key is generated by combining the master private key with system parameters. It should be noted that the IBE encryption service generates the master public key and the master private key when the cloud platform service is launched, and is not triggered when the first device registers the data sharing service. That is, the IBE encryption service can generate the master public key and the master private key before the first device registers the data sharing service.

[0085] S15: The IBE encryption service generates a first private key based on the identity authentication information and the master private key.

[0086] In some embodiments, the IBE encryption service generates a first private key based on the master private key and the first identification information in the identity authentication information.

[0087] S16: The IBE encryption service sends the master public key and the first private key to the first device, and sends the master private key to the key storage service.

[0088] In some embodiments, after the SE chip completes the generation of the master public key and the encrypted private key, it sends the master private key and the second private key to the first device through the IDS service, and sends the master private key to the key storage service of the cloud platform.

[0089] S17: The key storage service encrypts and stores the master private key.

[0090] The key storage service of the cloud platform is used to encrypt and store the master private key generated by the IBE encryption service to improve security.

[0091] S18: The SE chip of the first device stores the master public key and the first private key.

[0092] The first device also includes an SE chip, which is used to store the acquired master public key and the first private key.

[0093] The SE chip on the first device can also provide IBE encryption services. The first private key is generated based on the identity authentication information and the master private key of the sharer. When the first device obtains encrypted data shared by other electronic devices through the cloud disk APP, the cloud disk APP of the first device calls up the IBE encryption service of the SE chip and uses the first private key to automatically decrypt the decrypted data.

[0094] That is, the role of the first private key is to decrypt the encrypted shared data obtained by the cloud disk APP.

[0095] Through the above steps, when the first device triggers the data sharing service through the cloud disk APP for the first time, the generation of the master public key and the encryption private key is completed, that is, the registration for the data encryption sharing service is completed.

[0096] The following describes the steps of performing encrypted data sharing after the first device completes registration for the encrypted data sharing service.

[0097] See also Figure 4 , which is a flow chart of the method for sharing data provided by the sharer in an embodiment of the present application.

[0098] S20: The sharer initiates a registration query for the contact in the cloud disk APP.

[0099] After completing the registration for the data encryption sharing service, when the sharer needs to encrypt and share data with a specific sharee, he / she can pull up the contact list in the cloud disk APP and query the contacts who have registered the cloud disk APP.

[0100] It should be noted that these contacts may have also completed the registration of the above data encryption sharing service, or may not have completed the registration of the data encryption sharing service, which is not specifically limited in the embodiments of the present application. That is, the purpose of the service registration query is to query the contacts who hold a cloud disk APP registered account and can be provided with cloud services, rather than to query the contacts who have completed the registration of the data encryption sharing service.

[0101] The contact list may be a contact list of an email address, a contact list of a mobile phone number, or a contact list including both an email address and a mobile phone number, which is not specifically limited in the embodiments of the present application.

[0102] In some embodiments, when the user pulls up the contact list in the APP, the user can actively choose to perform a service registration query for all or some selected contacts.

[0103] In other embodiments, when the user pulls up the contact list in the APP, the cloud disk APP automatically performs a service registration query for all contacts in the list.

[0104] S21: A secure transmission channel is established between the first device and the SE chip of the cloud platform.

[0105] S22: The first device sends the hash information of the contact to the SE chip through a secure transmission channel.

[0106] After the secure transmission channel is established, the first device transmits the contact's hash information to the SE chip through the IDS service. The hash information is obtained by converting the second identification information corresponding to each contact. The second identification information can be the mobile phone number or email address of the contact in the contact list.

[0107] The conversion process of obtaining hash information is to transform the second identification information into a fixed-length output through a hash algorithm, and the output is the hash value. The specific implementation method of obtaining hash information according to the second identification information is a relatively mature prior art, and the embodiments of this application will not be repeated here.

[0108] S23: The contact discovery service queries the registration information according to the hash information of the contact to determine the contact who registered the cloud disk APP.

[0109] The SE chip is capable of providing contact discovery services.

[0110] The solution provided in this application queries the registration information on the SE chip of the cloud platform, making it impossible for the upper-level application or device system to perceive it, and does not establish a relationship chain between the user of the first device and the sharee, thereby ensuring privacy and security.

[0111] S24: The SE chip sends the query result to the first device.

[0112] After the SE chip completes the query of the contact's registration information, it replies the query result to the first electronic device, where the query result indicates the contact who has registered the cloud disk APP.

[0113] In one possible implementation, tags are added to the query results for contacts who have registered the cloud disk APP, that is, the contacts who have registered the cloud disk APP are marked with tags, so that the cloud disk APP on the first device can recognize the tag and then display the corresponding query results.

[0114] S25: The cloud disk APP displays the contacts who have registered with the cloud disk APP.

[0115] The Cloud Disk APP displays the contacts who have registered with the Cloud Disk APP based on the query results.

[0116] S26: The user selects contacts to be shared on the cloud disk APP.

[0117] The number of contacts to be shared in the embodiment of the present application may be one or more, and the embodiment of the present application does not impose a specific limit on the number.

[0118] S27: The cloud disk APP calls up the IBE encryption service of the SE chip of the first device.

[0119] S28: The IBE encryption service of the SE chip generates an encryption public key according to the second identification information of the shared contact.

[0120] S29: Encrypt the data to be shared using the encryption public key.

[0121] The cloud disk APP uses an encrypted public key to encrypt the shared data. It is understandable that when the number of sharers is multiple, the number of encrypted public keys is also multiple.

[0122] S30: Send the encrypted data to be shared to the cloud platform for storage.

[0123] The cloud platform also provides storage services for storing encrypted data to be shared, waiting for the sharee to download.

[0124] So far, the encrypted sharing of data has been completed for the sharer, that is, the user of the first device. The following describes the process of the sharee, that is, the user of the second device, obtaining and decrypting the encrypted data.

[0125] See also Figure 5 , which is a flow chart of a method for a sharee to start a data sharing service provided in an embodiment of the present application.

[0126] S31: Start the cloud disk APP.

[0127] The person being shared starts the cloud disk APP on the second device and triggers the data sharing service.

[0128] S32: The second device sends identity authentication information to the cloud platform.

[0129] When the second private key and group public key are not stored locally on the shared party, the data sharing service needs to be enabled first.

[0130] The identity authentication information carries the second identification information of the person being shared and the account information of the second device.

[0131] S33: The IDS service performs identity authentication on the second device.

[0132] S34: The IDS service sends identity authentication information to the SE chip.

[0133] S35: The IBE encryption service generates a private key of the second device according to the identity authentication information and the master private key.

[0134] It should be noted that at this time, the IBE encryption service does not need to regenerate the master public key and the master private key again, because the master public key and the master private key only need to be generated once, and the master private key has been saved in the cloud through the key storage service.

[0135] The IBE encryption service generates a private key of the second device according to the master private key and the second identification information in the identity authentication information.

[0136] S36: The IBE encryption service sends the master public key and the second private key to the second device.

[0137] S37: The SE chip of the second device stores the master public key and the second private key.

[0138] The second device also includes an SE chip, which is used to store the acquired master public key and the second private key.

[0139] The SE chip on the second device can also provide IBE encryption services. The second private key is generated based on the identity authentication information of the second device and the master private key. When the second device obtains encrypted data shared by other electronic devices through the cloud disk APP, the cloud disk APP of the second device calls up the IBE encryption service of the SE chip and uses the second private key to automatically decrypt the decrypted data. That is, the second private key is used to decrypt the encrypted shared data obtained by the cloud disk APP of the second device.

[0140] The registration process for the second device to implement the data encryption sharing service may be similar to Figure 3 The description in the embodiments of the present application will not be repeated here.

[0141] The specific process of the second device acquiring and decrypting the shared data is described below.

[0142] See also Figure 6 , which is a flow chart of the method for the sharee to accept data sharing provided in an embodiment of the present application.

[0143] S40: The cloud disk APP downloads the encrypted data to be shared.

[0144] The sharee downloads the encrypted data to be shared from the cloud platform through the cloud disk APP, that is, the cloud platform sends the encrypted data to be shared to the second device.

[0145] In one possible implementation, the cloud platform can be associated with a social platform or instant messaging software, for example, by associating and binding accounts. After the data sharer completes the encryption and upload of the data, the cloud platform can automatically notify the sharee through the social platform or instant messaging software, or the user can actively notify the sharee through the social platform or instant messaging software, so that the sharee can download the encrypted data from the cloud platform through the cloud disk APP.

[0146] S41: The sharee chooses to view the encrypted data to be shared.

[0147] S42: The cloud disk APP calls up the IBE encryption service of the SE chip.

[0148] S43: The IBE encryption service decrypts the encrypted data to be shared using the second private key stored locally.

[0149] At this time, the IBE encryption service decrypts the data to be shared. The encryption public key used by the first device to encrypt the data to be shared is generated based on the second identification information of the shared contact. At this time, the SE chip of the second device decrypts based on the second private key, which is also generated based on the second identification information of the shared contact. Therefore, the two match and can be decrypted normally.

[0150] In actual applications, the IBE encryption service automatically decrypts the encrypted data to be shared, and the person being shared can open the data without having to manually enter the key.

[0151] It is understandable that the division of the above steps in the embodiment of the present application is only for the convenience of explanation and does not constitute a limitation on the technical solution of the present application. For example, the query process for the registration information of the contact in the above S20-S25 can also occur in Figure 3 In the corresponding data sharing service activation process, for example, S18 occurs immediately as a step in the data sharing service activation process. When the user performs encrypted data sharing, the user can directly start from S26 by selecting the contact to be shared.

[0152] Combined with the above Figures 3 to 6 As described in , the principle of data encryption sharing provided in the embodiment of the present application can be reflected in the following figure.

[0153] See also Figure 7 , which is a schematic diagram of the principle of data encryption sharing provided in an embodiment of the present application.

[0154] When the first device 10 and the second device 20 have completed the registration of the cloud disk APP and the registration of the data encryption sharing service, when the sharer shares data with the sharee through the first device 10, an encryption public key is generated based on the identification information of the second device, and the shared data is encrypted and sent to the cloud platform 30 for storage.

[0155] The second device downloads the encrypted data to be shared through the cloud platform 30, and uses the second private key generated according to its own second identification information stored in the second device to decrypt the encrypted data to be shared, thereby achieving data acquisition.

[0156] In summary, by utilizing the technical solution provided in the embodiments of the present application, when the data sharer shares data with the sharee, the two do not need to negotiate a key, and the data sharer does not need to actively add the contact information of the sharee and inform the key and download link. It is only necessary to encrypt the shared data based on the known second identification information of the sharee, such as the email address or mobile phone number of the sharee, and upload it to the cloud platform. For the sharee, the data can be automatically decrypted after obtaining the data. During the whole process, there is no risk of key leakage due to notifying the sharee of the key, which improves the security of data sharing. In addition, when the number of sharees is large, there is no need to notify each sharee individually in turn, which simplifies the process of data sharing for users.

[0157] The above description takes the sharing of data through the cloud disk APP as an example. In actual applications, the cloud disk APP can also be replaced by the system of the electronic device. That is, the system of the electronic device uses its own security chip to encrypt and decrypt, and the electronic device system and the cloud platform interact to realize the sharing of data in the system library. The following is a detailed description.

[0158] At this time, the cloud disk APP may not be installed on the first device, and the system of the first device is provided with a data encryption sharing function.

[0159] See also Figure 8 , which is a flow chart of the system providing data sharing service startup in an embodiment of the present application.

[0160] S51: Enable system data sharing service.

[0161] S52: The first device sends identity authentication information to the cloud platform.

[0162] The identity authentication information carries the first identification information of the sharer and the account information of the first device.

[0163] At this time, the account information of the first device is the device account information registered by the first device, for example, the device account corresponding to the device manufacturer. After registering the device account, the service provided by the device manufacturer can be used or enjoyed.

[0164] The first identification information may be a mobile phone number or an email address.

[0165] The cloud platform is used to provide IDS services, IBE encryption services, and key storage services.

[0166] Among them, the IBE service uses KGC to generate a master private key and a master public key, and encrypts and saves the master private key through the key storage service.

[0167] S53: The IDS service performs identity authentication on the first device.

[0168] S54: The IDS service sends identity authentication information to the SE chip.

[0169] S55: The IBE encryption service generates a first private key according to the identity authentication information and the master private key.

[0170] S56: The IBE encryption service sends the master public key and the first private key to the first device.

[0171] S57: The SE chip of the first device stores the master public key and the first private key.

[0172] The above data sharing service is enabled with Figure 3 The corresponding descriptions are similar and the embodiments of the present application will not be repeated here.

[0173] See also Fig. 9 , this figure is a flow chart of another method for a sharer to share data provided in an embodiment of the present application.

[0174] S60: The sharer initiates a registration query for the contact through the system data sharing service.

[0175] After completing the registration for the data encryption sharing service, when the sharer needs to encrypt and share data with a specific sharee, he can pull up the contact list through the system's address book and query the contacts of the registered device account, that is, the contacts of the account provided by the manufacturer of the registered device. The purpose of the registration query is to determine the sharees who can be provided with cloud services.

[0176] S61: A secure transmission channel is established between the first device and the SE chip of the cloud platform.

[0177] S62: The first device sends the hash information of the contact to the SE chip through a secure transmission channel.

[0178] S63: The contact discovery service queries the registration information according to the hash information of the contact to determine the contact of the registered system account.

[0179] S64: The SE chip sends the query result to the first device.

[0180] S65: The system data sharing service displays the contacts who have registered the system account.

[0181] S66: The user selects contacts to be shared on the system data sharing service.

[0182] S67: The system data sharing service invokes the IBE encryption service of the SE chip of the first device.

[0183] S68: The IBE encryption service of the SE chip generates an encryption public key according to the second identification information of the shared contact.

[0184] S69: Encrypt the data to be shared using the encryption public key.

[0185] At this time, the data to be shared may be data in the system library, such as pictures in the system gallery, videos in the system video library, audios in the system audio library, and files in the system file library.

[0186] S70: Send the encrypted data to be shared to the cloud platform for storage.

[0187] So far, for the sharer, that is, the user of the first device, the encrypted sharing of data has been completed. For the user of the second device, the process of registering the system data sharing service is the same as Figure 8 The registration process of the first device is similar and will not be repeated here. The following describes the process of the sharee, that is, the user of the second device, obtaining and decrypting the encrypted data.

[0188] See also Fig.10 , this figure is a flow chart of another method for a sharee to accept data sharing provided in an embodiment of the present application.

[0189] S80: The second device downloads the encrypted data to be shared.

[0190] In one possible implementation, the cloud platform can be associated with a social platform or instant messaging software, for example, by associating and binding accounts. After the data sharer completes the encryption and upload of the data, the cloud platform can automatically notify the sharee through the social platform or instant messaging software, or the user can actively notify the sharee through the social platform or instant messaging software, so that the sharee can download the encrypted data from the cloud platform through the social platform or instant messaging software or the system data sharing service.

[0191] S81: The sharee chooses to view the encrypted data to be shared.

[0192] S82: The system data sharing service calls up the IBE encryption service of the SE chip.

[0193] In a possible implementation, the person being shared invokes the system data sharing service through a social platform or instant messaging software, and then invokes the IBE encryption service of the SE chip.

[0194] S83: The IBE encryption service decrypts the encrypted data to be shared using the second private key stored locally.

[0195] The encryption public key used by the first device to encrypt the data to be shared is generated based on the second identification information of the shared contact. At this time, the SE chip of the second device decrypts based on the second private key, which is also generated based on the second identification information of the shared contact. Therefore, the two match and can be decrypted normally. The IBE encryption service automatically decrypts the encrypted data to be shared, and the shared person can open the data without manually entering the key.

[0196] In summary, the technical solution provided by the embodiment of the present application can realize the sharing of system library data. During the whole process, there is no risk of key leakage due to notifying the key to the sharee, which improves the security of data sharing. In addition, when the number of sharees is large, there is no need to notify each sharee one by one, and the data sharee does not need to enter the key for decryption, which simplifies the process of data sharing for users.

[0197] Based on the data sharing method provided in the above embodiments, the embodiment of the present application further provides an electronic device, which is described in detail below with reference to the accompanying drawings.

[0198] See also Fig.11 , which is a schematic diagram of an electronic device provided in an embodiment of the present application.

[0199] The electronic device 100 provided in the embodiment of the present application includes an SE chip 101 .

[0200] The SE chip 101 is used to provide IBE encryption services, including storage, encryption and decryption functions.

[0201] The storage function refers to the ability of the SE chip 101 to store the master public key of the data encryption sharing service and the private key corresponding to the electronic device. The private key corresponding to the electronic device is generated by the cloud platform based on the identity authentication information of the electronic device and the master private key.

[0202] The encryption function means that when an electronic device performs encrypted data sharing, an encryption public key is generated based on the identification information of the shared contact, and the encryption public key is used to encrypt the shared data.

[0203] The decryption function means that when the electronic device decrypts the encrypted data, the encrypted data to be shared is decrypted using the private key corresponding to the electronic device stored locally.

[0204] The electronic device further includes a processor and a memory. The memory is used to store executable codes, and the processor executes the codes to implement the data sharing method in the above embodiment.

[0205] The software architecture of the electronic device is described below.

[0206] See also Fig.12 , which is a schematic diagram of the software architecture of the electronic device provided in an embodiment of the present application.

[0207] The layered architecture divides the software into several layers, each with clear roles and division of labor. The layers communicate with each other through software interfaces. In some embodiments, the Android system is divided into four layers, from top to bottom: the application layer, the application framework layer, the Android runtime and system library, and the kernel layer.

[0208] The application layer can include a series of application packages.

[0209] like Fig.12 As shown, the application package may include applications such as camera, music, video, WLAN, gallery, call, address book, and cloud disk APP.

[0210] Among them, regarding the functions of the cloud disk APP, please refer to the relevant description in the above embodiments, and the embodiments of this application will not be repeated here.

[0211] The application framework layer provides an application programming interface (API) and a programming framework for the applications in the application layer. The application framework layer includes some predefined functions.

[0212] like Fig.12 As shown, the application framework layer may include a window manager, a content provider, a view system, a phone manager, a resource manager, a notification manager, etc. Furthermore, the present application includes an IBE service and a system data sharing service. The IBE service is implemented based on the SE chip of the electronic device. The system data sharing service can coexist with the cloud disk APP, or it can include only one of the two. For the specific description of the IBE service and the system data sharing service, please refer to the above embodiments, which will not be repeated here.

[0213] Android Runtime includes core libraries and virtual machines. Android runtime is responsible for scheduling and management of the Android system.

[0214] The core library consists of two parts: one part is the function that needs to be called by the Java language, and the other part is the Android core library.

[0215] The application layer and the application framework layer run in a virtual machine. The virtual machine executes the Java files of the application layer and the application framework layer as binary files. The virtual machine is used to perform functions such as object life cycle management, stack management, thread management, security and exception management, and garbage collection.

[0216] The system library may include multiple functional modules, such as surface manager, media library, 3D graphics processing library (such as OpenGL ES), 2D graphics engine (such as SGL), etc.

[0217] The 3D graphics processing library is used to implement 3D graphics drawing, image rendering, compositing, and layer processing.

[0218] A 2D graphics engine is a drawing engine for 2D drawings.

[0219] The kernel layer is the layer between hardware and software. The kernel layer contains at least display driver, camera driver, audio driver, and sensor driver.

[0220] The embodiments of the present application do not specifically limit the type of electronic device, and the electronic device may be a mobile phone, a laptop computer, a wearable electronic device (such as a smart watch), a tablet computer, an augmented reality (AR) device, a virtual reality (VR) device, and a vehicle-mounted device, etc.

[0221] In summary, by using the electronic device provided in the embodiment of the present application, when the data sharer shares data with the sharee, the two do not need to negotiate a key, and the data sharer does not need to actively add the contact information of the sharee and inform the key and download link. It is only necessary to encrypt the shared data according to the known second identification information of the sharee, such as the email address or mobile phone number of the sharee, and upload it to the cloud platform. For the sharee, after obtaining the data, it can be automatically decrypted. During the whole process, there is no risk of key leakage due to notifying the sharee of the key, which improves the security of data sharing. In addition, when the number of sharees is large, there is no need to notify each sharee separately in turn, which simplifies the process of data sharing for users. The electronic device can implement the above data sharing method based on the system data sharing service provided by the cloud disk APP or the device system.

[0222] Based on the data sharing method provided in the above embodiment, the embodiment of the present application further provides a cloud platform, which can be a computer cluster for providing data sharing services. The computer cluster includes at least one computer, which can be a cloud server, and is described in detail below with reference to the accompanying drawings.

[0223] See also Fig.13 , which is a hardware structure diagram of a cloud platform provided in an embodiment of the present application.

[0224] The cloud platform, that is, the computer cluster 200, includes at least one computer 2000. Each computer includes a bus 2001, a processor 2002, a communication interface 2003 and a memory 2004.

[0225] The processor 2002 , the memory 2004 and the communication interface 2003 communicate with each other via the bus 2001 .

[0226] The bus 2001 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (ESIA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For the convenience of identification, Fig.13Only one bus is used in the diagram, but it does not indicate that only one bus or only one type of bus is included.

[0227] The communication interface 2003 is used for external communication, for example, communication with a data sharing initiator device or a data sharing receiver device.

[0228] The memory 2004 may include a volatile memory, such as a random access memory RAM, or a non-volatile memory, such as a read-only memory ROM, a flash controller, a hard disk drive HDD, or a solid state drive SSD.

[0229] The memory 2004 is used to store executable codes, and the processor 2002 executes the codes to implement the above IDS service, IBE service, contact discovery service, etc., thereby implementing the data sharing method in the above embodiment.

[0230] Furthermore, the computer may also include an SE chip. The SE chip is used to provide IBE encryption services, including: pre-generating a master private key and a master public key; and generating a private key corresponding to the electronic device according to the identity authentication information sent by the electronic device and the master private key; and providing a contact discovery service to obtain a query result corresponding to the registration query. For the description of the SE chip, please refer to the description in the above embodiment, which will not be repeated here.

[0231] To sum up, the cloud platform provided in the embodiment of the present application can be used in conjunction with a cloud disk APP or with a system data sharing service provided by an electronic device system to achieve encrypted and secure data sharing.

[0232] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0233] As described above, the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A data sharing method, characterized in that: Applied to a first device, the first device runs a cloud disk APP, the cloud platform is used to provide cloud services for the cloud disk APP, and the user of the first device is a sharer, the method includes: Initiate a registration query for contacts in the contact list of the cloud disk APP to determine a sharee who can be provided with the cloud service by the cloud platform, wherein the sharee is selected by the sharer from the contacts registered with the cloud disk APP on the first device; Generate an encryption public key according to the identification information of the person being shared, and use the encryption public key to encrypt the data to be shared; The encrypted data to be shared is sent to the cloud platform, and the cloud platform is used to provide the encrypted data to be shared to the second device of the sharee, so that the second device uses the second private key to decrypt the encrypted data to be shared, and the second private key is generated by the cloud platform using the identity authentication information of the sharee and sent to the second device.

2. The data sharing method according to claim 1, characterized in that: The determining of the sharee(s) to whom the cloud platform can provide the cloud service specifically includes: Receiving a query result sent by the cloud platform, wherein the query result indicates a contact person who registered the cloud disk APP; The shareeur is selected from the contacts who have registered the cloud disk APP.

3. The data sharing method according to claim 2, characterized in that: The initiating a registration query for a contact in the contact list of the cloud disk APP specifically includes: Establishing a secure transmission channel between the first device and the security module SE chip of the cloud platform; The hash information of the contact person for registration query is sent to the SE chip through the secure transmission channel, the hash information is generated according to the identification information of the contact person for registration query, and the SE chip is used to obtain the query result according to the hash information.

4. A data sharing method, characterized in that: Applied to a first device, the first device runs a system data sharing service, the cloud platform is used to provide cloud services for the system data sharing service, and the user of the first device is a sharer, the method includes: Initiate a registration query for contacts to the cloud platform to determine the sharees to whom the cloud platform can provide the cloud service; receiving a query result sent by the cloud platform, wherein the query result indicates a contact person who has registered for the system data sharing service; After the sharer selects the sharee from the contacts registered for the system data sharing service on the first device, the sharer generates an encryption public key according to the identification information of the sharee, and uses the encryption public key to encrypt the data to be shared; The encrypted data to be shared is sent to the cloud platform, and the cloud platform is used to provide the encrypted data to be shared to the second device of the sharee, so that the second device uses the second private key to decrypt the encrypted data to be shared, and the second private key is generated by the cloud platform using the identity authentication information of the sharee and sent to the second device.

5. The data sharing method according to claim 4, characterized in that: The initiating a registration query for the contact to the cloud platform specifically includes: Establishing a secure transmission channel between the first device and the security module SE chip of the cloud platform; The hash information of the contact person for registration query is sent to the SE chip through the secure transmission channel, the hash information is generated according to the identification information of the contact person for registration query, and the SE chip is used to obtain the query result according to the hash information.

6. The data sharing method according to claim 1 or 4, characterized in that: Before determining a sharee to whom the cloud platform can provide the cloud service, the method further includes: Sending identity authentication information carrying the identification information of the sharer and the account information of the sharer to the cloud platform so that the cloud platform performs identity authentication; Receive and store the master public key and the first private key sent by the cloud platform, where the first private key is generated by the cloud platform using the identity authentication information of the sharer and sent to the first device.

7. The data sharing method according to claim 1 or 4, characterized in that: The identification information is an email address or a mobile phone number.

8. The data sharing method according to claim 1 or 4, characterized in that: After sending the encrypted data to be shared to the cloud platform, the method further includes: The share recipient is notified via a social platform or instant messaging software, and the social platform or the messaging software is associated with the cloud platform.

9. A data sharing method, characterized in that: Applied to a second device, the second device runs a cloud disk APP, the cloud platform is used to provide cloud services for the cloud disk APP, the user of the second device is a sharee, and the sharee is selected from the contacts registered with the cloud disk APP after the sharer initiates a registration query for contacts in the contact list of the cloud disk APP of the first device, the method comprising: Acquire the encrypted data to be shared from the cloud platform, the encrypted data to be shared being encrypted by the first device of the sharer using an encryption public key, the encryption public key being generated by the first device according to the identification information of the sharee; The encrypted data to be shared is decrypted using a locally stored second private key to obtain the data to be shared, wherein the second private key is generated by the cloud platform using the identity authentication information of the person being shared and sent to the second device.

10. The data sharing method according to claim 9, characterized in that: Before obtaining the encrypted data to be shared from the cloud platform, the method further includes: Sending identity authentication information carrying the identification information of the sharee and the sharee's cloud disk APP account information to the cloud platform through the cloud disk APP, so that the cloud platform performs identity authentication; Receive and store the master public key and the second private key sent by the cloud platform.

11. A data sharing method, characterized in that: Applied to a second device, the second device runs a system data sharing service, the cloud platform is used to provide cloud services for the system data sharing service, and the user of the second device is a sharee, the method includes: Acquire encrypted data to be shared from the cloud platform, the encrypted data to be shared being encrypted by the first device of the sharer using an encryption public key, the encryption public key being generated by the first device according to identification information of the sharee, the sharee being selected by the sharer from contacts registered for the system data sharing service after the first device initiates a registration query for contacts to the cloud platform, the contacts registered for the system data sharing service being indicated by the query result sent by the cloud platform; The encrypted data to be shared is decrypted using a locally stored second private key to obtain the data to be shared, wherein the second private key is generated by the cloud platform using the identity authentication information of the person being shared and sent to the second device.

12. The data sharing method according to claim 11, characterized in that: Before obtaining the encrypted data to be shared from the cloud platform, the method further includes: Sending identity authentication information carrying identification information of the sharee and device account information of the sharee to the cloud platform through the system data sharing service, so that the cloud platform performs identity authentication; Receive and store the master public key and the second private key sent by the cloud platform.

13. The data sharing method according to claim 9 or 11, characterized in that: The identification information is an email address or a mobile phone number.

14. A data sharing method, characterized in that: Applied to a cloud platform, the cloud platform is used to provide cloud services for a cloud disk APP, the cloud platform is a computer cluster, and the method includes: Determine the contact person who registered the cloud disk APP and inform the first device that the user of the first device is the sharer, and the first device runs the cloud disk APP; Generate a second private key using the identity authentication information of the sharee and send it to the second device, the user of the second device is the sharee, and the sharee is selected by the sharer from the contacts registered with the cloud disk APP after initiating a registration query for contacts in the contact list of the cloud disk APP of the first device; The encrypted data to be shared sent by the first device is received and stored, and provided to the second device, wherein the encrypted data to be shared is encrypted by the first device of the sharer using an encryption public key, and the encryption public key is generated by the first device according to the identification information of the sharee.

15. The data sharing method according to claim 14, characterized in that: The determining the contact person who registered the cloud disk APP and informing the first device specifically includes: Accepting a registration query for a contact initiated by the first device, wherein the registration query is used to determine a contact who has registered the cloud disk APP; A registration query is performed on the contact and a query result is sent to the first device, wherein the query result indicates the contact who has registered the cloud disk APP.

16. The data sharing method according to claim 14, characterized in that: Before determining the contact person who registers the cloud disk APP and notifying the first device, the method further includes: Receiving identity authentication information sent by the first device and carrying identification information of the sharer and account information of the sharer; Performing identity authentication on the sharer according to the identity authentication information; When the identity authentication is passed, a first private key is generated according to the identity authentication information; The first private key and a master public key are sent to the first device, where the master public key is pre-generated by the cloud platform.

17. The data sharing method according to claim 14, characterized in that: The generating of the second private key by using the identity authentication information of the person being shared and sending the second private key to the second device specifically includes: Receiving identity authentication information sent by the cloud disk APP that carries the identification information of the sharee and the cloud disk APP account information of the sharee; Performing identity authentication on the sharee according to the identity authentication information; When the identity authentication is passed, generating the second private key according to the identity authentication information; The second private key and the master public key are sent to the second device, where the master public key is pre-generated by the cloud platform.

18. A data sharing method, characterized in that: Applied to a cloud platform, the cloud platform is used to provide cloud services for system data sharing services, the cloud platform is a computer cluster, and the method includes: Determine a contact person who registers the system data sharing service and inform the first device that the user of the first device is a sharer and the first device runs the system data sharing service; A second private key is generated using the identity authentication information of the sharee and sent to a second device, wherein the user of the second device is the sharee, and the sharee is selected from the contacts registered for the system data sharing service after the sharer initiates a registration query for contacts to the cloud platform through the first device, and the contacts registered for the system data sharing service are indicated by the query result sent by the cloud platform; The encrypted data to be shared sent by the first device is received and stored, and provided to the second device, wherein the encrypted data to be shared is encrypted by the first device of the sharer using an encryption public key, and the encryption public key is generated by the first device according to the identification information of the sharee.

19. The data sharing method according to claim 18, characterized in that: The determining the contact person who registers the system data sharing service and notifying the first device specifically includes: accepting a registration query for a contact initiated by the first device, wherein the registration query is used to determine a contact who registers for the system data sharing service; A registration query is performed on the contact and the query result is sent to the first device, wherein the query result indicates the contact who has registered for the system data sharing service.

20. The data sharing method according to claim 15 or 19, characterized in that: The accepting the registration query for the contact initiated by the first device specifically includes: Establishing a secure transmission channel between the security module SE chip of the cloud platform and the first device; The hash information of the contact person performing the registration query is received by the first device through the secure transmission channel, so that the SE chip obtains the query result according to the hash information, and the hash information is generated according to the identification information of the contact person performing the registration query.

21. The data sharing method according to claim 18, characterized in that: Before determining the contact person who registers the system data sharing service and notifying the first device, the method further includes: Receiving identity authentication information sent by the first device and carrying identification information of the sharer and account information of the sharer; Performing identity authentication on the sharer according to the identity authentication information; When the identity authentication is passed, a first private key is generated according to the identity authentication information; The first private key and a master public key are sent to the first device, where the master public key is pre-generated by the cloud platform.

22. The data sharing method according to claim 18, characterized in that: The generating of the second private key by using the identity authentication information of the person being shared and sending the second private key to the second device specifically includes: Receiving identity authentication information sent by the system data sharing service and carrying identification information of the sharee and device account information of the sharee; Performing identity authentication on the sharee according to the identity authentication information; When the identity authentication is passed, generating the second private key according to the identity authentication information; The second private key and the master public key are sent to the second device, where the master public key is pre-generated by the cloud platform.

23. The data sharing method according to claim 14 or 18, characterized in that: The identification information is an email address or a mobile phone number.

24. An electronic device, characterized in that: The electronic device includes a processor, a memory and a security module SE chip; The memory stores computer-readable instructions, and the processor executes the computer-readable instructions to perform the data sharing method according to any one of claims 1 to 13; The SE chip is used to store the master public key sent by the cloud platform and the private key corresponding to the electronic device; And, generating the encryption public key according to the identification information of the sharee, and using the encryption public key to encrypt the data to be shared; and, using the private key corresponding to the electronic device, decrypting the encrypted data to be shared obtained from the cloud platform.

25. A computer cluster, characterized in that: The computer cluster includes at least one computer, and the computer includes a memory, a processor and a security module SE chip; The memory stores computer-readable instructions, and the processor executes the computer-readable instructions to perform the data sharing method according to any one of claims 14 to 23; The security module SE chip is used to determine the sharee(s) to whom the cloud platform can provide cloud services, generate a master private key and a master public key, and generate a first private key corresponding to the first device based on the identity authentication information of the sharee(s) and the master private key, and generate a second private key corresponding to the second device based on the identity authentication information of the sharee(s) and the master private key.

Images